setcap-wrapper: Merging with upstream master and resolving conflicts

152 files changed, 2558 insertions, 1164 deletions

diff --git a/pkgs/os-specific/linux/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-lib/default.nix
index a839158d0cf..3205275ff93 100644
--- a/pkgs/os-specific/linux/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-lib/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-lib-1.1.1";
+  name = "alsa-lib-1.1.2";
 
   src = fetchurl {
     urls = [
      "ftp://ftp.alsa-project.org/pub/lib/${name}.tar.bz2"
      "http://alsa.cybermirror.org/lib/${name}.tar.bz2"
     ];
-    sha256 = "0sa24fy3qf3jg63xxvfb7j8halj1qmdbcak2lyfx8bpd8hqnriwa";
+    sha256 = "1mk1v2av6ibyydgr6f2mxrwy7clgnf0c68s9y2zvh1ibi7csr3fk";
   };
 
   patches = [
@@ -27,12 +27,6 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" ];
 
-  crossAttrs = {
-    patchPhase = ''
-      sed -i s/extern/static/g include/iatomic.h
-    '';
-  };
-
   meta = with stdenv.lib; {
     homepage = http://www.alsa-project.org/;
     description = "ALSA, the Advanced Linux Sound Architecture libraries";
diff --git a/pkgs/os-specific/linux/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-plugins/default.nix
index 22c3d464774..7f065a1b9b0 100644
--- a/pkgs/os-specific/linux/alsa-plugins/default.nix
+++ b/pkgs/os-specific/linux/alsa-plugins/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, lib, pkgconfig, alsaLib, libogg, libpulseaudio ? null, libjack2 ? null }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-plugins-1.1.0";
+  name = "alsa-plugins-1.1.1";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/plugins/${name}.tar.bz2"
       "http://alsa.cybermirror.org/plugins/${name}.tar.bz2"
     ];
-    sha256 = "3b83c329953bef99f5fe25ae04ec4a455fe6514939f3b45a5321966652b2c9ee";
+    sha256 = "1w81z5jlwqhd1l2m7qrq69lc4k9dnrg1wn52jsl2hrf3hbhd394f";
   };
 
   # ToDo: a52, etc.?
diff --git a/pkgs/os-specific/linux/alsa-tools/default.nix b/pkgs/os-specific/linux/alsa-tools/default.nix
index f0352530480..51a60a27431 100644
--- a/pkgs/os-specific/linux/alsa-tools/default.nix
+++ b/pkgs/os-specific/linux/alsa-tools/default.nix
@@ -1,4 +1,6 @@
-{ stdenv, fetchurl, alsaLib, pkgconfig, gtk, gtk3, fltk13 }:
+{ stdenv, fetchurl, alsaLib, pkgconfig, gtk2, gtk3, fltk13 }:
+# Comes from upstream as as bundle of several tools,
+# some use gtk2, some gtk3 (and some even fltk13).
 
 stdenv.mkDerivation rec {
   name = "alsa-tools-${version}";
@@ -12,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0ldbaz3qr7z0639xg37ba7cmrb512rrjavap6r5jjl0ab665ad3x";
   };
 
-  buildInputs = [ alsaLib pkgconfig gtk gtk3 fltk13 ];
+  buildInputs = [ alsaLib pkgconfig gtk2 gtk3 fltk13 ];
 
   patchPhase = ''
     export tools="as10k1 hda-verb hdspmixer echomixer hdajackretask hdspconf hwmixvolume mixartloader rmedigicontrol sscape_ctl vxloader envy24control hdajacksensetest hdsploader ld10k1 pcxhrloader sb16_csp us428control"
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index d47c9fa2c1a..3c2b53e0e3f 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "alsa-utils-${version}";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/utils/${name}.tar.bz2"
       "http://alsa.cybermirror.org/utils/${name}.tar.bz2"
     ];
-    sha256 = "3b1c3135b76e14532d3dd23fb15759ddd7daf9ffbc183f7a9a0a3a86374748f1";
+    sha256 = "0wcha78c2sm8qqk5r3w83cvm8fp6fb1zpd35kmcm24kxhz007xks";
   };
 
   patchPhase = ''
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
new file mode 100644
index 00000000000..cbfa2e1b030
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -0,0 +1,169 @@
+{ stdenv, fetchurl, elfutils, mesa_noglu
+, xorg, patchelf, openssl, libdrm, libudev
+, libxcb, libxshmfence, epoxy, perl, zlib
+, fetchFromGitHub, ncurses
+, libsOnly ? false, kernel ? null
+}:
+
+assert (!libsOnly) -> kernel != null;
+
+with stdenv.lib;
+
+let
+
+  kernelDir = if libsOnly then null else kernel.dev;
+
+  inherit (mesa_noglu) driverLink;
+
+  bitness = if stdenv.is64bit then "64" else "32";
+
+  libArch =
+    if stdenv.system == "i686-linux" then
+      "i386-linux-gnu"
+    else if stdenv.system == "x86_64-linux" then
+      "x86_64-linux-gnu"
+    else throw "amdgpu-pro is Linux only. Sorry. The build was stopped.";
+
+  libReplaceDir = "/usr/lib/${libArch}";
+
+  ncurses5 = ncurses.override { abiVersion = "5"; };
+
+in stdenv.mkDerivation rec {
+
+  version = "16.50";
+  pname = "amdgpu-pro";
+  build = "${version}-362463";
+
+  libCompatDir = "/run/lib/${libArch}";
+
+  name = pname + "-" + version + (optionalString (!libsOnly) "-${kernelDir.version}");
+
+  src = fetchurl {
+    url =
+    "https://www2.ati.com/drivers/linux/ubuntu/amdgpu-pro-${build}.tar.xz";
+    sha256 = "1wl8mabk9g7s43bdarzl2i5crp8rl1advnb5mw3p3821sqzh2nd9";
+    curlOpts = "--referer http://support.amd.com/en-us/kb-articles/Pages/AMD-Radeon-GPU-PRO-Linux-Beta-Driver%e2%80%93Release-Notes.aspx";
+  };
+
+  hardeningDisable = [ "pic" "format" ];
+
+  inherit libsOnly;
+
+  postUnpack = ''
+    cd $sourceRoot
+    mkdir root
+    cd root
+    for deb in ../*_all.deb ../*_i386.deb '' + optionalString stdenv.is64bit "../*_amd64.deb" + ''; do echo $deb; ar p $deb data.tar.xz | tar -xJ; done
+    sourceRoot=.
+  '';
+
+  modulePatches = [
+    ./patches/0001-Fix-kernel-module-install-location.patch
+    ./patches/0002-Add-Gentoo-as-build-option.patch
+    ./patches/0003-Remove-extra-parameter-from-ttm_bo_reserve-for-4.7.0.patch
+    ./patches/0004-Change-seq_printf-format-for-64-bit-context.patch
+    ./patches/0005-Fix-vblank-calls.patch
+    ./patches/0006-Fix-crtc_gamma-functions-for-4.8.0.patch
+    ./patches/0007-Fix-drm_atomic_helper_swap_state-for-4.8.0.patch
+    ./patches/0008-Add-extra-flag-to-ttm_bo_move_ttm-for-4.8.0-rc2.patch
+    ./patches/0009-Remove-dependency-on-System.map.patch
+    ./patches/0010-disable-dal-by-default.patch
+    ./patches/0011-kcl-fixes-for-16.50-linux-4.8.patch
+    ./patches/0012-use-kernel-fence_array-in-4.8.patch
+  ];
+
+  patchPhase = optionalString (!libsOnly) ''
+    pushd usr/src/amdgpu-pro-${build}
+    for patch in $modulePatches
+    do
+      echo $patch
+      patch -f -p1 < $patch || true
+    done
+    popd
+  '';
+
+  preBuild = optionalString (!libsOnly) ''
+    makeFlags="$makeFlags M=$(pwd)/usr/src/amdgpu-pro-${build}"
+  '';
+
+  postBuild = optionalString (!libsOnly) ''
+    xz usr/src/amdgpu-pro-${build}/amd/amdgpu/amdgpu.ko
+  '';
+
+  makeFlags = optionalString (!libsOnly)
+    "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build modules";
+
+  depLibPath = makeLibraryPath [
+    stdenv.cc.cc.lib xorg.libXext xorg.libX11 xorg.libXdamage xorg.libXfixes zlib
+    xorg.libXxf86vm libxcb libxshmfence epoxy openssl libdrm elfutils libudev ncurses5
+  ];
+
+  installPhase = ''
+    mkdir -p $out
+
+    cp -r etc $out/etc
+    cp -r lib $out/lib
+
+    pushd usr
+    cp -r lib/${libArch}/* $out/lib
+  '' + optionalString (!libsOnly) ''
+    cp -r src/amdgpu-pro-${build}/firmware $out/lib/firmware
+  '' + ''
+    cp -r share $out/share
+    popd
+
+    pushd opt/amdgpu-pro
+  '' + optionalString (!stdenv.is64bit) ''
+    cp -r bin $out/bin
+  '' + ''
+    cp -r include $out/include
+    cp -r lib/${libArch}/* $out/lib
+  '' + optionalString (!libsOnly) ''
+    mv lib/xorg $out/lib/xorg
+  '' + ''
+    popd
+
+  '' + optionalString (!libsOnly) ''
+    mkdir -p $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/amd/amdgpu/amdgpu.ko.xz
+    cp usr/src/amdgpu-pro-${build}/amd/amdgpu/amdgpu.ko.xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/amd/amdgpu/amdgpu.ko.xz
+  '' + ''
+    mv $out/etc/vulkan $out/share
+    interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
+    libPath="$out/lib:$out/lib/gbm:$depLibPath"
+  '' + optionalString (!stdenv.is64bit) ''
+    for prog in clinfo modetest vbltest kms-universal-planes kms-steal-crtc modeprint amdgpu_test kmstest proptest; do
+      patchelf --interpreter "$interpreter" --set-rpath "$libPath" "$out/bin/$prog"
+    done
+  '' + ''
+    ln -s ${makeLibraryPath [ncurses5]}/libncursesw.so.5 $out/lib/libtinfo.so.5
+  '';
+
+  # we'll just set the full rpath on everything to avoid having to track down dlopen problems
+  postFixup = assert (stringLength libReplaceDir == stringLength libCompatDir); ''
+    libPath="$out/lib:$out/lib/gbm:$depLibPath"
+    for lib in `find "$out/lib/" -name '*.so*' -type f`; do
+      patchelf --set-rpath "$libPath" "$lib"
+    done
+    for lib in libEGL.so.1 libGL.so.1.2 ${optionalString (!libsOnly) "xorg/modules/extensions/libglx.so"} dri/amdgpu_dri.so; do
+      perl -pi -e 's:${libReplaceDir}:${libCompatDir}:g' "$out/lib/$lib"
+    done
+    substituteInPlace "$out/share/vulkan/icd.d/amd_icd${bitness}.json" --replace "/opt/amdgpu-pro/lib/${libArch}" "$out/lib"
+  '';
+
+  buildInputs = [
+    patchelf
+    perl
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "AMDGPU-PRO drivers";
+    homepage =  http://support.amd.com/en-us/kb-articles/Pages/AMDGPU-PRO-Beta-Driver-for-Vulkan-Release-Notes.aspx ;
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ corngood ];
+    # Copied from the nvidia default.nix to prevent a store collision.
+    priority = 4;
+  };
+}
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0001-Fix-kernel-module-install-location.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0001-Fix-kernel-module-install-location.patch
new file mode 100644
index 00000000000..5af823a9394
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0001-Fix-kernel-module-install-location.patch
@@ -0,0 +1,25 @@
+From e787277fd4f43399de2da355b08e478c2a58d589 Mon Sep 17 00:00:00 2001
+From: "Luke A. Guest" <laguest@archeia.com>
+Date: Sun, 25 Sep 2016 15:31:13 +0100
+Subject: [PATCH 01/11] Fix kernel module install location
+
+---
+ dkms.conf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/dkms.conf b/dkms.conf
+index 7f11158..2f080e2 100644
+--- a/dkms.conf
++++ b/dkms.conf
+@@ -2,7 +2,7 @@ PACKAGE_NAME="amdgpu-pro"
+ PACKAGE_VERSION="16.50-362463"
+ BUILT_MODULE_NAME[0]="amdgpu"
+ BUILT_MODULE_LOCATION[0]="amd/amdgpu"
+-DEST_MODULE_LOCATION[0]="/updates"
++DEST_MODULE_LOCATION[0]="/kernel/drivers/gpu/drm/amd/amdgpu"
+ AUTOINSTALL="yes"
+ PRE_BUILD="pre-build.sh $kernelver"
+ 
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0002-Add-Gentoo-as-build-option.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0002-Add-Gentoo-as-build-option.patch
new file mode 100644
index 00000000000..be627992c06
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0002-Add-Gentoo-as-build-option.patch
@@ -0,0 +1,30 @@
+From da51551f671be3282b6f69ef76e495b169a5dc3f Mon Sep 17 00:00:00 2001
+From: "Luke A. Guest" <laguest@archeia.com>
+Date: Sun, 25 Sep 2016 15:31:49 +0100
+Subject: [PATCH 02/11] Add Gentoo as build option
+
+---
+ amd/backport/Makefile | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/amd/backport/Makefile b/amd/backport/Makefile
+index a6ab7fe..ff9339d 100644
+--- a/amd/backport/Makefile
++++ b/amd/backport/Makefile
+@@ -22,8 +22,13 @@ else ifeq ("sled",$(OS_NAME))
+ ccflags-y += -DOS_NAME_SLE
+ else ifeq ("sles",$(OS_NAME))
+ ccflags-y += -DOS_NAME_SLE
++else ifeq ("gentoo",$(OS_NAME))
++ccflags-y += -DOS_NAME_GENTOO
++# We don't have a version inside /etc/os-release.
++OS_VERSION = "0.0"
+ else
+ ccflags-y += -DOS_NAME_UNKNOWN
++OS_VERSION = "0.0"
+ endif
+ 
+ ccflags-y += \
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0003-Remove-extra-parameter-from-ttm_bo_reserve-for-4.7.0.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0003-Remove-extra-parameter-from-ttm_bo_reserve-for-4.7.0.patch
new file mode 100644
index 00000000000..ae5b62b1d23
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0003-Remove-extra-parameter-from-ttm_bo_reserve-for-4.7.0.patch
@@ -0,0 +1,28 @@
+From 999a30883f34c4603c3b747a58a89d4924583769 Mon Sep 17 00:00:00 2001
+From: "Luke A. Guest" <laguest@archeia.com>
+Date: Sun, 25 Sep 2016 15:46:58 +0100
+Subject: [PATCH 03/11] Remove extra parameter from ttm_bo_reserve for 4.7.0
+
+---
+ amd/backport/include/kcl/kcl_ttm.h | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/amd/backport/include/kcl/kcl_ttm.h b/amd/backport/include/kcl/kcl_ttm.h
+index 6e5a170..52cdbc8 100644
+--- a/amd/backport/include/kcl/kcl_ttm.h
++++ b/amd/backport/include/kcl/kcl_ttm.h
+@@ -113,7 +113,11 @@ static inline int kcl_ttm_bo_reserve(struct ttm_buffer_object *bo,
+ 				 struct ww_acquire_ctx *ticket)
+ {
+ #if defined(BUILD_AS_DKMS)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 7, 0)
++	return ttm_bo_reserve(bo, interruptible, no_wait, ticket);
++#else
+ 	return ttm_bo_reserve(bo, interruptible, no_wait, false, ticket);
++#endif
+ #else
+ 	return ttm_bo_reserve(bo, interruptible, no_wait, ticket);
+ #endif
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0004-Change-seq_printf-format-for-64-bit-context.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0004-Change-seq_printf-format-for-64-bit-context.patch
new file mode 100644
index 00000000000..925a92e2a7e
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0004-Change-seq_printf-format-for-64-bit-context.patch
@@ -0,0 +1,25 @@
+From 084b2915e6876d8fdb913938569c0ce7ffef65bc Mon Sep 17 00:00:00 2001
+From: "Luke A. Guest" <laguest@archeia.com>
+Date: Sun, 25 Sep 2016 16:46:39 +0100
+Subject: [PATCH 04/11] Change seq_printf format for 64 bit context
+
+---
+ amd/amdgpu/amdgpu_sa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/amd/amdgpu/amdgpu_sa.c b/amd/amdgpu/amdgpu_sa.c
+index 052f745..5886b9a 100644
+--- a/amd/amdgpu/amdgpu_sa.c
++++ b/amd/amdgpu/amdgpu_sa.c
+@@ -428,7 +428,7 @@ void amdgpu_sa_bo_dump_debug_info(struct amdgpu_sa_manager *sa_manager,
+ 			   soffset, eoffset, eoffset - soffset);
+ 
+ 		if (i->fence)
+-#if defined(BUILD_AS_DKMS)
++#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 8, 0)
+ 			seq_printf(m, " protected by 0x%08x on context %d",
+ 				   i->fence->seqno, i->fence->context);
+ #else
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0005-Fix-vblank-calls.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0005-Fix-vblank-calls.patch
new file mode 100644
index 00000000000..99b54aca2ab
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0005-Fix-vblank-calls.patch
@@ -0,0 +1,136 @@
+From 1884ef3a813f3dac0029c7539654ba978635d5d3 Mon Sep 17 00:00:00 2001
+From: "Luke A. Guest" <laguest@archeia.com>
+Date: Sun, 25 Sep 2016 16:49:09 +0100
+Subject: [PATCH 05/11] Fix vblank calls
+
+---
+ amd/amdgpu/amdgpu_display.c   | 8 ++++++++
+ amd/amdgpu/dce_v10_0.c        | 4 ++++
+ amd/amdgpu/dce_v11_0.c        | 4 ++++
+ amd/amdgpu/dce_v8_0.c         | 4 ++++
+ amd/amdgpu/dce_virtual.c      | 8 ++++++++
+ amd/dal/amdgpu_dm/amdgpu_dm.c | 4 ++++
+ 6 files changed, 32 insertions(+)
+
+diff --git a/amd/amdgpu/amdgpu_display.c b/amd/amdgpu/amdgpu_display.c
+index 8425b1d..d6cd383 100644
+--- a/amd/amdgpu/amdgpu_display.c
++++ b/amd/amdgpu/amdgpu_display.c
+@@ -268,7 +268,11 @@ int amdgpu_crtc_page_flip(struct drm_crtc *crtc,
+ 
+ 	work->base = base;
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	r = drm_crtc_vblank_get(crtc);
++#else
+ 	r = drm_vblank_get(crtc->dev, amdgpu_crtc->crtc_id);
++#endif
+ 	if (r) {
+ 		DRM_ERROR("failed to get vblank before flip\n");
+ 		goto pflip_cleanup;
+@@ -296,7 +300,11 @@ int amdgpu_crtc_page_flip(struct drm_crtc *crtc,
+ 	return 0;
+ 
+ vblank_cleanup:
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	drm_crtc_vblank_put(&amdgpu_crtc->base);
++#else
+ 	drm_vblank_put(crtc->dev, amdgpu_crtc->crtc_id);
++#endif
+ 
+ pflip_cleanup:
+ 	if (unlikely(amdgpu_bo_reserve(new_abo, false) != 0)) {
+diff --git a/amd/amdgpu/dce_v10_0.c b/amd/amdgpu/dce_v10_0.c
+index 650d193..b1880ac 100644
+--- a/amd/amdgpu/dce_v10_0.c
++++ b/amd/amdgpu/dce_v10_0.c
+@@ -3342,7 +3342,11 @@ static int dce_v10_0_pageflip_irq(struct amdgpu_device *adev,
+ 
+ 	spin_unlock_irqrestore(&adev->ddev->event_lock, flags);
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	drm_crtc_vblank_put(&amdgpu_crtc->base);
++#else
+ 	drm_vblank_put(adev->ddev, amdgpu_crtc->crtc_id);
++#endif
+ 	schedule_work(&works->unpin_work);
+ 
+ 	return 0;
+diff --git a/amd/amdgpu/dce_v11_0.c b/amd/amdgpu/dce_v11_0.c
+index ca03d8e..b654b64 100644
+--- a/amd/amdgpu/dce_v11_0.c
++++ b/amd/amdgpu/dce_v11_0.c
+@@ -3391,7 +3391,11 @@ static int dce_v11_0_pageflip_irq(struct amdgpu_device *adev,
+ 
+ 	spin_unlock_irqrestore(&adev->ddev->event_lock, flags);
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	drm_crtc_vblank_put(&amdgpu_crtc->base);
++#else
+ 	drm_vblank_put(adev->ddev, amdgpu_crtc->crtc_id);
++#endif
+ 	schedule_work(&works->unpin_work);
+ 
+ 	return 0;
+diff --git a/amd/amdgpu/dce_v8_0.c b/amd/amdgpu/dce_v8_0.c
+index 8e4dff7..b598caa 100644
+--- a/amd/amdgpu/dce_v8_0.c
++++ b/amd/amdgpu/dce_v8_0.c
+@@ -3252,7 +3252,11 @@ static int dce_v8_0_pageflip_irq(struct amdgpu_device *adev,
+ 
+ 	spin_unlock_irqrestore(&adev->ddev->event_lock, flags);
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	drm_crtc_vblank_put(&amdgpu_crtc->base);
++#else
+ 	drm_vblank_put(adev->ddev, amdgpu_crtc->crtc_id);
++#endif
+ 	schedule_work(&works->unpin_work);
+ 
+ 	return 0;
+diff --git a/amd/amdgpu/dce_virtual.c b/amd/amdgpu/dce_virtual.c
+index 0c6e873..36e2094 100644
+--- a/amd/amdgpu/dce_virtual.c
++++ b/amd/amdgpu/dce_virtual.c
+@@ -746,11 +746,19 @@ static int dce_virtual_pageflip_irq(struct amdgpu_device *adev,
+ 
+ 	/* wakeup usersapce */
+ 	if (works->event)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++    drm_crtc_send_vblank_event(&amdgpu_crtc->base, works->event);
++#else
+ 		drm_send_vblank_event(adev->ddev, crtc_id, works->event);
++#endif
+ 
+ 	spin_unlock_irqrestore(&adev->ddev->event_lock, flags);
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	drm_crtc_vblank_put(&amdgpu_crtc->base);
++#else
+ 	drm_vblank_put(adev->ddev, amdgpu_crtc->crtc_id);
++#endif
+ 	schedule_work(&works->unpin_work);
+ 
+ 	return 0;
+diff --git a/amd/dal/amdgpu_dm/amdgpu_dm.c b/amd/dal/amdgpu_dm/amdgpu_dm.c
+index c5fcf5a..e9892d8 100644
+--- a/amd/dal/amdgpu_dm/amdgpu_dm.c
++++ b/amd/dal/amdgpu_dm/amdgpu_dm.c
+@@ -213,10 +213,14 @@ static void dm_pflip_high_irq(void *interrupt_params)
+ 
+ 	/* wakeup usersapce */
+ 	if(works->event)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++		drm_crtc_send_vblank_event(&amdgpu_crtc->base, works->event);
++#else
+ 		drm_send_vblank_event(
+ 			adev->ddev,
+ 			amdgpu_crtc->crtc_id,
+ 			works->event);
++#endif
+ 
+ 	spin_unlock_irqrestore(&adev->ddev->event_lock, flags);
+ 
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0006-Fix-crtc_gamma-functions-for-4.8.0.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0006-Fix-crtc_gamma-functions-for-4.8.0.patch
new file mode 100644
index 00000000000..566b7039bb3
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0006-Fix-crtc_gamma-functions-for-4.8.0.patch
@@ -0,0 +1,163 @@
+From 12660ae02838f99c0784194908f7a189bc2ab0ae Mon Sep 17 00:00:00 2001
+From: "Luke A. Guest" <laguest@archeia.com>
+Date: Sun, 25 Sep 2016 16:56:47 +0100
+Subject: [PATCH 06/11] Fix crtc_gamma functions for 4.8.0
+
+---
+ amd/amdgpu/dce_v10_0.c              | 19 +++++++++++++++++++
+ amd/amdgpu/dce_v11_0.c              | 19 +++++++++++++++++++
+ amd/amdgpu/dce_v8_0.c               | 19 +++++++++++++++++++
+ amd/dal/amdgpu_dm/amdgpu_dm_types.c | 12 ++++++++++++
+ 4 files changed, 69 insertions(+)
+
+diff --git a/amd/amdgpu/dce_v10_0.c b/amd/amdgpu/dce_v10_0.c
+index b1880ac..53746fa 100644
+--- a/amd/amdgpu/dce_v10_0.c
++++ b/amd/amdgpu/dce_v10_0.c
+@@ -2627,6 +2627,24 @@ static void dce_v10_0_cursor_reset(struct drm_crtc *crtc)
+ 	}
+ }
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++static int dce_v10_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
++				    u16 *blue, uint32_t size)
++{
++	struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
++	int i;
++
++	/* userspace palettes are always correct as is */
++	for (i = 0; i < size; i++) {
++		amdgpu_crtc->lut_r[i] = red[i] >> 6;
++		amdgpu_crtc->lut_g[i] = green[i] >> 6;
++		amdgpu_crtc->lut_b[i] = blue[i] >> 6;
++	}
++	dce_v10_0_crtc_load_lut(crtc);
++
++	return 0;
++}
++#else
+ static void dce_v10_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+ 				    u16 *blue, uint32_t start, uint32_t size)
+ {
+@@ -2641,6 +2659,7 @@ static void dce_v10_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green
+ 	}
+ 	dce_v10_0_crtc_load_lut(crtc);
+ }
++#endif
+ 
+ static void dce_v10_0_crtc_destroy(struct drm_crtc *crtc)
+ {
+diff --git a/amd/amdgpu/dce_v11_0.c b/amd/amdgpu/dce_v11_0.c
+index b654b64..3edd66d 100644
+--- a/amd/amdgpu/dce_v11_0.c
++++ b/amd/amdgpu/dce_v11_0.c
+@@ -2643,6 +2643,24 @@ static void dce_v11_0_cursor_reset(struct drm_crtc *crtc)
+ 	}
+ }
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++static int dce_v11_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
++				    u16 *blue, uint32_t size)
++{
++	struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
++	int i;
++
++	/* userspace palettes are always correct as is */
++	for (i = 0; i < size; i++) {
++		amdgpu_crtc->lut_r[i] = red[i] >> 6;
++		amdgpu_crtc->lut_g[i] = green[i] >> 6;
++		amdgpu_crtc->lut_b[i] = blue[i] >> 6;
++	}
++	dce_v11_0_crtc_load_lut(crtc);
++
++	return 0;
++}
++#else
+ static void dce_v11_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+ 				    u16 *blue, uint32_t start, uint32_t size)
+ {
+@@ -2657,6 +2675,7 @@ static void dce_v11_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green
+ 	}
+ 	dce_v11_0_crtc_load_lut(crtc);
+ }
++#endif
+ 
+ static void dce_v11_0_crtc_destroy(struct drm_crtc *crtc)
+ {
+diff --git a/amd/amdgpu/dce_v8_0.c b/amd/amdgpu/dce_v8_0.c
+index b598caa..d203894 100644
+--- a/amd/amdgpu/dce_v8_0.c
++++ b/amd/amdgpu/dce_v8_0.c
+@@ -2478,6 +2478,24 @@ static void dce_v8_0_cursor_reset(struct drm_crtc *crtc)
+ 	}
+ }
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++static int dce_v8_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
++				    u16 *blue, uint32_t size)
++{
++	struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
++	int i;
++
++	/* userspace palettes are always correct as is */
++	for (i = 0; i < size; i++) {
++		amdgpu_crtc->lut_r[i] = red[i] >> 6;
++		amdgpu_crtc->lut_g[i] = green[i] >> 6;
++		amdgpu_crtc->lut_b[i] = blue[i] >> 6;
++	}
++	dce_v8_0_crtc_load_lut(crtc);
++
++	return 0;
++}
++#else
+ static void dce_v8_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+ 				    u16 *blue, uint32_t start, uint32_t size)
+ {
+@@ -2492,6 +2510,7 @@ static void dce_v8_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+ 	}
+ 	dce_v8_0_crtc_load_lut(crtc);
+ }
++#endif
+ 
+ static void dce_v8_0_crtc_destroy(struct drm_crtc *crtc)
+ {
+diff --git a/amd/dal/amdgpu_dm/amdgpu_dm_types.c b/amd/dal/amdgpu_dm/amdgpu_dm_types.c
+index edc8e86..32755a9 100644
+--- a/amd/dal/amdgpu_dm/amdgpu_dm_types.c
++++ b/amd/dal/amdgpu_dm/amdgpu_dm_types.c
+@@ -998,6 +998,13 @@ void amdgpu_dm_crtc_destroy(struct drm_crtc *crtc)
+ 	kfree(crtc);
+ }
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++static int amdgpu_dm_atomic_crtc_gamma_set(struct drm_crtc *crtc,
++					   u16 *red,
++					   u16 *green,
++					   u16 *blue,
++					   uint32_t size)
++#else
+ static void amdgpu_dm_atomic_crtc_gamma_set(
+ 		struct drm_crtc *crtc,
+ 		u16 *red,
+@@ -1005,6 +1012,7 @@ static void amdgpu_dm_atomic_crtc_gamma_set(
+ 		u16 *blue,
+ 		uint32_t start,
+ 		uint32_t size)
++#endif
+ {
+ 	struct drm_device *dev = crtc->dev;
+ 	struct drm_property *prop = dev->mode_config.prop_crtc_id;
+@@ -1012,6 +1020,10 @@ static void amdgpu_dm_atomic_crtc_gamma_set(
+ 	crtc->state->mode.private_flags |= AMDGPU_CRTC_MODE_PRIVATE_FLAGS_GAMMASET;
+ 
+ 	drm_atomic_helper_crtc_set_property(crtc, prop, 0);
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	return 0;
++#endif
+ }
+ 
+ static int dm_crtc_funcs_atomic_set_property(
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0007-Fix-drm_atomic_helper_swap_state-for-4.8.0.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0007-Fix-drm_atomic_helper_swap_state-for-4.8.0.patch
new file mode 100644
index 00000000000..197fdd32b10
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0007-Fix-drm_atomic_helper_swap_state-for-4.8.0.patch
@@ -0,0 +1,28 @@
+From 7a5d45874b1e2bbbff2d2410f38203b5b0ae67c4 Mon Sep 17 00:00:00 2001
+From: "Luke A. Guest" <laguest@archeia.com>
+Date: Sun, 25 Sep 2016 17:00:32 +0100
+Subject: [PATCH 07/11] Fix drm_atomic_helper_swap_state for 4.8.0
+
+---
+ amd/dal/amdgpu_dm/amdgpu_dm_types.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/amd/dal/amdgpu_dm/amdgpu_dm_types.c b/amd/dal/amdgpu_dm/amdgpu_dm_types.c
+index 32755a9..60ca073 100644
+--- a/amd/dal/amdgpu_dm/amdgpu_dm_types.c
++++ b/amd/dal/amdgpu_dm/amdgpu_dm_types.c
+@@ -2528,7 +2528,11 @@ int amdgpu_dm_atomic_commit(
+ 	 * the software side now.
+ 	 */
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	drm_atomic_helper_swap_state(state, true);
++#else
+ 	drm_atomic_helper_swap_state(dev, state);
++#endif
+ 
+ 	/*
+ 	 * From this point state become old state really. New state is
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0008-Add-extra-flag-to-ttm_bo_move_ttm-for-4.8.0-rc2.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0008-Add-extra-flag-to-ttm_bo_move_ttm-for-4.8.0-rc2.patch
new file mode 100644
index 00000000000..8674c3537e8
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0008-Add-extra-flag-to-ttm_bo_move_ttm-for-4.8.0-rc2.patch
@@ -0,0 +1,40 @@
+From 7c536e8b9f73926014c0622eb101f2cf174b507b Mon Sep 17 00:00:00 2001
+From: "Luke A. Guest" <laguest@archeia.com>
+Date: Sun, 25 Sep 2016 19:19:45 +0100
+Subject: [PATCH 08/11] Add extra flag to ttm_bo_move_ttm for >=4.8.0-rc2
+
+---
+ amd/amdgpu/amdgpu_ttm.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/amd/amdgpu/amdgpu_ttm.c b/amd/amdgpu/amdgpu_ttm.c
+index 89760f8..d102224 100644
+--- a/amd/amdgpu/amdgpu_ttm.c
++++ b/amd/amdgpu/amdgpu_ttm.c
+@@ -428,7 +428,11 @@ static int amdgpu_move_vram_ram(struct ttm_buffer_object *bo,
+ 	if (unlikely(r)) {
+ 		goto out_cleanup;
+ 	}
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	r = ttm_bo_move_ttm(bo, true, interruptible, no_wait_gpu, new_mem);
++#else
+ 	r = ttm_bo_move_ttm(bo, true, no_wait_gpu, new_mem);
++#endif
+ out_cleanup:
+ 	ttm_bo_mem_put(bo, &tmp_mem);
+ 	return r;
+@@ -461,7 +465,11 @@ static int amdgpu_move_ram_vram(struct ttm_buffer_object *bo,
+ 	if (unlikely(r)) {
+ 		return r;
+ 	}
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++	r = ttm_bo_move_ttm(bo, true, interruptible, no_wait_gpu, &tmp_mem);
++#else
+ 	r = ttm_bo_move_ttm(bo, true, no_wait_gpu, &tmp_mem);
++#endif
+ 	if (unlikely(r)) {
+ 		goto out_cleanup;
+ 	}
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0009-Remove-dependency-on-System.map.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0009-Remove-dependency-on-System.map.patch
new file mode 100644
index 00000000000..52c5f7f4593
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0009-Remove-dependency-on-System.map.patch
@@ -0,0 +1,61 @@
+From 4d645984264e449d6a4507af033b26daed952eac Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Wed, 26 Oct 2016 22:26:39 -0300
+Subject: [PATCH 09/11] Remove dependency on System.map
+
+---
+ amd/backport/Makefile    |  1 -
+ amd/backport/kcl_fence.c | 10 ++++++++--
+ amd/backport/symbols     |  7 -------
+ 3 files changed, 8 insertions(+), 10 deletions(-)
+ delete mode 100644 amd/backport/symbols
+
+diff --git a/amd/backport/Makefile b/amd/backport/Makefile
+index ff9339d..3f2d9ea 100644
+--- a/amd/backport/Makefile
++++ b/amd/backport/Makefile
+@@ -64,7 +64,6 @@ ccflags-y += -DOS_NAME_RHEL_7_3
+ endif
+ endif
+ 
+-BACKPORT_OBJS = symbols.o
+ endif
+ 
+ BACKPORT_OBJS += kcl_drm.o kcl_ttm.o kcl_amdgpu.o kcl_fence.o kcl_mn.o amdgpu_kcl.o kcl_fence_array.o kcl_kthread.o
+diff --git a/amd/backport/kcl_fence.c b/amd/backport/kcl_fence.c
+index 54ad819..39f6d61 100644
+--- a/amd/backport/kcl_fence.c
++++ b/amd/backport/kcl_fence.c
+@@ -52,8 +52,14 @@ struct default_wait_cb {
+ 	struct task_struct *task;
+ };
+ 
+-extern void
+-(*fence_default_wait_cb)(struct fence *fence, struct fence_cb *cb);
++static void
++fence_default_wait_cb(struct fence *fence, struct fence_cb *cb)
++{
++	struct default_wait_cb *wait =
++		container_of(cb, struct default_wait_cb, base);
++
++	wake_up_process(wait->task);
++}
+ 
+ signed long
+ _kcl_fence_wait_any_timeout(struct fence **fences, uint32_t count,
+diff --git a/amd/backport/symbols b/amd/backport/symbols
+deleted file mode 100644
+index 68cae63..0000000
+--- a/amd/backport/symbols
++++ /dev/null
+@@ -1,7 +0,0 @@
+-SYMS=""
+-
+-SYMS+="fence_default_wait_cb"
+-
+-if version_lt 2.6.33; then
+-    SYMS+=" kallsyms_lookup_name"
+-fi
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0010-disable-dal-by-default.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0010-disable-dal-by-default.patch
new file mode 100644
index 00000000000..e69e5c58319
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0010-disable-dal-by-default.patch
@@ -0,0 +1,25 @@
+From 5ab8e5e36634391a5c440bf78463226b2074485e Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Thu, 25 Aug 2016 22:17:06 -0300
+Subject: [PATCH 10/11] disable dal by default
+
+---
+ amd/amdgpu/amdgpu_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/amd/amdgpu/amdgpu_drv.c b/amd/amdgpu/amdgpu_drv.c
+index d6b3f35..4477865 100755
+--- a/amd/amdgpu/amdgpu_drv.c
++++ b/amd/amdgpu/amdgpu_drv.c
+@@ -88,7 +88,7 @@ int amdgpu_vm_fault_stop = 0;
+ int amdgpu_vm_debug = 0;
+ int amdgpu_vram_page_split = -1;
+ int amdgpu_exp_hw_support = 0;
+-int amdgpu_dal = -1;
++int amdgpu_dal = 0;
+ int amdgpu_sched_jobs = 32;
+ int amdgpu_sched_hw_submission = 2;
+ int amdgpu_powerplay = -1;
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0011-kcl-fixes-for-16.50-linux-4.8.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0011-kcl-fixes-for-16.50-linux-4.8.patch
new file mode 100644
index 00000000000..0cf3ad262f6
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0011-kcl-fixes-for-16.50-linux-4.8.patch
@@ -0,0 +1,114 @@
+From 156445f6eda047ee5a5d6e4bde36c3e9ccbbd7d9 Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Thu, 29 Dec 2016 14:20:06 -0400
+Subject: [PATCH 11/11] kcl fixes for 16.50 + linux-4.8
+
+---
+ amd/amdgpu/dce_v6_0.c              |  5 +++--
+ amd/amdgpu/dce_virtual.c           |  5 +++--
+ amd/backport/include/kcl/kcl_drm.h | 12 ++++++++++++
+ amd/backport/include/kcl/kcl_ttm.h |  2 +-
+ amd/backport/kcl_drm.c             |  4 ++++
+ 5 files changed, 23 insertions(+), 5 deletions(-)
+
+diff --git a/amd/amdgpu/dce_v6_0.c b/amd/amdgpu/dce_v6_0.c
+index fd3eeb0..1f1874c 100644
+--- a/amd/amdgpu/dce_v6_0.c
++++ b/amd/amdgpu/dce_v6_0.c
+@@ -1946,9 +1946,9 @@ static void dce_v6_0_cursor_reset(struct drm_crtc *crtc)
+ 	}
+ }
+ 
+-static void dce_v6_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+-				    u16 *blue, uint32_t start, uint32_t size)
++static kcl_crtc_gamma_set_callback(dce_v6_0_crtc_gamma_set)
+ {
++  kcl_crtc_gamma_set_pre
+ 	struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+ 	int end = (start + size > 256) ? 256 : start + size, i;
+ 
+@@ -1959,6 +1959,7 @@ static void dce_v6_0_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+ 		amdgpu_crtc->lut_b[i] = blue[i] >> 6;
+ 	}
+ 	dce_v6_0_crtc_load_lut(crtc);
++  kcl_crtc_gamma_set_suf
+ }
+ 
+ static void dce_v6_0_crtc_destroy(struct drm_crtc *crtc)
+diff --git a/amd/amdgpu/dce_virtual.c b/amd/amdgpu/dce_virtual.c
+index 36e2094..11b98e2 100644
+--- a/amd/amdgpu/dce_virtual.c
++++ b/amd/amdgpu/dce_virtual.c
+@@ -152,9 +152,9 @@ static void dce_virtual_bandwidth_update(struct amdgpu_device *adev)
+ 	return;
+ }
+ 
+-static void dce_virtual_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
+-				    u16 *blue, uint32_t start, uint32_t size)
++static kcl_crtc_gamma_set_callback(dce_virtual_crtc_gamma_set)
+ {
++  kcl_crtc_gamma_set_pre
+ 	struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+ 	int end = (start + size > 256) ? 256 : start + size, i;
+ 
+@@ -164,6 +164,7 @@ static void dce_virtual_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *gre
+ 		amdgpu_crtc->lut_g[i] = green[i] >> 6;
+ 		amdgpu_crtc->lut_b[i] = blue[i] >> 6;
+ 	}
++  kcl_crtc_gamma_set_suf
+ }
+ 
+ static void dce_virtual_crtc_destroy(struct drm_crtc *crtc)
+diff --git a/amd/backport/include/kcl/kcl_drm.h b/amd/backport/include/kcl/kcl_drm.h
+index 95bf640..61c38b1 100644
+--- a/amd/backport/include/kcl/kcl_drm.h
++++ b/amd/backport/include/kcl/kcl_drm.h
+@@ -206,4 +206,16 @@ int drm_atomic_helper_resume(struct drm_device *dev,
+ 
+ #endif
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++#define kcl_crtc_gamma_set_callback(n) int n(struct drm_crtc *crtc, \
++    u16 *red, u16 *green, u16 *blue, uint32_t size)
++#define kcl_crtc_gamma_set_pre uint32_t start = 0;
++#define kcl_crtc_gamma_set_suf return 0;
++#else
++#define kcl_crtc_gamma_set_callback(n) void n(struct drm_crtc *crtc, \
++    u16 *red, u16 *green, u16 *blue, uint32_t start, uint32_t size)
++#define kcl_crtc_gamma_set_pre
++#define kcl_crtc_gamma_set_suf
++#endif
++
+ #endif /* AMDGPU_BACKPORT_KCL_DRM_H */
+diff --git a/amd/backport/include/kcl/kcl_ttm.h b/amd/backport/include/kcl/kcl_ttm.h
+index 52cdbc8..cdda0b5 100644
+--- a/amd/backport/include/kcl/kcl_ttm.h
++++ b/amd/backport/include/kcl/kcl_ttm.h
+@@ -152,7 +152,7 @@ static inline int kcl_ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
+ 		bool evict, bool no_wait_gpu,
+ 		struct ttm_mem_reg *new_mem)
+ {
+-#if defined(BUILD_AS_DKMS)
++#if defined(BUILD_AS_DKMS) && (LINUX_VERSION_CODE < KERNEL_VERSION(4, 8, 0))
+ 	return ttm_bo_move_accel_cleanup(bo, fence,
+ 			evict, no_wait_gpu, new_mem);
+ #else
+diff --git a/amd/backport/kcl_drm.c b/amd/backport/kcl_drm.c
+index 27d4aaa..a083c87 100644
+--- a/amd/backport/kcl_drm.c
++++ b/amd/backport/kcl_drm.c
+@@ -178,7 +178,11 @@ static inline struct drm_plane_state *
+ _kcl_drm_atomic_get_existing_plane_state(struct drm_atomic_state *state,
+                     struct drm_plane *plane)
+ {
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 8, 0)
++    return drm_atomic_get_existing_plane_state(state, plane);
++#else
+     return state->plane_states[drm_plane_index(plane)];
++#endif
+ }
+ 
+ void
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0012-use-kernel-fence_array-in-4.8.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0012-use-kernel-fence_array-in-4.8.patch
new file mode 100644
index 00000000000..07ce868c29d
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0012-use-kernel-fence_array-in-4.8.patch
@@ -0,0 +1,55 @@
+From 73e77e056427e2042b8d84933c02db92e17cf233 Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Thu, 29 Dec 2016 14:49:18 -0400
+Subject: [PATCH] use kernel fence_array in 4.8+
+
+---
+ amd/backport/include/kcl/kcl_fence_array.h | 10 ++++++++--
+ amd/backport/kcl_fence_array.c             |  2 +-
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/amd/backport/include/kcl/kcl_fence_array.h b/amd/backport/include/kcl/kcl_fence_array.h
+index bb4401e..0d9f344 100644
+--- a/amd/backport/include/kcl/kcl_fence_array.h
++++ b/amd/backport/include/kcl/kcl_fence_array.h
+@@ -19,11 +19,15 @@
+  * more details.
+  */
+ 
+-#ifndef __LINUX_FENCE_ARRAY_H
+-#define __LINUX_FENCE_ARRAY_H
++#ifndef __KCL_FENCE_ARRAY_H
++#define __KCL_FENCE_ARRAY_H
+ 
+ #include <linux/fence.h>
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,8,0)
++#include <linux/fence-array.h>
++#else
++
+ /**
+  * struct fence_array_cb - callback helper for fence array
+  * @cb: fence callback structure for signaling
+@@ -72,4 +76,6 @@ struct fence_array *fence_array_create(int num_fences, struct fence **fences,
+ 				       u64 context, unsigned seqno,
+ 				       bool signal_on_any);
+ 
++#endif
++
+ #endif /* __LINUX_FENCE_ARRAY_H */
+diff --git a/amd/backport/kcl_fence_array.c b/amd/backport/kcl_fence_array.c
+index d7ee15c..1865444 100644
+--- a/amd/backport/kcl_fence_array.c
++++ b/amd/backport/kcl_fence_array.c
+@@ -21,7 +21,7 @@
+ #include <linux/export.h>
+ #include <linux/slab.h>
+ 
+-#if defined(BUILD_AS_DKMS)
++#if defined(BUILD_AS_DKMS) && LINUX_VERSION_CODE < KERNEL_VERSION(4,8,0)
+ static void fence_array_cb_func(struct fence *f, struct fence_cb *cb);
+ 
+ static const char *fence_array_get_driver_name(struct fence *fence)
+-- 
+2.11.0
+
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index cae5fe4329d..926675f0163 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "android-udev-rules-${version}";
-  version = "20160805";
+  version = "20170109";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    sha256 = "0sdf3insqs73cdzmwl3lqy7nj82f1lprxd3vm0jh3qpf0sd1k93c";
+    sha256 = "1fxr6iyb70swmmp46xvx8iz9h6xj7x6q9yfdsl958zd63j8sjzjr";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index f58a7557ce3..b576ca71d58 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -82,7 +82,6 @@ let
     buildInputs = [
       perl
       pythonPackages.python
-      pythonPackages.readline
       libapparmor
       libapparmor.python
     ];
diff --git a/pkgs/os-specific/linux/ati-drivers/default.nix b/pkgs/os-specific/linux/ati-drivers/default.nix
index 902f0e37e35..395850384d1 100644
--- a/pkgs/os-specific/linux/ati-drivers/default.nix
+++ b/pkgs/os-specific/linux/ati-drivers/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, kernel ? null, which
+{ stdenv, lib, fetchurl, kernel ? null, which
 , xorg, makeWrapper, glibc, patchelf, unzip
 , fontconfig, freetype, mesa # for fgl_glxgears
 , # Whether to build the libraries only (i.e. not the kernel module or
@@ -73,8 +73,14 @@ stdenv.mkDerivation rec {
     ./patches/15.9-kcl_str.patch
     ./patches/15.9-mtrr.patch
     ./patches/15.9-preempt.patch
-    ./patches/15.9-sep_printf.patch
-  ];
+    ./patches/15.9-sep_printf.patch ]
+  ++ optionals ( kernel != null &&
+                 (lib.versionAtLeast kernel.version "4.6") )
+               [ ./patches/kernel-4.6-get_user_pages.patch
+                 ./patches/kernel-4.6-page_cache_release-put_page.patch ]
+  ++ optionals ( kernel != null &&
+                 (lib.versionAtLeast kernel.version "4.7") )
+               [ ./patches/4.7-arch-cpu_has_pge-v2.patch ];
 
   buildInputs =
     [ xorg.libXrender xorg.libXext xorg.libX11 xorg.libXinerama xorg.libSM
@@ -121,7 +127,7 @@ stdenv.mkDerivation rec {
     description = "ATI Catalyst display drivers";
     homepage = http://support.amd.com/us/gpudownload/Pages/index.aspx;
     license = licenses.unfree;
-    maintainers = with maintainers; [ marcweber offline jgeerds ];
+    maintainers = with maintainers; [ marcweber offline jgeerds jerith666 ];
     platforms = platforms.linux;
     hydraPlatforms = [];
     # Copied from the nvidia default.nix to prevent a store collision.
diff --git a/pkgs/os-specific/linux/ati-drivers/patches/4.7-arch-cpu_has_pge-v2.patch b/pkgs/os-specific/linux/ati-drivers/patches/4.7-arch-cpu_has_pge-v2.patch
new file mode 100644
index 00000000000..cb86f5aff27
--- /dev/null
+++ b/pkgs/os-specific/linux/ati-drivers/patches/4.7-arch-cpu_has_pge-v2.patch
@@ -0,0 +1,70 @@
+diff -uNr 16.8/common/lib/modules/fglrx/build_mod/firegl_public.c 16.8b/common/lib/modules/fglrx/build_mod/firegl_public.c
+--- 16.8/common/lib/modules/fglrx/build_mod/firegl_public.c	2015-12-18 19:47:41.000000000 +0100
++++ 16.8b/common/lib/modules/fglrx/build_mod/firegl_public.c	2016-08-15 15:09:37.228538907 +0200
+@@ -4518,7 +4518,11 @@
+     write_cr0(cr0);
+     wbinvd();
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
++    if (boot_cpu_has(X86_FEATURE_PGE))
++#else
+     if (cpu_has_pge)
++#endif
+     {
+         cr4 = READ_CR4();
+         WRITE_CR4(cr4 & ~X86_CR4_PGE);
+@@ -4532,7 +4536,11 @@
+     wbinvd();
+     __flush_tlb();
+     write_cr0(cr0 & 0xbfffffff);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
++    if (boot_cpu_has(X86_FEATURE_PGE))
++#else
+     if (cpu_has_pge)
++#endif
+     {
+         WRITE_CR4(cr4);
+     }
+@@ -4559,7 +4567,11 @@
+     write_cr0(cr0);
+     wbinvd();
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
++    if (boot_cpu_has(X86_FEATURE_PGE))
++#else
+     if (cpu_has_pge)
++#endif
+     {
+         cr4 = READ_CR4();
+         WRITE_CR4(cr4 & ~X86_CR4_PGE);
+@@ -4572,7 +4584,11 @@
+     wbinvd();
+     __flush_tlb();
+     write_cr0(cr0 & 0xbfffffff);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
++    if (boot_cpu_has(X86_FEATURE_PGE))
++#else
+     if (cpu_has_pge)
++#endif
+     {
+         WRITE_CR4(cr4);
+     }
+diff -uNr 16.8/common/lib/modules/fglrx/build_mod/firegl_public.h 16.8b/common/lib/modules/fglrx/build_mod/firegl_public.h
+--- 16.8/common/lib/modules/fglrx/build_mod/firegl_public.h	2015-12-18 19:47:41.000000000 +0100
++++ 16.8b/common/lib/modules/fglrx/build_mod/firegl_public.h	2016-08-15 15:09:05.815141238 +0200
+@@ -650,9 +650,15 @@
+ #define cpu_has_pat  test_bit(X86_FEATURE_PAT, (void *) &boot_cpu_data.x86_capability)
+ #endif
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
++#ifndef boot_cpu_has(X86_FEATURE_PGE)
++#define boot_cpu_has(X86_FEATURE_PGE) test_bit(X86_FEATURE_PGE, &boot_cpu_data.x86_capability)
++#endif
++#else
+ #ifndef cpu_has_pge
+ #define cpu_has_pge test_bit(X86_FEATURE_PGE, &boot_cpu_data.x86_capability)
+ #endif
++#endif
+ 
+ /* 2.6.29 defines pgprot_writecombine as a macro which resolves to a
+  * GPL-only function with the same name. So we always use our own
diff --git a/pkgs/os-specific/linux/ati-drivers/patches/kernel-4.6-get_user_pages.patch b/pkgs/os-specific/linux/ati-drivers/patches/kernel-4.6-get_user_pages.patch
new file mode 100644
index 00000000000..1e7209ed5ed
--- /dev/null
+++ b/pkgs/os-specific/linux/ati-drivers/patches/kernel-4.6-get_user_pages.patch
@@ -0,0 +1,25 @@
+diff --git a/common/lib/modules/fglrx/build_mod/firegl_public.c b/common/lib/modules/fglrx/build_mod/firegl_public.c
+index 9c70211..b2242af 100755
+--- a/common/lib/modules/fglrx/build_mod/firegl_public.c
++++ b/common/lib/modules/fglrx/build_mod/firegl_public.c
+@@ -3220,7 +3220,7 @@ int ATI_API_CALL KCL_LockUserPages(unsigned long vaddr, unsigned long* page_list
+     int ret;
+ 
+     down_read(&current->mm->mmap_sem);
+-    ret = get_user_pages(current, current->mm, vaddr, page_cnt, 1, 0, (struct page **)page_list, NULL);
++    ret = get_user_pages(vaddr, page_cnt, 1, 0, (struct page **)page_list, NULL);
+     up_read(&current->mm->mmap_sem);
+ 
+     return ret;
+@@ -3238,7 +3238,7 @@ int ATI_API_CALL KCL_LockReadOnlyUserPages(unsigned long vaddr, unsigned long* p
+     int ret;
+ 
+     down_read(&current->mm->mmap_sem);
+-    ret = get_user_pages(current, current->mm, vaddr, page_cnt, 0, 0, (struct page **)page_list, NULL);
++    ret = get_user_pages(vaddr, page_cnt, 0, 0, (struct page **)page_list, NULL);
+     up_read(&current->mm->mmap_sem);
+ 
+     return ret;
+-- 
+2.9.2
+
diff --git a/pkgs/os-specific/linux/ati-drivers/patches/kernel-4.6-page_cache_release-put_page.patch b/pkgs/os-specific/linux/ati-drivers/patches/kernel-4.6-page_cache_release-put_page.patch
new file mode 100644
index 00000000000..28820790e49
--- /dev/null
+++ b/pkgs/os-specific/linux/ati-drivers/patches/kernel-4.6-page_cache_release-put_page.patch
@@ -0,0 +1,16 @@
+diff --git a/common/lib/modules/fglrx/build_mod/firegl_public.c b/common/lib/modules/fglrx/build_mod/firegl_public.c
+index b2242af..586129c 100755
+--- a/common/lib/modules/fglrx/build_mod/firegl_public.c
++++ b/common/lib/modules/fglrx/build_mod/firegl_public.c
+@@ -3249,7 +3249,7 @@ void ATI_API_CALL KCL_UnlockUserPages(unsigned long* page_list, unsigned int pag
+     unsigned int i;
+     for (i=0; i<page_cnt; i++)
+     {
+-        page_cache_release((struct page*)page_list[i]);
++        put_page((struct page*)page_list[i]);
+     }
+ }
+ 
+-- 
+2.9.2
+
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index afe73ef1b5a..4decc8c7a32 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0jwrww1vn7yqxmb84n6y4p58z34gga0ic4rs2msvpzc2x1hxrn31";
   };
 
-  outputs = [ "bin" "dev" "out" "man" ];
+  outputs = [ "bin" "dev" "out" "man" "plugins" ];
 
   buildInputs = [ openldap ]
             ++ stdenv.lib.optional enablePython python;
@@ -21,6 +21,16 @@ stdenv.mkDerivation rec {
     ${if enablePython then "--with-python" else "--without-python"}
   '';
 
+  enableParallelBuilding = true;
+
+  postInstall =
+    ''
+      # Move the z/OS plugin to a separate output to prevent an
+      # openldap runtime dependency in audit.bin.
+      mkdir -p $plugins/bin
+      mv $bin/sbin/audispd-zos-remote $plugins/bin/
+    '';
+
   meta = {
     description = "Audit Library";
     homepage = "http://people.redhat.com/sgrubb/audit/";
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 4401eb24cb4..d2d2c4a3988 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, flex, bison, linuxHeaders, libtirpc, utillinux, nfs-utils, e2fsprogs
-, libxml2 }:
+, libxml2, kerberos, kmod, openldap, sssd, cyrus_sasl, openssl }:
 
 let
   version = "5.1.2";
@@ -13,7 +13,9 @@ in stdenv.mkDerivation {
   };
 
   preConfigure = ''
-    configureFlags="--enable-force-shutdown --enable-ignore-busy --with-path=$PATH"
+    configureFlags="--enable-force-shutdown --enable-ignore-busy --with-path=$PATH --with-openldap=${openldap} --with-sasl=${cyrus_sasl}"
+    export sssldir="${sssd}/lib/sssd/modules"
+    export HAVE_SSS_AUTOFS=1
 
     export MOUNT=${lib.getBin utillinux}/bin/mount
     export MOUNT_NFS=${lib.getBin nfs-utils}/bin/mount.nfs
@@ -29,7 +31,8 @@ in stdenv.mkDerivation {
     #make install SUBDIRS="samples" # impure!
   '';
 
-  buildInputs = [ linuxHeaders libtirpc libxml2 ];
+  buildInputs = [ linuxHeaders libtirpc libxml2 kerberos kmod openldap sssd
+                  openssl cyrus_sasl ];
 
   nativeBuildInputs = [ flex bison ];
 
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
index b58beab94b3..0ee928754db 100644
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -1,18 +1,18 @@
-{ stdenv, fetchurl, pkgconfig, gpsd, libcap }:
+{ stdenv, fetchurl, pkgconfig, gpsd, libcap, libnl }:
 
 let
-  ver = "2016.2";
+  ver = "2016.5";
 in
 stdenv.mkDerivation rec {
   name = "alfred-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "19025arn926lhn54ss4gmmdss9z4a3yxk4ja5kyv17mi5i4yg7j6";
+    sha256 = "1ln997qyknkfm7xp4vx5lm0z833ksn1gn4dyjvr3qr1pgyzvmcrp";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gpsd libcap ];
+  buildInputs = [ gpsd libcap libnl ];
 
   preBuild = ''
     makeFlags="PREFIX=$out PKG_CONFIG=${pkgconfig}/bin/pkg-config"
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index 5dafc3d2668..c8cab86413f 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:
 
 let
-  ver = "2016.2";
+  ver = "2016.5";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0bf5zlpwxvq4blcgpwjgh8ms4lfapwjpjl4sczwf3i1rv7f4p05q";
+    sha256 = "1saa088ggsr7bwlvnzpgjj6zqn51j0km96f4x1djhj55hwfypv87";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index 65fcd07a6e0..04446998624 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -2,14 +2,14 @@
 
 #assert stdenv.lib.versionOlder kernel.version "3.17";
 
-let base = "batman-adv-2016.2"; in
+let base = "batman-adv-2016.5"; in
 
 stdenv.mkDerivation rec {
   name = "${base}-${kernel.version}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/${base}/${base}.tar.gz";
-    sha256 = "0pj6jans75pxw9arp1747kmmk72zbc2vgkf2a0w565pj98x1nlk1";
+    sha256 = "1dqdzpxdrgqpgkc6bqfvbvx5x18bpd9y459j0iyva47lqj8gr86h";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index 838c65dd196..f3b262f1f7d 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -2,14 +2,14 @@
   flex, bison, elfutils, python, pythonPackages, luajit, netperf, iperf }:
 
 stdenv.mkDerivation rec {
-  version = "git-2016-05-18";
+  version = "0.2.0";
   name = "bcc-${version}";
 
   src = fetchFromGitHub {
     owner = "iovisor";
     repo = "bcc";
-    rev = "c7f317deb577d59007411e978ac21a2ea376358f";
-    sha256 = "0jv4smy615kp7623pd61s46m52jjp6m47w0fjgr7s22qamra3g98";
+    rev = "v${version}";
+    sha256 = "1xifh8lcqmn4mk6w4srjf4zk6mlwgck4fpcyhhliy39963ch5k08";
   };
 
   buildInputs = [ makeWrapper cmake llvmPackages.llvm llvmPackages.clang-unwrapped kernel
@@ -17,17 +17,21 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags="-DBCC_KERNEL_MODULES_DIR=${kernel.dev}/lib/modules -DBCC_KERNEL_HAS_SOURCE_DIR=1";
-    
+
   postInstall = ''
-    mkdir -p $out/bin
+    mkdir -p $out/bin $out/share
+    rm -r $out/share/bcc/tools/{old,doc/CMakeLists.txt}
+    mv $out/share/bcc/tools/doc $out/share
+    mv $out/share/bcc/man $out/share/
+
     for f in $out/share/bcc/tools\/*; do
-      ln -s $f $out/bin/$(basename $f) 
+      ln -s $f $out/bin/$(basename $f)
       wrapProgram $f \
         --prefix LD_LIBRARY_PATH : $out/lib \
         --prefix PYTHONPATH : $out/lib/python2.7/site-packages \
         --prefix PYTHONPATH : :${pythonPackages.netaddr}/lib/${python.libPrefix}/site-packages
     done
-  '';  
+  '';
 
   meta = with stdenv.lib; {
     description = "Dynamic Tracing Tools for Linux";
diff --git a/pkgs/os-specific/linux/bluez/bluez5.nix b/pkgs/os-specific/linux/bluez/bluez5.nix
index 22b6f5d6354..b5429812441 100644
--- a/pkgs/os-specific/linux/bluez/bluez5.nix
+++ b/pkgs/os-specific/linux/bluez/bluez5.nix
@@ -5,15 +5,15 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.40";
+  name = "bluez-5.43";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "09ywk3lvgis0nbi0d5z8d4qp5r33lzwnd6bdakacmbsm420qpnns";
+    sha256 = "05cdnpz0w2lwq2x5ba87q1h2wgb4lfnpbnbh6p7499hx59fw1j8n";
   };
 
   pythonPath = with pythonPackages;
-    [ dbus pygobject pygobject3 recursivePthLoader ];
+    [ dbus pygobject2 pygobject3 recursivePthLoader ];
 
   buildInputs =
     [ pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython
diff --git a/pkgs/os-specific/linux/bluez/bluez5_28.nix b/pkgs/os-specific/linux/bluez/bluez5_28.nix
index 829b383e072..8cd5e064e1e 100644
--- a/pkgs/os-specific/linux/bluez/bluez5_28.nix
+++ b/pkgs/os-specific/linux/bluez/bluez5_28.nix
@@ -15,7 +15,7 @@ in stdenv.mkDerivation rec {
   };
 
   pythonPath = with pythonPackages;
-    [ dbus pygobject pygobject3 recursivePthLoader ];
+    [ dbus pygobject2 pygobject3 recursivePthLoader ];
 
   buildInputs =
     [ pkgconfig dbus glib alsaLib python pythonPackages.wrapPython
diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
index e36512e0076..c548b55105d 100644
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, kernel }:
+{ stdenv, fetchurl, fetchpatch, kernel }:
 
 let
   version = "6.30.223.271";
@@ -15,8 +15,8 @@ stdenv.mkDerivation {
   name = "broadcom-sta-${version}-${kernel.version}";
 
   src = fetchurl {
-    url = "http://www.broadcom.com/docs/linux_sta/${tarball}";
-    sha256 = hashes.${stdenv.system};
+    url = "https://docs.broadcom.com/docs-and-downloads/docs/linux_sta/${tarball}";
+    sha256 = hashes."${stdenv.system}";
   };
 
   hardeningDisable = [ "pic" ];
@@ -27,6 +27,11 @@ stdenv.mkDerivation {
     ./linux-4.7.patch
     ./null-pointer-fix.patch
     ./gcc.patch
+    (fetchpatch {
+      name = "linux-4.8.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/004-linux48.patch?h=broadcom-wl-dkms";
+      sha256 = "1g1gazxx67kxyw242cli6bf62il7ikzmf0w6v14k44j6b4bihcax";
+    })
   ];
 
   makeFlags = "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}";
@@ -49,7 +54,7 @@ stdenv.mkDerivation {
     description = "Kernel module driver for some Broadcom's wireless cards";
     homepage = http://www.broadcom.com/support/802.11/linux_sta.php;
     license = stdenv.lib.licenses.unfreeRedistributable;
-    maintainers = with stdenv.lib.maintainers; [ phreedom vcunat ];
+    maintainers = with stdenv.lib.maintainers; [ phreedom ];
     platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/btfs/default.nix b/pkgs/os-specific/linux/btfs/default.nix
index f6b3839c6bc..84f1abcca36 100644
--- a/pkgs/os-specific/linux/btfs/default.nix
+++ b/pkgs/os-specific/linux/btfs/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "btfs-${version}";
-  version = "2.11";
+  version = "2.12";
 
   src = fetchFromGitHub {
     owner = "johang";
     repo = "btfs";
-    rev = "fe585ca285690579db50b1624cec81ae76279ba2";
-    sha256 = "1vqya2k8cx5x7jfapl9vmmb002brwbsz4j5xs4417kzv3j2bsms9";
+    rev = "daeb2fd43795f0bb9a4861279b6064b35186ff25";
+    sha256 = "1apvf1gp5973s4wlzwndxp711yd9pj9zf2ypdssfxv2a3rihly2b";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/busybox/busybox-in-store.patch b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
index ea245a49259..d3111efbdc4 100644
--- a/pkgs/os-specific/linux/busybox/busybox-in-store.patch
+++ b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
@@ -1,16 +1,14 @@
 Allow BusyBox to be invoked as "<something>-busybox". This is
 necessary when it's run from the Nix store as <hash>-busybox during
 stdenv bootstrap.
-
-diff -ru -x '*~' busybox-1.22.1-orig/libbb/appletlib.c busybox-1.22.1/libbb/appletlib.c
---- busybox-1.22.1-orig/libbb/appletlib.c	2014-01-09 19:15:44.000000000 +0100
-+++ busybox-1.22.1/libbb/appletlib.c	2014-10-29 09:53:01.232052068 +0100
-@@ -764,7 +764,7 @@
- 	int applet = find_applet_by_name(name);
- 	if (applet >= 0)
- 		run_applet_no_and_exit(applet, argv);
--	if (strncmp(name, "busybox", 7) == 0)
+--- busybox-1.26.1-orig/libbb/appletlib.orig	2016-10-26 19:54:20.510957575 -0400
++++ busybox-1.26.1/libbb/appletlib.c	2016-10-26 19:48:31.590862853 -0400
+@@ -887,7 +887,7 @@
+ static NORETURN void run_applet_and_exit(const char *name, char **argv)
+ {
+ #  if ENABLE_BUSYBOX
+-	if (is_prefixed_with(name, "busybox"))
 +	if (strstr(name, "busybox") != 0)
  		exit(busybox_main(argv));
- }
- 
+ #  endif
+ #  if NUM_APPLETS > 0
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index efb06ba845e..b3502d269b0 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -26,14 +26,14 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.23.2";
+  name = "busybox-1.26.1";
 
   src = fetchurl {
     url = "http://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "16ii9sqracvh2r1gfzhmlypl269nnbkpvrwa7270k35d3bigk9h5";
+    sha256 = "1wl1yy82am53srhgpi1w04hs5hbqjljrrxwwfic35k1mza3y9fqg";
   };
 
-  hardeningDisable = [ "format" ];
+  hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
 
   patches = [ ./busybox-in-store.patch ];
 
diff --git a/pkgs/os-specific/linux/cachefilesd/default.nix b/pkgs/os-specific/linux/cachefilesd/default.nix
new file mode 100644
index 00000000000..99cb7d264fe
--- /dev/null
+++ b/pkgs/os-specific/linux/cachefilesd/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "cachefilesd-${version}";
+  version = "0.10.9";
+
+  src = fetchurl {
+    url = "https://people.redhat.com/dhowells/fscache/${name}.tar.bz2";
+    sha256 = "1jkb3qd8rcmli3g2qgcpp1f9kklil4qgy86w7pg2cpv10ikyr5y8";
+  };
+
+  installFlags = [
+    "ETCDIR=$(out)/etc"
+    "SBINDIR=$(out)/sbin"
+    "MANDIR=$(out)/share/man"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Local network file caching management daemon";
+    homepage = "https://people.redhat.com/dhowells/fscache/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/os-specific/linux/cifs-utils/default.nix b/pkgs/os-specific/linux/cifs-utils/default.nix
index 6dcf8e11a3e..f69319b5256 100644
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, kerberos, keyutils, pam }:
+{ stdenv, fetchurl, kerberos, keyutils, pam, talloc }:
 
 stdenv.mkDerivation rec {
   name = "cifs-utils-${version}";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1xs9rwqfpx8qj5mcmagw6y1hzwc71zhzb5r8hv06sz16p1w6axz2";
   };
 
-  buildInputs = [ kerberos keyutils pam ];
+  buildInputs = [ kerberos keyutils pam talloc ];
 
   makeFlags = "root_sbindir=$(out)/sbin";
 
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index 37ad34d8b64..674f3caa765 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -62,13 +62,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "conky-${version}";
-  version = "1.10.3";
+  version = "1.10.5";
 
   src = fetchFromGitHub {
     owner = "brndnmtthws";
     repo = "conky";
     rev = "v${version}";
-    sha256 = "0sa2jl159jk5p2hr37adwq84m0ynva7v87qrwj1xv0kw8l4qzhjs";
+    sha256 = "1x1b7h4s8f8qbiyas7sw5v2nq5h2wy3q7hsp1ah4l7191jjidqix";
   };
 
   postPatch = ''
@@ -102,7 +102,7 @@ stdenv.mkDerivation rec {
     ++ optional  weatherXoapSupport libxml2
     ;
 
-  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" ]
+  cmakeFlags = []
     ++ optional docsSupport         "-DMAINTAINER_MODE=ON"
     ++ optional curlSupport         "-DBUILD_CURL=ON"
     ++ optional (!ibmSupport)       "-DBUILD_IBM=OFF"
diff --git a/pkgs/os-specific/linux/consoletools/default.nix b/pkgs/os-specific/linux/consoletools/default.nix
index b9f1ee90fe9..1064f628c10 100644
--- a/pkgs/os-specific/linux/consoletools/default.nix
+++ b/pkgs/os-specific/linux/consoletools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "linuxconsoletools-${version}";
-  version = "1.4.9";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxconsole/${name}.tar.bz2";
-    sha256 = "0rwv2fxn12bblp096m9jy1lhngz26lv6g6zs4cgfg4frikwn977s";
+    sha256 = "0il1m8pgw8f6b8qid035ixamv0w5fgh9pinx5vw4ayxn03nyzlnf";
   };
 
   buildInputs = [ SDL ];
diff --git a/pkgs/os-specific/linux/crda/default.nix b/pkgs/os-specific/linux/crda/default.nix
index d28ae6f5098..ac6117cd599 100644
--- a/pkgs/os-specific/linux/crda/default.nix
+++ b/pkgs/os-specific/linux/crda/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, libgcrypt, libnl, pkgconfig, pythonPackages, wireless-regdb }:
+{ stdenv, fetchurl, libgcrypt, libnl, pkgconfig, python2Packages, wireless-regdb }:
 
 stdenv.mkDerivation rec {
   name = "crda-${version}";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libgcrypt libnl ];
   nativeBuildInputs = [
-    pkgconfig pythonPackages.m2crypto pythonPackages.python
+    pkgconfig python2Packages.m2crypto python2Packages.python
   ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/cryopid/default.nix b/pkgs/os-specific/linux/cryopid/default.nix
deleted file mode 100644
index 0cb64bcc975..00000000000
--- a/pkgs/os-specific/linux/cryopid/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{stdenv, fetchurl, zlibStatic}:
-
-let
-
-  pname = "cryopid";
-  version = "20090908";
-  revision = "7da69201d50e";
-
-in
-
-stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
-
-  src = fetchurl {
-    url = "https://sharesource.org/hg/cryopid/archive/${revision}.tar.bz2";
-    sha256 = "908a4b1cb26322ee25afe13ff59e0d86f669538cb4583766b15ca79fda6c69ca";
-  };
-
-  buildInputs = [ zlibStatic ];
-
-  preBuild = "cd src";
-
-  installPhase = "mkdir -p $out/bin; cp cryopid $out/bin";
-
-  meta = {
-    description = "A process freezer for Linux";
-    longDescription = ''
-      CryoPID allows you to capture the state of a running process in Linux
-      and save it to a file.  This file can then be used to resume the process
-      later on, either after a reboot or even on another machines.
-    '';
-    homepage = http://sharesource.org/project/cryopid;
-    license = ''
-      Modified BSD license (without advertising clause).  CryoPID ships with
-      and links against the dietlibc library, which is distributed under the
-      GNU General Public Licence, version 2.
-    '';
-  };
-}
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 8e92aaf6346..f61a5497c4b 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -1,22 +1,22 @@
 { stdenv, fetchurl, devicemapper, openssl, libuuid, pkgconfig, popt
-, enablePython ? false, python ? null
+, enablePython ? false, python2 ? null
 }:
 
-assert enablePython -> python != null;
+assert enablePython -> python2 != null;
 
 stdenv.mkDerivation rec {
-  name = "cryptsetup-1.7.0";
+  name = "cryptsetup-1.7.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v1.7/${name}.tar.xz";
-    sha256 = "0j6iwf64pdrl4nm5ypc2r33b3k0aflb939wz2496vcqdrjkj8m87";
+    sha256 = "00nwd96m9yq4k3cayc04i5y7iakkzana35zxky6hpx2w8zl08axg";
   };
 
   configureFlags = [ "--enable-cryptsetup-reencrypt" "--with-crypto_backend=openssl" ]
                 ++ stdenv.lib.optional enablePython "--enable-python";
 
   buildInputs = [ devicemapper openssl libuuid pkgconfig popt ]
-             ++ stdenv.lib.optional enablePython python;
+             ++ stdenv.lib.optional enablePython python2;
 
   meta = {
     homepage = https://gitlab.com/cryptsetup/cryptsetup/;
diff --git a/pkgs/os-specific/linux/devmem2/default.nix b/pkgs/os-specific/linux/devmem2/default.nix
new file mode 100644
index 00000000000..17450f36daa
--- /dev/null
+++ b/pkgs/os-specific/linux/devmem2/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "devmem2-2004-08-05";
+
+  src = fetchurl {
+    url = "http://lartmaker.nl/lartware/port/devmem2.c";
+    sha256 = "14f1k7v6i1yaxg4xcaaf5i4aqn0yabba857zjnbg9wiymy82qf7c";
+  };
+
+  buildCommand = ''
+    export hardeningDisable=format  # fix compile error
+    cc "$src" -o devmem2
+    install -D devmem2 "$out/bin/devmem2"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Simple program to read/write from/to any location in memory";
+    homepage = "http://lartmaker.nl/lartware/port/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ bjornfor ];
+  };
+}
diff --git a/pkgs/os-specific/linux/displaylink/default.nix b/pkgs/os-specific/linux/displaylink/default.nix
new file mode 100644
index 00000000000..87cf7c18caf
--- /dev/null
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -0,0 +1,70 @@
+{ stdenv, lib, fetchurl, fetchFromGitHub, unzip, kernel, utillinux, libdrm, libusb1, makeWrapper }:
+
+let
+  arch =
+    if stdenv.system == "x86_64-linux" then "x64"
+    else if stdenv.system == "i686-linux" then "x86"
+    else throw "Unsupported architecture";
+  libPath = lib.makeLibraryPath [ stdenv.cc.cc utillinux libusb1 ];
+
+in stdenv.mkDerivation rec {
+  name = "displaylink-${version}";
+  version = "1.1.62";
+
+  src = fetchFromGitHub {
+    owner = "DisplayLink";
+    repo = "evdi";
+    rev = "fe779940ff9fc7b512019619e24a5b22e4070f6a";
+    sha256 = "02hw83f6lscms8hssjzf30hl9zly3b28qcxwmxvnqwfhx1q491z9";
+  };
+
+  daemon = fetchurl {
+    name = "displaylink.zip";
+    url = "http://www.displaylink.com/downloads/file?id=607";
+    sha256 = "0jky3xk4dfzbzg386qya9l9952i4m8zhf55fdl06pi9r82k2iijx";
+  };
+
+  nativeBuildInputs = [ unzip makeWrapper ];
+
+  buildInputs = [ kernel libdrm ];
+
+  buildCommand = ''
+    unpackPhase
+    cd $sourceRoot
+    unzip $daemon
+    chmod +x displaylink-driver-${version}.run
+    ./displaylink-driver-${version}.run --target daemon --noexec
+
+    ( cd module
+      export makeFlags="$makeFlags KVER=${kernel.modDirVersion} KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+      export hardeningDisable="pic format"
+      buildPhase
+      install -Dm755 evdi.ko $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/evdi/evdi.ko
+    )
+
+    ( cd library
+      buildPhase
+      install -Dm755 libevdi.so $out/lib/libevdi.so
+    )
+
+    fixupPhase
+
+    ( cd daemon
+      install -Dt $out/lib/displaylink *.spkg
+      install -Dm755 ${arch}/DisplayLinkManager $out/bin/DisplayLinkManager
+      patchelf \
+        --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+        --set-rpath $out/lib:${libPath} \
+        $out/bin/DisplayLinkManager
+      wrapProgram $out/bin/DisplayLinkManager \
+        --run "cd $out/lib/displaylink"
+    )
+  '';
+
+  meta = with stdenv.lib; {
+    description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
+    platforms = [ "x86_64-linux" "i686-linux" ];
+    license = licenses.unfree;
+    homepage = "http://www.displaylink.com/";
+  };
+}
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index e0c164e6232..cd561df0ec4 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -4,11 +4,11 @@ assert lib.versionAtLeast kernel.version "3.18";
 
 stdenv.mkDerivation rec {
   name = "dpdk-${version}-${kernel.version}";
-  version = "16.04";
+  version = "16.07.2";
 
   src = fetchurl {
-    url = "http://dpdk.org/browse/dpdk/snapshot/dpdk-${version}.tar.gz";
-    sha256 = "0yrz3nnhv65v2jzz726bjswkn8ffqc1sr699qypc9m78qrdljcfn";
+    url = "http://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
+    sha256 = "1mzwazmzpq8mvwiham80y6h53qpvjpp76v0d58gz9bfiphbi9876";
   };
 
   buildInputs = [ pkgconfig libvirt ];
diff --git a/pkgs/os-specific/linux/dstat/default.nix b/pkgs/os-specific/linux/dstat/default.nix
index 8f7772de1fd..ccedc381504 100644
--- a/pkgs/os-specific/linux/dstat/default.nix
+++ b/pkgs/os-specific/linux/dstat/default.nix
@@ -1,6 +1,6 @@
-{ stdenv, fetchurl, python, pythonPackages }:
+{ stdenv, fetchurl, python2Packages }:
 
-stdenv.mkDerivation rec {
+python2Packages.mkPythonDerivation rec {
   name = "dstat-${version}";
   version = "0.7.3";
 
@@ -9,21 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "16286z3y2lc9nsq8njzjkv6k2vyxrj9xiixj1k3gnsbvhlhkirj6";
   };
 
-  buildInputs = with pythonPackages; [ python-wifi wrapPython ];
-
-  pythonPath = with pythonPackages; [ python-wifi ];
-
-  patchPhase = ''
-    sed -i -e 's|/usr/bin/env python|${python}/bin/python|' \
-           -e "s|/usr/share/dstat|$out/share/dstat|" dstat
-  '';
+  propagatedBuildInputs = with python2Packages; [ python-wifi ];
 
   makeFlags = [ "prefix=$(out)" ];
 
-  postInstall = ''
-    wrapPythonProgramsIn $out/bin "$out $pythonPath"
-  '';
-
   meta = with stdenv.lib; {
     homepage = http://dag.wieers.com/home-made/dstat/;
     description = "Versatile resource statistics tool";
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index 8d2f368bc99..d3db8ca7d43 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.eelco ];
     platforms = lib.platforms.linux;
+    broken = kernel.features.chromiumos or false;
   };
 }
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
index 8ab4da2da8c..772e69ac390 100644
--- a/pkgs/os-specific/linux/eudev/default.nix
+++ b/pkgs/os-specific/linux/eudev/default.nix
@@ -3,10 +3,10 @@ let
   s = # Generated upstream information
   rec {
     baseName="eudev";
-    version = "3.2";
+    version = "3.2.1";
     name="${baseName}-${version}";
     url="http://dev.gentoo.org/~blueness/eudev/eudev-${version}.tar.gz";
-    sha256 = "099w62ncq78nxpxizf910mx18hc8x4qvzw3azjd00fir89wmyjnq";
+    sha256 = "06gyyl90n85x8i7lfhns514y1kg1ians13l467admyzy3kjxkqsp";
   };
   buildInputs = [
     glib pkgconfig gperf utillinux
diff --git a/pkgs/os-specific/linux/facetimehd/default.nix b/pkgs/os-specific/linux/facetimehd/default.nix
index de726d5b42c..a9cea506c97 100644
--- a/pkgs/os-specific/linux/facetimehd/default.nix
+++ b/pkgs/os-specific/linux/facetimehd/default.nix
@@ -3,25 +3,40 @@
 # facetimehd is not supported for kernels older than 3.19";
 assert stdenv.lib.versionAtLeast kernel.version "3.19";
 
+let
+  # Note: When updating this revision:
+  # 1. Also update pkgs/os-specific/linux/firmware/facetimehd-firmware/
+  # 2. Test the module and firmware change via:
+  #    a. Give some applications a try (Skype, Hangouts, Cheese, etc.)
+  #    b. Run: journalctl -f
+  #    c. Then close the lid
+  #    d. Then open the lid (and maybe press a key to wake it up)
+  #    e. see if the module loads back (apps using the camera won't
+  #       recover and will have to be restarted) and the camera
+  #       still works.
+  srcParams = if (stdenv.lib.versionAtLeast kernel.version "4.8") then
+    { # Use mainline branch
+      version = "unstable-2016-10-09";
+      rev = "887d0f531ef7b91457be519474136c3355c5132b";
+      sha256 = "0bayahnxar1q6wvf9cb6p8gsfw98w0wqp715hs4r7apmddwk9v7n";
+    }
+  else
+    { # Use master branch (broken on 4.8)
+      version = "unstable-2016-05-02";
+      rev = "5a7083bd98b38ef3bd223f7ee531d58f4fb0fe7c";
+      sha256 = "0d455kajvn5xav9iilqy7s1qvsy4yb8vzjjxx7bvcgp7aj9ljvdp";
+    }
+  ;
+in
+
 stdenv.mkDerivation rec {
   name = "facetimehd-${version}-${kernel.version}";
-  version = "git-20160503";
+  version = srcParams.version;
 
   src = fetchFromGitHub {
     owner = "patjak";
     repo = "bcwc_pcie";
-    # Note: When updating this revision:
-    # 1. Also update pkgs/os-specific/linux/firmware/facetimehd-firmware/
-    # 2. Test the module and firmware change via:
-    #    a. Give some applications a try (Skype, Hangouts, Cheese, etc.)
-    #    b. Run: journalctl -f
-    #    c. Then close the lid
-    #    d. Then open the lid (and maybe press a key to wake it up)
-    #    e. see if the module loads back (apps using the camera won't
-    #       recover and will have to be restarted) and the camera
-    #       still works.
-    rev = "5a7083bd98b38ef3bd223f7ee531d58f4fb0fe7c";
-    sha256 = "0d455kajvn5xav9iilqy7s1qvsy4yb8vzjjxx7bvcgp7aj9ljvdp";
+    inherit (srcParams) rev sha256;
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/fanctl/default.nix b/pkgs/os-specific/linux/fanctl/default.nix
index f60951f5541..5cc875f5c90 100644
--- a/pkgs/os-specific/linux/fanctl/default.nix
+++ b/pkgs/os-specific/linux/fanctl/default.nix
@@ -4,11 +4,11 @@
 stdenv.mkDerivation rec {
   name = "fanctl-${version}";
 
-  version = "0.9.0";
+  version = "0.12.0";
 
   src = fetchurl {
     url = "https://launchpad.net/ubuntu/+archive/primary/+files/ubuntu-fan_${version}.tar.xz";
-    sha256 = "03dv5zzb8fkl9kkbhznxm48d6j3fjms74fn0s1zip2gz53l1s14n";
+    sha256 = "0lj7371n06sg5mlbbfgvm0qhzgp464n6v55rgs7kmmx4d37gb5fl";
   };
 
   # The Ubuntu package creates a number of state/config directories upon
diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
index ce2f860efc8..74486843b92 100644
--- a/pkgs/os-specific/linux/firejail/default.nix
+++ b/pkgs/os-specific/linux/firejail/default.nix
@@ -3,10 +3,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="firejail";
-    version="0.9.42-rc1";
+    version="0.9.44.4";
     name="${baseName}-${version}";
-    url="mirror://sourceforge/project/firejail/firejail/firejail-0.9.42~rc1.tar.bz2";
-    sha256="11br6xp86bxs1ic2x683hbvg1hk8v2wp8cw6blj0zz3cdl0pcjqf";
+    hash="03y1xc70w5xr6jynmj305fmgniz2cq21q85s5q7dnda8ap6s4w1d";
+    url="https://netcologne.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.44.4.tar.xz";
+    sha256="03y1xc70w5xr6jynmj305fmgniz2cq21q85s5q7dnda8ap6s4w1d";
   };
   buildInputs = [
     which
@@ -23,8 +24,6 @@ stdenv.mkDerivation {
   preConfigure = ''
     sed -e 's@/bin/bash@${stdenv.shell}@g' -i $( grep -lr /bin/bash .)
     sed -e "s@/bin/cp@$(which cp)@g" -i $( grep -lr /bin/cp .)
-    sed -e '/void fs_var_run(/achar *vrcs = get_link("/var/run/current-system")\;' -i ./src/firejail/fs_var.c
-    sed -e '/ \/run/iif(vrcs!=NULL){symlink(vrcs, "/var/run/current-system")\;free(vrcs)\;}' -i ./src/firejail/fs_var.c
   '';
 
   preBuild = ''
diff --git a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
index bfcef1d9c1a..c87023bf336 100644
--- a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     description = "Firmware for Intel 2200BG cards";
     homepage = http://ipw2200.sourceforge.net/firmware.php;
     license = stdenv.lib.licenses.unfreeRedistributableFirmware;
-    maintainers = with maintainers; [ lukasepple ];
+    maintainers = with maintainers; [ sternenseemann ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index 2ee232e877d..1c1b11f1ef4 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "raspberrypi-firmware-${version}";
-  version = "1.20160620";
+  version = "1.20161020";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "06g691px0abndp5zvz2ba1g675rcqb64n055h5ahgnlck5cdpawg";
+    sha256 = "073cry7xqrbkn8p1qzl4f3z6jvcbks4i61fz7i2pbwa60vddcp34";
   };
 
   dontStrip = true;    # Stripping breaks some of the binaries
diff --git a/pkgs/os-specific/linux/firmware/rtlwifi_new-firmware/default.nix b/pkgs/os-specific/linux/firmware/rtlwifi_new-firmware/default.nix
new file mode 100644
index 00000000000..673ef686e48
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/rtlwifi_new-firmware/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, lib, linuxPackages }:
+
+with lib;
+
+stdenv.mkDerivation rec {
+  name = "rtlwifi_new-firmware-${linuxPackages.rtlwifi_new.version}";
+  inherit (linuxPackages.rtlwifi_new) src;
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p "$out/lib/firmware"
+    cp -rf firmware/rtlwifi/ "$out/lib/firmware"
+  '';
+
+  meta = {
+    description = "Firmware for the newest Realtek rtlwifi codes";
+    inherit (src.meta) homepage;
+    license = licenses.unfreeRedistributableFirmware;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ tvorog ];
+  };
+}
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 9f63ae4f35a..a36934004d2 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -1,18 +1,18 @@
-{ stdenv, fetchurl, utillinux }:
+{ stdenv, fetchFromGitHub, utillinux
+, autoconf, automake, libtool, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "fuse-2.9.5";
-
-  #builder = ./builder.sh;
-
-  src = fetchurl {
-    url = "https://github.com/libfuse/libfuse/releases/download/fuse_2_9_5/${name}.tar.gz";
-    sha256 = "1dfvbi1p57svbv2sfnbqwpnsk219spvjnlapf35azhgzqlf3g7sp";
+  name = "fuse-${version}";
+  version = "2.9.7";
+
+  src = fetchFromGitHub {
+    owner = "libfuse";
+    repo = "libfuse";
+    rev = name;
+    sha256 = "1wyjjfb7p4jrkk15zryzv33096a5fmsdyr2p4b00dd819wnly2n2";
   };
 
-  buildInputs = [ utillinux ];
-
-  inherit utillinux;
+  buildInputs = [ utillinux autoconf automake libtool gettext ];
 
   preConfigure =
     ''
@@ -26,12 +26,15 @@ stdenv.mkDerivation rec {
       export NIX_CFLAGS_COMPILE="-DFUSERMOUNT_DIR=\"/var/permissions-wrappers\""
 
       sed -e 's@/bin/@${utillinux}/bin/@g' -i lib/mount_util.c
+      sed -e 's@CONFIG_RPATH=/usr/share/gettext/config.rpath@CONFIG_RPATH=${gettext}/share/gettext/config.rpath@' -i makeconf.sh
+
+      ./makeconf.sh
     '';
 
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage = http://fuse.sourceforge.net/;
+    homepage = https://github.com/libfuse/libfuse;
     description = "Kernel module and library that allows filesystems to be implemented in user space";
     platforms = platforms.linux;
     maintainers = [ maintainers.mornfall ];
diff --git a/pkgs/os-specific/linux/google-authenticator/default.nix b/pkgs/os-specific/linux/google-authenticator/default.nix
index 3402f7a7013..119621d9278 100644
--- a/pkgs/os-specific/linux/google-authenticator/default.nix
+++ b/pkgs/os-specific/linux/google-authenticator/default.nix
@@ -1,29 +1,31 @@
-{ stdenv, fetchurl, pam, qrencode }:
+{ stdenv, lib, fetchurl, autoreconfHook, pam, qrencode }:
 
 stdenv.mkDerivation rec {
-  name = "google-authenticator-1.0";
+  name = "google-authenticator-libpam-${version}";
+  version = "1.03";
 
   src = fetchurl {
-    url = "https://google-authenticator.googlecode.com/files/libpam-${name}-source.tar.bz2";
-    sha1 = "017b7d89989f1624e360abe02d6b27a6298d285d";
+    url = "https://github.com/google/google-authenticator-libpam/archive/${version}.tar.gz";
+    sha256 = "0wb95z5v1w4sk0p7y9pbn4v95w9hrbf80vw9k2z2sgs0156ljkb7";
   };
 
-  buildInputs = [ pam ];
+  buildInputs = [ autoreconfHook pam ];
 
   preConfigure = ''
-    sed -i 's|libqrencode.so.3|${qrencode}/lib/libqrencode.so.3|' google-authenticator.c
+    sed -i "s|libqrencode.so.3|${qrencode}/lib/libqrencode.so.3|" src/google-authenticator.c
   '';
 
   installPhase = ''
     mkdir -p $out/bin $out/lib/security
-    cp pam_google_authenticator.so $out/lib/security
+    cp ./.libs/pam_google_authenticator.so $out/lib/security
     cp google-authenticator $out/bin
   '';
 
-  meta = {
-    homepage = https://code.google.com/p/google-authenticator/;
+  meta = with lib; {
+    homepage = https://github.com/google/google-authenticator-libpam;
     description = "Two-step verification, with pam module";
-    license = stdenv.lib.licenses.asl20;
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ aneeshusa ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/guvcview/default.nix b/pkgs/os-specific/linux/guvcview/default.nix
index 40af8c8553a..5385651030b 100644
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
       portaudio
       udev
       gsl
-    ] ++ stdenv.lib.optional pulseaudioSupport [ libpulseaudio ];
+    ] ++ stdenv.lib.optional pulseaudioSupport libpulseaudio;
 
   meta = {
     description = "A simple interface for devices supported by the linux UVC driver";
diff --git a/pkgs/os-specific/linux/iotop/default.nix b/pkgs/os-specific/linux/iotop/default.nix
index a83d4a2ad9f..a19b3d4ec16 100644
--- a/pkgs/os-specific/linux/iotop/default.nix
+++ b/pkgs/os-specific/linux/iotop/default.nix
@@ -1,16 +1,13 @@
-{ stdenv, fetchurl, buildPythonApplication, pythonPackages }:
+{ stdenv, fetchurl, python2Packages }:
 
-buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   name = "iotop-0.6";
-  namePrefix = "";
 
   src = fetchurl {
     url = "http://guichaz.free.fr/iotop/files/${name}.tar.bz2";
     sha256 = "0nzprs6zqax0cwq8h7hnszdl3d2m4c2d4vjfxfxbnjfs9sia5pis";
   };
 
-  pythonPath = [ pythonPackages.curses ];
-
   doCheck = false;
 
   meta = {
diff --git a/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch b/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
index ca91b816000..e0c8278d488 100644
--- a/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
+++ b/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
@@ -57,7 +57,7 @@ Index: iproute2-4.1.1/ip/link_iptnl.c
 +
 +		if (addr)
 +			fprintf(f, "underlay %s ",
-+				format_host(AF_INET, 4, &addr, s1, sizeof(s1)));
++				format_host_r(AF_INET, 4, &addr, s1, sizeof(s1)));
 +	}
 +
  	if (tb[IFLA_IPTUN_LINK] && rta_getattr_u32(tb[IFLA_IPTUN_LINK])) {
diff --git a/pkgs/os-specific/linux/iproute/1001-ubuntu-poc-fan-driver-v3.patch b/pkgs/os-specific/linux/iproute/1001-ubuntu-poc-fan-driver-v3.patch
index a940b341ea0..634daa0de29 100644
--- a/pkgs/os-specific/linux/iproute/1001-ubuntu-poc-fan-driver-v3.patch
+++ b/pkgs/os-specific/linux/iproute/1001-ubuntu-poc-fan-driver-v3.patch
@@ -111,9 +111,9 @@ Index: iproute2-4.1.1/ip/link_iptnl.c
 +		p = RTA_PAYLOAD(i);
 +		m = RTA_DATA(i);
 +		fprintf(f, "%s/%d:%s/%d ",
-+			rt_addr_n2a(AF_INET, p, &m->overlay, b1, INET_ADDRSTRLEN),
++			rt_addr_n2a_r(AF_INET, p, &m->overlay, b1, INET_ADDRSTRLEN),
 +			m->overlay_prefix,
-+			rt_addr_n2a(AF_INET, p, &m->underlay, b2, INET_ADDRSTRLEN),
++			rt_addr_n2a_r(AF_INET, p, &m->underlay, b2, INET_ADDRSTRLEN),
 +			m->underlay_prefix);
 +	}
 +}
diff --git a/pkgs/os-specific/linux/iproute/1002-ubuntu-poc-fan-driver-vxlan.patch b/pkgs/os-specific/linux/iproute/1002-ubuntu-poc-fan-driver-vxlan.patch
index 2ddc2840bdd..070023d0b92 100644
--- a/pkgs/os-specific/linux/iproute/1002-ubuntu-poc-fan-driver-vxlan.patch
+++ b/pkgs/os-specific/linux/iproute/1002-ubuntu-poc-fan-driver-vxlan.patch
@@ -6,9 +6,9 @@ Index: iproute2-4.3.0/include/linux/if_link.h
 --- iproute2-4.3.0.orig/include/linux/if_link.h
 +++ iproute2-4.3.0/include/linux/if_link.h
 @@ -392,6 +392,7 @@ enum {
- 	IFLA_VXLAN_GBP,
- 	IFLA_VXLAN_REMCSUM_NOPARTIAL,
  	IFLA_VXLAN_COLLECT_METADATA,
+ 	IFLA_VXLAN_LABEL,
+ 	IFLA_VXLAN_GPE,
 +	IFLA_VXLAN_FAN_MAP = 33,
  	__IFLA_VXLAN_MAX
  };
@@ -88,9 +88,9 @@ Index: iproute2-4.3.0/ip/iplink_vxlan.c
  			  struct nlmsghdr *n)
  {
 @@ -201,6 +243,10 @@ static int vxlan_parse_opt(struct link_u
- 			udp6zerocsumrx = 0;
- 		} else if (!matches(*argv, "gbp")) {
  			gbp = 1;
+ 		} else if (!matches(*argv, "gpe")) {
+ 			gpe = 1;
 +		} else if (!matches(*argv, "fan-map")) {
 +			NEXT_ARG();
 +			if (fan_parse_map(&argc, &argv, n))
@@ -117,9 +117,9 @@ Index: iproute2-4.3.0/ip/iplink_vxlan.c
 +		p = RTA_PAYLOAD(i);
 +		m = RTA_DATA(i);
 +		fprintf(f, "%s/%d:%s/%d ",
-+			rt_addr_n2a(AF_INET, p, &m->overlay, b1, INET_ADDRSTRLEN),
++			rt_addr_n2a_r(AF_INET, p, &m->overlay, b1, INET_ADDRSTRLEN),
 +			m->overlay_prefix,
-+			rt_addr_n2a(AF_INET, p, &m->underlay, b2, INET_ADDRSTRLEN),
++			rt_addr_n2a_r(AF_INET, p, &m->underlay, b2, INET_ADDRSTRLEN),
 +			m->underlay_prefix);
 +	}
 +}
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 6813b5bcf1b..1ff68fc0408 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -3,11 +3,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "iproute2-4.5.0";
+  name = "iproute2-${version}";
+  version = "4.9.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "0jj9phsi8m2sbnz7bbh9cf9vckm67hs62ab5srdwnrg4acpjj59z";
+    sha256 = "1i0n071hiqxw1gisngw2jln3kcp9sh47n6fj5hdwqrvp7w20zwy0";
   };
 
   patches = lib.optionals enableFan [
@@ -28,6 +29,7 @@ stdenv.mkDerivation rec {
     "LIBDIR=$(out)/lib"
     "SBINDIR=$(out)/sbin"
     "MANDIR=$(out)/share/man"
+    "BASH_COMPDIR=$(out)/share/bash-completion/completions"
     "DOCDIR=$(TMPDIR)/share/doc/${name}" # Don't install docs
   ];
 
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index f6fcef11eb0..3e2eb93d213 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -34,7 +34,8 @@ stdenv.mkDerivation rec {
 
       mkdir -p $out/share/man/man8
       cp -p doc/clockdiff.8 doc/arping.8 doc/ping.8 doc/rdisc.8 \
-        doc/tracepath.8 doc/ninfod.8 $out/share/man/man8
+        doc/tracepath.8 doc/ninfod.8 doc/traceroute6.8 \
+        $out/share/man/man8
       ln -s $out/share/man/man8/{ping,ping6}.8
       ln -s $out/share/man/man8/{tracepath,tracepath6}.8
     '';
diff --git a/pkgs/os-specific/linux/jool/cli.nix b/pkgs/os-specific/linux/jool/cli.nix
index 8fb37ed1c5b..c8775eee48c 100644
--- a/pkgs/os-specific/linux/jool/cli.nix
+++ b/pkgs/os-specific/linux/jool/cli.nix
@@ -13,6 +13,10 @@ stdenv.mkDerivation {
 
   buildInputs = [ autoreconfHook pkgconfig libnl ];
 
+  postPatch = ''
+    chmod u+w -R ../common
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://www.jool.mx/;
     description = "Fairly compliant SIIT and Stateful NAT64 for Linux - CLI tools";
diff --git a/pkgs/os-specific/linux/jool/default.nix b/pkgs/os-specific/linux/jool/default.nix
index 274d0cc4139..79094ebb3e3 100644
--- a/pkgs/os-specific/linux/jool/default.nix
+++ b/pkgs/os-specific/linux/jool/default.nix
@@ -28,7 +28,5 @@ stdenv.mkDerivation {
     description = "Fairly compliant SIIT and Stateful NAT64 for Linux - kernel modules";
     platforms = platforms.linux;
     maintainers = with maintainers; [ fpletz ];
-    # kernel version 4.3 is the most recent supported version
-    broken = builtins.compareVersions kernel.version "4.3" == 1;
   };
 }
diff --git a/pkgs/os-specific/linux/jool/source.nix b/pkgs/os-specific/linux/jool/source.nix
index 60415c0d009..0f2038fb2e3 100644
--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@@ -1,9 +1,9 @@
 { fetchzip }:
 
 rec {
-  version = "3.4.4";
+  version = "3.5.0";
   src = fetchzip {
     url = "https://github.com/NICMx/releases/raw/master/Jool/Jool-${version}.zip";
-    sha256 = "1k5iyfzjdzl5q64234r806pf6b3qdflvjpw06pnwl0ycj05p5frr";
+    sha256 = "06jp6gpfryn66q0z4w3gwkvfr17bcrjvys597nj49pxfiz4vczb2";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 54e6b7822f9..bd99a7979ee 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -27,8 +27,11 @@ with stdenv.lib;
     MODULE_COMPRESS_XZ y
   ''}
 
+  KERNEL_XZ y
+
   # Debugging.
   DEBUG_KERNEL y
+  DYNAMIC_DEBUG y
   TIMER_STATS y
   BACKTRACE_SELF_TEST n
   CPU_NOTIFIER_ERROR_INJECT? n
@@ -180,7 +183,7 @@ with stdenv.lib;
   VGA_SWITCHEROO y # Hybrid graphics support
   DRM_GMA600 y
   DRM_GMA3600 y
-  ${optionalString (versionAtLeast version "4.5") ''
+  ${optionalString (versionAtLeast version "4.5" && (versionOlder version "4.9")) ''
     DRM_AMD_POWERPLAY y # necessary for amdgpu polaris support
   ''}
 
@@ -210,6 +213,7 @@ with stdenv.lib;
   # ACLs for all filesystems that support them.
   FANOTIFY y
   TMPFS y
+  FS_ENCRYPTION? m
   EXT2_FS_XATTR y
   EXT2_FS_POSIX_ACL y
   EXT2_FS_SECURITY y
@@ -219,6 +223,7 @@ with stdenv.lib;
   EXT3_FS_POSIX_ACL y
   EXT3_FS_SECURITY y
   EXT4_FS_POSIX_ACL y
+  EXT4_ENCRYPTION? ${if versionOlder version "4.8" then "m" else "y"}
   EXT4_FS_SECURITY y
   REISERFS_FS_XATTR? y
   REISERFS_FS_POSIX_ACL? y
@@ -231,6 +236,10 @@ with stdenv.lib;
   OCFS2_DEBUG_MASKLOG? n
   BTRFS_FS_POSIX_ACL y
   UBIFS_FS_ADVANCED_COMPR? y
+  F2FS_FS m
+  F2FS_FS_SECURITY? y
+  F2FS_FS_ENCRYPTION? y
+  UDF_FS m
   ${optionalString (versionAtLeast version "4.0" && versionOlder version "4.6") ''
     NFSD_PNFS y
   ''}
@@ -252,6 +261,12 @@ with stdenv.lib;
   CIFS_XATTR y
   CIFS_POSIX y
   CIFS_FSCACHE y
+  CIFS_STATS y
+  CIFS_WEAK_PW_HASH y
+  CIFS_UPCALL y
+  CIFS_ACL y
+  CIFS_DFS_UPCALL y
+  CIFS_SMB2 y
   ${optionalString (versionAtLeast version "3.12") ''
     CEPH_FSCACHE y
   ''}
@@ -270,6 +285,13 @@ with stdenv.lib;
     SQUASHFS_LZ4 y
   ''}
 
+  # Native Language Support modules, needed by some filesystems
+  NLS y
+  NLS_DEFAULT utf8
+  NLS_UTF8 m
+  NLS_CODEPAGE_437 m # VFAT default for the codepage= mount option
+  NLS_ISO8859_1 m    # VFAT default for the iocharset= mount option
+
   # Runtime security tests
   DEBUG_SET_MODULE_RONX? y # Detect writes to read-only module pages
 
@@ -277,6 +299,7 @@ with stdenv.lib;
   RANDOMIZE_BASE? y
   STRICT_DEVMEM y # Filter access to /dev/mem
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
+  SECURITY_YAMA? y # Prevent processes from ptracing non-children processes
   DEVKMEM n # Disable /dev/kmem
   ${if versionOlder version "3.14" then ''
     CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
@@ -327,6 +350,7 @@ with stdenv.lib;
   CGROUPS y # used by systemd
   FHANDLE y # used by systemd
   SECCOMP y # used by systemd >= 231
+  SECCOMP_FILTER y # ditto
   POSIX_MQUEUE y
   FRONTSWAP y
   FUSION y # Fusion MPT device support
@@ -349,7 +373,9 @@ with stdenv.lib;
   ${optionalString (versionAtLeast version "3.15" && versionOlder version "4.8") ''
     MLX4_EN_VXLAN y
   ''}
-  MODVERSIONS y
+  ${optionalString (versionOlder version "4.9") ''
+    MODVERSIONS y
+  ''}
   MOUSE_PS2_ELANTECH y # Elantech PS/2 protocol extension
   MTRR_SANITIZER y
   NET_FC y # Fibre Channel driver support
@@ -388,7 +414,7 @@ with stdenv.lib;
 
   # Linux containers.
   NAMESPACES? y #  Required by 'unshare' used by 'nixos-install'
-  RT_GROUP_SCHED? y
+  RT_GROUP_SCHED n
   CGROUP_DEVICE? y
   MEMCG y
   MEMCG_SWAP y
@@ -505,9 +531,15 @@ with stdenv.lib;
   TRANSPARENT_HUGEPAGE_MADVISE? y
 
   # zram support (e.g for in-memory compressed swap).
-  ZSMALLOC y
   ZRAM m
   ZSWAP? y
+  ZBUD? y
+  ${optionalString (versionOlder version "3.18") ''
+    ZSMALLOC y
+  ''}
+  ${optionalString (versionAtLeast version "3.18") ''
+    ZSMALLOC m
+  ''}
 
   # Enable PCIe and USB for the brcmfmac driver
   BRCMFMAC_USB? y
diff --git a/pkgs/os-specific/linux/kernel/gcc5-link-apm.patch b/pkgs/os-specific/linux/kernel/gcc5-link-apm.patch
deleted file mode 100644
index e415c2d9f2b..00000000000
--- a/pkgs/os-specific/linux/kernel/gcc5-link-apm.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 54c2f3fdb941204cad136024c7b854b7ad112ab6 Mon Sep 17 00:00:00 2001
-From: Andi Kleen <ak@linux.intel.com>
-Date: Mon, 5 Aug 2013 15:02:45 -0700
-Subject: x86, asmlinkage, apm: Make APM data structure used from assembler
- visible
-
-Signed-off-by: Andi Kleen <ak@linux.intel.com>
-Link: http://lkml.kernel.org/r/1375740170-7446-12-git-send-email-andi@firstfloor.org
-Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
----
- arch/x86/kernel/apm_32.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
-index 53a4e27..3ab0343 100644
---- a/arch/x86/kernel/apm_32.c
-+++ b/arch/x86/kernel/apm_32.c
-@@ -392,7 +392,7 @@ static struct cpuidle_device apm_cpuidle_device;
- /*
-  * Local variables
-  */
--static struct {
-+__visible struct {
- 	unsigned long	offset;
- 	unsigned short	segment;
- } apm_bios_entry;
--- 
-cgit v0.12
-
diff --git a/pkgs/os-specific/linux/kernel/gcc5-link-lguest.patch b/pkgs/os-specific/linux/kernel/gcc5-link-lguest.patch
deleted file mode 100644
index b2474f572ae..00000000000
--- a/pkgs/os-specific/linux/kernel/gcc5-link-lguest.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From cdd77e87eae52b7251acc5990207a1c4500a84ce Mon Sep 17 00:00:00 2001
-From: Andi Kleen <ak@linux.intel.com>
-Date: Tue, 5 Nov 2013 21:22:28 +1030
-Subject: x86, asmlinkage, lguest: Pass in globals into assembler statement
-
-Tell the compiler that the inline assembler statement
-references lguest_entry.
-
-This fixes compile problems with LTO where the variable
-and the assembler code may end up in different files.
-
-Cc: x86@kernel.org
-Cc: rusty@rustcorp.com.au
-Signed-off-by: Andi Kleen <ak@linux.intel.com>
-Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
----
- drivers/lguest/x86/core.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
-index 5169239..922a1ac 100644
---- a/drivers/lguest/x86/core.c
-+++ b/drivers/lguest/x86/core.c
-@@ -157,7 +157,7 @@ static void run_guest_once(struct lg_cpu *cpu, struct lguest_pages *pages)
- 	 * stack, then the address of this call.  This stack layout happens to
- 	 * exactly match the stack layout created by an interrupt...
- 	 */
--	asm volatile("pushf; lcall *lguest_entry"
-+	asm volatile("pushf; lcall *%4"
- 		     /*
- 		      * This is how we tell GCC that %eax ("a") and %ebx ("b")
- 		      * are changed by this routine.  The "=" means output.
-@@ -169,7 +169,9 @@ static void run_guest_once(struct lg_cpu *cpu, struct lguest_pages *pages)
- 		      * physical address of the Guest's top-level page
- 		      * directory.
- 		      */
--		     : "0"(pages), "1"(__pa(cpu->lg->pgdirs[cpu->cpu_pgd].pgdir))
-+		     : "0"(pages), 
-+		       "1"(__pa(cpu->lg->pgdirs[cpu->cpu_pgd].pgdir)),
-+		       "m"(lguest_entry)
- 		     /*
- 		      * We tell gcc that all these registers could change,
- 		      * which means we don't have to save and restore them in
--- 
-cgit v0.12
-
diff --git a/pkgs/os-specific/linux/kernel/generate-config.pl b/pkgs/os-specific/linux/kernel/generate-config.pl
index e5fa780c6e7..5574cc937af 100644
--- a/pkgs/os-specific/linux/kernel/generate-config.pl
+++ b/pkgs/os-specific/linux/kernel/generate-config.pl
@@ -91,17 +91,17 @@ sub runConfig {
                 print STDERR "CHOICE: $1, ANSWER: $answer\n" if $debug;
                 print OUT "$answer\n" if $1 =~ /-/;
             }
-        
+
             # Some questions lack the option name ("bla bla [Y/n/m/...] ").
             elsif ($line =~ /(.*) \[(.*)\] ###$/) {
                 print OUT "\n";
             }
-            
+
             else {
                 warn "don't know how to answer this question: $line\n";
                 print OUT "\n";
             }
-        
+
             $line = "";
             %choices = ();
         }
@@ -124,7 +124,10 @@ my %config;
 open CONFIG, "<.config" or die;
 while (<CONFIG>) {
     chomp;
-    if (/^CONFIG_([A-Za-z0-9_]+)=(.*)$/) {
+    if (/^CONFIG_([A-Za-z0-9_]+)="(.*)"$/) {
+        # String options have double quotes, e.g. 'CONFIG_NLS_DEFAULT="utf8"' and allow escaping.
+        ($config{$1} = $2) =~ s/\\([\\"])/$1/g;
+    } elsif (/^CONFIG_([A-Za-z0-9_]+)=(.*)$/) {
         $config{$1} = $2;
     } elsif (/^# CONFIG_([A-Za-z0-9_]+) is not set$/) {
         $config{$1} = "n";
@@ -136,6 +139,6 @@ foreach my $name (sort (keys %answers)) {
     my $f = $requiredAnswers{$name} && $ENV{'ignoreConfigErrors'} ne "1"
         ? sub { die "error: " . $_[0]; } : sub { warn "warning: " . $_[0]; };
     &$f("unused option: $name\n") unless defined $config{$name};
-    &$f("option not set correctly: $name\n")
+    &$f("option not set correctly: $name (wanted '$answers{$name}', got '$config{$name}')\n")
         if $config{$name} && $config{$name} ne $answers{$name};
 }
diff --git a/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix b/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix
index 4c81cd5b6ad..ed8942b1066 100644
--- a/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix
+++ b/pkgs/os-specific/linux/kernel/grsecurity-nixos-config.nix
@@ -3,43 +3,61 @@
 with stdenv.lib;
 
 ''
-GRKERNSEC y
-PAX y
-
+# Auto configuration with these constraints will enable most of the
+# important features (RAP, UDEREF, ASLR, memory sanitization).
 GRKERNSEC_CONFIG_AUTO y
 GRKERNSEC_CONFIG_DESKTOP y
-GRKERNSEC_CONFIG_VIRT_HOST y
+GRKERNSEC_CONFIG_PRIORITY_SECURITY y
+
+# We specify virt guest rather than host here, the latter deselects e.g.,
+# paravirtualization.
+GRKERNSEC_CONFIG_VIRT_GUEST y
+# Note: assumes platform supports CPU-level virtualization (so no pentium 4)
 GRKERNSEC_CONFIG_VIRT_EPT y
 GRKERNSEC_CONFIG_VIRT_KVM y
-GRKERNSEC_CONFIG_PRIORITY_SECURITY y
 
+# PaX control
 PAX_SOFTMODE y
-
 PAX_PT_PAX_FLAGS y
 PAX_XATTR_PAX_FLAGS y
 PAX_EI_PAX n
 
-GRKERNSEC_PROC_GID 0
+PAX_INITIFY y
+
+# The bts instrumentation method is compatible with binary only modules.
+#
+# Note: if platform supports SMEP, we could do without this
+PAX_KERNEXEC_PLUGIN_METHOD_BTS y
+
+# Additional grsec hardening not implied by auto constraints
+GRKERNSEC_IO y
+GRKERNSEC_SYSFS_RESTRICT y
+GRKERNSEC_ROFS y
 
-PAX_LATENT_ENTROPY n
+GRKERNSEC_MODHARDEN y
 
+# Disable protections rendered useless by redistribution
 GRKERNSEC_HIDESYM n
 GRKERNSEC_RANDSTRUCT n
-GRKERNSEC_PROC n
-GRKERNSEC_SYSFS_RESTRICT n
-GRKERNSEC_KMEM n
-GRKERNSEC_MODHARDEN n
-GRKERNSEC_NO_SIMULT_CONNECT n
 
-PAX_KERNEXEC_PLUGIN_METHOD_BTS y
+# Disable protections covered by vanilla mechanisms
+GRKERNSEC_DMESG n
+GRKERNSEC_KMEM n
+GRKERNSEC_PROC n
 
-GRKERNSEC_ACL_HIDEKERN y
-GRKERNSEC_IO y
+# Disable protections that are inappropriate for a general-purpose kernel
+GRKERNSEC_NO_SIMULT_CONNECT n
 
+# Enable additional audititing
+GRKERNSEC_AUDIT_MOUNT y
 GRKERNSEC_AUDIT_PTRACE y
 GRKERNSEC_FORKFAIL y
 
+# Wishlist: support trusted path execution
+GRKERNSEC_TPE n
+
 GRKERNSEC_SYSCTL y
 GRKERNSEC_SYSCTL_DISTRO y
-GRKERNSEC_SYSCTL_ON y
+# Assume that appropriate sysctls are toggled once the system is up
+GRKERNSEC_SYSCTL_ON n
 ''
diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
index 27b97054d1a..3e6bd51cc47 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.10.102";
+  version = "3.10.104";
   extraMeta.branch = "3.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0hvymhmbvpmpz1jk0xwhxyskijdh6bzakqj7k0gaa2y0wdj33pxi";
+    sha256 = "04kc64zdpg8h8655m825lbny3fwvqhmh3mg9h564i2irnll35lp3";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
index 3d98da9526b..95ca51a972e 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.12.62";
+  version = "3.12.69";
   extraMeta.branch = "3.12";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0a9vghq3z5xhr9xssfivb78d3i74h4kn15wqgls1cw5qzyhc1wb0";
+    sha256 = "1pzghmj0j2shms4n3knryigy73qssskd6awbgk6mmyg42wypbcmm";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.14.nix b/pkgs/os-specific/linux/kernel/linux-3.14.nix
deleted file mode 100644
index fdc5cc802a1..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-3.14.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ stdenv, fetchurl, perl, buildLinux, ... } @ args:
-
-import ./generic.nix (args // rec {
-  version = "3.14.77";
-  extraMeta.branch = "3.14";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1v3cc3ddla2b8gkwbms4x3lbjygw87r13150nikf1gc0hf64rqp0";
-  };
-
-  kernelPatches = args.kernelPatches;
-
-  features.iwlwifi = true;
-  features.efiBootStub = true;
-  features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
-  features.netfilterRPFilter = true;
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-3.18.nix b/pkgs/os-specific/linux/kernel/linux-3.18.nix
index 98151295d1b..727126de388 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.18.40";
+  version = "3.18.45";
   extraMeta.branch = "3.18";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0x94lp4vkw1472m8sq308r8aw96nirkwppkjvqi2240ayw89d5jb";
+    sha256 = "1qwvqrlzpf57zvh57dsdk4c4swgbasf2ab75vcn2py8l7jl6rxf0";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.1.nix b/pkgs/os-specific/linux/kernel/linux-4.1.nix
index 1f89edecfe6..b7f98829931 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.1.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.1.31";
+  version = "4.1.36";
   extraMeta.branch = "4.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0madbh1sdkf8gk6ns0zacygvfrpzrl1vd1a4qw8py7slg1bpk79n";
+    sha256 = "140my5r39w795gsaglqxaw97hwpy8qf95c6hy2cr7a122bgnslp1";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index b1892e51600..f3eceb5fe26 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.19";
+  version = "4.4.41";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1566d8x0ljdsgcgazj7paia3m3qfjw0hw3qh9dg6yd321dphrbam";
+    sha256 = "1z26frg7sx5n9bvkpg9pfspwhxxvlnnfnrnjr7aqhcgsbxzq8vca";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.6.nix b/pkgs/os-specific/linux/kernel/linux-4.8.nix
index 6bca1bfe718..a5ce23ee3e4 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.8.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.6.7";
-  extraMeta.branch = "4.6";
+  version = "4.8.17";
+  extraMeta.branch = "4.8";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "107acpq6jk48ng25jlyv905zslrrv77yxwr46mqbq5lxg8rdg7fh";
+    sha256 = "1zk0q6bvqgz2pk1axd5z0cx71vqk96314f1zn8apwa4raylf9fpa";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.7.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index bd54c5352a5..29f0eba7175 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.7.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.7.2";
-  extraMeta.branch = "4.7";
+  version = "4.9.2";
+  extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1234z4wzvrbyzql6cc8i4bq7bbbjgaxhys4fcnqzm14lavk3wjaq";
+    sha256 = "0f2p12pkzgrh9k5c7g2wwjnv6gzqha8bgd7b0qgbzq3ss7nrmnld";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
index bd54c5352a5..8a71a771c4f 100644
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
+++ b/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.7.2";
-  extraMeta.branch = "4.7";
+  version = "4.8.16";
+  extraMeta.branch = "4.8";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1234z4wzvrbyzql6cc8i4bq7bbbjgaxhys4fcnqzm14lavk3wjaq";
+    sha256 = "1aml6vhsfpvm8rsadraff7qj0ivgd9aw75k2q65drz4iby1pqb9h";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-mptcp.nix b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
index b39514d45dd..a037343751c 100644
--- a/pkgs/os-specific/linux/kernel/linux-mptcp.nix
+++ b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
@@ -1,18 +1,18 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  mptcpVersion = "0.91";
-  modDirVersion = "4.1.26";
+  mptcpVersion = "0.91.2";
+  modDirVersion = "4.1.35";
   version = "${modDirVersion}-mptcp_v${mptcpVersion}";
 
   extraMeta = {
     branch = "4.1";
-    maintainers = stdenv.lib.maintainers.layus;
+    maintainers = [ stdenv.lib.maintainers.layus ];
   };
 
   src = fetchurl {
     url = "https://github.com/multipath-tcp/mptcp/archive/v${mptcpVersion}.tar.gz";
-    sha256 = "0rbvgz89j5wk781y201qdxy2kz4gmlamb72wdbxj8mxv92x56lh3";
+    sha256 = "1jfxycg8i99ry2cr2ksarvqjzlr46sp192wkpb4sb2mynbzf3dmk";
   };
 
   kernelPatches = args.kernelPatches;
@@ -29,12 +29,12 @@ import ./generic.nix (args // rec {
     # ... but use none by default.
     # The default is safer if source policy routing is not setup.
     DEFAULT_DUMMY y
-    DEFAULT_MPTCP_PM "default"
+    DEFAULT_MPTCP_PM default
 
     # MPTCP scheduler selection.
     # Disabled as the only non-default is the useless round-robin.
     MPTCP_SCHED_ADVANCED n
-    DEFAULT_MPTCP_SCHED "default"
+    DEFAULT_MPTCP_SCHED default
 
     # Smarter TCP congestion controllers
     TCP_CONG_LIA m
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index a069e7606cc..f41c53da5a6 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
-  modDirVersion = "4.4.13";
-  tag = "1.20160620-1";
+  modDirVersion = "4.4.26";
+  tag = "1.20161020-1";
 in
 stdenv.lib.overrideDerivation (import ./generic.nix (args // rec {
   version = "${modDirVersion}-${tag}";
@@ -12,10 +12,13 @@ stdenv.lib.overrideDerivation (import ./generic.nix (args // rec {
     owner = "raspberrypi";
     repo = "linux";
     rev = "raspberrypi-kernel_${tag}";
-    sha256 = "0bydlzmd9mar07j6dihhzn1xm6vpn92y33vf1qsdkl3hjil6brfc";
+    sha256 = "0y76xrapq7710zzf6sif94xzly72gg505y65lslfirng500ncnv5";
   };
 
   features.iwlwifi = true;
+  features.needsCifsUtils = true;
+  features.canDisableNetfilterConntrackHelpers = true;
+  features.netfilterRPFilter = true;
 
   extraMeta.hydraPlatforms = [];
 })) (oldAttrs: {
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 7b4284028ed..b547240eaf2 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.8-rc4";
-  modDirVersion = "4.8.0-rc4";
-  extraMeta.branch = "4.8";
+  version = "4.10-rc2";
+  modDirVersion = "4.10.0-rc2";
+  extraMeta.branch = "4.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/testing/linux-${version}.tar.xz";
-    sha256 = "0is4pzmci1i59fxw9b645c8710zjnx19dfl20m4k06kxdbbs01wg";
+    sha256 = "1r3w6mqvmjnsmqrk73xsrqybdvs1czjw5xl1x2wsi2w9nifb47zq";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 4ab688c26af..5f890b9b9fe 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -129,9 +129,7 @@ let
       '' + (optionalString installsFirmware ''
         mkdir -p $out/lib/firmware
       '') + (if (platform ? kernelDTB && platform.kernelDTB) then ''
-        make $makeFlags "''${makeFlagsArray[@]}" dtbs
-        mkdir -p $out/dtbs
-        cp $buildRoot/arch/$karch/boot/dts/*.dtb $out/dtbs
+        make $makeFlags "''${makeFlagsArray[@]}" dtbs dtbs_install INSTALL_DTBS_PATH=$out/dtbs
       '' else "") + (if isModular then ''
         if [ -z "$dontStrip" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
diff --git a/pkgs/os-specific/linux/kernel/multithreaded-rsapubkey-asn1.patch b/pkgs/os-specific/linux/kernel/multithreaded-rsapubkey-asn1.patch
new file mode 100644
index 00000000000..9f5790862b6
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/multithreaded-rsapubkey-asn1.patch
@@ -0,0 +1,45 @@
+
+From	Yang Shi <>
+Subject	[PATCH] crypto: rsa - fix a potential race condition in build
+Date	Fri, 2 Dec 2016 15:41:04 -0800
+
+
+When building kernel with RSA enabled with multithreaded, the below
+compile failure might be caught:
+
+| /buildarea/kernel-source/crypto/rsa_helper.c:18:28: fatal error: rsapubkey-asn1.h: No such file or directory
+| #include "rsapubkey-asn1.h"
+| ^
+| compilation terminated.
+| CC crypto/rsa-pkcs1pad.o
+| CC crypto/algboss.o
+| CC crypto/testmgr.o
+| make[3]: *** [/buildarea/kernel-source/scripts/Makefile.build:289: crypto/rsa_helper.o] Error 1
+| make[3]: *** Waiting for unfinished jobs....
+| make[2]: *** [/buildarea/kernel-source/Makefile:969: crypto] Error 2
+| make[1]: *** [Makefile:150: sub-make] Error 2
+| make: *** [Makefile:24: __sub-make] Error 2
+
+The header file is not generated before rsa_helper is compiled, so
+adding dependency to avoid such issue.
+
+Signed-off-by: Yang Shi <yang.shi@windriver.com>
+
+---
+ crypto/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/crypto/Makefile b/crypto/Makefile
+index 99cc64a..8db39f9 100644
+--- a/crypto/Makefile
++++ b/crypto/Makefile
+@@ -40,6 +40,7 @@ obj-$(CONFIG_CRYPTO_ECDH) += ecdh_generic.o
+
+ $(obj)/rsapubkey-asn1.o: $(obj)/rsapubkey-asn1.c $(obj)/rsapubkey-asn1.h
+ $(obj)/rsaprivkey-asn1.o: $(obj)/rsaprivkey-asn1.c $(obj)/rsaprivkey-asn1.h
++$(obj)/rsa_helper.o: $(obj)/rsa_helper.c $(obj)/rsaprivkey-asn1.h
+ clean-files += rsapubkey-asn1.c rsapubkey-asn1.h
+ clean-files += rsaprivkey-asn1.c rsaprivkey-asn1.h
+
+--
+2.0.2
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 3b5e97f9edf..42a6e0d037b 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -25,10 +25,13 @@ let
     inherit grver kver grrev;
 
     patch = fetchurl {
-      # When updating versions/hashes, ALWAYS use the official version; we use
-      # this mirror only because upstream removes sources files immediately upon
-      # releasing a new version ...
-      url = "https://raw.githubusercontent.com/slashbeast/grsecurity-scrape/master/${grbranch}/${name}.patch";
+      urls = [
+        "https://grsecurity.net/${grbranch}/${name}.patch"
+        # When updating versions/hashes, ALWAYS use the official
+        # version; we use this mirror only because upstream removes
+        # source files immediately upon releasing a new version ...
+        "https://raw.githubusercontent.com/slashbeast/grsecurity-scrape/master/${grbranch}/${name}.patch"
+      ];
       inherit sha256;
     };
 
@@ -38,14 +41,10 @@ in
 
 rec {
 
-  link_lguest =
-    { name = "gcc5-link-lguest";
-      patch = ./gcc5-link-lguest.patch;
-    };
-
-  link_apm =
-    { name = "gcc5-link-apm";
-      patch = ./gcc5-link-apm.patch;
+  multithreaded_rsapubkey =
+    {
+      name = "multithreaded-rsapubkey-asn1.patch";
+      patch = ./multithreaded-rsapubkey-asn1.patch;
     };
 
   bridge_stp_helper =
@@ -95,14 +94,10 @@ rec {
     sha256 = "00b1rqgd4yr206dxp4mcymr56ymbjcjfa4m82pxw73khj032qw3j";
   };
 
-  grsecurity_3_14 = throw "grsecurity stable is no longer supported";
-
-  grsecurity_4_4 = throw "grsecurity stable is no longer supported";
-
   grsecurity_testing = grsecPatch
-    { kver   = "4.7.2";
-      grrev  = "201608312326";
-      sha256 = "0nbp3lnl6gi6kklpc8wnjpz5cj9zafaw2445lan15qnyzf5zb966";
+    { kver   = "4.8.16";
+      grrev  = "201701062021";
+      sha256 = "0ivl9dpbyf0f7ywgh8kbzdf0za10yrh6s8plqk9vnns3dhgcnvnq";
     };
 
   # This patch relaxes grsec constraints on the location of usermode helpers,
@@ -153,4 +148,40 @@ rec {
     };
 
   cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches;
+
+  lguest_entry-linkage =
+    { name = "lguest-asmlinkage.patch";
+      patch = fetchpatch {
+        url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git"
+            + "/patch/drivers/lguest/x86/core.c?id=cdd77e87eae52";
+        sha256 = "04xlx6al10cw039av6jkby7gx64zayj8m1k9iza40sw0fydcfqhc";
+      };
+    };
+
+  packet_fix_race_condition_CVE_2016_8655 =
+    { name = "packet_fix_race_condition_CVE_2016_8655.patch";
+      patch = fetchpatch {
+        url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/patch/?id=84ac7260236a49c79eede91617700174c2c19b0c";
+        sha256 = "19viqjjgq8j8jiz5yhgmzwhqvhwv175q645qdazd1k69d25nv2ki";
+      };
+    };
+
+  panic_on_icmp6_frag_CVE_2016_9919 = rec
+    { name = "panic_on_icmp6_frag_CVE_2016_9919.patch";
+      patch = fetchpatch {
+        inherit name;
+        url = "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/patch/?id=79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2";
+        sha256 = "0mps33r4mnwiy0bmgrzgqkrk59yya17v6kzpv9024g4xlz61rk8p";
+      };
+    };
+
+  p9_caching_4_4 = rec
+    { name = "9p-caching.patch";
+      patch = fetchpatch {
+        inherit name;
+        url = https://github.com/edolstra/linux/commit/d522582553368b9564e2d88a8d7b1d469bf98c65.patch;
+        sha256 = "01h7461pdgavd6ghd6w9wg136hkaca0mrmmzhy6s3phksksimbc2";
+      };
+    };
+
 }
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 4b1120afa4e..9e572498457 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -1,11 +1,11 @@
 { lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto
 , docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
-, libiberty
-, zlib, withGtk ? false, gtk ? null }:
+, libiberty, libaudit
+, zlib, withGtk ? false, gtk2 ? null }:
 
 with lib;
 
-assert withGtk -> gtk != null;
+assert withGtk -> gtk2 != null;
 assert versionAtLeast kernel.version "3.12";
 
 stdenv.mkDerivation {
@@ -24,9 +24,9 @@ stdenv.mkDerivation {
   # perf refers both to newt and slang
   # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-      flex bison libiberty ];
+      flex bison libiberty libaudit ];
   buildInputs = [ elfutils python perl newt slang pkgconfig libunwind binutils zlib ] ++
-    stdenv.lib.optional withGtk gtk;
+    stdenv.lib.optional withGtk gtk2;
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index cb30de44a81..206dc6889e8 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -2,17 +2,17 @@
 
 stdenv.mkDerivation rec {
   name = "kexec-tools-${version}";
-  version = "2.0.12";
+  version = "2.0.14";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${name}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz"
     ];
-    sha256 = "03cj7w2l5fqn72xfhl4q6z0zbziwkp9bfn0gs7gaf9i44jv6gkhl";
+    sha256 = "1ihd3kzw8xnc5skq4pb633rr80007knjm4n1dd67a24xkplygcpz";
   };
 
-  hardeningDisable = [ "format" ];
+  hardeningDisable = [ "format" "pic" "relro" ];
 
   buildInputs = [ zlib ];
 
diff --git a/pkgs/os-specific/linux/kmod/aggregator.nix b/pkgs/os-specific/linux/kmod/aggregator.nix
index 88069ba4bf1..9bd7c8480c1 100644
--- a/pkgs/os-specific/linux/kmod/aggregator.nix
+++ b/pkgs/os-specific/linux/kmod/aggregator.nix
@@ -17,10 +17,12 @@ buildEnv {
 
       echo "kernel version is $kernelVersion"
 
+      shopt -s extglob
+
       # Regenerate the depmod map files.  Be sure to pass an explicit
       # kernel version number, otherwise depmod will use `uname -r'.
       if test -w $out/lib/modules/$kernelVersion; then
-          rm -f $out/lib/modules/$kernelVersion/modules.*
+          rm -f $out/lib/modules/$kernelVersion/modules.!(builtin*|order*)
           ${kmod}/bin/depmod -b $out -a $kernelVersion
       fi
     '';
diff --git a/pkgs/os-specific/linux/latencytop/default.nix b/pkgs/os-specific/linux/latencytop/default.nix
index 163ac189050..8c2badc3d68 100644
--- a/pkgs/os-specific/linux/latencytop/default.nix
+++ b/pkgs/os-specific/linux/latencytop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, ncurses, glib, pkgconfig, gtk }:
+{ stdenv, fetchurl, ncurses, glib, pkgconfig, gtk2 }:
 
 stdenv.mkDerivation rec {
   name = "latencytop-0.5";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "1vq3j9zdab6njly2wp900b3d5244mnxfm88j2bkiinbvxbxp4zwy";
   };
 
-  buildInputs = [ ncurses glib pkgconfig gtk ];
+  buildInputs = [ ncurses glib pkgconfig gtk2 ];
 
   meta = {
     homepage = http://latencytop.org;
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 1327a349474..c7da0fcca2a 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -19,7 +19,13 @@ stdenv.mkDerivation rec {
   buildInputs = [ pkgconfig libsepol pcre ]
              ++ optionals enablePython [ swig python ];
 
-  NIX_CFLAGS_COMPILE = "-fstack-protector-all -std=gnu89";
+  # Avoid this false warning:
+  # avc_internal.c: In function 'avc_netlink_receive':
+  # avc_internal.c:105:25: error: cast increases required alignment of target type [-Werror=cast-align]
+  #  struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
+  #                         ^
+
+  NIX_CFLAGS_COMPILE = "-std=gnu89 -Wno-error=cast-align";
 
   # Unreleased upstream patch that fixes Python package issue arising
   # from recent SWIG changes.
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index ecbb2a0ec46..0417bf59cfa 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -13,8 +13,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ flex ];
 
-  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
-
   preBuild = ''
     makeFlagsArray+=("PREFIX=$out")
     makeFlagsArray+=("DESTDIR=$out")
diff --git a/pkgs/os-specific/linux/libudev0-shim/default.nix b/pkgs/os-specific/linux/libudev0-shim/default.nix
new file mode 100644
index 00000000000..203d1defa28
--- /dev/null
+++ b/pkgs/os-specific/linux/libudev0-shim/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, udev }:
+
+stdenv.mkDerivation rec {
+  name = "libudev0-shim-${version}";
+  version = "1";
+
+  src = fetchFromGitHub {
+    owner = "archlinux";
+    repo = "libudev0-shim";
+    rev = "v${version}";
+    sha256 = "1460qm6rp1cqnns39lj24z7191m8sbpvbjabqbzb55dkdd2kw50z";
+  };
+
+  buildInputs = [ udev ];
+
+  installPhase = ''
+    name="$(echo libudev.so.*)"
+    install -Dm755 "$name" "$out/lib/$name"
+    ln -s "$name" "$out/lib/libudev.so.0"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Shim to preserve libudev.so.0 compatibility";
+    homepage = "https://github.com/archlinux/libudev0-shim";
+    platforms = platforms.linux;
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/os-specific/linux/light/default.nix b/pkgs/os-specific/linux/light/default.nix
index 5ca9f69f879..1c44c0d78a8 100644
--- a/pkgs/os-specific/linux/light/default.nix
+++ b/pkgs/os-specific/linux/light/default.nix
@@ -1,15 +1,18 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, help2man }:
 
 stdenv.mkDerivation rec {
-  version = "0.9";
+  version = "1.0";
   name = "light-${version}";
   src = fetchurl {
     url = "https://github.com/haikarainen/light/archive/v${version}.tar.gz";
-    sha256 = "1dnzkkg307izvw76gvzsl2vpxd2a1grxg5h82ix505rb9nnmn0d6";
+    sha256 = "974608ee42ffe85cfd23184306d56d86ec4e6f4b0518bafcb7b3330998b1af64";
   };
+  buildInputs = [ help2man ];
 
   installPhase = "mkdir -p $out/bin; cp light $out/bin/";
 
+  preFixup = "make man; mkdir -p $out/man/man1; mv light.1.gz $out/man/man1";
+
   meta = {
     description = "GNU/Linux application to control backlights";
     homepage = https://haikarainen.github.io/light/;
diff --git a/pkgs/os-specific/linux/lksctp-tools/default.nix b/pkgs/os-specific/linux/lksctp-tools/default.nix
new file mode 100644
index 00000000000..f5f08a3e7c6
--- /dev/null
+++ b/pkgs/os-specific/linux/lksctp-tools/default.nix
@@ -0,0 +1,16 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "lksctp-tools-1.0.17";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/lksctp/${name}.tar.gz";
+    sha256 = "05da6c2v3acc18ndvmkrag6x5lf914b7s0xkkr6wkvrbvd621sqs";
+  };
+
+  meta = {
+    description = "Linux Kernel Stream Control Transmission Protocol Tools.";
+    homepage = http://lksctp.sourceforge.net/;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 10551c08077..7e29aa0f67d 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   pname = "lttng-modules-${version}";
   name = "${pname}-${kernel.version}";
-  version = "2.8.0";
+  version = "2.8.3";
 
   src = fetchurl {
     url = "http://lttng.org/files/lttng-modules/lttng-modules-${version}.tar.bz2";
-    sha256 = "0a9xwq0kgpx1y800l232h524f19g3py6cnxff10j9p01q6lzhrxh";
+    sha256 = "018lqxbksj9hpjfp2a3yc6lkjkj4rgf2x147l1jjh7mfgqvcb53b";
   };
 
   hardeningDisable = [ "pic" ];
@@ -31,7 +31,8 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.bjornfor ];
     broken =
       (builtins.compareVersions kernel.version "3.18" == -1) ||
-      (kernel.features.grsecurity or false);
+      (kernel.features.grsecurity or false) ||
+      (kernel.features.chromiumos or false);
   };
 
 }
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index aad73844a66..3c413ca2426 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -12,11 +12,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "lxc-${version}";
-  version = "2.0.4";
+  version = "2.0.6";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz";
-    sha256 = "10lm7vfw4j7arcynmgyjqd8v2fqn7spbablj42j26kmzljcydj8l";
+    sha256 = "0ynddnfirh9pmy7ijg300jrgzdhjzm07fsmvdw71mb2x0p82qabw";
   };
 
   nativeBuildInputs = [
@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
     "localstatedir=\${TMPDIR}"
     "sysconfdir=\${out}/etc"
     "sysconfigdir=\${out}/etc/default"
+    "bashcompdir=\${out}/share/bash-completion/completions"
     "READMEdir=\${TMPDIR}/var/lib/lxc/rootfs"
     "LXCPATH=\${TMPDIR}/var/lib/lxc"
   ];
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
new file mode 100644
index 00000000000..ceaed205db9
--- /dev/null
+++ b/pkgs/os-specific/linux/lxcfs/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, pkgconfig, help2man, fuse, pam }:
+
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  name = "lxcfs-${version}";
+  version = "2.0.4";
+
+  src = fetchurl {
+    url = "https://linuxcontainers.org/downloads/lxcfs/lxcfs-${version}.tar.gz";
+    sha256 = "0pfrsn7hqccpcnwg4xk8ds0avb2yc9gyvj7bk2bl90vpwsm35j7y";
+  };
+
+  nativeBuildInputs = [ pkgconfig help2man ];
+  buildInputs = [ fuse pam ];
+
+  configureFlags = [
+    "--with-init-script=systemd"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+  ];
+
+  installFlags = [ "SYSTEMD_UNIT_DIR=\${out}/lib/systemd" ];
+
+  postFixup = ''
+    # liblxcfs.so is reloaded with dlopen()
+    patchelf --set-rpath "$(patchelf --print-rpath "$out/bin/lxcfs"):$out/lib" "$out/bin/lxcfs"
+  '';
+
+  meta = {
+    homepage = https://linuxcontainers.org/lxcfs;
+    description = "FUSE filesystem for LXC";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mic92 ];
+  };
+}
diff --git a/pkgs/os-specific/linux/mba6x_bl/default.nix b/pkgs/os-specific/linux/mba6x_bl/default.nix
index 2a0e53b3925..350915c55b5 100644
--- a/pkgs/os-specific/linux/mba6x_bl/default.nix
+++ b/pkgs/os-specific/linux/mba6x_bl/default.nix
@@ -6,13 +6,14 @@ let pkgName = "mba6x_bl";
 in
 
 stdenv.mkDerivation rec {
-  name = "${pkgName}-2016-02-12";
+  name = "${pkgName}-${version}";
+  version = "2016-04-22";
 
   src = fetchFromGitHub {
     owner = "patjak";
     repo = pkgName;
-    rev = "9c2de8a24e7d4e8506170a19d32d6f11f380a142";
-    sha256 = "1zaypai8lznqcaszb6an643amsvr5qjnqj6aq6jkr0qk37x0fjff";
+    rev = "d05c125efe182376ddab30d486994ec00e144650";
+    sha256 = "15h90z3ijq4lv37nmx70xqggcvn21vr7mki2psk1jyj88in3j3xn";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index 2d743035e14..dee201c1778 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -1,11 +1,11 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, utillinux }:
 
 stdenv.mkDerivation rec {
   name = "mcelog-${version}";
-  version = "138";
+  version = "144";
 
   src = fetchFromGitHub {
-    sha256 = "039ycn5m3gx4n0kppxl35wcrkyva6lv64qhlqhh7034qkbqbhqiy";
+    sha256 = "05b1x9z6x9yz3xmb93qvwwssjbvp28bawy8as9bfm29pyhzdxx6k";
     rev = "v${version}";
     repo = "mcelog";
     owner = "andikleen";
@@ -18,6 +18,10 @@ stdenv.mkDerivation rec {
     touch mcelog.conf.5 # avoid regeneration requiring Python
 
     substituteInPlace Makefile --replace '"unknown"' '"${version}"'
+
+    for i in triggers/*; do
+      substituteInPlace $i --replace 'logger' '${utillinux}/bin/logger'
+    done
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/mdadm/4.nix b/pkgs/os-specific/linux/mdadm/4.nix
new file mode 100644
index 00000000000..d929668a26a
--- /dev/null
+++ b/pkgs/os-specific/linux/mdadm/4.nix
@@ -0,0 +1,42 @@
+{ stdenv, fetchurl, groff }:
+
+assert stdenv.isLinux;
+
+stdenv.mkDerivation rec {
+  name = "mdadm-4.0";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/utils/raid/mdadm/${name}.tar.xz";
+    sha256 = "1ad3mma641946wn5lsllwf0lifw9lps34fv1nnkhyfpd9krffshx";
+  };
+
+  # This is to avoid self-references, which causes the initrd to explode
+  # in size and in turn prevents mdraid systems from booting.
+  allowedReferences = [ stdenv.glibc.out ];
+
+  patches = [ ./no-self-references.patch ];
+
+  makeFlags = [
+    "NIXOS=1" "INSTALL=install" "INSTALL_BINDIR=$(out)/sbin"
+    "MANDIR=$(out)/share/man" "RUN_DIR=/dev/.mdadm"
+  ] ++ stdenv.lib.optionals (stdenv ? cross) [
+    "CROSS_COMPILE=${stdenv.cross.config}-"
+  ];
+
+  nativeBuildInputs = [ groff ];
+
+  # Attempt removing if building with gcc5 when updating
+  NIX_CFLAGS_COMPILE = "-std=gnu89";
+
+  preConfigure = ''
+    sed -e 's@/lib/udev@''${out}/lib/udev@' \
+        -e 's@ -Werror @ @' \
+        -e 's@/usr/sbin/sendmail@/var/setuid-wrappers/sendmail@' -i Makefile
+  '';
+
+  meta = {
+    description = "Programs for managing RAID arrays under Linux";
+    homepage = http://neil.brown.name/blog/mdadm;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
index f4e7ad1f234..8887237b304 100644
--- a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = https://archlinux.org/;
+    homepage = "https://archlinux.org/";
     description = "ipconfig and nfsmount tools for root on NFS, ported from klibc";
     license = licenses.gpl2;
     platforms  = platforms.linux;
diff --git a/pkgs/os-specific/linux/molly-guard/default.nix b/pkgs/os-specific/linux/molly-guard/default.nix
new file mode 100644
index 00000000000..ac083e545fe
--- /dev/null
+++ b/pkgs/os-specific/linux/molly-guard/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, dpkg, busybox, systemd }:
+
+stdenv.mkDerivation rec {
+  name = "molly-guard-${version}";
+  version = "0.6.3";
+
+  src = fetchurl {
+    url = "https://launchpad.net/ubuntu/+source/molly-guard/${version}/+build/8892607/+files/molly-guard_${version}_all.deb";
+    sha256 = "1d1x60m6kh9wfh9lc22g5s0j40aivwgsczykk27ymwl1pvk58dxn";
+  };
+
+  buildInputs = [ dpkg ];
+
+  sourceRoot = ".";
+
+  unpackCmd = ''
+    dpkg-deb -x "$src" .
+  '';
+
+  installPhase = ''
+    sed -i "s|/lib/molly-guard|${systemd}/sbin|g" lib/molly-guard/molly-guard
+    sed -i "s|run-parts|${busybox}/bin/run-parts|g" lib/molly-guard/molly-guard
+    sed -i "s|/etc/molly-guard/|$out/etc/molly-guard/|g" lib/molly-guard/molly-guard
+    cp -r ./ $out/
+  '';
+
+  postFixup = ''
+    for modus in init halt poweroff reboot runlevel shutdown telinit; do
+       ln -sf $out/lib/molly-guard/molly-guard $out/bin/$modus;
+    done;
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Attempts to prevent you from accidentally shutting down or rebooting machines";
+    homepage    = https://anonscm.debian.org/git/collab-maint/molly-guard.git/;
+    license     = licenses.artistic2;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ DerTim1 ];
+    priority    = -10;
+  };
+}
diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix
index 409eb31e14f..0e0178e8845 100644
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -1,25 +1,26 @@
-{ stdenv, fetchurl, lvm2, libaio, gzip, readline, udev }:
+{ stdenv, fetchurl, lvm2, libaio, gzip, readline, systemd, liburcu }:
 
 stdenv.mkDerivation rec {
-  name = "multipath-tools-0.5.0";
+  name = "multipath-tools-0.6.2";
 
   src = fetchurl {
-    url = "http://christophe.varoqui.free.fr/multipath-tools/${name}.tar.bz2";
-    sha256 = "1yd6l1l1c62xjr1xnij2x49kr416anbgfs4y06r86kp9hkmz2g7i";
+    name = "${name}.tar.gz";
+    url = "http://git.opensvc.com/?p=multipath-tools/.git;a=snapshot;h=e165b73a16fc9027aa3306df40052038c175be1b;sf=tgz";
+    sha256 = "159hxvbk9kh1qay9x04w0gsqzg0hkl5yghfc1wi9kv2n5pcwbkpm";
   };
 
-  hardeningDisable = [ "format" ];
-
   postPatch = ''
     sed -i -re '
       s,^( *#define +DEFAULT_MULTIPATHDIR\>).*,\1 "'"$out/lib/multipath"'",
     ' libmultipath/defaults.h
     sed -i -e 's,\$(DESTDIR)/\(usr/\)\?,$(prefix)/,g' \
       kpartx/Makefile libmpathpersist/Makefile
+    sed -i -e "s,GZIP = .*, GZIP = gzip -9n -c," \
+      Makefile.inc
   '';
 
   nativeBuildInputs = [ gzip ];
-  buildInputs = [ udev lvm2 libaio readline ];
+  buildInputs = [ systemd lvm2 libaio readline liburcu ];
 
   makeFlags = [
     "LIB=lib"
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index ae0c7703de6..dd12a18dc82 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   name    = "musl-${version}";
-  version = "1.1.11";
+  version = "1.1.15";
 
   src = fetchurl {
     url    = "http://www.musl-libc.org/releases/${name}.tar.gz";
-    sha256 = "0grmmah3d9wajii26010plpinv3cbiq3kfqsblgn84kv3fjnv7mv";
+    sha256 = "1ymhxkskivzph0q34zadwfglc5gyahqajm7chqqn2zraxv3lgr4p";
   };
 
   enableParallelBuilding = true;
@@ -22,6 +22,15 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--enable-shared"
     "--enable-static"
+    "--disable-gcc-wrapper"
+  ];
+
+  patches = [
+    # CVE-2016-8859: http://www.openwall.com/lists/oss-security/2016/10/19/1
+    (fetchpatch {
+      url = "https://git.musl-libc.org/cgit/musl/patch/?id=c3edc06d1e1360f3570db9155d6b318ae0d0f0f7";
+      sha256 = "15ih0aj27lz4sgq8r5jndc3qy5gz3ciraavrqpp0vw8h5wjcsb9v";
+    })
   ];
 
   dontDisableStatic = true;
diff --git a/pkgs/os-specific/linux/ndiswrapper/default.nix b/pkgs/os-specific/linux/ndiswrapper/default.nix
index eabc2840881..c22ffb60df8 100644
--- a/pkgs/os-specific/linux/ndiswrapper/default.nix
+++ b/pkgs/os-specific/linux/ndiswrapper/default.nix
@@ -38,5 +38,6 @@ stdenv.mkDerivation {
     description = "Ndis driver wrapper for the Linux kernel";
     homepage = http://sourceforge.net/projects/ndiswrapper;
     license = "GPL";
+    broken = true;
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch b/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch
deleted file mode 100644
index 8d1436c5094..00000000000
--- a/pkgs/os-specific/linux/nvidia-x11/365.35-kernel-4.7.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-fb.c NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-fb.c
---- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-fb.c	2016-07-31 19:07:06.595038290 -0400
-+++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-fb.c	2016-07-31 19:09:18.532197060 -0400
-@@ -114,7 +114,7 @@
-      * We don't support any planar format, pick up first buffer only.
-      */
- 
--    gem = drm_gem_object_lookup(dev, file, cmd->handles[0]);
-+    gem = drm_gem_object_lookup(file, cmd->handles[0]);
- 
-     if (gem == NULL)
-     {
-diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-gem.c NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-gem.c
---- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-drm/nvidia-drm-gem.c	2016-07-31 19:07:06.595038290 -0400
-+++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-drm/nvidia-drm-gem.c	2016-07-31 19:08:56.187492736 -0400
-@@ -408,7 +408,7 @@
- 
-     mutex_lock(&dev->struct_mutex);
- 
--    gem = drm_gem_object_lookup(dev, file, handle);
-+    gem = drm_gem_object_lookup(file, handle);
- 
-     if (gem == NULL)
-     {
-diff -Naur NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-uvm/uvm_linux.h NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-uvm/uvm_linux.h
---- NVIDIA-Linux-x86_64-367.35-no-compat32-upstream/kernel/nvidia-uvm/uvm_linux.h	2016-07-31 19:07:06.600038448 -0400
-+++ NVIDIA-Linux-x86_64-367.35-no-compat32/kernel/nvidia-uvm/uvm_linux.h	2016-07-31 19:08:06.506926763 -0400
-@@ -554,12 +554,6 @@
-     INIT_RADIX_TREE(tree, GFP_NOWAIT);
- }
- 
--static bool radix_tree_empty(struct radix_tree_root *tree)
--{
--    void *dummy;
--    return radix_tree_gang_lookup(tree, &dummy, 0, 1) == 0;
--}
--
- 
- #if !defined(NV_USLEEP_RANGE_PRESENT)
- static void __sched usleep_range(unsigned long min, unsigned long max)
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index f561c0addc8..967a98d9566 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, kernel ? null, xorg, zlib, perl
-, gtk, atk, pango, glib, gdk_pixbuf, cairo, nukeReferences
+, gtk2, atk, pango, glib, gdk_pixbuf, cairo, nukeReferences
 , # Whether to build the libraries only (i.e. not the kernel module or
   # nvidia-settings).  Used to support 32-bit binaries on 64-bit
   # Linux.
@@ -12,15 +12,17 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "367.35";
+  versionNumber = "375.26";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
 
+  nameSuffix = optionalString (!libsOnly) "-${kernel.version}";
+
 in
 
 stdenv.mkDerivation {
-  name = "nvidia-x11-${versionNumber}${optionalString (!libsOnly) "-${kernel.version}"}";
+  name = "nvidia-x11-${versionNumber}${nameSuffix}";
 
   builder = ./builder.sh;
 
@@ -28,12 +30,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "05g36bxcfk21ab8b0ay3zy21k5nd71468p9y1nbflx7ghpx25jrq";
+        sha256 = "0yv19rkz2wzzj0fygfjb1mh21iy769kff3yg2kzk8bsiwnmcyybw";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
-        url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "0m4k8f0212l63h22wk6hgi8fbfsgxqih5mizsw4ixqqmjd75av4a";
+        url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}.run";
+        sha256 = "1kqy9ayja3g5znj2hzx8pklz8qi0b0l9da7c3ldg3hlxf31v4hjg";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
@@ -52,10 +54,10 @@ stdenv.mkDerivation {
   allLibPath  = makeLibraryPath [xorg.libXext xorg.libX11 xorg.libXrandr zlib stdenv.cc.cc];
 
   gtkPath = optionalString (!libsOnly) (makeLibraryPath
-    [ gtk atk pango glib gdk_pixbuf cairo ] );
+    [ gtk2 atk pango glib gdk_pixbuf cairo ] );
   programPath = makeLibraryPath [ xorg.libXv ];
 
-  patches = if (!libsOnly) && (versionAtLeast kernel.dev.version "4.7") then [ ./365.35-kernel-4.7.patch ] else [];
+
 
   buildInputs = [ perl nukeReferences ];
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy173.nix b/pkgs/os-specific/linux/nvidia-x11/legacy173.nix
index 27c963f4bd9..d1f6d36a6a7 100644
--- a/pkgs/os-specific/linux/nvidia-x11/legacy173.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/legacy173.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, kernel, xorg, zlib, gtk, atk, pango, glib, gdk_pixbuf}:
+{stdenv, fetchurl, kernel, xorg, zlib, gtk2, atk, pango, glib, gdk_pixbuf}:
 
 let
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
 
   cudaPath = stdenv.lib.makeLibraryPath [zlib stdenv.cc.cc];
 
-  programPath = stdenv.lib.makeLibraryPath [ gtk atk pango glib gdk_pixbuf xorg.libXv ];
+  programPath = stdenv.lib.makeLibraryPath [ gtk2 atk pango glib gdk_pixbuf xorg.libXv ];
 
   meta = {
     homepage = http://www.nvidia.com/object/unix.html;
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy304.nix b/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
index 65cf42333e0..63da39e0c23 100644
--- a/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, kernel ? null, xorg, zlib, perl
-, gtk, atk, pango, glib, gdk_pixbuf
+, gtk2, atk, pango, glib, gdk_pixbuf
 , # Whether to build the libraries only (i.e. not the kernel module or
   # nvidia-settings).  Used to support 32-bit binaries on 64-bit
   # Linux.
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
   cudaPath = stdenv.lib.makeLibraryPath [zlib stdenv.cc.cc];
 
   programPath = optionalString (!libsOnly) (stdenv.lib.makeLibraryPath
-    [ gtk atk pango glib gdk_pixbuf xorg.libXv ] );
+    [ gtk2 atk pango glib gdk_pixbuf xorg.libXv ] );
 
   buildInputs = [ perl ];
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy340.nix b/pkgs/os-specific/linux/nvidia-x11/legacy340.nix
index 0682954d558..e34aaf3c908 100644
--- a/pkgs/os-specific/linux/nvidia-x11/legacy340.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/legacy340.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, kernel ? null, xorg, zlib, perl
-, gtk, atk, pango, glib, gdk_pixbuf
+, gtk2, atk, pango, glib, gdk_pixbuf
 , # Whether to build the libraries only (i.e. not the kernel module or
   # nvidia-settings).  Used to support 32-bit binaries on 64-bit
   # Linux.
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
   allLibPath  = makeLibraryPath [xorg.libXext xorg.libX11 xorg.libXrandr zlib stdenv.cc.cc];
 
   programPath = optionalString (!libsOnly) (makeLibraryPath
-    [ gtk atk pango glib gdk_pixbuf xorg.libXv ] );
+    [ gtk2 atk pango glib gdk_pixbuf xorg.libXv ] );
 
   buildInputs = [ perl ];
 
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
new file mode 100644
index 00000000000..94fc9ca05e7
--- /dev/null
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "nvme-cli-${version}";
+  version = "0.9";
+
+  src = fetchFromGitHub {
+    owner = "linux-nvme";
+    repo = "nvme-cli";
+    rev = "v${version}";
+    sha256 = "16n0gg1zx4fgadcq94kx6bgysqw60jvybjwynk7mj3fzdbvzrqyh";
+  };
+
+  makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
+
+  meta = with lib; {
+    inherit (src.meta) homepage;
+    description = "NVM-Express user space tooling for Linux";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ tavyc ];
+  };
+}
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index faf57450ce1..8182394536c 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -1,27 +1,21 @@
-{ stdenv, fetchgit, autoreconfHook, openssl, libpcap, dpdk, bash }:
+{ stdenv, fetchgit, autoreconfHook, openssl, libpcap, dpdk }:
 
 stdenv.mkDerivation rec {
   name = "odp-dpdk-${version}";
-  version = "1.10.1.0";
+  version = "1.12.0.0";
 
   src = fetchgit {
     url = "https://git.linaro.org/lng/odp-dpdk.git";
-    rev = "0ed1ced007d98980f90604675083bf30c354e867";
-    sha256 = "1kf090bizr0p0cxn525qpmypb5j86imvxrfpmwbl7vqqfh74j5ax";
+    rev = "5e370e1113973feafb43a8e57d4c59be40e9aeab";
+    sha256 = "0rrakbxnbsqaj148xaz2hwxjvg3cmzlynfkvcp8w56sqyly75d0n";
   };
 
-  nativeBuildInputs = [ autoreconfHook bash ];
-  buildInputs = [ stdenv openssl dpdk libpcap ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ openssl dpdk libpcap ];
 
   RTE_SDK = "${dpdk}";
   RTE_TARGET = "x86_64-native-linuxapp-gcc";
 
-  patchPhase = ''
-    substituteInPlace scripts/git_hash.sh --replace /bin/bash /bin/sh
-    substituteInPlace scripts/get_impl_str.sh --replace /bin/bash /bin/sh
-    echo -n ${version} > .scmversion
-  '';
-
   dontDisableStatic = true;
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/ofp/default.nix b/pkgs/os-specific/linux/ofp/default.nix
new file mode 100644
index 00000000000..e083c0f0457
--- /dev/null
+++ b/pkgs/os-specific/linux/ofp/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook
+, openssl, libpcap, odp-dpdk, dpdk
+}:
+
+stdenv.mkDerivation rec {
+  name = "ofp-${version}";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "OpenFastPath";
+    repo = "ofp";
+    rev = "${version}";
+    sha256 = "05902593fycgkwzk5g7wzgk0k40nrrgybplkdka3rqnlj6aydhqf";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl libpcap odp-dpdk dpdk ];
+
+  dontDisableStatic = true;
+
+  postPatch = ''
+    substituteInPlace configure.ac --replace m4_esyscmd m4_esyscmd_s
+    substituteInPlace scripts/git_hash.sh --replace /bin/bash /bin/sh
+    echo ${version} > .scmversion
+  '';
+
+  configureFlags = [
+    "--with-odp=${odp-dpdk}"
+    "--with-odp-lib=odp-dpdk"
+    "--disable-shared"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "High performance TCP/IP stack";
+    homepage = http://www.openfastpath.org;
+    license = licenses.bsd3;
+    platforms =  [ "x86_64-linux" ];
+    maintainers = [ maintainers.abuibrahim ];
+  };
+}
diff --git a/pkgs/os-specific/linux/pagemon/default.nix b/pkgs/os-specific/linux/pagemon/default.nix
index 4246e512321..414338702cc 100644
--- a/pkgs/os-specific/linux/pagemon/default.nix
+++ b/pkgs/os-specific/linux/pagemon/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "pagemon-${version}";
-  version = "0.01.08";
+  version = "0.01.10";
 
   src = fetchFromGitHub {
-    sha256 = "079x8ah33nh4faqcy0jy24x30l40j5m00d57aawaayaq18smqs3f";
+    sha256 = "04dbcr7bzgp4kvhw1rsn084cz4qbfhf7ifyh3ikgdka9w98057h1";
     rev = "V${version}";
     repo = "pagemon";
     owner = "ColinIanKing";
diff --git a/pkgs/os-specific/linux/pam_pgsql/default.nix b/pkgs/os-specific/linux/pam_pgsql/default.nix
index 42949a3557a..10383a13e7e 100644
--- a/pkgs/os-specific/linux/pam_pgsql/default.nix
+++ b/pkgs/os-specific/linux/pam_pgsql/default.nix
@@ -1,8 +1,8 @@
 { stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, postgresql, libgcrypt, pam }:
 
 stdenv.mkDerivation rec {
-  version = "0.7.3.2";
   name = "pam_pgsql-${version}";
+  version = "0.7.3.2";
 
   src = fetchFromGitHub {
     owner = "pam-pgsql";
diff --git a/pkgs/os-specific/linux/pam_usb/default.nix b/pkgs/os-specific/linux/pam_usb/default.nix
index a96e951bf9b..baf24b27562 100644
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@@ -1,6 +1,32 @@
-{stdenv, fetchurl, makeWrapper, useSetUID, dbus, libxml2, pam, pkgconfig, pmount, pythonPackages}:
+{ stdenv, fetchurl, makeWrapper, dbus, libxml2, pam, pkgconfig, pmount, pythonPackages, writeScript }:
 
 let
+
+  # Search in the environment if the same program exists with a set uid or
+  # set gid bit.  If it exists, run the first program found, otherwise run
+  # the default binary.
+  useSetUID = drv: path:
+    let
+      name = baseNameOf path;
+      bin = "${drv}${path}";
+    in assert name != "";
+      writeScript "setUID-${name}" ''
+        #!${stdenv.shell}
+        inode=$(stat -Lc %i ${bin})
+        for file in $(type -ap ${name}); do
+          case $(stat -Lc %a $file) in
+            ([2-7][0-7][0-7][0-7])
+              if test -r "$file".real; then
+                orig=$(cat "$file".real)
+                if test $inode = $(stat -Lc %i "$orig"); then
+                  exec "$file" "$@"
+                fi
+              fi;;
+          esac
+        done
+        exec ${bin} "$@"
+      '';
+
   pmountBin = useSetUID pmount "/bin/pmount";
   pumountBin = useSetUID pmount "/bin/pumount";
   inherit (pythonPackages) python dbus-python;
diff --git a/pkgs/os-specific/linux/pax-utils/default.nix b/pkgs/os-specific/linux/pax-utils/default.nix
index 65cbf1c4589..1e4373f286c 100644
--- a/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/pkgs/os-specific/linux/pax-utils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "pax-utils-${version}";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchurl {
     url = "https://dev.gentoo.org/~vapier/dist/${name}.tar.xz";
-    sha256 = "04hvsizzspfzfq6hhfif7ya9nwsc0cs6z6n2bq1zfh7agd8nqhzm";
+    sha256 = "045dxgl4kkmq6205iw6fqyx3565gd607p3xpad5l9scdi3qdp6xv";
   };
 
   makeFlags = [
@@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
     homepage    = "https://dev.gentoo.org/~vapier/dist/";
     license     = licenses.gpl2;
     platforms   = platforms.linux;
-    maintainers = with maintainers; [ thoughtpolice ];
+    maintainers = with maintainers; [ thoughtpolice joachifm ];
   };
 }
diff --git a/pkgs/os-specific/linux/paxtest/default.nix b/pkgs/os-specific/linux/paxtest/default.nix
index 0c2fd9b6f86..4611a3c09b7 100644
--- a/pkgs/os-specific/linux/paxtest/default.nix
+++ b/pkgs/os-specific/linux/paxtest/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name    = "paxtest-${version}";
-  version = "0.9.14";
+  version = "0.9.15";
 
   src = fetchurl {
     url    = "https://www.grsecurity.net/~spender/${name}.tar.gz";
-    sha256 = "0j40h3x42k5mr5gc5np4wvr9cdf9szk2f46swf42zny8rlgxiskx";
+    sha256 = "0zv6vlaszlik98gj9200sv0irvfzrvjn46rnr2v2m37x66288lym";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/phc-intel/default.nix b/pkgs/os-specific/linux/phc-intel/default.nix
index 56c12e9a4f0..cb320111017 100644
--- a/pkgs/os-specific/linux/phc-intel/default.nix
+++ b/pkgs/os-specific/linux/phc-intel/default.nix
@@ -8,14 +8,14 @@ assert !kernel.features ? grsecurity;
 
 let
   release = "0.4.0";
-  revbump = "rev19"; # don't forget to change forum download id...
+  revbump = "rev22"; # don't forget to change forum download id...
 in stdenv.mkDerivation rec {
   name = "linux-phc-intel-${version}-${kernel.version}";
   version = "${release}-${revbump}";
 
   src = fetchurl {
-    sha256 = "1apvjp2rpaf3acjvsxgk6xiwrx4n9p565gxvra05pvicwikfiqa8";
-    url = "http://www.linux-phc.org/forum/download/file.php?id=168";
+    sha256 = "f80285a8cd2ebb1753841e493af0c091d55c33823777b26a93d25ed7264a385d";
+    url = "http://www.linux-phc.org/forum/download/file.php?id=172";
     name = "phc-intel-pack-${revbump}.tar.bz2";
   };
 
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 5154ccce1b4..68237d70f51 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -1,34 +1,32 @@
 { stdenv, fetchurl, dpdk, libpcap, utillinux
 , pkgconfig
-, gtk, withGtk ? false
+, gtk2, withGtk ? false
 }:
 
 stdenv.mkDerivation rec {
   name = "pktgen-${version}";
-  version = "3.0.04";
+  version = "3.1.0";
 
   src = fetchurl {
-    url = "http://dpdk.org/browse/apps/pktgen-dpdk/snapshot/pktgen-${version}.tar.gz";
-    sha256 = "0vrmbpl8zaal5zjwyzlx0y3d6jydfxdmf0psdj7ic37h5yh2iv2q";
+    url = "http://dpdk.org/browse/apps/pktgen-dpdk/snapshot/pktgen-v${version}.tar.gz";
+    sha256 = "1a1dl8h8p76wlcjlvn736mz4nc2nc5c3764rlydiz86wl45mb0nb";
   };
 
   nativeBuildInputs = stdenv.lib.optionals withGtk [ pkgconfig ];
 
   buildInputs =
     [ dpdk libpcap ]
-    ++ stdenv.lib.optionals withGtk [gtk];
+    ++ stdenv.lib.optionals withGtk [gtk2];
 
   RTE_SDK = "${dpdk}";
   RTE_TARGET = "x86_64-native-linuxapp-gcc";
   GUI = stdenv.lib.optionalString withGtk "true";
 
-  enableParallelBuilding = true;
-
   NIX_CFLAGS_COMPILE = [ "-march=core2" ];
 
   postPatch = ''
     substituteInPlace lib/lua/src/luaconf.h --replace /usr/local $out
-    substituteInPlace lib/common/wr_lscpu.h --replace /usr/bin/lscpu ${utillinux}/bin/lscpu
+    substituteInPlace lib/common/lscpu.h --replace /usr/bin/lscpu ${utillinux}/bin/lscpu
   '';
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/pommed-light/default.nix b/pkgs/os-specific/linux/pommed-light/default.nix
new file mode 100644
index 00000000000..a039984ff33
--- /dev/null
+++ b/pkgs/os-specific/linux/pommed-light/default.nix
@@ -0,0 +1,65 @@
+{
+  stdenv
+, fetchurl
+, pciutils
+, confuse
+, alsaLib
+, audiofile
+, pkgconfig
+, zlib
+, eject
+}:
+
+stdenv.mkDerivation rec {
+  pkgname = "pommed-light";
+  version = "1.50lw";
+  name = "${pkgname}-${version}";
+
+  src = fetchurl {
+    url = "https://github.com/bytbox/${pkgname}/archive/v${version}.tar.gz";
+
+    sha256 = "1r2f28zqmyvzgymd0ng53hscbrq8vcqhxdnkq5dppjf9yrzn018b";
+  };
+
+  postPatch = ''
+    substituteInPlace pommed.conf.mactel --replace /usr $out
+    substituteInPlace pommed.conf.pmac --replace /usr $out
+    substituteInPlace pommed/beep.h --replace /usr $out
+    substituteInPlace pommed/cd_eject.c --replace /usr/bin/eject ${eject}/bin/eject
+  '';
+
+  buildInputs = [
+    pciutils
+    confuse
+    alsaLib
+    audiofile
+    pkgconfig
+    zlib
+    eject
+  ];
+
+  installPhase = ''
+    install -Dm755 pommed/pommed $out/bin/pommed
+    install -Dm644 pommed.conf.mactel $out/etc/pommed.conf.mactel
+    install -Dm644 pommed.conf.pmac $out/etc/pommed.conf.pmac
+
+    # Man page
+    install -Dm644 pommed.1 $out/share/man/man1/pommed.1
+
+    # Sounds
+    install -Dm644 pommed/data/goutte.wav $out/share/pommed/goutte.wav
+    install -Dm644 pommed/data/click.wav $out/share/pommed/click.wav
+  '';
+
+  meta = {
+    description = "A trimmed version of the pommed hotkey handler for MacBooks";
+    longDescription = ''
+      This is a stripped-down version of pommed with client, dbus, and
+      ambient light sensor support removed, optimized for use with dwm
+      and the like.
+    '';
+    homepage = https://github.com/bytbox/pommed-light;
+    platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.gpl2;
+  };
+}
diff --git a/pkgs/os-specific/linux/pommed/default.nix b/pkgs/os-specific/linux/pommed/default.nix
index 6318654742e..1cdf9044b8f 100644
--- a/pkgs/os-specific/linux/pommed/default.nix
+++ b/pkgs/os-specific/linux/pommed/default.nix
@@ -7,7 +7,7 @@
 , alsaLib
 , audiofile
 , pkgconfig
-, gtk
+, gtk2
 , gettext
 , libXpm
 }:
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     audiofile
     dbus_glib
     pkgconfig
-    gtk
+    gtk2
     gettext
     libXpm
   ];
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 59083a8b040..4d81126af44 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -8,17 +8,19 @@ stdenv.mkDerivation rec {
     sha256 = "0nlwazxbnn0k6q5f5b09wdhw0f194lpzkp3l7vxansqhfczmcyx8";
   };
 
-  buildInputs = [ gettext libnl ncurses pciutils pkgconfig zlib ];
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ gettext libnl ncurses pciutils zlib ];
 
   postPatch = ''
     substituteInPlace src/main.cpp --replace "/sbin/modprobe" "modprobe"
     substituteInPlace src/calibrate/calibrate.cpp --replace "/usr/bin/xset" "xset"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Analyze power consumption on Intel-based laptops";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = [ stdenv.lib.maintainers.chaoflow ];
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://01.org/powertop;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ chaoflow fpletz ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index fe392fb0841..dd6f9ec42af 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, pkgconfig, dbus, libcap }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, dbus, libcap }:
 
 stdenv.mkDerivation rec {
   name = "rtkit-0.11";
-  
+
   src = fetchurl {
     url = "http://0pointer.de/public/${name}.tar.xz";
     sha256 = "1l5cb1gp6wgpc9vq6sx021qs6zb0nxg3cn1ba00hjhgnrw4931b8";
@@ -12,6 +12,20 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
   ];
 
+  patches = [
+    # Drop removed ControlGroup stanza
+    (fetchpatch {
+      url = "http://git.0pointer.net/rtkit.git/patch/?id=6c28e20c0be2f616a025059fda0ffac84e7f4f17";
+      sha256 = "0lsxk5nv08i1wjb4xh20i5fcwg3x0qq0k4f8bc0r9cczph2sv7ck";
+    })
+
+    # security patch: Pass uid of caller to polkit
+    (fetchpatch {
+      url = "http://git.0pointer.net/rtkit.git/patch/?id=88d4082ef6caf6b071d749dca1c50e7edde914cc";
+      sha256 = "0hp1blbi359qz8fmr6nj4w9yc0jf3dd176f8pn25wdj38n13qkix";
+    })
+  ];
+
   buildInputs = [ pkgconfig dbus libcap ];
 
   meta = {
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index c38fa8843f4..6b1e93e59df 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "rtl8812au-${kernel.version}-${version}";
-  version = "4.2.2-1";
+  version = "4.3.20";
 
   src = fetchFromGitHub {
-    owner = "csssuf";
-    repo = "rtl8812au";
-    rev = "874906aec694c800bfc29b146737b88dae767832";
-    sha256 = "14ifhplawipfd6971mxw76dv3ygwc0n8sbz2l3f0vvkin6x88bsj";
+    owner = "Grawp";
+    repo = "rtl8812au_rtl8821au";
+    rev = "d716b38abf5ca7da72d2be0adfcebe98cceeda8f";
+    sha256 = "01z5p2vps3an69bbzca7ig14llc5rd6067pgs47kkhfjbsbws4ry";
   };
 
   hardeningDisable = [ "pic" ];
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Driver for Realtek 802.11ac, rtl8812au, provides the 8812au mod";
-    homepage = "https://github.com/csssuf/rtl8812au";
+    homepage = "https://github.com/Grawp/rtl8812au_rtl8821au";
     license = stdenv.lib.licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
     broken = (kernel.features.grsecurity or false);
diff --git a/pkgs/os-specific/linux/rtlwifi_new/default.nix b/pkgs/os-specific/linux/rtlwifi_new/default.nix
new file mode 100644
index 00000000000..0c7cb24e465
--- /dev/null
+++ b/pkgs/os-specific/linux/rtlwifi_new/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, lib, fetchFromGitHub, kernel }:
+
+with lib;
+
+let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless/realtek/rtlwifi";
+
+in stdenv.mkDerivation rec {
+  name = "rtlwifi_new-${version}";
+  version = "2016-09-12";
+
+  src = fetchFromGitHub {
+    owner = "lwfinger";
+    repo = "rtlwifi_new";
+    rev = "7a1b37d2121e8ab1457f002b2729fc23e6ff3e10";
+    sha256 = "0z8grf0fak2ryxwzapp9di77c4bghzkv8lffv76idkcnxgq6sclv";
+  };
+
+  hardeningDisable = [ "pic" "format" ];
+
+  makeFlags = "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    mkdir -p ${modDestDir}
+    find . -name '*.ko' -exec cp --parents {} ${modDestDir} \;
+    find ${modDestDir} -name '*.ko' -exec xz -f {} \;
+  '';
+
+  meta = {
+    description = "The newest Realtek rtlwifi codes";
+    inherit (src.meta) homepage;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ tvorog ];
+    priority = -1;
+  };
+}
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 8c0dc57b61b..e99d7d86bfb 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   patches = [ ./keep-path.patch dots_in_usernames ];
 
-  outputs = [ "out" "su" ];
+  outputs = [ "out" "su" "man" ];
 
   # Assume System V `setpgrp (void)', which is the default on GNU variants
   # (`AC_FUNC_SETPGRP' is not cross-compilation capable.)
@@ -43,7 +43,8 @@ stdenv.mkDerivation rec {
   postInstall =
     ''
       # Don't install ‘groups’, since coreutils already provides it.
-      rm $out/bin/groups $out/share/man/man1/groups.*
+      rm $out/bin/groups
+      rm $man/share/man/man1/groups.*
 
       # Move the su binary into the su package
       mkdir -p $su/bin
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index d5a235084d4..06ad440c775 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -9,57 +9,64 @@ with stdenv.lib;
 let
   buildKernel = any (n: n == configFile) [ "kernel" "all" ];
   buildUser = any (n: n == configFile) [ "user" "all" ];
-in
-
-assert any (n: n == configFile) [ "kernel" "user" "all" ];
-assert buildKernel -> kernel != null;
 
-stdenv.mkDerivation rec {
-  name = "spl-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
+  common = { version, sha256 } @ args : stdenv.mkDerivation rec {
+    name = "spl-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
-  version = "0.6.5.7";
-
-  src = fetchFromGitHub {
-    owner = "zfsonlinux";
-    repo = "spl";
-    rev = "spl-${version}";
-    sha256 = "0i9ak4wqn444i6362xq5xl0msvcck8qqypp0fynrxq8mddzypwps";
-  };
+    src = fetchFromGitHub {
+      owner = "zfsonlinux";
+      repo = "spl";
+      rev = "spl-${version}";
+      inherit sha256;
+    };
 
-  patches = [ ./const.patch ./install_prefix.patch ];
+    patches = [ ./const.patch ./install_prefix.patch ];
 
-  nativeBuildInputs = [ autoreconfHook ];
+    nativeBuildInputs = [ autoreconfHook ];
 
-  hardeningDisable = [ "pic" ];
+    hardeningDisable = [ "pic" ];
 
-  preConfigure = ''
-    substituteInPlace ./module/spl/spl-generic.c --replace /usr/bin/hostid hostid
-    substituteInPlace ./module/spl/spl-generic.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:${gawk}:/bin"
-    substituteInPlace ./module/splat/splat-vnode.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
-    substituteInPlace ./module/splat/splat-linux.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
-  '';
+    preConfigure = ''
+      substituteInPlace ./module/spl/spl-generic.c --replace /usr/bin/hostid hostid
+      substituteInPlace ./module/spl/spl-generic.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:${gawk}:/bin"
+      substituteInPlace ./module/splat/splat-vnode.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
+      substituteInPlace ./module/splat/splat-linux.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
+    '';
 
-  configureFlags = [
-    "--with-config=${configFile}"
-  ] ++ optionals buildKernel [
-    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-  ];
+    configureFlags = [
+      "--with-config=${configFile}"
+    ] ++ optionals buildKernel [
+      "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+      "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    ];
 
-  enableParallelBuilding = true;
+    enableParallelBuilding = true;
 
-  meta = {
-    description = "Kernel module driver for solaris porting layer (needed by in-kernel zfs)";
+    meta = {
+      description = "Kernel module driver for solaris porting layer (needed by in-kernel zfs)";
 
-    longDescription = ''
-      This kernel module is a porting layer for ZFS to work inside the linux
-      kernel.
-    '';
+      longDescription = ''
+          This kernel module is a porting layer for ZFS to work inside the linux
+          kernel.
+      '';
 
-    homepage = http://zfsonlinux.org/;
-    platforms = platforms.linux;
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ jcumming wizeman wkennington ];
-    broken = (kernel.features.grsecurity or false);
+      homepage = http://zfsonlinux.org/;
+      platforms = platforms.linux;
+      license = licenses.gpl2Plus;
+      maintainers = with maintainers; [ jcumming wizeman wkennington fpletz ];
+    };
   };
-}
+
+in
+  assert any (n: n == configFile) [ "kernel" "user" "all" ];
+  assert buildKernel -> kernel != null;
+  {
+    splStable = common {
+      version = "0.6.5.8";
+      sha256 = "000yvaccqlkrq15sdz0734fp3lkmx58182cdcfpm4869i0q7rf0s";
+    };
+    splUnstable = common {
+      version = "0.7.0-rc2";
+      sha256 = "1y7jlyj8jwgrgnd6hiabms5h9430b6wjbnr3pwb16mv40wns1i65";
+    };
+  }
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
new file mode 100644
index 00000000000..312ac0c281a
--- /dev/null
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -0,0 +1,87 @@
+{ stdenv, fetchurl, pkgs, lib, glibc, augeas, dnsutils, c-ares,
+  cyrus_sasl, ding-libs, libnl, libunistring, nss, samba, libnfsidmap, doxygen,
+  python, python3, pam, popt, talloc, tdb, tevent, pkgconfig, ldb, openldap,
+  pcre, kerberos, cifs_utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
+  docbook_xml_xslt, ldap, systemd, nspr, check, cmocka, uid_wrapper,
+  nss_wrapper, docbook_xml_dtd_44, ncurses, Po4a, http-parser, jansson }:
+
+let
+  name = "sssd-${version}";
+  version = "1.14.2";
+
+  docbookFiles = "${pkgs.docbook_xml_xslt}/share/xml/docbook-xsl/catalog.xml:${pkgs.docbook_xml_dtd_44}/xml/dtd/docbook/catalog.xml";
+in
+stdenv.mkDerivation {
+  inherit name;
+  inherit version;
+
+  src = fetchurl {
+    url = "https://fedorahosted.org/released/sssd/${name}.tar.gz";
+    sha1 = "167b2216c536035175ff041d0449e0a874c68601";
+  };
+
+  preConfigure = ''
+    export SGML_CATALOG_FILES="${docbookFiles}"
+    export PYTHONPATH=${ldap}/lib/python2.7/site-packages
+    export PATH=$PATH:${pkgs.openldap}/libexec
+    export CPATH=${pkgs.libxml2.dev}/include/libxml2
+
+    configureFlagsArray=(
+      --prefix=$out
+      --sysconfdir=/etc
+      --localstatedir=/var
+      --enable-pammoddir=$out/lib/security
+      --with-os=fedora
+      --with-pid-path=/run
+      --with-python2-bindings
+      --with-python3-bindings
+      --with-syslog=journald
+      --without-selinux
+      --without-semanage
+      --with-xml-catalog-path=''${SGML_CATALOG_FILES%%:*}
+      --with-ldb-lib-dir=$out/modules/ldb
+      --with-nscd=${glibc.bin}/sbin/nscd
+    )
+  '';
+
+  enableParallelBuilding = true;
+  buildInputs = [ augeas dnsutils c-ares cyrus_sasl ding-libs libnl libunistring nss
+                  samba libnfsidmap doxygen python python3 popt
+                  talloc tdb tevent pkgconfig ldb pam openldap pcre kerberos
+                  cifs_utils glib keyutils dbus fakeroot libxslt libxml2
+                  ldap systemd nspr check cmocka uid_wrapper
+                  nss_wrapper ncurses Po4a http-parser jansson ];
+
+  makeFlags = [
+    "SGML_CATALOG_FILES=${docbookFiles}"
+  ];
+
+  installFlags = [
+     "sysconfdir=$(out)/etc"
+     "localstatedir=$(out)/var"
+     "pidpath=$(out)/run"
+     "sss_statedir=$(out)/var/lib/sss"
+     "logpath=$(out)/var/log/sssd"
+     "pubconfpath=$(out)/var/lib/sss/pubconf"
+     "dbpath=$(out)/var/lib/sss/db"
+     "mcpath=$(out)/var/lib/sss/mc"
+     "pipepath=$(out)/var/lib/sss/pipes"
+     "gpocachepath=$(out)/var/lib/sss/gpo_cache"
+     "secdbpath=$(out)/var/lib/sss/secrets"
+     "initdir=$(out)/rc.d/init"
+  ];
+
+  postInstall = ''
+    rm -rf "$out"/run
+    rm -rf "$out"/rc.d
+    rm -f "$out"/modules/ldb/memberof.la
+    find "$out" -depth -type d -exec rmdir --ignore-fail-on-non-empty {} \;
+  '';
+
+  meta = with stdenv.lib; {
+    description = "System Security Services Daemon";
+    homepage = https://fedorahosted.org/sssd/;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.e-user ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 76858ab5e48..281ee101eac 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -1,26 +1,19 @@
-{stdenv, fetchurl, fetchFromGitHub, cmake, luajit, kernel, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl}:
+{stdenv, fetchurl, fetchFromGitHub, cmake, luajit, kernel, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc}:
 let
   inherit (stdenv.lib) optional optionalString;
   baseName = "sysdig";
-  version = "0.10.0";
-  # sysdig-0.11.0 depends on some headers from jq which are not
-  # installed by default.
-  # Relevant sysdig issue: https://github.com/draios/sysdig/issues/626
-  jq-prefix = fetchurl {
-    url="https://github.com/stedolan/jq/releases/download/jq-1.5/jq-1.5.tar.gz";
-    sha256="0g29kyz4ykasdcrb0zmbrp2jqs9kv1wz9swx849i2d1ncknbzln4";
-  };
+  version = "0.13.0";
 in
 stdenv.mkDerivation {
   name = "${baseName}-${version}";
 
   src = fetchurl {
     url = "https://github.com/draios/sysdig/archive/${version}.tar.gz";
-    sha256 = "0hs0r9z9j7padqdcj69bwx52iw6gvdl0w322qwivpv12j3prcpsj";
+    sha256 = "0ghxj473v471nnry8h9accxpwwjp8nbzkgw8dniqld0ixx678pia";
   };
 
   buildInputs = [
-    cmake zlib luajit ncurses perl jsoncpp libb64 openssl curl
+    cmake zlib luajit ncurses perl jsoncpp libb64 openssl curl jq gcc
   ];
 
   hardeningDisable = [ "pic" ];
@@ -31,7 +24,6 @@ stdenv.mkDerivation {
 
   cmakeFlags = [
     "-DUSE_BUNDLED_DEPS=OFF"
-    "-DUSE_BUNDLED_JQ=ON"
     "-DSYSDIG_VERSION=${version}"
   ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
@@ -41,12 +33,23 @@ stdenv.mkDerivation {
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   '';
 
-  preBuild = ''
-    mkdir -p jq-prefix/src
-    cp ${jq-prefix} jq-prefix/src/jq-1.5.tar.gz
-  '';
+  libPath = stdenv.lib.makeLibraryPath [
+    zlib
+    luajit
+    ncurses
+    jsoncpp
+    curl
+    jq
+    openssl
+    libb64
+    gcc
+    stdenv.cc.cc
+  ];
 
-  postInstall = optionalString (kernel != null) ''
+  postInstall = ''
+    patchelf --set-rpath "$libPath" "$out/bin/sysdig"
+    patchelf --set-rpath "$libPath" "$out/bin/csysdig"
+  '' + optionalString (kernel != null) ''
     make install_driver
     kernel_dev=${kernel.dev}
     kernel_dev=''${kernel_dev#/nix/store/}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index eff515c3dad..8939f854870 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, pkgconfig, intltool, gperf, libcap, kmod
+{ stdenv, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
 , zlib, xz, pam, acl, cryptsetup, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libapparmor, audit, lz4
 , kexectools, libmicrohttpd, linuxHeaders ? stdenv.cc.libc.linuxHeaders, libseccomp
@@ -16,17 +16,19 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "systemd";
-    rev = "124564dd451349ec12673a7d4836b4a7a2f8fb4e";
-    sha256 = "021b7filp1dlhic1iv54b821w7mj5595njvzns939pmn636ry4m5";
+    rev = "3b11791d323cf2d0e00a156967021e1ae9119de2";
+    sha256 = "1xzldwd6407jdg6z36smd49d961nmqykpay969i4xfdldcgyjdv0";
   };
 
-  /* gave up for now!
-  outputs = [ "out" "libudev" "doc" ]; # maybe: "dev"
-  # note: there are many references to ${systemd}/...
-  outputDev = "out";
-  propagatedBuildOutputs = "libudev";
-  */
-  outputs = [ "out" "man" ];
+  patches = [
+    # Fixes tty issues, see #18158. Remove when upgrading to systemd 232.
+    (fetchpatch {
+      url = "https://github.com/systemd/systemd/commit/bd64d82c1c0e3fe2a5f9b3dd9132d62834f50b2d.patch";
+      sha256 = "1gc9fxdlnfmjhbi77xfwcb5mkhryjsdi0rmbh2lq2qq737iyqqwm";
+    })
+  ];
+
+  outputs = [ "out" "lib" "man" "dev" ];
 
   buildInputs =
     [ linuxHeaders pkgconfig intltool gperf libcap kmod xz pam acl
@@ -111,16 +113,6 @@ stdenv.mkDerivation rec {
       #export NIX_CFLAGS_LINK+=" -Wl,-rpath,$libudev/lib"
     '';
 
-  /*
-  makeFlags = [
-    "udevlibexecdir=$(libudev)/lib/udev"
-    # udev rules refer to $out, and anything but libs should probably go to $out
-    "udevrulesdir=$(out)/lib/udev/rules.d"
-    "udevhwdbdir=$(out)/lib/udev/hwdb.d"
-  ];
-  */
-
-
   PYTHON_BINARY = "${coreutils}/bin/env python"; # don't want a build time dependency on Python
 
   NIX_CFLAGS_COMPILE =
@@ -172,26 +164,18 @@ stdenv.mkDerivation rec {
 
       rm -rf $out/etc/rpm
 
-      rm $out/lib/*.la
+      rm $lib/lib/*.la
 
       # "kernel-install" shouldn't be used on NixOS.
       find $out -name "*kernel-install*" -exec rm {} \;
-    ''; # */
-  /*
-      # Move lib(g)udev to a separate output. TODO: maybe split them up
-      #   to avoid libudev pulling glib
-      mkdir -p "$libudev/lib"
-      mv "$out"/lib/lib{,g}udev* "$libudev/lib/"
 
-      for i in "$libudev"/lib/*.la; do
-        substituteInPlace $i --replace "$out" "$libudev"
-      done
-      for i in "$out"/lib/pkgconfig/{libudev,gudev-1.0}.pc; do
-        substituteInPlace $i --replace "libdir=$out" "libdir=$libudev"
-      done
-  */
+      # Keep only libudev and libsystemd in the lib output.
+      mkdir -p $out/lib
+      mv $lib/lib/security $lib/lib/libnss* $out/lib/
+    ''; # */
 
   enableParallelBuilding = true;
+
   /*
   # some libs fail to link to liblzma and/or libffi
   postFixup = let extraLibs = stdenv.lib.makeLibraryPath [ xz.out libffi.out zlib.out ];
diff --git a/pkgs/os-specific/linux/systemd/libudev.nix b/pkgs/os-specific/linux/systemd/libudev.nix
deleted file mode 100644
index 401e1ba6805..00000000000
--- a/pkgs/os-specific/linux/systemd/libudev.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ stdenv, systemd }:
-
-stdenv.mkDerivation {
-  name = "libudev-${systemd.version}";
-
-  unpackPhase = ":";
-  outputs = [ "out" "dev" ];
-  installPhase = ''
-    mkdir -p "$out/lib" "$dev/lib/pkgconfig" "$dev/include"
-    cp -P "${systemd}"/lib/libudev.* "$out/lib/"
-    cp -P "${systemd}"/lib/pkgconfig/libudev.pc "$dev/lib/pkgconfig/"
-    cp -P "${systemd}"/include/libudev.h "$dev/include/"
-
-    substituteInPlace "$dev"/lib/pkgconfig/*.pc \
-      --replace "${systemd}" "$out"
-    sed "/^includedir=/cincludedir=$dev/include" -i "$dev"/lib/pkgconfig/*.pc
-  '';
-
-  meta = {
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/thin-provisioning-tools/default.nix b/pkgs/os-specific/linux/thin-provisioning-tools/default.nix
deleted file mode 100644
index c075c3f1667..00000000000
--- a/pkgs/os-specific/linux/thin-provisioning-tools/default.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ stdenv, fetchFromGitHub, autoconf, pkgconfig, utillinux, coreutils, expat, libaio, boost}:
-
-let
-  version = "0.6.1";
-in
-
-stdenv.mkDerivation {
-  name = "thin-provisioning-tools-${version}";
-
-  src = fetchFromGitHub {
-    owner = "jthornber";
-    repo = "thin-provisioning-tools";
-    rev = "e46bdfd4cc6cdb13852de8aba4e3019425ab0a89";
-    sha256 = "061rw33nw16g71ij05axl713wimawx54h2ggpqxvzy7iyi6lhdcm";
-  };
-
-  nativeBuildInputs = [ autoconf pkgconfig expat libaio boost ];
-
-  preConfigure =
-    ''
-      autoconf
-    '';
-
-  meta = {
-    homepage = https://github.com/jthornber/thin-provisioning-tools;
-    descriptions = "Tools for manipulating the metadata of the device-mapper targets (dm-thin-pool, dm-cache, dm-era)";
-    platforms = stdenv.lib.platforms.linux;
-    inherit version;
-  };
-}
diff --git a/pkgs/os-specific/linux/tp_smapi/default.nix b/pkgs/os-specific/linux/tp_smapi/default.nix
index f0f25f14e49..272b1368dec 100644
--- a/pkgs/os-specific/linux/tp_smapi/default.nix
+++ b/pkgs/os-specific/linux/tp_smapi/default.nix
@@ -1,13 +1,12 @@
-{stdenv, fetchurl, kernel}:
+{ stdenv, fetchurl, kernel, writeScript, coreutils, gnugrep, jq, curl
+}:
 
-stdenv.mkDerivation rec {
-  version = "0.42";
-  name = "tp_smapi-${version}-${kernel.version}";
+let
+  data = stdenv.lib.importJSON ./update.json;
+in stdenv.mkDerivation rec {
+  name = "tp_smapi-${data.version}-${kernel.version}";
 
-  src = fetchurl {
-    url = "https://github.com/evgeni/tp_smapi/releases/download/tp-smapi%2F0.42/tp_smapi-${version}.tgz";
-    sha256 = "09rdg7fm423x6sbbw3lvnvmk4nyc33az8ar93xgq0n9qii49z3bv";
-  };
+  src = fetchurl  { inherit (data) url sha256; };
 
   hardeningDisable = [ "pic" ];
 
@@ -25,6 +24,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.updateScript = import ./update.nix {
+    inherit writeScript coreutils gnugrep jq curl;
+  };
+
   meta = {
     description = "IBM ThinkPad hardware functions driver";
     homepage = "https://github.com/evgeni/tp_smapi/tree/tp-smapi/0.41";
diff --git a/pkgs/os-specific/linux/tp_smapi/update.json b/pkgs/os-specific/linux/tp_smapi/update.json
new file mode 100644
index 00000000000..15e9801e7f2
--- /dev/null
+++ b/pkgs/os-specific/linux/tp_smapi/update.json
@@ -0,0 +1,5 @@
+{
+  "version": "0.42",
+  "url": "https://github.com/evgeni/tp_smapi/archive/tp-smapi/0.42.tar.gz",
+  "sha256": "cd28bf6ee21b2c27b88d947cb0bfcb19648c7daa5d350115403dbcad05849381"
+}
diff --git a/pkgs/os-specific/linux/tp_smapi/update.nix b/pkgs/os-specific/linux/tp_smapi/update.nix
new file mode 100644
index 00000000000..0c97d18472c
--- /dev/null
+++ b/pkgs/os-specific/linux/tp_smapi/update.nix
@@ -0,0 +1,23 @@
+{ writeScript, coreutils, gnugrep, jq, curl
+}:
+
+writeScript "update-tp_smapi" ''
+PATH=${coreutils}/bin:${gnugrep}/bin:${jq}/bin:${curl}/bin
+
+pushd pkgs/os-specific/linux/tp_smapi
+
+tmpfile=`mktemp`
+tags=`curl -s https://api.github.com/repos/evgeni/tp_smapi/tags`
+latest_tag=`echo $tags | jq -r '.[] | .name' | grep -oP "^tp-smapi/\K.*" | sort --version-sort | tail -1`
+sha256=`curl -sL "https://github.com/evgeni/tp_smapi/archive/tp-smapi/$latest_tag.tar.gz" | sha256sum | cut -d" " -f1`
+
+cat > update.json <<EOF
+{
+  "version": "$latest_tag",
+  "url": "https://github.com/evgeni/tp_smapi/archive/tp-smapi/$latest_tag.tar.gz",
+  "sha256": "$sha256"
+}
+EOF
+
+popd
+''
diff --git a/pkgs/os-specific/linux/tpacpi-bat/default.nix b/pkgs/os-specific/linux/tpacpi-bat/default.nix
new file mode 100644
index 00000000000..bf60331d8ad
--- /dev/null
+++ b/pkgs/os-specific/linux/tpacpi-bat/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, perl, kmod }:
+
+# Requires the acpi_call kernel module in order to run.
+stdenv.mkDerivation rec {
+  name = "tpacpi-bat-${version}";
+  version = "3.0";
+
+  src = fetchFromGitHub {
+    owner = "teleshoes";
+    repo = "tpacpi-bat";
+    rev = "v${version}";
+    sha256 = "0l72qvjk5j7sg9x4by7an0xwx65x10dx82fky8lnwlwfv54vgg8l";
+  };
+
+  buildInputs = [ perl ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp tpacpi-bat $out/bin
+  '';
+
+  postPatch = ''
+    substituteInPlace tpacpi-bat --replace modprobe ${kmod}/bin/modprobe
+  '';
+
+  meta = {
+    maintainers = [stdenv.lib.maintainers.orbekk];
+    platforms = stdenv.lib.platforms.linux;
+    description = "Tool to set battery charging thesholds on Lenovo Thinkpad";
+    license = stdenv.lib.licenses.gpl3Plus;
+  };
+}
diff --git a/pkgs/os-specific/linux/ttysnoop/default.nix b/pkgs/os-specific/linux/ttysnoop/default.nix
deleted file mode 100644
index 670c9608344..00000000000
--- a/pkgs/os-specific/linux/ttysnoop/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{stdenv, fetchurl}:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="ttysnoop";
-    version="0.12d.k26";
-    name="${baseName}-${version}";
-    hash="0jb2zchaiqmmickj0la7wjw3sf9vy65qfhhs11yrzx4mmwkp0395";
-    url="http://sysd.org/stas/files/active/0/ttysnoop-0.12d.k26.tar.gz";
-    sha256="0jb2zchaiqmmickj0la7wjw3sf9vy65qfhhs11yrzx4mmwkp0395";
-  };
-  buildInputs = [
-  ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchurl {
-    inherit (s) url sha256;
-  };
-  preBuild = ''
-    sed -e "s@/sbin@$out/sbin@g" -i Makefile
-    sed -e "s@/usr/man@$out/share/man@g" -i Makefile
-    mkdir -p "$out/share/man/man8"
-    mkdir -p "$out/sbin"
-  '';
-  postInstall = ''
-    mkdir -p "$out/etc"
-    cp snooptab.dist "$out/etc/snooptab"
-  '';
-  meta = {
-    inherit (s) version;
-    description = "A tool to clone input and output of another tty/pty to the current one";
-    license = stdenv.lib.licenses.gpl2 ;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/ttysnoop/default.upstream b/pkgs/os-specific/linux/ttysnoop/default.upstream
deleted file mode 100644
index 905a639c31e..00000000000
--- a/pkgs/os-specific/linux/ttysnoop/default.upstream
+++ /dev/null
@@ -1,3 +0,0 @@
-url http://sysd.org/stas/node/35
-ensure_choice
-version '.*-([0-9a-z.]+)[.]tar[.].*' '\1'
diff --git a/pkgs/os-specific/linux/udev/145.nix b/pkgs/os-specific/linux/udev/145.nix
deleted file mode 100644
index 6dd551e1ce1..00000000000
--- a/pkgs/os-specific/linux/udev/145.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ stdenv, fetchurl, gperf, pkgconfig, glib, acl, libusb, usbutils, pciutils }:
-
-assert stdenv ? glibc;
-
-stdenv.mkDerivation rec {
-  name = "udev-145";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/utils/kernel/hotplug/${name}.tar.bz2";
-    sha256 = "1zmibp6n7d582fqx8vmg9vb2a1435hghfpz36056bc25ccwf7yiv";
-  };
-
-  buildInputs = [gperf pkgconfig glib acl libusb usbutils];
-
-  configureFlags = "--with-pci-ids-path=${pciutils}/share/pci.ids";
-
-  preConfigure =
-    ''
-      substituteInPlace extras/keymap/Makefile.in \
-        --replace /usr/include ${stdenv.glibc.dev}/include
-    '';
-
-  postInstall =
-    ''
-      # Install some rules that really should be installed by default.
-      for i in 40-alsa.rules 40-infiniband.rules 40-isdn.rules 40-pilot-links.rules 64-device-mapper.rules 64-md-raid.rules; do
-        cp rules/packages/$i $out/libexec/rules.d/
-      done
-
-      # The path to rule_generator.functions in write_cd_rules and
-      # write_net_rules is broken.  Also, don't store the mutable
-      # persistant rules in /etc/udev/rules.d but in
-      # /var/lib/udev/rules.d.
-      for i in $out/libexec/write_cd_rules $out/libexec/write_net_rules; do
-        substituteInPlace $i \
-          --replace /lib/udev $out/libexec \
-          --replace /etc/udev/rules.d /var/lib/udev/rules.d
-      done
-
-      # Don't set PATH to /bin:/sbin; won't work in NixOS.
-      substituteInPlace $out/libexec/rule_generator.functions \
-        --replace 'PATH=' '#PATH='
-
-      # Don't hardcore the FIRMWARE_DIRS variable; obtain it from the
-      # environment of the caller.
-      sed '3,4d' -i $out/libexec/firmware.sh
-    '';
-
-  meta = {
-    homepage = http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html;
-    description = "Udev manages the /dev filesystem";
-  };
-}
diff --git a/pkgs/os-specific/linux/udev/182.nix b/pkgs/os-specific/linux/udev/182.nix
deleted file mode 100644
index 33a4907c7ca..00000000000
--- a/pkgs/os-specific/linux/udev/182.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ stdenv, fetchurl, pkgconfig
-, pciutils, utillinux, kmod, usbutils, gperf
-}:
-
-assert stdenv ? glibc;
-
-stdenv.mkDerivation rec {
-  name = "udev-182";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/utils/kernel/hotplug/${name}.tar.bz2";
-    sha256 = "143qvm0kij26j2l5icnch4x38fajys6li7j0c5mpwi6kqmc8hqx0";
-  };
-
-  nativeBuildInputs = [ pkgconfig ];
-
-  buildInputs = [ utillinux kmod usbutils #glib gobjectIntrospection
-                  gperf
-                ];
-
-  configureFlags = [ "--with-pci-ids-path=${pciutils}/share/pci.ids"
-                     "--disable-gudev"
-                     "--disable-introspection"
-                   ];
-
-  postPatch = ''
-    sed -i 's:input.h:input-event-codes.h:' Makefile.in
-    sed -i '20a#include <stdint.h>' src/mtd_probe/mtd_probe.h
-  '';
-
-  NIX_LDFLAGS = [ "-lrt" ];
-
-  meta = with stdenv.lib; {
-    homepage = http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html;
-    description = "Udev manages the /dev filesystem";
-    platforms = platforms.linux;
-    license = licenses.gpl2;
-  };
-}
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 11444c57f9a..e808eaf5216 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, fetchurl, pkgconfig, zlib, ncurses ? null, perl ? null, pam, systemd }:
+{ lib, stdenv, fetchurl, pkgconfig, zlib, libseccomp, fetchpatch, autoreconfHook, ncurses ? null, perl ? null, pam, systemd, minimal ? false }:
 
 stdenv.mkDerivation rec {
   name = "util-linux-${version}";
-  version = stdenv.lib.concatStringsSep "." ([ majorVersion ]
-    ++ stdenv.lib.optional (patchVersion != "") patchVersion);
+  version = lib.concatStringsSep "." ([ majorVersion ]
+    ++ lib.optional (patchVersion != "") patchVersion);
   majorVersion = "2.28";
   patchVersion = "1";
 
@@ -14,12 +14,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
-  ];
-
-  outputs = [ "bin" "out" "man" ]; # TODO: $bin is kept the first for now
-  # due to lots of ${utillinux}/bin occurences and headers being rather small
-  outputDev = "bin";
+    (fetchpatch {
+      name = "CVE-2016-2779.diff";
+      url = https://github.com/karelzak/util-linux/commit/8e4925016875c6a4f2ab4f833ba66f0fc57396a2.patch;
+      sha256 = "0kmigkq4s1b1ijrq8vcg2a5cw4qnm065m7cb1jn1q1f4x99ycy60";
+  })];
 
+  outputs = [ "bin" "dev" "out" "man" ];
 
   #FIXME: make it also work on non-nixos?
   postPatch = ''
@@ -53,20 +54,24 @@ stdenv.mkDerivation rec {
 
   makeFlags = "usrbin_execdir=$(bin)/bin usrsbin_execdir=$(bin)/sbin";
 
-  nativeBuildInputs = [ pkgconfig ];
+  # autoreconfHook is required for CVE-2016-2779
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  # libseccomp is required for CVE-2016-2779
   buildInputs =
-    [ zlib pam ]
-    ++ stdenv.lib.optional (ncurses != null) ncurses
-    ++ stdenv.lib.optional (systemd != null) [ systemd pkgconfig ]
-    ++ stdenv.lib.optional (perl != null) perl;
+    [ zlib pam libseccomp ]
+    ++ lib.optional (ncurses != null) ncurses
+    ++ lib.optional (systemd != null) systemd
+    ++ lib.optional (perl != null) perl;
 
   postInstall = ''
     rm "$bin/bin/su" # su should be supplied by the su package (shadow)
+  '' + lib.optionalString minimal ''
+    rm -rf $out/share/{locale,doc,bash-completion}
   '';
 
   enableParallelBuilding = true;
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     homepage = https://www.kernel.org/pub/linux/utils/util-linux/;
     description = "A set of system utilities for Linux";
     license = licenses.gpl2; # also contains parts under more permissive licenses
diff --git a/pkgs/os-specific/linux/virtualbox/default.nix b/pkgs/os-specific/linux/virtualbox/default.nix
new file mode 100644
index 00000000000..593c4400b7f
--- /dev/null
+++ b/pkgs/os-specific/linux/virtualbox/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, virtualbox, kernel, strace }:
+
+stdenv.mkDerivation {
+  name = "virtualbox-modules-${virtualbox.version}-${kernel.version}";
+  src = virtualbox.modsrc;
+  hardeningDisable = [
+    "fortify" "pic" "stackprotector"
+  ];
+
+  makeFlags = [
+    "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+  ];
+  preBuild = "makeFlagsArray+=(\"M=$(pwd)\")";
+  buildFlags = [ "modules" ];
+  installTargets = [ "modules_install" ];
+
+  enableParallelBuilding = true;
+
+  meta = virtualbox.meta // {
+    description = virtualbox.meta.description + " (kernel modules)";
+  };
+}
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 3264194f125..489d6ac8bc6 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -1,16 +1,16 @@
 { stdenv, fetchurl, libmnl, kernel ? null }:
 
-# module requires Linux >= 4.1 https://www.wireguard.io/install/#kernel-requirements
-assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "4.1";
+# module requires Linux >= 3.18 https://www.wireguard.io/install/#kernel-requirements
+assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.18";
 
 let
-  name = "wireguard-unstable-${version}";
+  name = "wireguard-${version}";
 
-  version = "2016-08-08";
+  version = "0.0.20170105";
 
   src = fetchurl {
-    url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-experimental-0.0.20160808.tar.xz";
-    sha256 = "0z9s9xi8dzkmjnki7ialf2haxb0mn2x5676sjwmjij1jfi9ypxhw";
+    url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
+    sha256 = "15iqb1a85aygbf3myw6r79i5h3vpjam1rs6xrnf5kgvgmvp91n8v";
   };
 
   meta = with stdenv.lib; {
@@ -46,6 +46,9 @@ let
     buildInputs = [ libmnl ];
 
     makeFlags = [
+      "WITH_BASHCOMPLETION=yes"
+      "WITH_WGQUICK=yes"
+      "WITH_SYSTEMDUNITS=yes"
       "DESTDIR=$(out)"
       "PREFIX=/"
       "-C" "tools"
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index a3e9e930f5e..fe0d2ca28f9 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -4,13 +4,13 @@
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  version = "2.5";
+  version = "2.6";
 
   name = "wpa_supplicant-${version}";
 
   src = fetchurl {
     url = "http://hostap.epitest.fi/releases/${name}.tar.gz";
-    sha256 = "05mkp5bx1c3z7h5biddsv0p49gkrq9ksany3anp4wdiv92p5prfc";
+    sha256 = "0l0l5gz3d5j9bqjsbjlfcv4w4jwndllp9fmyai4x9kg6qhs6v4xl";
   };
 
   # TODO: Patch epoll so that the dbus actually responds
@@ -79,7 +79,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./build-fix.patch
-    ./libressl.patch
   ];
 
   postInstall = ''
diff --git a/pkgs/os-specific/linux/wpa_supplicant/gui.nix b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
index a75367f0bb0..89f40589c87 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/gui.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, qt4, qmake4Hook, inkscape, wpa_supplicant }:
+{ stdenv, fetchurl, qt4, qmake4Hook, imagemagick, wpa_supplicant }:
 
 stdenv.mkDerivation {
   name = "wpa_gui-${wpa_supplicant.version}";
@@ -6,33 +6,29 @@ stdenv.mkDerivation {
   inherit (wpa_supplicant) src;
 
   buildInputs = [ qt4 ];
-
-  nativeBuildInputs = [ inkscape qmake4Hook ];
-
-  prePatch = "cd wpa_supplicant/wpa_gui-qt4";
-
-  preConfigure =
-    ''
-      lrelease wpa_gui.pro
-    '';
-
-  # We do not install .xpm icons. First of all, I don't know where they should
-  # be install. Second, this allows us to drop imagemagick build-time dependency.
-  postBuild =
-    ''
-      sed -e '/ICONS.*xpm/d' -i icons/Makefile
-      make -C icons
-    '';
-
-  installPhase =
-    ''
-      mkdir -pv $out/bin
-      cp -v wpa_gui $out/bin
-      mkdir -pv $out/share/applications
-      cp -v wpa_gui.desktop $out/share/applications
-      mkdir -pv $out/share/icons
-      cp -av icons/hicolor $out/share/icons
-    '';
+  nativeBuildInputs = [ qmake4Hook imagemagick ];
+
+  patches = [ ./remove_inkscape.patch ];
+  prePatch = ''
+    cd wpa_supplicant/wpa_gui-qt4
+  '';
+
+  preConfigure = ''
+    lrelease wpa_gui.pro
+  '';
+
+  postBuild = ''
+    make -C icons
+  '';
+
+  installPhase = ''
+    mkdir -pv $out/bin
+    cp -v wpa_gui $out/bin
+    mkdir -pv $out/share/applications
+    cp -v wpa_gui.desktop $out/share/applications
+    mkdir -pv $out/share/icons
+    cp -av icons/hicolor $out/share/icons
+  '';
 
   meta = {
     description = "Qt-based GUI for wpa_supplicant";
diff --git a/pkgs/os-specific/linux/wpa_supplicant/libressl.patch b/pkgs/os-specific/linux/wpa_supplicant/libressl.patch
deleted file mode 100644
index 0de3810dacc..00000000000
--- a/pkgs/os-specific/linux/wpa_supplicant/libressl.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-$OpenBSD: patch-src_crypto_tls_openssl_c,v 1.3 2015/09/29 11:57:54 dcoppa Exp $
-
-Compatibility fixes for LibreSSL
-
---- a/src/crypto/tls_openssl.c	Sun Sep 27 21:02:05 2015
-+++ b/src/crypto/tls_openssl.c	Mon Sep 28 13:43:46 2015
-@@ -2229,7 +2229,7 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL
- 	}
- 
- 	if (certs) {
--#if OPENSSL_VERSION_NUMBER >= 0x10002000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
- 		SSL_clear_chain_certs(ssl);
- 		while ((cert = sk_X509_pop(certs)) != NULL) {
- 			X509_NAME_oneline(X509_get_subject_name(cert), buf,
-@@ -2247,7 +2247,7 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL
- 			/* Try to continue anyway */
- 		}
- 		sk_X509_free(certs);
--#ifndef OPENSSL_IS_BORINGSSL
-+#if !defined(OPENSSL_IS_BORINGSSL) && !defined(LIBRESSL_VERSION_NUMBER)
- 		res = SSL_build_cert_chain(ssl,
- 					   SSL_BUILD_CHAIN_FLAG_CHECK |
- 					   SSL_BUILD_CHAIN_FLAG_IGNORE_ERROR);
-@@ -2812,7 +2812,7 @@ int tls_connection_get_random(void *ssl_ctx, struct tl
- 	if (conn == NULL || keys == NULL)
- 		return -1;
- 	ssl = conn->ssl;
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	if (ssl == NULL || ssl->s3 == NULL || ssl->session == NULL)
- 		return -1;
- 
-@@ -2841,7 +2841,7 @@ int tls_connection_get_random(void *ssl_ctx, struct tl
- #ifndef CONFIG_FIPS
- static int openssl_get_keyblock_size(SSL *ssl)
- {
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	const EVP_CIPHER *c;
- 	const EVP_MD *h;
- 	int md_size;
-@@ -2911,7 +2911,7 @@ static int openssl_tls_prf(struct tls_connection *conn
- 		   "mode");
- 	return -1;
- #else /* CONFIG_FIPS */
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	SSL *ssl;
- 	u8 *rnd;
- 	int ret = -1;
-@@ -3394,7 +3394,7 @@ int tls_connection_set_cipher_list(void *tls_ctx, stru
- 
- 	wpa_printf(MSG_DEBUG, "OpenSSL: cipher suites: %s", buf + 1);
- 
--#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
- #if defined(EAP_FAST) || defined(EAP_FAST_DYNAMIC) || defined(EAP_SERVER_FAST)
- 	if (os_strstr(buf, ":ADH-")) {
- 		/*
-@@ -3977,7 +3977,7 @@ static int tls_sess_sec_cb(SSL *s, void *secret, int *
- 	struct tls_connection *conn = arg;
- 	int ret;
- 
--#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
- 	if (conn == NULL || conn->session_ticket_cb == NULL)
- 		return 0;
- 
diff --git a/pkgs/os-specific/linux/wpa_supplicant/remove_inkscape.patch b/pkgs/os-specific/linux/wpa_supplicant/remove_inkscape.patch
new file mode 100644
index 00000000000..1bdb164e24f
--- /dev/null
+++ b/pkgs/os-specific/linux/wpa_supplicant/remove_inkscape.patch
@@ -0,0 +1,30 @@
+From 7a42ef048b420f9b939085ea8c6af6deb9c19dac Mon Sep 17 00:00:00 2001
+From: Moritz Ulrich <moritz@tarn-vedra.de>
+Date: Sun, 30 Oct 2016 22:17:54 +0100
+Subject: [PATCH] Foo
+
+---
+ icons/Makefile | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/icons/Makefile b/icons/Makefile
+index 709514c..9a5fa94 100644
+--- a/icons/Makefile
++++ b/icons/Makefile
+@@ -9,10 +9,9 @@ all: $(ICONS)
+ 
+ %.png:
+ 	mkdir -p hicolor/$(word 1, $(subst /, ,$(@)))/apps/
+-	inkscape $(subst .png,.svg, $(word 2, $(subst /, , $(@)))) --without-gui \
+-		--export-width=$(word 1, $(subst x, , $(@)))  \
+-	        --export-height=$(word 2, $(subst x, , $(subst /, , $(@)))) \
+-		--export-png=hicolor/$(word 1, $(subst /, ,$(@)))/apps/$(word 2, $(subst /, , $@))
++	convert $(subst .png,.svg, $(word 2, $(subst /, , $(@)))) \
++		-size $(word 1, $(subst x, , $(@)))x$(word 2, $(subst x, , $(subst /, , $(@)))) \
++		hicolor/$(word 1, $(subst /, ,$(@)))/apps/$(word 2, $(subst /, , $@))
+ 
+ %.xpm:
+ 	mkdir -p pixmaps/
+-- 
+2.10.1
+
diff --git a/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index 3d3b52acf6f..b308a5ec3c3 100644
--- a/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -3,11 +3,11 @@
 , ncurses, pkgconfig, randrproto, xorgserver, xproto, udev, libXinerama, pixman }:
 
 stdenv.mkDerivation rec {
-  name = "xf86-input-wacom-0.32.0";
+  name = "xf86-input-wacom-0.34.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxwacom/${name}.tar.bz2";
-    sha256 = "03c73vi5rrcr92442k82f4kbabp21yqcrqi6ak2afl41zjdar5wc";
+    sha256 = "0idhkigl0pnyp08sqm6bqfb4h20v6rjrb71z1gdv59gk7d7qwpgi";
   };
 
   buildInputs = [ inputproto libX11 libXext libXi libXrandr libXrender
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 4b5d7e35dae..bd2767a66b4 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -1,114 +1,161 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, utillinux, nukeReferences, coreutils
+{ stdenv, fetchFromGitHub, autoreconfHook, utillinux, nukeReferences, coreutils, fetchpatch
 , configFile ? "all"
 
 # Userspace dependencies
-, zlib, libuuid, python
+, zlib, libuuid, python, attr
 
 # Kernel dependencies
-, kernel ? null, spl ? null
+, kernel ? null, spl ? null, splUnstable ? null
 }:
 
 with stdenv.lib;
 let
   buildKernel = any (n: n == configFile) [ "kernel" "all" ];
   buildUser = any (n: n == configFile) [ "user" "all" ];
-in
 
-assert any (n: n == configFile) [ "kernel" "user" "all" ];
-assert buildKernel -> kernel != null && spl != null;
-
-stdenv.mkDerivation rec {
-  name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
-
-  version = "0.6.5.7";
-
-  src = fetchFromGitHub {
-    owner = "zfsonlinux";
-    repo = "zfs";
-    rev = "zfs-${version}";
-    sha256 = "17mshxyp8k7i9a7ys0rznhkz83f6650pby9ka48d6gzgcwv9nnsm";
-  };
-
-  patches = [ ./nix-build.patch ];
-
-  buildInputs = [ autoreconfHook nukeReferences ]
-    ++ optionals buildKernel [ spl ]
-    ++ optionals buildUser [ zlib libuuid python ];
-
-  # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
-  NIX_CFLAGS_LINK = "-lgcc_s";
-
-  hardeningDisable = [ "pic" ];
-
-  preConfigure = ''
-    substituteInPlace ./module/zfs/zfs_ctldir.c   --replace "umount -t zfs"           "${utillinux}/bin/umount -t zfs"
-    substituteInPlace ./module/zfs/zfs_ctldir.c   --replace "mount -t zfs"            "${utillinux}/bin/mount -t zfs"
-    substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/umount"             "${utillinux}/bin/umount"
-    substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/mount"              "${utillinux}/bin/mount"
-    substituteInPlace ./udev/rules.d/*            --replace "/lib/udev/vdev_id"       "$out/lib/udev/vdev_id"
-    substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/ztest"         "$out/sbin/ztest"
-    substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/zdb"           "$out/sbin/zdb"
-    substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
-    substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d"
-    substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
-    substituteInPlace ./cmd/zed/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
-    substituteInPlace ./module/Makefile.in        --replace "/bin/cp"                 "cp"
-    substituteInPlace ./etc/systemd/system/zfs-share.service.in \
-        --replace "@bindir@/rm " "${coreutils}/bin/rm "
-    ./autogen.sh
-  '';
-
-  configureFlags = [
-    "--with-config=${configFile}"
-  ] ++ optionals buildUser [
-    "--with-dracutdir=$(out)/lib/dracut"
-    "--with-udevdir=$(out)/lib/udev"
-    "--with-systemdunitdir=$(out)/etc/systemd/system"
-    "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
-    "--with-mounthelperdir=$(out)/bin"
-    "--sysconfdir=/etc"
-    "--localstatedir=/var"
-    "--enable-systemd"
-  ] ++ optionals buildKernel [
-    "--with-spl=${spl}/libexec/spl"
-    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-  ];
-
-  enableParallelBuilding = true;
-
-  installFlags = [
-    "sysconfdir=\${out}/etc"
-    "DEFAULT_INITCONF_DIR=\${out}/default"
-  ];
-
-  postInstall = ''
-    # Prevent kernel modules from depending on the Linux -dev output.
-    nuke-refs $(find $out -name "*.ko")
-  '' + optionalString buildUser ''
-    # Remove provided services as they are buggy
-    rm $out/etc/systemd/system/zfs-import-*.service
-
-    sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
-
-    for i in $out/etc/systemd/system/*; do
-      substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
-    done
-
-    # Fix pkgconfig.
-    ln -s ../share/pkgconfig $out/lib/pkgconfig
-  '';
-
-  meta = {
-    description = "ZFS Filesystem Linux Kernel module";
-    longDescription = ''
-      ZFS is a filesystem that combines a logical volume manager with a
-      Copy-On-Write filesystem with data integrity detection and repair,
-      snapshotting, cloning, block devices, deduplication, and more.
+  common = { version, sha256, extraPatches, spl, inkompatibleKernelVersion ? null } @ args:
+    if buildKernel &&
+       (inkompatibleKernelVersion != null) &&
+       versionAtLeast kernel.version inkompatibleKernelVersion then
+      throw "linux v${kernel.version} is not yet supported by zfsonlinux v${version}"
+    else stdenv.mkDerivation rec {
+      name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
+
+      src = fetchFromGitHub {
+        owner = "zfsonlinux";
+        repo = "zfs";
+        rev = "zfs-${version}";
+        inherit sha256;
+      };
+
+      patches = extraPatches;
+
+      buildInputs = [ autoreconfHook nukeReferences ]
+      ++ optionals buildKernel [ spl ]
+      ++ optionals buildUser [ zlib libuuid python attr ];
+
+      # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
+      NIX_CFLAGS_LINK = "-lgcc_s";
+
+      hardeningDisable = [ "pic" ];
+
+      preConfigure = ''
+        substituteInPlace ./module/zfs/zfs_ctldir.c   --replace "umount -t zfs"           "${utillinux}/bin/umount -t zfs"
+        substituteInPlace ./module/zfs/zfs_ctldir.c   --replace "mount -t zfs"            "${utillinux}/bin/mount -t zfs"
+        substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/umount"             "${utillinux}/bin/umount"
+        substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/mount"              "${utillinux}/bin/mount"
+        substituteInPlace ./udev/rules.d/*            --replace "/lib/udev/vdev_id"       "$out/lib/udev/vdev_id"
+        substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/ztest"         "$out/sbin/ztest"
+        substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/zdb"           "$out/sbin/zdb"
+        substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
+        substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d"
+        substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
+        substituteInPlace ./cmd/zed/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
+        substituteInPlace ./module/Makefile.in        --replace "/bin/cp"                 "cp"
+        substituteInPlace ./etc/systemd/system/zfs-share.service.in \
+          --replace "@bindir@/rm " "${coreutils}/bin/rm "
+        ./autogen.sh
+      '';
+
+      configureFlags = [
+        "--with-config=${configFile}"
+        ] ++ optionals buildUser [
+        "--with-dracutdir=$(out)/lib/dracut"
+        "--with-udevdir=$(out)/lib/udev"
+        "--with-systemdunitdir=$(out)/etc/systemd/system"
+        "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
+        "--with-mounthelperdir=$(out)/bin"
+        "--sysconfdir=/etc"
+        "--localstatedir=/var"
+        "--enable-systemd"
+        ] ++ optionals buildKernel [
+        "--with-spl=${spl}/libexec/spl"
+        "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+        "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+      ];
+
+      enableParallelBuilding = true;
+
+      installFlags = [
+        "sysconfdir=\${out}/etc"
+        "DEFAULT_INITCONF_DIR=\${out}/default"
+      ];
+
+      postInstall = ''
+        # Prevent kernel modules from depending on the Linux -dev output.
+        nuke-refs $(find $out -name "*.ko")
+      '' + optionalString buildUser ''
+        # Remove provided services as they are buggy
+        rm $out/etc/systemd/system/zfs-import-*.service
+
+        sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
+
+        for i in $out/etc/systemd/system/*; do
+        substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
+        done
+
+        # Fix pkgconfig.
+        ln -s ../share/pkgconfig $out/lib/pkgconfig
+
+        # Remove tests because they add a runtime dependency on gcc
+        rm -rf $out/share/zfs/zfs-tests
       '';
-    homepage = http://zfsonlinux.org/;
-    license = licenses.cddl;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ jcumming wizeman wkennington ];
-  };
-}
+
+      meta = {
+        description = "ZFS Filesystem Linux Kernel module";
+        longDescription = ''
+          ZFS is a filesystem that combines a logical volume manager with a
+          Copy-On-Write filesystem with data integrity detection and repair,
+          snapshotting, cloning, block devices, deduplication, and more.
+        '';
+        homepage = http://zfsonlinux.org/;
+        license = licenses.cddl;
+        platforms = platforms.linux;
+        maintainers = with maintainers; [ jcumming wizeman wkennington fpletz ];
+      };
+    };
+in
+  assert any (n: n == configFile) [ "kernel" "user" "all" ];
+  assert buildKernel -> kernel != null && spl != null;
+  {
+    # also check if kernel version constraints in
+    # ./nixos/modules/tasks/filesystems/zfs.nix needs
+    # to be adapted
+    zfsStable = common {
+      # comment/uncomment if breaking kernel versions are known
+      inkompatibleKernelVersion = "4.9";
+
+      version = "0.6.5.8";
+
+      # this package should point to the latest release.
+      sha256 = "0qccz1832p3i80qlrrrypypspb9sy9hmpgcfx9vmhnqmkf0yri4a";
+      extraPatches = [
+        (fetchpatch {
+          url = "https://github.com/Mic92/zfs/compare/zfs-0.6.5.8...nixos-zfs-0.6.5.8.patch";
+          sha256 = "14kqqphzg02m9a7qncdhff8958cfzdrvsid3vsrm9k75lqv1w08z";
+        })
+      ];
+      inherit spl;
+    };
+    zfsUnstable = common {
+      # comment/uncomment if breaking kernel versions are known
+      inkompatibleKernelVersion = "4.10";
+
+      version = "0.7.0-rc2";
+
+      # this package should point to a version / git revision compatible with the latest kernel release
+      sha256 = "197y2jyav9h1ksri9kzqvrwmzpb58mlgw27vfvgd4bvxpwfxq53s";
+      extraPatches = [
+        (fetchpatch {
+          url = "https://github.com/Mic92/zfs/compare/zfs-0.7.0-rc2...nixos-zfs-0.7.0-rc2.patch";
+          sha256 = "1p33bwd6p5r5phbqb657x8h9x3bd012k2mdmbzgnb09drh9v0r82";
+        })
+        (fetchpatch {
+          name = "Kernel_4.9_zfs_aio_fsync_removal.patch";
+          url = "https://github.com/zfsonlinux/zfs/commit/99ca173929cb693012dabe98bcee4f12ec7e6e92.patch";
+          sha256 = "10npvpj52rpq88vdsn7zkdhx2lphzvqypsd9abdadjbqkwxld9la";
+        })
+      ];
+      spl = splUnstable;
+    };
+  }
diff --git a/pkgs/os-specific/linux/zfs/nix-build.patch b/pkgs/os-specific/linux/zfs/nix-build.patch
deleted file mode 100644
index cc9e36838c7..00000000000
--- a/pkgs/os-specific/linux/zfs/nix-build.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index f8abb5f..82e8fb6 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -11,10 +11,10 @@ endif
- if CONFIG_KERNEL
- SUBDIRS += module
- 
--extradir = @prefix@/src/zfs-$(VERSION)
-+extradir = @prefix@/libexec/zfs-$(VERSION)
- extra_HEADERS = zfs.release.in zfs_config.h.in
- 
--kerneldir = @prefix@/src/zfs-$(VERSION)/$(LINUX_VERSION)
-+kerneldir = @prefix@/zfs-$(VERSION)/$(LINUX_VERSION)
- nodist_kernel_HEADERS = zfs.release zfs_config.h module/$(LINUX_SYMBOLS)
- endif
- 
-diff --git a/include/Makefile.am b/include/Makefile.am
-index a94cad5..a160fe2 100644
---- a/include/Makefile.am
-+++ b/include/Makefile.am
-@@ -29,6 +29,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
- endif
- 
- if CONFIG_KERNEL
--kerneldir = @prefix@/src/zfs-$(VERSION)/include
-+kerneldir = @prefix@/include
- kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
- endif
-diff --git a/include/linux/Makefile.am b/include/linux/Makefile.am
-index 595d1db..d41375d 100644
---- a/include/linux/Makefile.am
-+++ b/include/linux/Makefile.am
-@@ -18,6 +18,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
- endif
- 
- if CONFIG_KERNEL
--kerneldir = @prefix@/src/zfs-$(VERSION)/include/linux
-+kerneldir = @prefix@/include/linux
- kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
- endif
-diff --git a/include/sys/Makefile.am b/include/sys/Makefile.am
-index 77ecfb2..52b3612 100644
---- a/include/sys/Makefile.am
-+++ b/include/sys/Makefile.am
-@@ -114,6 +114,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
- endif
- 
- if CONFIG_KERNEL
--kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys
-+kerneldir = @prefix@/include/sys
- kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
- endif
-diff --git a/include/sys/fm/Makefile.am b/include/sys/fm/Makefile.am
-index 8bca5d8..a5eafcd 100644
---- a/include/sys/fm/Makefile.am
-+++ b/include/sys/fm/Makefile.am
-@@ -16,6 +16,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
- endif
- 
- if CONFIG_KERNEL
--kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys/fm
-+kerneldir = @prefix@/include/sys/fm
- kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
- endif
-diff --git a/include/sys/fm/fs/Makefile.am b/include/sys/fm/fs/Makefile.am
-index fdc9eb5..807c47c 100644
---- a/include/sys/fm/fs/Makefile.am
-+++ b/include/sys/fm/fs/Makefile.am
-@@ -13,6 +13,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
- endif
- 
- if CONFIG_KERNEL
--kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys/fm/fs
-+kerneldir = @prefix@/include/sys/fm/fs
- kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
- endif
-diff --git a/include/sys/fs/Makefile.am b/include/sys/fs/Makefile.am
-index 0859b9f..b0c6eec 100644
---- a/include/sys/fs/Makefile.am
-+++ b/include/sys/fs/Makefile.am
-@@ -13,6 +13,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
- endif
- 
- if CONFIG_KERNEL
--kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys/fs
-+kerneldir = @prefix@/include/sys/fs
- kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
- endif
-diff --git a/module/Makefile.in b/module/Makefile.in
-index d4ddee2..876c811 100644
---- a/module/Makefile.in
-+++ b/module/Makefile.in
-@@ -18,9 +18,9 @@ modules:
- 	@# installed devel headers, or they may be in the module
- 	@# subdirectory when building against the spl source tree.
- 	@if [ -f @SPL_OBJ@/@SPL_SYMBOLS@ ]; then \
--		/bin/cp @SPL_OBJ@/@SPL_SYMBOLS@ .; \
-+		cp @SPL_OBJ@/@SPL_SYMBOLS@ .; \
- 	elif [ -f @SPL_OBJ@/module/@SPL_SYMBOLS@ ]; then \
--		/bin/cp @SPL_OBJ@/module/@SPL_SYMBOLS@ .; \
-+		cp @SPL_OBJ@/module/@SPL_SYMBOLS@ .; \
- 	else \
- 		echo -e "\n" \
- 		"*** Missing spl symbols ensure you have built the spl:\n" \
-@@ -28,6 +28,8 @@ modules:
- 		"*** - @SPL_OBJ@/module/@SPL_SYMBOLS@\n"; \
- 		exit 1; \
- 	fi
-+	@# when copying a file out of the nix store, we need to make it writable again.
-+	chmod +w @SPL_SYMBOLS@
- 	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` @KERNELMAKE_PARAMS@ CONFIG_ZFS=m $@
- 
- clean:
-@@ -42,15 +44,15 @@ clean:
- modules_install:
- 	@# Install the kernel modules
- 	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` $@ \
--		INSTALL_MOD_PATH=$(DESTDIR)$(INSTALL_MOD_PATH) \
-+		INSTALL_MOD_PATH=@prefix@/$(INSTALL_MOD_PATH) \
- 		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR) \
- 		KERNELRELEASE=@LINUX_VERSION@
- 	@# Remove extraneous build products when packaging
--	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
--	if [ -n "$(DESTDIR)" ]; then \
-+	kmoddir=@prefix@/$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
-+	if [ -n "@prefix@" ]; then \
- 		find $$kmoddir -name 'modules.*' | xargs $(RM); \
- 	fi
--	sysmap=$(DESTDIR)$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
-+	sysmap=@prefix@/$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
- 	if [ -f $$sysmap ]; then \
- 		depmod -ae -F $$sysmap @LINUX_VERSION@; \
- 	fi