summary refs log tree commit diff
path: root/pkgs/os-specific/linux
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific/linux')
-rw-r--r--pkgs/os-specific/linux/acpi/default.nix2
-rw-r--r--pkgs/os-specific/linux/acpid/default.nix1
-rw-r--r--pkgs/os-specific/linux/alsa-utils/default.nix3
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/default.nix4
-rw-r--r--pkgs/os-specific/linux/android-udev-rules/default.nix4
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix96
-rw-r--r--pkgs/os-specific/linux/ati-drivers/builder.sh4
-rw-r--r--pkgs/os-specific/linux/ati-drivers/default.nix8
-rw-r--r--pkgs/os-specific/linux/audit/default.nix23
-rw-r--r--pkgs/os-specific/linux/autofs/default.nix4
-rw-r--r--pkgs/os-specific/linux/batman-adv/alfred.nix4
-rw-r--r--pkgs/os-specific/linux/batman-adv/batctl.nix4
-rw-r--r--pkgs/os-specific/linux/batman-adv/default.nix6
-rw-r--r--pkgs/os-specific/linux/bbswitch/default.nix2
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix16
-rw-r--r--pkgs/os-specific/linux/beegfs/default.nix46
-rw-r--r--pkgs/os-specific/linux/beegfs/kernel-module.nix5
-rw-r--r--pkgs/os-specific/linux/blktrace/default.nix6
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix6
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/default.nix1
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/linux-4.15.patch47
-rw-r--r--pkgs/os-specific/linux/btfs/default.nix6
-rw-r--r--pkgs/os-specific/linux/busybox/busybox-in-store.patch12
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix37
-rw-r--r--pkgs/os-specific/linux/busybox/sandbox-shell.nix27
-rw-r--r--pkgs/os-specific/linux/cachefilesd/default.nix4
-rw-r--r--pkgs/os-specific/linux/cifs-utils/default.nix8
-rw-r--r--pkgs/os-specific/linux/conky/default.nix22
-rw-r--r--pkgs/os-specific/linux/conntrack-tools/default.nix2
-rw-r--r--pkgs/os-specific/linux/cpupower/default.nix41
-rw-r--r--pkgs/os-specific/linux/crda/default.nix1
-rw-r--r--pkgs/os-specific/linux/criu/criu-2.12.1-glibc-2.26.patch13
-rw-r--r--pkgs/os-specific/linux/criu/default.nix11
-rw-r--r--pkgs/os-specific/linux/dbus-broker/default.nix11
-rw-r--r--pkgs/os-specific/linux/displaylink/default.nix9
-rw-r--r--pkgs/os-specific/linux/dmtcp/default.nix4
-rw-r--r--pkgs/os-specific/linux/dstat/default.nix2
-rw-r--r--pkgs/os-specific/linux/eudev/default.nix4
-rw-r--r--pkgs/os-specific/linux/evdi/default.nix12
-rw-r--r--pkgs/os-specific/linux/eventstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/exfat/default.nix2
-rw-r--r--pkgs/os-specific/linux/fatrace/default.nix1
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix12
-rw-r--r--pkgs/os-specific/linux/ffado/gcc6.patch19
-rw-r--r--pkgs/os-specific/linux/ffado/glibc226.patch10
-rw-r--r--pkgs/os-specific/linux/firejail/default.nix8
-rw-r--r--pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix1
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix3
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix88
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/fix-missing-deps.patch22
-rw-r--r--pkgs/os-specific/linux/firmware/fwupdate/default.nix99
-rw-r--r--pkgs/os-specific/linux/firmware/fwupdate/do-not-create-sharedstatedir.patch10
-rw-r--r--pkgs/os-specific/linux/firmware/fwupdate/fix-paths.patch116
-rw-r--r--pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix2
-rw-r--r--pkgs/os-specific/linux/fnotifystat/default.nix4
-rw-r--r--pkgs/os-specific/linux/forkstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/freefall/default.nix1
-rw-r--r--pkgs/os-specific/linux/fscrypt/default.nix10
-rw-r--r--pkgs/os-specific/linux/fscryptctl/default.nix8
-rw-r--r--pkgs/os-specific/linux/fscryptctl/install.patch22
-rw-r--r--pkgs/os-specific/linux/ftop/default.nix1
-rw-r--r--pkgs/os-specific/linux/fuse/common.nix6
-rw-r--r--pkgs/os-specific/linux/fuse/default.nix2
-rw-r--r--pkgs/os-specific/linux/fwts/default.nix30
-rw-r--r--pkgs/os-specific/linux/gogoclient/default.nix2
-rw-r--r--pkgs/os-specific/linux/hal-flash/default.nix6
-rw-r--r--pkgs/os-specific/linux/hdparm/default.nix4
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix6
-rw-r--r--pkgs/os-specific/linux/iio-sensor-proxy/default.nix8
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix12
-rw-r--r--pkgs/os-specific/linux/ipset/default.nix4
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix4
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix18
-rw-r--r--pkgs/os-specific/linux/ipvsadm/default.nix37
-rw-r--r--pkgs/os-specific/linux/irqbalance/default.nix4
-rw-r--r--pkgs/os-specific/linux/jfbview/default.nix3
-rw-r--r--pkgs/os-specific/linux/kbd/default.nix2
-rw-r--r--pkgs/os-specific/linux/kernel-headers/4.4.nix61
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix54
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix97
-rw-r--r--pkgs/os-specific/linux/kernel/generate-config.pl14
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix93
-rw-r--r--pkgs/os-specific/linux/kernel/hardened-config.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.13.nix17
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix11
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.15.nix18
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/linux-beagleboard.nix23
-rw-r--r--pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix (renamed from pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix)8
-rw-r--r--pkgs/os-specific/linux/kernel/linux-mptcp.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/linux-riscv.nix18
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-samus-4.12.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix13
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix12
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix102
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/perf.nix37
-rwxr-xr-xpkgs/os-specific/linux/kernel/update.sh6
-rw-r--r--pkgs/os-specific/linux/kexectools/default.nix5
-rw-r--r--pkgs/os-specific/linux/kmod/default.nix4
-rw-r--r--pkgs/os-specific/linux/kmscon/default.nix4
-rw-r--r--pkgs/os-specific/linux/kmscube/default.nix6
-rw-r--r--pkgs/os-specific/linux/libaio/default.nix7
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix5
-rw-r--r--pkgs/os-specific/linux/libnl/default.nix8
-rw-r--r--pkgs/os-specific/linux/libsemanage/default.nix8
-rw-r--r--pkgs/os-specific/linux/libsepol/default.nix2
-rw-r--r--pkgs/os-specific/linux/libsmbios/default.nix25
-rw-r--r--pkgs/os-specific/linux/lm-sensors/default.nix4
-rw-r--r--pkgs/os-specific/linux/lm-sensors/musl-fix-includes.patch62
-rw-r--r--pkgs/os-specific/linux/lttng-modules/default.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/default.nix23
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix10
-rw-r--r--pkgs/os-specific/linux/mbpfan/default.nix4
-rw-r--r--pkgs/os-specific/linux/mcelog/default.nix5
-rw-r--r--pkgs/os-specific/linux/mdadm/4.nix43
-rw-r--r--pkgs/os-specific/linux/mdadm/default.nix9
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix6
-rw-r--r--pkgs/os-specific/linux/musl/default.nix55
-rw-r--r--pkgs/os-specific/linux/musl/fts.nix14
-rw-r--r--pkgs/os-specific/linux/musl/getconf.nix19
-rw-r--r--pkgs/os-specific/linux/musl/getent.nix18
-rw-r--r--pkgs/os-specific/linux/net-tools/default.nix5
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix5
-rw-r--r--pkgs/os-specific/linux/numactl/default.nix23
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix20
-rw-r--r--pkgs/os-specific/linux/nvidiabl/default.nix19
-rw-r--r--pkgs/os-specific/linux/nvidiabl/linux4compat.patch22
-rw-r--r--pkgs/os-specific/linux/nvme-cli/default.nix4
-rw-r--r--pkgs/os-specific/linux/openvswitch/default.nix4
-rw-r--r--pkgs/os-specific/linux/pagemon/default.nix5
-rw-r--r--pkgs/os-specific/linux/pam/default.nix26
-rw-r--r--pkgs/os-specific/linux/pam_krb5/default.nix2
-rw-r--r--pkgs/os-specific/linux/pam_mount/default.nix6
-rw-r--r--pkgs/os-specific/linux/pcm/default.nix26
-rw-r--r--pkgs/os-specific/linux/perf-tools/default.nix6
-rw-r--r--pkgs/os-specific/linux/phc-intel/default.nix3
-rw-r--r--pkgs/os-specific/linux/pipework/default.nix9
-rw-r--r--pkgs/os-specific/linux/pmount/default.nix2
-rw-r--r--pkgs/os-specific/linux/pommed/default.nix4
-rw-r--r--pkgs/os-specific/linux/powerstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/powertop/default.nix2
-rw-r--r--pkgs/os-specific/linux/prl-tools/default.nix9
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix5
-rw-r--r--pkgs/os-specific/linux/radeontop/default.nix2
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix40
-rw-r--r--pkgs/os-specific/linux/reptyr/default.nix3
-rw-r--r--pkgs/os-specific/linux/rewritefs/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8192eu/default.nix39
-rw-r--r--pkgs/os-specific/linux/rtl8812au/default.nix42
-rw-r--r--pkgs/os-specific/linux/rtl8814au/default.nix39
-rw-r--r--pkgs/os-specific/linux/rtlwifi_new/default.nix6
-rw-r--r--pkgs/os-specific/linux/sdparm/default.nix1
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix11
-rw-r--r--pkgs/os-specific/linux/smemstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/spl/default.nix16
-rw-r--r--pkgs/os-specific/linux/sssd/default.nix4
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix4
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/cryptsetup-generator.nix14
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix298
-rw-r--r--pkgs/os-specific/linux/tp_smapi/default.nix7
-rw-r--r--pkgs/os-specific/linux/trinity/default.nix9
-rw-r--r--pkgs/os-specific/linux/udisks-glue/default.nix6
-rw-r--r--pkgs/os-specific/linux/udisks/1-default.nix4
-rw-r--r--pkgs/os-specific/linux/udisks/2-default.nix10
-rw-r--r--pkgs/os-specific/linux/upower/default.nix8
-rw-r--r--pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch13
-rw-r--r--pkgs/os-specific/linux/usbguard/default.nix22
-rw-r--r--pkgs/os-specific/linux/usbguard/documentation.patch32
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix7
-rw-r--r--pkgs/os-specific/linux/v4l-utils/default.nix4
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/default.nix1
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix4
-rw-r--r--pkgs/os-specific/linux/wireless-tools/default.nix12
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix41
178 files changed, 1859 insertions, 1144 deletions
diff --git a/pkgs/os-specific/linux/acpi/default.nix b/pkgs/os-specific/linux/acpi/default.nix
index 6dae0f6bb38..37de98780b6 100644
--- a/pkgs/os-specific/linux/acpi/default.nix
+++ b/pkgs/os-specific/linux/acpi/default.nix
@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     homepage = https://sourceforge.net/projects/acpiclient/;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = [ maintainers.mornfall ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/acpid/default.nix b/pkgs/os-specific/linux/acpid/default.nix
index 95efbab5be4..c209cf6e316 100644
--- a/pkgs/os-specific/linux/acpid/default.nix
+++ b/pkgs/os-specific/linux/acpid/default.nix
@@ -13,6 +13,5 @@ stdenv.mkDerivation rec {
     description = "A daemon for delivering ACPI events to userspace programs";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index c9b5b0d2e2d..e2340939fce 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -17,7 +17,8 @@ stdenv.mkDerivation rec {
       --replace "which" "type -p" \
       --replace "lspci" "${pciutils}/bin/lspci"
   '';
-  buildInputs = [ gettext alsaLib ncurses libsamplerate fftw ];
+  nativeBuildInputs = [ gettext ];
+  buildInputs = [ alsaLib ncurses libsamplerate fftw ];
 
   configureFlags = "--disable-xmlto --with-udev-rules-dir=$(out)/lib/udev/rules.d";
 
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index ccf13656fff..a3c09c3de99 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, elfutils, mesa_noglu
+{ stdenv, fetchurl, elfutils, libGL
 , xorg, patchelf, openssl, libdrm, libudev
 , libxcb, libxshmfence, epoxy, perl, zlib
 , fetchFromGitHub, ncurses
@@ -13,7 +13,7 @@ let
 
   kernelDir = if libsOnly then null else kernel.dev;
 
-  inherit (mesa_noglu) driverLink;
+  inherit (libGL) driverLink;
 
   bitness = if stdenv.is64bit then "64" else "32";
 
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index ff32ca01a97..88e8a966558 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "android-udev-rules-${version}";
-  version = "20171113";
+  version = "20180112";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    sha256 = "11gcnk6wjc2sw05hwi4xphvx9ksmkpvsdziaczymqxkaads3f1dy";
+    sha256 = "13gj79nnd04szqlrrzzkdr6wi1fky08pi7x8xfbg0jj3d3v0giah";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index b576ca71d58..c8e58dfbf6f 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -1,16 +1,20 @@
-{ stdenv, fetchurl, makeWrapper, autoreconfHook
+{ stdenv, fetchurl, fetchpatch, makeWrapper, autoreconfHook
 , pkgconfig, which
 , flex, bison
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
-, pythonPackages
+, python
+, gawk
 , perl
 , swig
+, ncurses
 , pam
+, buildPackages
 }:
 
 let
-  apparmor-series = "2.10";
-  apparmor-version = apparmor-series;
+  apparmor-series = "2.12";
+  apparmor-patchver = "0";
+  apparmor-version = apparmor-series + "." + apparmor-patchver;
 
   apparmor-meta = component: with stdenv.lib; {
     homepage = http://apparmor.net/;
@@ -21,17 +25,38 @@ let
   };
 
   apparmor-sources = fetchurl {
-    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "1x06qmmbha9krx7880pxj2k3l8fxy3nm945xjjv735m2ax1243jd";
+    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-series}.tar.gz";
+    sha256 = "0mm0mcp0w18si9wl15drndysm7v27az2942p1xjd197shg80qawa";
   };
 
   prePatchCommon = ''
-    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"
-    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"
+    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man"
+    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html"
     substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
     substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"
   '';
 
+  # use 'if c then x else null' to avoid rebuilding
+  # patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [
+  patches = if stdenv.hostPlatform.isMusl then [
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0002-Provide-missing-secure_getenv-and-scandirat-function.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
+      name = "0002-Provide-missing-secure_getenv-and-scandirat-function.patch";
+      sha256 = "0pj1bzifghxwxlc39j8hyy17dkjr9fk64kkj94ayymyprz4i4nac";
+    })
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0003-Added-missing-typedef-definitions-on-parser.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
+      name = "0003-Added-missing-typedef-definitions-on-parser.patch";
+      sha256 = "0yyaqz8jlmn1bm37arggprqz0njb4lhjni2d9c8qfqj0kll0bam0";
+    })
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0007-Do-not-build-install-vim-file-with-utils-package.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
+      name = "0007-Do-not-build-install-vim-file-with-utils-package.patch";
+      sha256 = "1m4dx901biqgnr4w4wz8a2z9r9dxyw7wv6m6mqglqwf2lxinqmp4";
+    })
+    # (alpine patches {1,4,5,6,8} are needed for apparmor 2.11, but not 2.12)
+  ] else null;
+
   # FIXME: convert these to a single multiple-outputs package?
 
   libapparmor = stdenv.mkDerivation {
@@ -44,12 +69,14 @@ let
       flex
       pkgconfig
       swig
+      ncurses
       which
+      perl
     ];
 
-    buildInputs = [
+    buildInputs = stdenv.lib.optionals (!stdenv.isCross) [
       perl
-      pythonPackages.python
+      python
     ];
 
     # required to build apparmor-parser
@@ -59,13 +86,15 @@ let
       substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${stdenv.cc.libc.dev}/include/netinet/in.h"
       substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${stdenv.cc.libc.dev}/include/netinet/in.h"
     '';
+    inherit patches;
 
     postPatch = "cd ./libraries/libapparmor";
-    configureFlags = "--with-python --with-perl";
+    # https://gitlab.com/apparmor/apparmor/issues/1
+    configureFlags = stdenv.lib.optionalString (!stdenv.isCross) "--with-python --with-perl";
 
-    outputs = [ "out" "python" ];
+    outputs = if stdenv.isCross then [ "out" ] else [ "out" "python" ];
 
-    postInstall = ''
+    postInstall = stdenv.lib.optionalString (!stdenv.isCross) ''
       mkdir -p $python/lib
       mv $out/lib/python* $python/lib/
     '';
@@ -81,22 +110,23 @@ let
 
     buildInputs = [
       perl
-      pythonPackages.python
+      python
       libapparmor
       libapparmor.python
     ];
 
     prePatch = prePatchCommon;
+    inherit patches;
     postPatch = "cd ./utils";
     makeFlags = ''LANGS='';
     installFlags = ''DESTDIR=$(out) BINDIR=$(out)/bin VIM_INSTALL_PATH=$(out)/share PYPREFIX='';
 
     postInstall = ''
       for prog in aa-audit aa-autodep aa-cleanprof aa-complain aa-disable aa-enforce aa-genprof aa-logprof aa-mergeprof aa-status aa-unconfined ; do
-        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${pythonPackages.python.libPrefix}/site-packages:$PYTHONPATH"
+        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
       done
 
-      for prog in aa-exec aa-notify ; do
+      for prog in aa-notify ; do
         wrapProgram $out/bin/$prog --prefix PERL5LIB : "${libapparmor}/lib/perl5:$PERL5LIB"
       done
     '';
@@ -104,6 +134,29 @@ let
     meta = apparmor-meta "user-land utilities";
   };
 
+  apparmor-bin-utils = stdenv.mkDerivation {
+    name = "apparmor-bin-utils-${apparmor-version}";
+    src = apparmor-sources;
+
+    nativeBuildInputs = [
+      pkgconfig
+      libapparmor
+      gawk
+      which
+    ];
+
+    buildInputs = [
+      libapparmor
+    ];
+
+    prePatch = prePatchCommon;
+    postPatch = "cd ./binutils";
+    makeFlags = ''LANGS= USE_SYSTEM=1'';
+    installFlags = ''DESTDIR=$(out) BINDIR=$(out)/bin'';
+
+    meta = apparmor-meta "binary user-land utilities";
+  };
+
   apparmor-parser = stdenv.mkDerivation {
     name = "apparmor-parser-${apparmor-version}";
     src = apparmor-sources;
@@ -119,6 +172,7 @@ let
       ## techdoc.pdf still doesn't build ...
       substituteInPlace ./parser/Makefile --replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
     '';
+    inherit patches;
     postPatch = "cd ./parser";
     makeFlags = ''LANGS= USE_SYSTEM=1 INCLUDEDIR=${libapparmor}/include'';
     installFlags = ''DESTDIR=$(out) DISTRO=unknown'';
@@ -170,6 +224,12 @@ let
 in
 
 {
-  inherit libapparmor apparmor-utils apparmor-parser apparmor-pam
-  apparmor-profiles apparmor-kernel-patches;
+  inherit
+    libapparmor
+    apparmor-utils
+    apparmor-bin-utils
+    apparmor-parser
+    apparmor-pam
+    apparmor-profiles
+    apparmor-kernel-patches;
 }
diff --git a/pkgs/os-specific/linux/ati-drivers/builder.sh b/pkgs/os-specific/linux/ati-drivers/builder.sh
index 2b907bde10a..6cb8cacbffa 100644
--- a/pkgs/os-specific/linux/ati-drivers/builder.sh
+++ b/pkgs/os-specific/linux/ati-drivers/builder.sh
@@ -246,9 +246,9 @@ if test -z "$libsOnly"; then
   ( # build and install fgl_glxgears
     cd fgl_glxgears;
     gcc -DGL_ARB_texture_multisample=1 -g \
-    -I$mesa/include \
+    -I$libGLU_combined/include \
     -I$out/include \
-    -L$mesa/lib -lGL -lGLU -lX11 -lm \
+    -L$libGLU_combined/lib -lGL -lGLU -lX11 -lm \
     -o $out/bin/fgl_glxgears -Wall fgl_glxgears.c
   )
 
diff --git a/pkgs/os-specific/linux/ati-drivers/default.nix b/pkgs/os-specific/linux/ati-drivers/default.nix
index d9e6ec3cf62..df6fa3555fe 100644
--- a/pkgs/os-specific/linux/ati-drivers/default.nix
+++ b/pkgs/os-specific/linux/ati-drivers/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchurl, kernel ? null, which
 , xorg, makeWrapper, glibc, patchelf, unzip
-, fontconfig, freetype, mesa # for fgl_glxgears
+, fontconfig, freetype, libGLU_combined # for fgl_glxgears
 , # Whether to build the libraries only (i.e. not the kernel module or
   # driver utils). Used to support 32-bit binaries on 64-bit
   # Linux.
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
       xorg.libXrandr xorg.libXxf86vm xorg.xf86vidmodeproto xorg.imake xorg.libICE
       patchelf
       unzip
-      mesa
+      libGLU_combined
       fontconfig
       freetype
       makeWrapper
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
   LD_LIBRARY_PATH = makeLibraryPath
     [ xorg.libXrender xorg.libXext xorg.libX11 xorg.libXinerama xorg.libSM
       xorg.libXrandr xorg.libXxf86vm xorg.xf86vidmodeproto xorg.imake xorg.libICE
-      mesa
+      libGLU_combined
       fontconfig
       freetype
       stdenv.cc.cc
@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
                    xorg.libX11.out xorg.libXinerama.out xorg.libSM.out
                    xorg.libICE.out ];
 
-  inherit mesa; # only required to build the examples
+  inherit libGLU_combined; # only required to build the examples
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 7bec6cadcfc..390bab849c2 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -1,20 +1,21 @@
 {
-  stdenv, fetchurl,
+  stdenv, buildPackages, fetchurl, fetchpatch,
   enablePython ? false, python ? null,
 }:
 
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
-  name = "audit-2.8.1";
+  name = "audit-2.8.2";
 
   src = fetchurl {
     url = "http://people.redhat.com/sgrubb/audit/${name}.tar.gz";
-    sha256 = "0v1vng43fjsh158zb5k5d81ngn4p4jmj1247m27pk0bfzy9dxv0v";
+    sha256 = "1fmw8whraz1q3y3z5mgdpgsa3wz6r3zq0kgsgbc9xvmgfwmrpdb7";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = stdenv.lib.optional enablePython python;
 
   configureFlags = [
@@ -26,6 +27,22 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  patches = stdenv.lib.optional stdenv.hostPlatform.isMusl [
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/audit/0002-auparse-remove-use-of-rawmemchr.patch?id=3e57180fdf3f90c30a25aea44f57846efc93a696";
+      name = "0002-auparse-remove-use-of-rawmemchr.patch";
+      sha256 = "1caaqbfgb2rq3ria5bz4n8x30ihgihln6w9w9a46k62ba0wh9rkz";
+    })
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/audit/0003-all-get-rid-of-strndupa.patch?id=3e57180fdf3f90c30a25aea44f57846efc93a696";
+      name = "0003-all-get-rid-of-strndupa.patch";
+      sha256 = "1ddrm6a0ijrf7caw1wpw2kkbjp2lkxkmc16v51j5j7dvdalc6591";
+    })
+  ];
+
+  prePatch = ''
+    sed -i 's,#include <sys/poll.h>,#include <poll.h>\n#include <limits.h>,' audisp/audispd.c
+  '';
   meta = {
     description = "Audit Library";
     homepage = http://people.redhat.com/sgrubb/audit/;
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 8c207e4a47d..79e12dd0f43 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -2,14 +2,14 @@
 , libxml2, kerberos, kmod, openldap, sssd, cyrus_sasl, openssl }:
 
 let
-  version = "5.1.3";
+  version = "5.1.4";
   name = "autofs-${version}";
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
     url = "mirror://kernel/linux/daemons/autofs/v5/${name}.tar.xz";
-    sha256 = "1gxifa93104pxlmxrikhwciy5zdgk20m63siyhq1myym7vzfnvp9";
+    sha256 = "08hpphawzcdibwbhw0r3y7hnfczlazpp90sf3bz2imgza7p31klg";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
index 002e458b24d..9b7484932eb 100644
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, gpsd, libcap, libnl }:
 
 let
-  ver = "2017.3";
+  ver = "2018.0";
 in
 stdenv.mkDerivation rec {
   name = "alfred-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0202mxp7hwflkqnkkajx5lv1nxjng45q5gcvvdv68x46p8ikb5n2";
+    sha256 = "0mzjgjkmgdrrqa6fbpii9q1xqvg3kvwgq2k2kpdf0vy4xxnypky7";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index 6ff3903c4f2..ef1d51501e8 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:
 
 let
-  ver = "2017.3";
+  ver = "2018.0";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "1a48kc2v8cb1757pxlli96qf3d7x7k3qw04rjadfs0iy09sz1ir9";
+    sha256 = "1x7gy6agwk68s2cbhc4wfhvhdy2ccrq0vi7jzaj94pn8nqshi5ss";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index 4f8a85d5d88..8f835b6d7ed 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,15 +1,17 @@
 { stdenv, fetchurl, kernel }:
 
-let base = "batman-adv-2017.3"; in
+let base = "batman-adv-2018.0"; in
 
 stdenv.mkDerivation rec {
   name = "${base}-${kernel.version}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/${base}/${base}.tar.gz";
-    sha256 = "1m541czjwgi4rfhjr6rg9r9c3cp2ncnif4ln7ri926zigwlxs3l3";
+    sha256 = "0v2pyy9lxyy71nr9600k9935qcpn2wpyl9fsf2a4m4d2x0wgh9j8";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   hardeningDisable = [ "pic" ];
 
   preBuild = ''
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index ade9b8f750f..f5d3b4f5c4e 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "A module for powering off hybrid GPUs";
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" "i686-linux" ];
     homepage = https://github.com/Bumblebee-Project/bbswitch;
     maintainers = with maintainers; [ abbradar ];
   };
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index 23e8c1ca7d7..2e2c872fb18 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -1,5 +1,7 @@
-{ stdenv, fetchFromGitHub, fetchpatch, makeWrapper, cmake, llvmPackages_5, kernel
-, flex, bison, elfutils, python, pythonPackages, luajit, netperf, iperf, libelf }:
+{ stdenv, fetchFromGitHub, fetchpatch, makeWrapper, cmake, llvmPackages, kernel
+, flex, bison, elfutils, python, pythonPackages, luajit, netperf, iperf, libelf
+, systemtap
+}:
 
 stdenv.mkDerivation rec {
   version = "0.5.0";
@@ -13,8 +15,9 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    llvmPackages_5.llvm llvmPackages_5.clang-unwrapped kernel
+    llvmPackages.llvm llvmPackages.clang-unwrapped kernel
     elfutils python pythonPackages.netaddr luajit netperf iperf
+    systemtap.stapBuild
   ];
 
   patches = [
@@ -29,7 +32,12 @@ stdenv.mkDerivation rec {
     # libelf is incompatible with elfutils-libelf
     ++ stdenv.lib.filter (x: x != libelf) kernel.moduleBuildDependencies;
 
-  cmakeFlags="-DBCC_KERNEL_MODULES_DIR=${kernel.dev}/lib/modules";
+  cmakeFlags =
+    [ "-DBCC_KERNEL_MODULES_DIR=${kernel.dev}/lib/modules"
+      "-DREVISION=${version}"
+      "-DENABLE_USDT=ON"
+      "-DENABLE_CPP_API=ON"
+    ];
 
   postInstall = ''
     mkdir -p $out/bin $out/share
diff --git a/pkgs/os-specific/linux/beegfs/default.nix b/pkgs/os-specific/linux/beegfs/default.nix
index 1bb5612ce92..f17bc9492c1 100644
--- a/pkgs/os-specific/linux/beegfs/default.nix
+++ b/pkgs/os-specific/linux/beegfs/default.nix
@@ -1,12 +1,15 @@
 { stdenv, fetchurl, pkgconfig, unzip, which
-, libuuid, attr, xfsprogs, cppunit
+, libuuid, attr, xfsprogs, cppunit, rdma-core
 , zlib, openssl, sqlite, jre, openjdk, ant
+, openssh, perl, gfortran
 } :
 
 let
-  version = "6.17";
+  version = "6.18";
 
   subdirs = [
+    "beeond_thirdparty/build"
+    "beeond_thirdparty_gpl/build"
     "beegfs_thirdparty/build"
     "beegfs_opentk_lib/build"
     "beegfs_common/build"
@@ -27,24 +30,44 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://git.beegfs.com/pub/v6/repository/archive.tar.bz2?ref=${version}";
-    sha256 = "10xs7gzdmlg23k6zn1b7jij3lljn7rr1j6h476hq4lbg981qk3n3";
+    sha256 = "1g874qyxh4v53ah3lzchrqi0jci7wngr54q3f4d9q0kzvvifripn";
   };
 
-  nativeBuildInputs = [ which unzip pkgconfig cppunit openjdk ant];
-  buildInputs = [ libuuid attr xfsprogs zlib openssl sqlite jre ];
+  nativeBuildInputs = [ which unzip pkgconfig cppunit openjdk ant perl ];
+
+  buildInputs = [
+    libuuid
+    attr
+    xfsprogs
+    zlib
+    openssl
+    sqlite
+    jre
+    rdma-core
+    openssh
+    gfortran ];
+
+  hardeningDisable = [ "format" ]; # required for building beeond
 
   postPatch = ''
     patchShebangs ./
     find -type f -name Makefile -exec sed -i "s:/bin/bash:${stdenv.shell}:" \{} \;
     find -type f -name Makefile -exec sed -i "s:/bin/true:true:" \{} \;
     find -type f -name "*.mk" -exec sed -i "s:/bin/true:true:" \{} \;
+
+    # unpack manually and patch variable name
+    sed -i '/tar -C $(SOURCE_PATH) -xzf $(PCOPY_TAR)/d' beeond_thirdparty/build/Makefile
+    cd beeond_thirdparty/source
+    tar xf pcopy-0.96.tar.gz
+    sed -i 's/\([^_]\)rank/\1grank/' pcopy-0.96/src/pcp.cpp
+    cd ../..
   '';
 
   buildPhase = ''
     for i in ${toString subdirs}; do
-      make -C $i
+      make -C $i BEEGFS_OPENTK_IBVERBS=1
     done
-    make -C beegfs_admon/build admon_gui
+    make -C beegfs_admon/build admon_gui BEEGFS_OPENTK_IBVERBS=1
   '';
 
   installPhase = ''
@@ -93,6 +116,12 @@ in stdenv.mkDerivation rec {
 
     cp beegfs_client_devel/build/dist/usr/share/doc/beegfs-client-devel/examples/* $docDir
     cp -r beegfs_client_devel/include/* $includeDir
+
+    cp beeond_thirdparty_gpl/build/parallel $out/bin
+    cp beeond_thirdparty/build/pcopy/p* $out/bin
+    cp beeond_thirdparty/build/pcopy/s* $out/bin
+    cp -r beeond/scripts/* $out
+    cp beeond/source/* $out/bin
   '';
 
   postFixup = ''
@@ -100,6 +129,9 @@ in stdenv.mkDerivation rec {
       --replace " java " " ${jre}/bin/java " \
       --replace "/opt/beegfs/beegfs-admon-gui/beegfs-admon-gui.jar" \
                 "$libDirPkg/beegfs-admon-gui.jar"
+
+    substituteInPlace $out/bin/beeond \
+      --replace /opt/beegfs/sbin "$out/bin"
   '';
 
   doCheck = true;
diff --git a/pkgs/os-specific/linux/beegfs/kernel-module.nix b/pkgs/os-specific/linux/beegfs/kernel-module.nix
index 4525d156159..63e45928f21 100644
--- a/pkgs/os-specific/linux/beegfs/kernel-module.nix
+++ b/pkgs/os-specific/linux/beegfs/kernel-module.nix
@@ -3,13 +3,13 @@
 } :
 
 let
-  version = "6.17";
+  version = "6.18";
 in stdenv.mkDerivation {
   name = "beegfs-module-${version}-${kernel.version}";
 
   src = fetchurl {
     url = "https://git.beegfs.com/pub/v6/repository/archive.tar.bz2?ref=${version}";
-    sha256 = "10xs7gzdmlg23k6zn1b7jij3lljn7rr1j6h476hq4lbg981qk3n3";
+    sha256 = "1g874qyxh4v53ah3lzchrqi0jci7wngr54q3f4d9q0kzvvifripn";
   };
 
   hardeningDisable = [ "fortify" "pic" "stackprotector" ];
@@ -41,6 +41,5 @@ in stdenv.mkDerivation {
     platforms = [ "i686-linux" "x86_64-linux" ];
     license = licenses.gpl2;
     maintainers = with maintainers; [ markuskowa ];
-    broken = versionAtLeast kernel.version "4.14";
   };
 }
diff --git a/pkgs/os-specific/linux/blktrace/default.nix b/pkgs/os-specific/linux/blktrace/default.nix
index 886aa503abb..4ae449c19aa 100644
--- a/pkgs/os-specific/linux/blktrace/default.nix
+++ b/pkgs/os-specific/linux/blktrace/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, libaio }:
 
 stdenv.mkDerivation {
-  name = "blktrace-1.1.0";
+  name = "blktrace-1.2.0";
 
   # Official source
   # "git://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git"
   src = fetchurl {
-    url = "http://brick.kernel.dk/snaps/blktrace-1.1.0.tar.bz2";
-    sha256 = "15cj9aki7z5i5y6bnchqry6yp40r4lmgmam6ar5gslnx0smgm8jl";
+    url = "http://brick.kernel.dk/snaps/blktrace-1.2.0.tar.bz2";
+    sha256 = "0i9z7ayh9qx4wi0ihyz15bhr1c9aknjl8v5i8c9mx3rhyy41i5i6";
   };
 
   buildInputs = [ libaio ];
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index e9a1f314abc..62c3986569d 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -5,15 +5,15 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.47";
+  name = "bluez-5.48";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "1j22hfjz0fp4pgclgz9mfcwjbr4wqgah3gd2qhfg4r6msmybyxfg";
+    sha256 = "140fjyxa2q4y35d9n52vki649jzb094pf71hxkkvlrpgf8q75a5r";
   };
 
   pythonPath = with pythonPackages;
-    [ dbus pygobject2 pygobject3 recursivePthLoader ];
+    [ dbus-python pygobject2 pygobject3 recursivePthLoader ];
 
   buildInputs = [
     pkgconfig dbus glib alsaLib pythonPackages.python pythonPackages.wrapPython
diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
index c6bd4f4b206..9423e7a33f4 100644
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation {
     ./linux-4.11.patch
     # source: https://aur.archlinux.org/cgit/aur.git/tree/linux412.patch?h=broadcom-wl
     ./linux-4.12.patch
+    ./linux-4.15.patch
     ./null-pointer-fix.patch
     ./gcc.patch
   ];
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-4.15.patch b/pkgs/os-specific/linux/broadcom-sta/linux-4.15.patch
new file mode 100644
index 00000000000..523fa291d52
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/linux-4.15.patch
@@ -0,0 +1,47 @@
+See: https://lkml.org/lkml/2017/11/25/90
+
+diff -urNZ a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
+--- a/src/wl/sys/wl_linux.c	2015-09-18 22:47:30.000000000 +0000
++++ b/src/wl/sys/wl_linux.c	2018-01-31 22:52:10.859856221 +0000
+@@ -93,7 +93,11 @@
+
+ #include <wlc_wowl.h>
+
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
++static void wl_timer(struct timer_list *tl);
++#else
+ static void wl_timer(ulong data);
++#endif
+ static void _wl_timer(wl_timer_t *t);
+ static struct net_device *wl_alloc_linux_if(wl_if_t *wlif);
+
+@@ -2298,9 +2302,15 @@
+ }
+
+ static void
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
++wl_timer(struct timer_list *tl)
++{
++	wl_timer_t *t = from_timer(t, tl, timer);
++#else
+ wl_timer(ulong data)
+ {
+ 	wl_timer_t *t = (wl_timer_t *)data;
++#endif
+
+ 	if (!WL_ALL_PASSIVE_ENAB(t->wl))
+ 		_wl_timer(t);
+@@ -2352,9 +2362,13 @@
+
+ 	bzero(t, sizeof(wl_timer_t));
+
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
++	timer_setup(&t->timer, wl_timer, 0);
++#else
+ 	init_timer(&t->timer);
+ 	t->timer.data = (ulong) t;
+ 	t->timer.function = wl_timer;
++#endif
+ 	t->wl = wl;
+ 	t->fn = fn;
+ 	t->arg = arg;
diff --git a/pkgs/os-specific/linux/btfs/default.nix b/pkgs/os-specific/linux/btfs/default.nix
index 6cc4dc6f6d5..83c442618b8 100644
--- a/pkgs/os-specific/linux/btfs/default.nix
+++ b/pkgs/os-specific/linux/btfs/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "btfs-${version}";
-  version = "2.17";
+  version = "2.18";
 
   src = fetchFromGitHub {
     owner  = "johang";
     repo   = "btfs";
     rev    = "v${version}";
-    sha256 = "0v0mypwnx832f7vg52wmiw0lyz7rrkhqsgi7zc261ak1gfaw4nwd";
+    sha256 = "1cn21bxx43iqvac6scmwhkw0bql092sl48r6qfidbmhbw30xl5yf";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A bittorrent filesystem based on FUSE";
-    homepage    = "https://github.com/johang/btfs";
+    homepage    = https://github.com/johang/btfs;
     license     = licenses.gpl3;
     maintainers = with maintainers; [ rnhmjoj ];
     platforms   = platforms.linux;
diff --git a/pkgs/os-specific/linux/busybox/busybox-in-store.patch b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
index 0de7348c44f..2d356b66b3a 100644
--- a/pkgs/os-specific/linux/busybox/busybox-in-store.patch
+++ b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
@@ -1,19 +1,19 @@
 Allow BusyBox to be invoked as "<something>-busybox". This is
 necessary when it's run from the Nix store as <hash>-busybox during
 stdenv bootstrap.
---- busybox-1.26.1-orig/libbb/appletlib.orig	2016-10-26 19:54:20.510957575 -0400
-+++ busybox-1.26.1/libbb/appletlib.c	2016-10-26 19:48:31.590862853 -0400
-@@ -887,7 +887,7 @@
+--- a/libbb/appletlib.c
++++ b/libbb/appletlib.c
+@@ -947,7 +947,7 @@ void FAST_FUNC run_applet_no_and_exit(int applet_no, const char *name, char **ar
  static NORETURN void run_applet_and_exit(const char *name, char **argv)
  {
  #  if ENABLE_BUSYBOX
 -	if (is_prefixed_with(name, "busybox"))
 +	if (strstr(name, "busybox") != 0)
- 		exit(busybox_main(argv));
+ 		exit(busybox_main(/*unused:*/ 0, argv));
  #  endif
  #  if NUM_APPLETS > 0
-@@ -981,7 +981,7 @@ int main(int argc UNUSED_PARAM, char **argv)
- 
+@@ -1045,7 +1045,7 @@ int main(int argc UNUSED_PARAM, char **argv)
+
  	lbb_prepare("busybox" IF_FEATURE_INDIVIDUAL(, argv));
  # if !ENABLE_BUSYBOX
 -	if (argv[1] && is_prefixed_with(bb_basename(argv[0]), "busybox"))
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 73c945fa0ba..d4c4582ffb2 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -1,11 +1,13 @@
 { stdenv, lib, buildPackages, fetchurl, fetchpatch
 , enableStatic ? false
 , enableMinimal ? false
-, useMusl ? false, musl
+, useMusl ? stdenv.hostPlatform.libc == "musl", musl
 , extraConfig ? ""
 , buildPlatform, hostPlatform
 }:
 
+assert stdenv.hostPlatform.libc == "musl" -> useMusl;
+
 let
   configParser = ''
     function parseconfig {
@@ -24,40 +26,31 @@ let
     }
   '';
 
+  libcConfig = lib.optionalString useMusl ''
+    CONFIG_FEATURE_UTMP n
+    CONFIG_FEATURE_WTMP n
+  '';
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.27.2";
+  name = "busybox-1.28.1";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "http://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "1pv3vs2w4l2wnw5qb0rkbpvjjdd1fwjv87miavqq0r0ynqbfajwx";
+    sha256 = "0bk52cxxlya5hg9va87snr9caz9ppdrpdyjwrnbwamhi64y1vzlq";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
 
   patches = [
-    ./busybox-in-store.patch 
-    (fetchpatch {
-      name = "CVE-2017-15873.patch";
-      url = "https://git.busybox.net/busybox/patch/?id=0402cb32df015d9372578e3db27db47b33d5c7b0";
-      sha256 = "1s3xqifd0dww19mbnzrks0i1az0qwd884sxjzrx33d6a9jxv4dzn";
-    })
-    (fetchpatch {
-      name = "CVE-2017-15874.patch";
-      url = "https://git.busybox.net/busybox/patch/?id=9ac42c500586fa5f10a1f6d22c3f797df11b1f6b";
-      sha256 = "0169p4ylz9zd14ghhb39yfjvbdca2kb21pphylfh9ny7i484ahql";
-    })
-    (fetchpatch {
-      name = "CVE-2017-16544.patch";
-      url = "https://git.busybox.net/busybox/patch/?id=c3797d40a1c57352192c6106cc0f435e7d9c11e8";
-      sha256 = "1q3lkc4xczxrzhz73x2r0w7kmd6y33zhcnz3478nk5xi0qr66mcy";
-    })
+    ./busybox-in-store.patch
   ];
 
+  postPatch = "patchShebangs .";
+
   configurePhase = ''
     export KCONFIG_NOTIMESTAMP=1
     make ${if enableMinimal then "allnoconfig" else "defconfig"}
@@ -82,8 +75,12 @@ stdenv.mkDerivation rec {
     # Set paths for console fonts.
     CONFIG_DEFAULT_SETFONT_DIR "/etc/kbd"
 
+    # Bump from 4KB, much faster I/O
+    CONFIG_FEATURE_COPYBUF_KB 64
+
     ${extraConfig}
     CONFIG_CROSS_COMPILER_PREFIX "${stdenv.cc.targetPrefix}"
+    ${libcConfig}
     EOF
 
     make oldconfig
@@ -92,7 +89,7 @@ stdenv.mkDerivation rec {
   '';
 
   postConfigure = lib.optionalString useMusl ''
-    makeFlagsArray+=("CC=${stdenv.cc.targetPrefix}gcc -isystem ${musl}/include -B${musl}/lib -L${musl}/lib")
+    makeFlagsArray+=("CC=${stdenv.cc.targetPrefix}cc -isystem ${musl.dev}/include -B${musl}/lib -L${musl}/lib")
   '';
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
diff --git a/pkgs/os-specific/linux/busybox/sandbox-shell.nix b/pkgs/os-specific/linux/busybox/sandbox-shell.nix
new file mode 100644
index 00000000000..b94fae7f787
--- /dev/null
+++ b/pkgs/os-specific/linux/busybox/sandbox-shell.nix
@@ -0,0 +1,27 @@
+{ busybox, hostPlatform }:
+
+# Minimal shell for use as basic /bin/sh in sandbox builds
+busybox.override {
+  # musl roadmap has RISC-V support projected for 1.1.20
+  useMusl = !hostPlatform.isRiscV;
+  enableStatic = true;
+  enableMinimal = true;
+  extraConfig = ''
+    CONFIG_FEATURE_FANCY_ECHO y
+    CONFIG_FEATURE_SH_MATH y
+    CONFIG_FEATURE_SH_MATH_64 y
+
+    CONFIG_ASH y
+    CONFIG_ASH_OPTIMIZE_FOR_SIZE y
+
+    CONFIG_ASH_ALIAS y
+    CONFIG_ASH_BASH_COMPAT y
+    CONFIG_ASH_CMDCMD y
+    CONFIG_ASH_ECHO y
+    CONFIG_ASH_GETOPTS y
+    CONFIG_ASH_INTERNAL_GLOB y
+    CONFIG_ASH_JOB_CONTROL y
+    CONFIG_ASH_PRINTF y
+    CONFIG_ASH_TEST y
+  '';
+}
diff --git a/pkgs/os-specific/linux/cachefilesd/default.nix b/pkgs/os-specific/linux/cachefilesd/default.nix
index 6ef5476f8e8..d77539fb89e 100644
--- a/pkgs/os-specific/linux/cachefilesd/default.nix
+++ b/pkgs/os-specific/linux/cachefilesd/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "cachefilesd-${version}";
-  version = "0.10.9";
+  version = "0.10.10";
 
   src = fetchurl {
     url = "https://people.redhat.com/dhowells/fscache/${name}.tar.bz2";
-    sha256 = "1jkb3qd8rcmli3g2qgcpp1f9kklil4qgy86w7pg2cpv10ikyr5y8";
+    sha256 = "00hsw4cdlm13wijlygp8f0aq6gxdp0skbxs9r2vh5ggs3s2hj0qd";
   };
 
   installFlags = [
diff --git a/pkgs/os-specific/linux/cifs-utils/default.nix b/pkgs/os-specific/linux/cifs-utils/default.nix
index 08c6d997795..7b6dd6fba35 100644
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@@ -1,14 +1,15 @@
-{ stdenv, fetchurl, kerberos, keyutils, pam, talloc }:
+{ stdenv, fetchurl, autoreconfHook, pkgconfig, kerberos, keyutils, pam, talloc }:
 
 stdenv.mkDerivation rec {
   name = "cifs-utils-${version}";
-  version = "6.6";
+  version = "6.8";
 
   src = fetchurl {
     url = "mirror://samba/pub/linux-cifs/cifs-utils/${name}.tar.bz2";
-    sha256 = "09biws1jm23l3mjb9kh99v57z8bgzybrmimwddb40s6y0yl54wfh";
+    sha256 = "0ygz3pagjpaj5ky11hzh4byyymb7fpmqiqkprn11zwj31h2zdlg7";
   };
 
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [ kerberos keyutils pam talloc ];
 
   makeFlags = "root_sbindir=$(out)/sbin";
@@ -18,6 +19,5 @@ stdenv.mkDerivation rec {
     description = "Tools for managing Linux CIFS client filesystems";
     platforms = platforms.linux;
     license = licenses.lgpl3;
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index b7a8dc23a78..e4c45a9440a 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -27,6 +27,7 @@
 
 , wirelessSupport     ? true      , wirelesstools ? null
 , nvidiaSupport       ? false     , libXNVCtrl ? null
+, pulseSupport        ? false     , libpulseaudio ? null
 
 , curlSupport         ? true      , curl ? null
 , rssSupport          ? curlSupport
@@ -54,6 +55,7 @@ assert luaCairoSupport || luaImlib2Support
 
 assert wirelessSupport     -> wirelesstools != null;
 assert nvidiaSupport       -> libXNVCtrl != null;
+assert pulseSupport        -> libpulseaudio != null;
 
 assert curlSupport         -> curl != null;
 assert rssSupport          -> curlSupport && libxml2 != null;
@@ -64,25 +66,15 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "conky-${version}";
-  version = "1.10.6";
+  version = "1.10.8";
 
   src = fetchFromGitHub {
     owner = "brndnmtthws";
     repo = "conky";
     rev = "v${version}";
-    sha256 = "15j8h251v9jpdg6h6wn1vb45pkk806pf9s5n3rdrps9r185w8hn8";
+    sha256 = "18kxjmaplqvn81vmvybvpc9qczm7wgcgd4af3a8vsqdv77cn5bwq";
   };
 
-  patches = [
-    # Patch to fix compilation on gcc-7 from conky PR
-    # https://github.com/brndnmtthws/conky/pull/402
-    (fetchpatch {
-      name = "gcc7.patch";
-      url = "https://github.com/brndnmtthws/conky/commit/6140122b82d50acc333e5d2a813cc1933ecc6d21.patch";
-      sha256 = "1fblfj1w2kc0gshc2pq9lc1pxxsgmgh8byb1xs2v6amx15kj11k7";
-    })
-  ];
-
   postPatch = ''
     sed -i -e '/include.*CheckIncludeFile)/i include(CheckIncludeFiles)' \
       cmake/ConkyPlatformChecks.cmake
@@ -95,8 +87,8 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lgcc_s";
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ glib cmake libXinerama ]
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ glib libXinerama ]
     ++ optionals docsSupport        [ docbook2x docbook_xsl docbook_xml_dtd_44 libxslt man less ]
     ++ optional  ncursesSupport     ncurses
     ++ optional  x11Support         xlibsWrapper
@@ -110,6 +102,7 @@ stdenv.mkDerivation rec {
     ++ optional  rssSupport         libxml2
     ++ optional  weatherXoapSupport libxml2
     ++ optional  nvidiaSupport      libXNVCtrl
+    ++ optional  pulseSupport       libpulseaudio
     ;
 
   cmakeFlags = []
@@ -129,6 +122,7 @@ stdenv.mkDerivation rec {
     ++ optional weatherXoapSupport  "-DBUILD_WEATHER_XOAP=ON"
     ++ optional wirelessSupport     "-DBUILD_WLAN=ON"
     ++ optional nvidiaSupport       "-DBUILD_NVIDIA=ON"
+    ++ optional pulseSupport        "-DBUILD_PULSEAUDIO=ON"
     ;
 
   # `make -f src/CMakeFiles/conky.dir/build.make src/CMakeFiles/conky.dir/conky.cc.o`:
diff --git a/pkgs/os-specific/linux/conntrack-tools/default.nix b/pkgs/os-specific/linux/conntrack-tools/default.nix
index ea09050fc60..9736d7a8f4b 100644
--- a/pkgs/os-specific/linux/conntrack-tools/default.nix
+++ b/pkgs/os-specific/linux/conntrack-tools/default.nix
@@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
     description = "Connection tracking userspace tools";
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ nckx fpletz ];
+    maintainers = with maintainers; [ fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/cpupower/default.nix b/pkgs/os-specific/linux/cpupower/default.nix
index d6d529627e2..d10b789f3e4 100644
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -1,35 +1,32 @@
-{ stdenv, fetchurl, kernel, coreutils, pciutils, gettext }:
+{ stdenv, buildPackages, fetchurl, kernel, pciutils, gettext }:
 
 stdenv.mkDerivation {
   name = "cpupower-${kernel.version}";
 
   src = kernel.src;
 
-  buildInputs = [ coreutils pciutils gettext ];
+  nativeBuildInputs = [ gettext ];
+  buildInputs = [ pciutils ];
 
-  configurePhase = ''
+  postPatch = ''
     cd tools/power/cpupower
-    sed -i 's,/bin/true,${coreutils}/bin/true,' Makefile
-    sed -i 's,/bin/pwd,${coreutils}/bin/pwd,' Makefile
-    sed -i 's,/usr/bin/install,${coreutils}/bin/install,' Makefile
+    sed -i 's,/bin/true,${buildPackages.coreutils}/bin/true,' Makefile
+    sed -i 's,/bin/pwd,${buildPackages.coreutils}/bin/pwd,' Makefile
+    sed -i 's,/usr/bin/install,${buildPackages.coreutils}/bin/install,' Makefile
   '';
 
-  buildPhase = ''
-    make
-  '';
-
-  installPhase = ''
-    make \
-      bindir="$out/bin" \
-      sbindir="$out/sbin" \
-      mandir="$out/share/man" \
-      includedir="$out/include" \
-      libdir="$out/lib" \
-      localedir="$out/share/locale" \
-      docdir="$out/share/doc/cpupower" \
-      confdir="$out/etc" \
-      install install-man
-  '';
+  makeFlags = [ "CROSS=${stdenv.cc.targetPrefix}" ];
+
+  installFlags = [
+    "bindir=$(out)/bin"
+    "sbindir=$(out)/sbin"
+    "mandir=$(out)/share/man"
+    "includedir=$(out)/include"
+    "libdir=$(out)/lib"
+    "localedir=$(out)/share/locale"
+    "docdir=$(out)/share/doc/cpupower"
+    "confdir=$(out)/etc"
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/crda/default.nix b/pkgs/os-specific/linux/crda/default.nix
index 63330020afe..940913d6a6c 100644
--- a/pkgs/os-specific/linux/crda/default.nix
+++ b/pkgs/os-specific/linux/crda/default.nix
@@ -53,6 +53,5 @@ stdenv.mkDerivation rec {
     homepage = http://drvbp1.linux-foundation.org/~mcgrof/rel-html/crda/;
     license = licenses.free; # "copyleft-next 0.3.0", as yet without a web site
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/criu/criu-2.12.1-glibc-2.26.patch b/pkgs/os-specific/linux/criu/criu-2.12.1-glibc-2.26.patch
deleted file mode 100644
index 916161e35a4..00000000000
--- a/pkgs/os-specific/linux/criu/criu-2.12.1-glibc-2.26.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- a/criu/cr-restore.c
-+++ b/criu/cr-restore.c
-@@ -650,3 +650,2 @@ static void zombie_prepare_signals(void)
- 		(1 << SIGSYS)	|\
--		(1 << SIGUNUSED)|\
- 		(1 << SIGSTKFLT)|\
---- a/test/zdtm/static/pthread01.c
-+++ b/test/zdtm/static/pthread01.c
-@@ -45,3 +45,3 @@ static char *decode_signal(const sigset_t *s, char *buf)
- 	COLLECT(SIGXFSZ); COLLECT(SIGVTALRM); COLLECT(SIGPROF); COLLECT(SIGWINCH); COLLECT(SIGIO);
--	COLLECT(SIGPOLL); COLLECT(SIGPWR); COLLECT(SIGSYS); COLLECT(SIGUNUSED);
-+	COLLECT(SIGPOLL); COLLECT(SIGPWR); COLLECT(SIGSYS);
- #undef COLLECT
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 4ceb397d9f8..4ef162e56c7 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -4,30 +4,23 @@
 
 stdenv.mkDerivation rec {
   name    = "criu-${version}";
-  version = "2.12.1";
+  version = "3.7";
 
   src = fetchurl {
     url    = "http://download.openvz.org/criu/${name}.tar.bz2";
-    sha256 = "18m0sjgcfvzc86w49fd3kxw145nmrsvc5w7zf42nxdiklmszbr1k";
+    sha256 = "0qrpz7pvnks34v7d8lb73flz3mb7qwnib94pdwaxh0mskn8470fq";
   };
 
-  patches = [ ./criu-2.12.1-glibc-2.26.patch ];
-
   enableParallelBuilding = true;
   nativeBuildInputs = [ pkgconfig docbook_xsl ];
   buildInputs = [ protobuf protobufc asciidoc xmlto libpaper libnl libcap libnet python ];
 
   postPatch = ''
-    chmod +w ./scripts/gen-offsets.sh
-    substituteInPlace ./scripts/gen-offsets.sh --replace hexdump ${utillinux}/bin/hexdump
     substituteInPlace ./Documentation/Makefile --replace "2>/dev/null" ""
     substituteInPlace ./Documentation/Makefile --replace "-m custom.xsl" "-m custom.xsl --skip-validation -x ${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl"
     substituteInPlace ./criu/Makefile --replace "-I/usr/include/libnl3" "-I${libnl.dev}/include/libnl3"
     substituteInPlace ./Makefile --replace "head-name := \$(shell git tag -l v\$(CRIU_VERSION))" "head-name = ${version}.0"
     ln -sf ${protobuf}/include/google/protobuf/descriptor.proto ./images/google/protobuf/descriptor.proto
-
-    # Avoid a glibc >= 2.25 deprecation warning that gets fatal via -Werror.
-    sed 1i'#include <sys/sysmacros.h>' -i criu/include/util.h
   '';
 
   buildPhase = "make PREFIX=$out";
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index 51d0fb5e125..c97f1b54622 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -1,21 +1,21 @@
 { stdenv, fetchgit, fetchFromGitHub, docutils, meson, ninja, pkgconfig
-, dbus, glib, systemd }:
+, dbus, glib, linuxHeaders, systemd }:
 
 stdenv.mkDerivation rec {
   name = "dbus-broker-${version}";
-  version = "9";
+  version = "11";
 
   src = fetchFromGitHub {
     owner           = "bus1";
     repo            = "dbus-broker";
     rev             = "v${version}";
-    sha256          = "0q0kbinkkia96bsy7jczlyjz8xgdrfkyx8v6gdr2zflgv0mgbsab";
+    sha256          = "19sszb6ac7md494i996ixqmz9b3gim8rrv2nbrmlgjd59gk6hf7b";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ docutils meson ninja pkgconfig ];
 
-  buildInputs = [ dbus glib systemd ];
+  buildInputs = [ dbus glib linuxHeaders systemd ];
 
   enableParallelBuilding = true;
 
@@ -27,6 +27,9 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     install -Dm644 ../README $out/share/doc/dbus-broker/README
+
+    sed -i $out/lib/systemd/{system,user}/dbus-broker.service \
+      -e 's,^ExecReload.*busctl,ExecReload=${systemd}/bin/busctl,'
   '';
 
   checkPhase = "ninja test";
diff --git a/pkgs/os-specific/linux/displaylink/default.nix b/pkgs/os-specific/linux/displaylink/default.nix
index f561a65ea5c..55be85d33f0 100644
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -11,17 +11,17 @@ let
 
 in stdenv.mkDerivation rec {
   name = "displaylink-${version}";
-  version = "1.3.52";
+  version = "4.1.9";
 
   src = requireFile rec {
     name = "displaylink.zip";
-    sha256 = "0ridpsxcf761vym0nlpq702qa46ynddzci17bjmyax2pph7khr0k";
+    sha256 = "d762145014df7fea8ca7af12206a077d73d8e7f2259c8dc2ce7e5fb1e69ef9a3";
     message = ''
       In order to install the DisplayLink drivers, you must first
       comply with DisplayLink's EULA and download the binaries and
       sources from here:
 
-      http://www.displaylink.com/downloads/file?id=744
+      http://www.displaylink.com/downloads/file?id=1087
 
       Once you have downloaded the file, please use the following
       commands and re-run the installation:
@@ -57,6 +57,9 @@ in stdenv.mkDerivation rec {
     fixupPhase
   '';
 
+  dontStrip = true;
+  dontPatchELF = true;
+
   meta = with stdenv.lib; {
     description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
     platforms = [ "x86_64-linux" "i686-linux" ];
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index 76f9d8c128c..534e5735447 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "dmtcp-${version}";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "dmtcp";
     repo = "dmtcp";
     rev = version;
-    sha256 = "1z6cc7avs2sj8csf7rapf7nbw0giva6xpj0cshv7p9s643y8yxmi";
+    sha256 = "1sq38in4wk855yhfnzbs9xpnps97fhja93w08xjmx7szzm33g5a8";
   };
 
   dontDisableStatic = true;
diff --git a/pkgs/os-specific/linux/dstat/default.nix b/pkgs/os-specific/linux/dstat/default.nix
index 366cc9787f2..81cc6b4fbd8 100644
--- a/pkgs/os-specific/linux/dstat/default.nix
+++ b/pkgs/os-specific/linux/dstat/default.nix
@@ -19,6 +19,6 @@ python2Packages.buildPythonApplication rec {
     description = "Versatile resource statistics tool";
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ jgeerds nckx ];
+    maintainers = with maintainers; [ jgeerds ];
   };
 }
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
index 67ce39ddbd3..0ca85c7e50b 100644
--- a/pkgs/os-specific/linux/eudev/default.nix
+++ b/pkgs/os-specific/linux/eudev/default.nix
@@ -3,10 +3,10 @@ let
   s = # Generated upstream information
   rec {
     baseName="eudev";
-    version = "3.2.4";
+    version = "3.2.5";
     name="${baseName}-${version}";
     url="http://dev.gentoo.org/~blueness/eudev/eudev-${version}.tar.gz";
-    sha256 = "1vbg2k5mngyxdcdw4jkkzxbwdgrcr643hkby1whz7x91kg4g9p6x";
+    sha256 = "1bwh72brp4dvr2dm6ng0lflic6abl87h8zk209im5lna0m0x1hj9";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 11d0a461da0..730df56a642 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -2,20 +2,22 @@
 
 stdenv.mkDerivation rec {
   name = "evdi-${version}";
-  version = "1.4.1+git2017-06-12";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = "evdi";
-    rev = "ee1c578774e62fe4b08d92750620ed3094642160";
-    sha256 = "1m3wkmw4hjpjax7rvhmpicz09d7vxcxklq797ddjg6ljvf12671b";
+    rev = "v${version}";
+    sha256 = "01z7bx5rgpb5lc4c6dxfiv52ni25564djxmvmgy3d7r1x1mqhxgs";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   buildInputs = [ kernel libdrm ];
 
   makeFlags = [ "KVER=${kernel.modDirVersion}" "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
-  hardeningDisable = [ "pic" "format" ];
+  hardeningDisable = [ "format" "pic" "fortify" ];
 
   installPhase = ''
     install -Dm755 module/evdi.ko $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/evdi/evdi.ko
@@ -27,6 +29,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     license = licenses.gpl2;
     homepage = http://www.displaylink.com/;
-    broken = versionOlder kernel.version "4.9" || !stdenv.lib.versionOlder kernel.version "4.13";
+    broken = versionOlder kernel.version "4.9" || versionAtLeast kernel.version "4.15";
   };
 }
diff --git a/pkgs/os-specific/linux/eventstat/default.nix b/pkgs/os-specific/linux/eventstat/default.nix
index cd11a79c8f8..e2647112f1b 100644
--- a/pkgs/os-specific/linux/eventstat/default.nix
+++ b/pkgs/os-specific/linux/eventstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "eventstat-${version}";
-  version = "0.03.04";
+  version = "0.04.03";
   src = fetchzip {
     url = "http://kernel.ubuntu.com/~cking/tarballs/eventstat/eventstat-${version}.tar.gz";
-    sha256 = "1sqf1mfafrw6402qx457gh8yxgsw80311qi0lp4cjl9dfz7vl2x1";
+    sha256 = "0yv7rpdg07rihw8iilvigib963nxf16mn26hzlb6qd1wv54k6dbr";
   };
   buildInputs = [ ncurses ];
   installFlags = [ "DESTDIR=$(out)" ];
diff --git a/pkgs/os-specific/linux/exfat/default.nix b/pkgs/os-specific/linux/exfat/default.nix
index ee6249ce040..56da5b0f16f 100644
--- a/pkgs/os-specific/linux/exfat/default.nix
+++ b/pkgs/os-specific/linux/exfat/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   makeFlags = [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
diff --git a/pkgs/os-specific/linux/fatrace/default.nix b/pkgs/os-specific/linux/fatrace/default.nix
index f68856f6b86..fd955676775 100644
--- a/pkgs/os-specific/linux/fatrace/default.nix
+++ b/pkgs/os-specific/linux/fatrace/default.nix
@@ -32,7 +32,6 @@ stdenv.mkDerivation rec {
       Requires a Linux kernel with the FANOTIFY configuration option enabled.
       Enabling X86_MSR is also recommended for power-usage-report on x86.
     '';
-    maintainers = with maintainers; [ nckx ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index aa273ec613e..4e3e373d244 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -11,7 +11,7 @@
 
 let
 
-  shouldUsePkg = pkg: if pkg != null && stdenv.lib.any (x: x == stdenv.system) pkg.meta.platforms then pkg else null;
+  shouldUsePkg = pkg: if pkg != null && pkg.meta.available then pkg else null;
 
   libOnly = prefix == "lib";
 
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "${prefix}ffado-${version}";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "http://www.ffado.org/files/libffado-${version}.tgz";
-    sha256 = "122z8gya60nyg47i738z2yr4qcjyk2xix4kwhf5ybkmp23kcgqqq";
+    sha256 = "14rprlcd0gpvg9kljh0zzjzd2rc9hbqqpjidshxxjvvfh4r00f4f";
   };
 
   nativeBuildInputs = [ scons pkgconfig which makeWrapper python ];
@@ -41,12 +41,8 @@ stdenv.mkDerivation rec {
     optXdg_utils libxmlxx glibmm
   ];
 
-  patches = [
-    ./gcc6.patch
-    ./glibc226.patch
-  ];
-
   postPatch = ''
+    sed '1iimport sys' -i SConstruct
     # SConstruct checks cpuinfo and an objdump of /bin/mount to determine the appropriate arch
     # Let's just skip this and tell it which to build
     sed '/def is_userspace_32bit(cpuinfo):/a\
diff --git a/pkgs/os-specific/linux/ffado/gcc6.patch b/pkgs/os-specific/linux/ffado/gcc6.patch
deleted file mode 100644
index f9cad9c88ab..00000000000
--- a/pkgs/os-specific/linux/ffado/gcc6.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Author: Adrian Knoth <adi@drcomp.erfurt.thur.de>
-Forwarded: Yes
-Applied-Upstream: 2.3.1
-Last-Update: 2016-08-11
-Description: Fix FTBFS with gcc6
-
-Index: b/src/ffadotypes.h
-===================================================================
---- a/src/ffadotypes.h
-+++ b/src/ffadotypes.h
-@@ -51,6 +51,8 @@ struct ffado_handle {
- };
- 
- 
-+#include <cmath>
-+#include <algorithm>
- #include <vector>
- #include <string>
- 
diff --git a/pkgs/os-specific/linux/ffado/glibc226.patch b/pkgs/os-specific/linux/ffado/glibc226.patch
deleted file mode 100644
index e147ee9aa76..00000000000
--- a/pkgs/os-specific/linux/ffado/glibc226.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- libffado/src/libutil/PosixMessageQueue.cpp  (revision 2705)
-+++ libffado/src/libutil/PosixMessageQueue.cpp  (revision 2706)
-@@ -30,6 +30,7 @@
- #include <errno.h>
- #include <string.h>
- #include <poll.h>
-+#include <signal.h>
-
- #define MQ_INVALID_ID ((mqd_t) -1)
- // one second
diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
index 5ee8ab564b0..1c7ebce9f87 100644
--- a/pkgs/os-specific/linux/firejail/default.nix
+++ b/pkgs/os-specific/linux/firejail/default.nix
@@ -3,11 +3,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="firejail";
-    version="0.9.50";
+    version="0.9.52";
     name="${baseName}-${version}";
-    hash="005q7f1h7z4c1wg8vzb1zh0xi4msz6z0fcph0y3ywhlbxjvpam61";
-    url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.50.tar.xz";
-    sha256="005q7f1h7z4c1wg8vzb1zh0xi4msz6z0fcph0y3ywhlbxjvpam61";
+    hash="0w8l8z4j7iph8fp7rchhnfsrik3f00f9v5xr191fp38fphzcj56s";
+    url="https://vorboss.dl.sourceforge.net/project/firejail/firejail/firejail-0.9.52.tar.xz";
+    sha256="0w8l8z4j7iph8fp7rchhnfsrik3f00f9v5xr191fp38fphzcj56s";
   };
   buildInputs = [
     which
diff --git a/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix b/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix
index 4f09410c75e..2637beb517a 100644
--- a/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix
+++ b/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix
@@ -25,6 +25,5 @@ stdenv.mkDerivation rec {
     homepage = http://wireless.kernel.org/en/users/Drivers/b43;
     downloadPage = http://www.lwfinger.com/b43-firmware;
     license = licenses.unfree;
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 809d0ba5264..acdba5987bb 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -32,8 +32,7 @@ stdenv.mkDerivation rec {
     # traffic, so don't do that.
     preferLocalBuild = true;
 
-    buildInputs = [ git gnupg ];
-    NIX_SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    nativeBuildInputs = [ cacert git gnupg ];
   } ''
     git init src && (
       cd src
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 988f4efb9cd..646c18860c5 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -1,56 +1,90 @@
-{ stdenv, fetchurl, gtk_doc, pkgconfig, gobjectIntrospection, intltool
-, libgudev, polkit, appstream-glib, gusb, sqlite, libarchive, glib_networking
-, libsoup, docbook2x, gpgme, libxslt, libelf, libsmbios, efivar, glibcLocales
-, fwupdate, libyaml, valgrind, meson, libuuid, pygobject3, colord
-, pillow, ninja, gcab, gnutls, python3Packages, wrapGAppsHook
+{ stdenv, fetchurl, fetchpatch, gtk-doc, pkgconfig, gobjectIntrospection, intltool
+, libgudev, polkit, appstream-glib, gusb, sqlite, libarchive, glib-networking
+, libsoup, help2man, gpgme, libxslt, elfutils, libsmbios, efivar, glibcLocales
+, fwupdate, libyaml, valgrind, meson, libuuid, colord, docbook_xml_dtd_43, docbook_xsl
+, ninja, gcab, gnutls, python3, wrapGAppsHook, json-glib
+, shared-mime-info, umockdev
 }:
 let
-  version = "1.0.1";
+  # Updating? Keep $out/etc synchronized with passthru.filesInstalledToEtc
+  version = "1.0.5";
+  python = python3.withPackages (p: with p; [ pygobject3 pycairo pillow ]);
+  installedTestsPython = python3.withPackages (p: with p; [ pygobject3 requests ]);
 in stdenv.mkDerivation {
   name = "fwupd-${version}";
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "1k627rja7df51dkzqvkzgbwrrj4049k6408d01m34n66zwr2fp59";
+    sha256 = "0wm195vkf6x1kg1dz0sbfwpdcn9f6638l7vyzplcfrb3v07pqxpq";
   };
 
+  outputs = [ "out" "devdoc" "man" "installedTests" ];
+
   nativeBuildInputs = [
-    meson ninja gtk_doc pkgconfig gobjectIntrospection intltool glibcLocales
-    valgrind gcab docbook2x libxslt pygobject3 python3Packages.pycairo wrapGAppsHook
+    meson ninja gtk-doc pkgconfig gobjectIntrospection intltool glibcLocales shared-mime-info
+    valgrind gcab docbook_xml_dtd_43 docbook_xsl help2man libxslt python wrapGAppsHook
   ];
   buildInputs = [
-    polkit appstream-glib gusb sqlite libarchive libsoup libelf libsmbios fwupdate libyaml
-    libgudev colord gpgme libuuid pillow gnutls glib_networking
+    polkit appstream-glib gusb sqlite libarchive libsoup elfutils libsmbios fwupdate libyaml
+    libgudev colord gpgme libuuid gnutls glib-networking efivar json-glib umockdev
   ];
 
   LC_ALL = "en_US.UTF-8"; # For po/make-images
 
-  NIX_CFLAGS_COMPILE = [
-    "-I${efivar}/include/efivar"
-    # warning: "__LIBELF_INTERNAL__" is not defined
-    "-Wno-error=undef"
-  ];
-
   patches = [
     ./fix-missing-deps.patch
+    (fetchpatch {
+      url = https://github.com/hughsie/fwupd/commit/767210e4b1401d5d5bb7ac1e7c052a60b6529d88.patch;
+      sha256 = "00adfabxpgdg74jx7i6jihhh8njjk2r7v3fxqs4scj3vn06k5fmw";
+    })
   ];
+
   postPatch = ''
+    # needs a different set of modules than po/make-images
+    escapedInterpreterLine=$(echo "${installedTestsPython}/bin/python3" | sed 's|\\|\\\\|g')
+    sed -i -e "1 s|.*|#\!$escapedInterpreterLine|" data/installed-tests/hardware.py
+
     patchShebangs .
+    substituteInPlace data/installed-tests/fwupdmgr.test.in --subst-var-by installedtestsdir "$installedTests/share/installed-tests/fwupd"
+  '';
+
+  doCheck = true;
+
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
   '';
 
   mesonFlags = [
-    "-Denable-man=false"
-    "-Denable-tests=false"
-    "-Denable-doc=false"
-    "-Dwith-bootdir=/boot"
-    "-Dwith-udevdir=lib/udev"
-    "-Dwith-systemdunitdir=lib/systemd/system"
+    "-Dplugin_dummy=true"
+    "-Dbootdir=/boot"
+    "-Dudevdir=lib/udev"
+    "-Dsystemdunitdir=lib/systemd/system"
     "--localstatedir=/var"
   ];
 
-  enableParallelBuilding = true;
-  meta = {
+  postInstall = ''
+    moveToOutput share/installed-tests "$installedTests"
+    wrapProgram $installedTests/share/installed-tests/fwupd/hardware.py \
+      --prefix GI_TYPELIB_PATH : "$out/lib/girepository-1.0:${libsoup}/lib/girepository-1.0"
+  '';
+
+  passthru = {
+    filesInstalledToEtc = [
+      "fwupd/remotes.d/fwupd.conf"
+      "fwupd/remotes.d/lvfs-testing.conf"
+      "fwupd/remotes.d/lvfs.conf"
+      "fwupd/remotes.d/vendor.conf"
+      "pki/fwupd/GPG-KEY-Hughski-Limited"
+      "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd/LVFS-CA.pem"
+      "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd-metadata/LVFS-CA.pem"
+    ];
+  };
+
+  meta = with stdenv.lib; {
     homepage = https://fwupd.org/;
-    license = [ stdenv.lib.licenses.gpl2 ];
-    platforms = stdenv.lib.platforms.linux;
+    maintainers = with maintainers; [];
+    license = [ licenses.gpl2 ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/fwupd/fix-missing-deps.patch b/pkgs/os-specific/linux/firmware/fwupd/fix-missing-deps.patch
index 46e11952afe..d1d7c06027f 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/fix-missing-deps.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/fix-missing-deps.patch
@@ -2,7 +2,7 @@
 +++ b/data/builder/meson.build
 @@ -1,3 +0,0 @@
 -install_data('README.md',
--  install_dir : join_paths(get_option('localstatedir'), 'lib', 'fwupd', 'builder')
+-  install_dir : join_paths(localstatedir, 'lib', 'fwupd', 'builder')
 -)
 --- a/data/meson.build
 +++ b/data/meson.build
@@ -11,15 +11,15 @@
  endif
  
 -install_data(['daemon.conf'],
--  install_dir : join_paths(get_option('sysconfdir'), 'fwupd')
+-  install_dir : join_paths(sysconfdir, 'fwupd')
 -)
 -
  install_data(['org.freedesktop.fwupd.metainfo.xml'],
-   install_dir: join_paths(get_option('datadir'), 'metainfo')
+   install_dir: join_paths(datadir, 'metainfo')
  )
  
  install_data(['org.freedesktop.fwupd.conf'],
--  install_dir : join_paths(get_option('sysconfdir'), 'dbus-1', 'system.d')
+-  install_dir : join_paths(sysconfdir, 'dbus-1', 'system.d')
 +  install_dir : join_paths(get_option('prefix'), 'etc', 'dbus-1', 'system.d')
  )
  
@@ -30,14 +30,14 @@
        'GPG-KEY-Hughski-Limited',
        'GPG-KEY-Linux-Vendor-Firmware-Service',
      ],
--    install_dir : join_paths(get_option('sysconfdir'), 'pki', 'fwupd')
+-    install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
 +    install_dir : join_paths(get_option('prefix'), 'etc', 'pki', 'fwupd')
    )
  
    install_data([
        'GPG-KEY-Linux-Vendor-Firmware-Service',
      ],
--    install_dir : join_paths(get_option('sysconfdir'), 'pki', 'fwupd-metadata')
+-    install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
 +    install_dir : join_paths(get_option('prefix'), 'etc', 'pki', 'fwupd-metadata')
    )
  endif
@@ -46,13 +46,13 @@
    install_data([
        'LVFS-CA.pem',
      ],
--    install_dir : join_paths(get_option('sysconfdir'), 'pki', 'fwupd')
+-    install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
 +    install_dir : join_paths(get_option('prefix'), 'etc', 'pki', 'fwupd')
    )
    install_data([
        'LVFS-CA.pem',
      ],
--    install_dir : join_paths(get_option('sysconfdir'), 'pki', 'fwupd-metadata')
+-    install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
 +    install_dir : join_paths(get_option('prefix'), 'etc', 'pki', 'fwupd-metadata')
    )
  endif
@@ -63,7 +63,7 @@
        'lvfs.conf',
        'lvfs-testing.conf',
      ],
--    install_dir : join_paths(get_option('sysconfdir'), 'fwupd', 'remotes.d')
+-    install_dir : join_paths(sysconfdir, 'fwupd', 'remotes.d')
 +    install_dir : join_paths(get_option('prefix'), 'etc', 'fwupd', 'remotes.d')
    )
  endif
@@ -72,7 +72,7 @@
    output : 'fwupd.conf',
    configuration : con2,
    install: true,
--  install_dir: join_paths(get_option('sysconfdir'), 'fwupd', 'remotes.d'),
+-  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(get_option('prefix'), 'etc', 'fwupd', 'remotes.d'),
  )
  configure_file(
@@ -80,7 +80,7 @@
    output : 'vendor.conf',
    configuration : con2,
    install: true,
--  install_dir: join_paths(get_option('sysconfdir'), 'fwupd', 'remotes.d'),
+-  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(get_option('prefix'), 'etc', 'fwupd', 'remotes.d'),
  )
 --- a/meson_post_install.sh
diff --git a/pkgs/os-specific/linux/firmware/fwupdate/default.nix b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
index f2bb9bddd57..fd0d222eaac 100644
--- a/pkgs/os-specific/linux/firmware/fwupdate/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupdate/default.nix
@@ -1,37 +1,62 @@
-{ stdenv, fetchurl, gnu-efi, efivar, libsmbios, popt, pkgconfig
-, gettext }:
-let version = "8"; in
-  stdenv.mkDerivation
-    { name = "fwupdate-${version}";
-      src = fetchurl
-        { url = "https://github.com/rhinstaller/fwupdate/releases/download/${version}/fwupdate-${version}.tar.bz2";
-          sha256 = "10q8k1kghvbcb5fwcl2smzp8vqdfzimx9dkk0c3hz39py1phy4n8";
-        };
-      makeFlags =
-        [ "EFIDIR=nixos"
-          "LIBDIR=$(out)/lib"
-          "GNUEFIDIR=${gnu-efi}/lib"
-          "TARGETDIR=$(out)/boot/efi/nixos/"
-          "prefix=$(out)/"
-        ];
-  nativeBuildInputs = [ pkgconfig ];
-      buildInputs = [ gnu-efi libsmbios popt gettext ];
-      propagatedBuildInputs = [ efivar ];
-      # TODO: Just apply the disable to the efi subdir
-      hardeningDisable = [ "all" ];
-      patchPhase = ''
-        sed -i 's|/usr/include/smbios_c/token.h|smbios_c/token.h|' \
-          linux/libfwup.c
-        sed -i 's|/usr/share|$(prefix)share|' linux/Makefile
-        sed -i "s|/usr/include|$out/include|" linux/fwup.pc.in
-        find . -type f -print0 | xargs -0 sed -i -e 's|/boot/efi|/boot|g' -e 's|/boot/efi/EFI|/boot/EFI|g'
-      '';
-      configurePhase = ''
-        arch=$(cc -dumpmachine | cut -f1 -d- | sed 's,i[3456789]86,ia32,' )
-        export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${gnu-efi}/include/efi -I${efivar}/include/efivar -I${gnu-efi}/include/efi/$arch"
-      '';
-      meta =
-        { license = [ stdenv.lib.licenses.gpl2 ];
-          platforms = stdenv.lib.platforms.linux;
-        };
-    }
+{ efivar, fetchurl, gettext, gnu-efi, libsmbios, pkgconfig, popt, stdenv }:
+let
+  version = "10";
+in stdenv.mkDerivation {
+  name = "fwupdate-${version}";
+  src = fetchurl {
+    url = "https://github.com/rhinstaller/fwupdate/releases/download/${version}/fwupdate-${version}.tar.bz2";
+    sha256 = "0fpk3q0msq2l0bs2mvk0cqp8jbwnmi17ggc81r4v96h4jxh2rx3k";
+  };
+
+  patches = [
+    # https://github.com/rhboot/fwupdate/pull/99
+    ./fix-paths.patch
+    ./do-not-create-sharedstatedir.patch
+  ];
+
+  NIX_CFLAGS_COMPILE = [ "-I${gnu-efi}/include/efi" ];
+
+  # TODO: Just apply the disable to the efi subdir
+  hardeningDisable = [ "stackprotector" ];
+
+  makeFlags = [
+    "EFIDIR=nixos"
+    "prefix=$(out)"
+    "LIBDIR=$(out)/lib"
+    "GNUEFIDIR=${gnu-efi}/lib"
+    "ESPMOUNTPOINT=$(out)/boot"
+  ];
+
+  nativeBuildInputs = [
+    pkgconfig
+    gettext
+  ];
+
+  buildInputs = [
+    gnu-efi
+    libsmbios
+    popt
+  ];
+
+  propagatedBuildInputs = [
+    efivar
+  ];
+
+  # TODO: fix wrt cross-compilation
+  preConfigure = ''
+    arch=$(cc -dumpmachine | cut -f1 -d- | sed 's,i[3456789]86,ia32,' )
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${gnu-efi}/include/efi/$arch"
+  '';
+
+  postInstall = ''
+    rm -rf $out/src
+    rm -rf $out/lib/debug
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Tools for using the ESRT and UpdateCapsule() to apply firmware updates";
+    maintainers = with maintainers; [ ];
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/firmware/fwupdate/do-not-create-sharedstatedir.patch b/pkgs/os-specific/linux/firmware/fwupdate/do-not-create-sharedstatedir.patch
new file mode 100644
index 00000000000..b8588ef2b11
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/fwupdate/do-not-create-sharedstatedir.patch
@@ -0,0 +1,10 @@
+--- a/linux/Makefile
++++ b/linux/Makefile
+@@ -131,7 +131,6 @@
+ 		ln -fs $(x) $(patsubst %.so.1.$(VERSION),%.so.1,$(DESTDIR)$(libdir)/$(x)) ;\
+ 		ln -fs $(x) $(patsubst %.so.1.$(VERSION),%.so,$(DESTDIR)$(libdir)/$(x)) ;\
+ 		)
+-	$(INSTALL) -d -m 755 $(DESTDIR)$(sharedstatedir)/fwupdate/
+ 	$(INSTALL) -d -m 755 $(DESTDIR)$(libexecdir)/fwupdate/
+ 	$(INSTALL) -m 755 cleanup $(DESTDIR)$(libexecdir)/fwupdate/cleanup
+ 	$(INSTALL) -d -m 755 $(DESTDIR)$(libdatadir)/systemd/system
diff --git a/pkgs/os-specific/linux/firmware/fwupdate/fix-paths.patch b/pkgs/os-specific/linux/firmware/fwupdate/fix-paths.patch
new file mode 100644
index 00000000000..b01dfa355ef
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/fwupdate/fix-paths.patch
@@ -0,0 +1,116 @@
+--- a/Make.defaults
++++ b/Make.defaults
+@@ -18,19 +18,20 @@
+ ABIDIFF		:= abidiff
+ ABIDW		:= abidw
+ prefix		?= /usr/
+-prefix		:= $(abspath $(prefix))/
++prefix		:= $(abspath $(prefix))
++exec_prefix		?= $(prefix)
+ ARCH		= $(shell $(CC) -dumpmachine | cut -f1 -d- | sed s,i[3456789]86,ia32,)
+ ifeq ($(ARCH),x86_64)
+-  LIBDIR	?= $(prefix)lib64
++  LIBDIR	?= $(exec_prefix)/lib64
+ endif
+ ifeq ($(ARCH),ia32)
+-  LIBDIR	?= $(prefix)lib
++  LIBDIR	?= $(exec_prefix)/lib
+ endif
+ ifeq ($(ARCH),aarch64)
+-  LIBDIR	?= $(prefix)lib64
++  LIBDIR	?= $(exec_prefix)/lib64
+ endif
+ ifeq ($(ARCH),arm)
+-  LIBDIR	?= $(prefix)lib
++  LIBDIR	?= $(exec_prefix)/lib
+ endif
+ LIBDIR		?= unknown
+ ifeq ($(LIBDIR),unknown)
+@@ -45,13 +46,13 @@
+ GNUEFIDIR	?= $(LIBDIR)/gnuefi
+ libdir		?= $(LIBDIR)
+ pcdir		?= $(libdir)/pkgconfig
+-mandir		?= $(prefix)share/man
+-includedir	?= $(prefix)include
+-bindir		?= $(prefix)bin
+-datadir 	?= $(prefix)share
++mandir		?= $(prefix)/share/man
++includedir	?= $(prefix)/include
++bindir		?= $(exec_prefix)/bin
++datadir 	?= $(prefix)/share
+ localedir	?= $(datadir)/locale
+-libexecdir	?= $(prefix)libexec
+-libdatadir	?= $(prefix)lib
++libexecdir	?= $(exec_prefix)/libexec
++libdatadir	?= $(exec_prefix)/lib
+ sharedstatedir	?= /var/lib
+ 
+ EFIDIR		?= $(shell x=$$(which --skip-alias --skip-functions git 2>/dev/null) ; [ -n "$$x" ] && git config --get fwupdate.efidir)
+@@ -63,8 +64,8 @@
+ 	ESPMOUNTPOINT = "/boot/efi"
+ endif
+ 
+-DEBUGINFO	?= $(prefix)lib/debug
+-DEBUGSOURCE	?= $(prefix)src/debug
++DEBUGINFO	?= $(exec_prefix)/lib/debug
++DEBUGSOURCE	?= $(prefix)/src/debug
+ TARGETDIR	?= $(ESPMOUNTPOINT)/EFI/$(EFIDIR)
+ 
+ .PHONY: check_efidir_error
+--- a/linux/Makefile
++++ b/linux/Makefile
+@@ -93,16 +93,19 @@
+ 	sed -e "s,@@VERSION@@,$(VERSION),g" \
+ 		-e "s,@@FWUP_MAJOR_VERSION@@,$(MAJOR_VERSION),g" \
+ 		-e "s,@@FWUP_MINOR_VERSION@@,$(MINOR_VERSION),g" \
++		-e "s,@@PREFIX@@,$(prefix),g" \
++		-e "s,@@EXEC_PREFIX@@,$(exec_prefix),g" \
+ 		-e "s,@@SHAREDSTATEDIR@@,$(sharedstatedir),g" \
+ 		-e "s,@@ESPMOUNTPOINT@@,$(ESPMOUNTPOINT),g" \
+ 		-e "s,@@EFIDIR@@,$(EFIDIR),g" \
+ 		-e "s,@@LIBDIR@@,$(libdir),g" \
+ 		-e "s,@@LIBEXECDIR@@,$(libexecdir),g" \
++		-e "s,@@INCLUDEDIR@@,$(includedir),g" \
+ 		$< > $@
+ 
+ tester : tester.c
+-	$(CC) -Wall -Werror -ggdb -L. -I./include -I/usr/include/efivar \
+-		-lefivar -lfwup -o $@ $^
++	$(CC) -Wall -Werror -ggdb -L. -I./include $(shell $(PKG_CONFIG) --cflags efivar) \
++		$(shell $(PKG_CONFIG) --libs efivar) -lfwup -o $@ $^
+ 
+ test : tester
+ 	LD_LIBRARY_PATH=$(shell pwd) ./tester
+@@ -134,6 +137,6 @@
+ 	$(INSTALL) -d -m 755 $(DESTDIR)$(libdatadir)/systemd/system
+ 	$(INSTALL) -m 644 cleanup.service \
+ 		$(DESTDIR)$(libdatadir)/systemd/system/fwupdate-cleanup.service
+-	$(INSTALL) -d -m 755 $(DESTDIR)/usr/share/bash-completion/completions/
++	$(INSTALL) -d -m 755 $(DESTDIR)$(datadir)/bash-completion/completions/
+ 	$(INSTALL) -m 755 $(VPATH)/bash-completion \
+-		$(DESTDIR)/usr/share/bash-completion/completions/fwupdate
++		$(DESTDIR)$(datadir)/bash-completion/completions/fwupdate
+--- a/linux/fwup.pc.in
++++ b/linux/fwup.pc.in
+@@ -1,7 +1,7 @@
+-prefix=/usr
+-exec_prefix=/usr
++prefix=@@PREFIX@@
++exec_prefix=@@EXEC_PREFIX@@
+ libdir=@@LIBDIR@@
+-includedir=/usr/include
++includedir=@@INCLUDEDIR@@
+ 
+ Name: fwup
+ Description: Library for deployment of UEFI firmware updates.
+--- a/linux/libfwup.c
++++ b/linux/libfwup.c
+@@ -35,7 +35,7 @@
+ 
+ #include <dell-wmi-smi.h>
+ #ifdef FWUPDATE_HAVE_LIBSMBIOS__
+-#include </usr/include/smbios_c/token.h>
++#include <smbios_c/token.h>
+ #include <smbios_c/smi.h>
+ #endif
+ 
diff --git a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
index c87023bf336..e8ab77a509f 100644
--- a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation {
   name = "intel2200BGFirmware-${version}";
 
   src = fetchurl {
-    url = "http://pkgs.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-${version}.tgz/eaba788643c7cc7483dd67ace70f6e99/ipw2200-fw-${version}.tgz";
+    url = "http://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-${version}.tgz/eaba788643c7cc7483dd67ace70f6e99/ipw2200-fw-${version}.tgz";
     sha256 = "c6818c11c18cc030d55ff83f64b2bad8feef485e7742f84f94a61d811a6258bd";
   };
 
diff --git a/pkgs/os-specific/linux/fnotifystat/default.nix b/pkgs/os-specific/linux/fnotifystat/default.nix
index 2c90ff94d4a..d49d0115822 100644
--- a/pkgs/os-specific/linux/fnotifystat/default.nix
+++ b/pkgs/os-specific/linux/fnotifystat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "fnotifystat-${version}";
-  version = "0.01.17";
+  version = "0.02.00";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/fnotifystat/fnotifystat-${version}.tar.gz";
-    sha256 = "0ncfbrpyb3ak49nrdr4cb3w082n9s181lizfqx51zi9rdgkj1vm3";
+    sha256 = "0sfzmggfhhhp3vxn1s61b5bacr2hz6r7y699n3nysdciaa2scgdq";
   };
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
diff --git a/pkgs/os-specific/linux/forkstat/default.nix b/pkgs/os-specific/linux/forkstat/default.nix
index d69d54af96c..bf7bc8a4546 100644
--- a/pkgs/os-specific/linux/forkstat/default.nix
+++ b/pkgs/os-specific/linux/forkstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "forkstat-${version}";
-  version = "0.02.00";
+  version = "0.02.02";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/forkstat/forkstat-${version}.tar.gz";
-    sha256 = "07df2lb32lbr2ggi84h9pjy6ig18n2961ksji4x1hhb4cvc175dg";
+    sha256 = "02iqi4xjg2hl4paw88fz9jb88a9p4zprvq3g56cd7jwfx3vmw5a4";
   };
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
diff --git a/pkgs/os-specific/linux/freefall/default.nix b/pkgs/os-specific/linux/freefall/default.nix
index 54be786d10d..a091b2f17c5 100644
--- a/pkgs/os-specific/linux/freefall/default.nix
+++ b/pkgs/os-specific/linux/freefall/default.nix
@@ -29,6 +29,5 @@ stdenv.mkDerivation rec {
     '';
 
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index 8efef4fac4b..267e31d427c 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -1,21 +1,21 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, libargon2, pam }:
+{ stdenv, buildGoPackage, fetchFromGitHub, pam }:
 
 # Don't use this for anything important yet!
 
 buildGoPackage rec {
   name = "fscrypt-${version}";
-  version = "0.2.2";
+  version = "0.2.3";
 
   goPackagePath = "github.com/google/fscrypt";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
-    rev = version;
-    sha256 = "0a85vj1zsybhzvvgdvlw6ywh2a6inmrmc95pfa1js4vkx0ixf1kh";
+    rev = "v${version}";
+    sha256 = "126bbxim4nj56kplvyv528i88mfray50r2rc6ysblkmaw6x0fd9c";
   };
 
-  buildInputs = [ libargon2 pam ];
+  buildInputs = [ pam ];
 
   meta = with stdenv.lib; {
     description =
diff --git a/pkgs/os-specific/linux/fscryptctl/default.nix b/pkgs/os-specific/linux/fscryptctl/default.nix
index 81cd95332c8..8622dc001a8 100644
--- a/pkgs/os-specific/linux/fscryptctl/default.nix
+++ b/pkgs/os-specific/linux/fscryptctl/default.nix
@@ -4,19 +4,17 @@
 
 stdenv.mkDerivation rec {
   name = "fscryptctl-unstable-${version}";
-  version = "2017-09-12";
+  version = "2017-10-23";
 
   goPackagePath = "github.com/google/fscrypt";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscryptctl";
-    rev = "f037dcf4354ce8f25d0f371b58dfe7a7ac27576f";
-    sha256 = "1dw1y6jbm2ibn7npvpw6cl28rcz0jz4as2yl6walz7ppmqbj9scf";
+    rev = "142326810eb19d6794793db6d24d0775a15aa8e5";
+    sha256 = "1853hlpklisbqnkb7a921dsf0vp2nr2im26zpmrs592cnpsvk3hb";
   };
 
-  patches = [ ./install.patch ];
-
   makeFlags = [ "DESTDIR=$(out)/bin" ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/fscryptctl/install.patch b/pkgs/os-specific/linux/fscryptctl/install.patch
deleted file mode 100644
index 11f9843bbfb..00000000000
--- a/pkgs/os-specific/linux/fscryptctl/install.patch
+++ /dev/null
@@ -1,22 +0,0 @@
---- a/Makefile	2017-09-24 22:48:19.322116085 +0200
-+++ b/Makefile	2017-09-24 22:50:07.655725022 +0200
-@@ -19,7 +19,7 @@
- CFLAGS += -O2 -Wall
- 
- INSTALL = install
--DESTDIR = /usr/local/bin
-+DESTDIR ?= /usr/local/bin
- 
- OBJECTS = $(NAME).o sha512.o
- 
-@@ -38,8 +38,8 @@
- 	@python -m pytest test.py -s -q
- 
- install: $(NAME)
--	$(INSTALL) -d $(DEST_DIR)
--	$(INSTALL) $(NAME) $(DEST_DIR)
-+	$(INSTALL) -d $(DESTDIR)
-+	$(INSTALL) $(NAME) $(DESTDIR)
- 
- clean:
- 	rm -f $(OBJECTS)
diff --git a/pkgs/os-specific/linux/ftop/default.nix b/pkgs/os-specific/linux/ftop/default.nix
index 73a6d18fc8b..915431c0cb1 100644
--- a/pkgs/os-specific/linux/ftop/default.nix
+++ b/pkgs/os-specific/linux/ftop/default.nix
@@ -32,7 +32,6 @@ stdenv.mkDerivation rec {
       generally all that is of interest to the user).
       As with top, the items are displayed in order from most to least active.
     '';
-    maintainers = with maintainers; [ nckx ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index b9ac015f459..a10a4f466c7 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -4,6 +4,7 @@
 , fusePackages, utillinux, gettext
 , autoconf, automake, libtool
 , meson, ninja, pkgconfig
+, autoreconfHook
 }:
 
 let
@@ -18,6 +19,8 @@ in stdenv.mkDerivation rec {
     sha256 = sha256Hash;
   };
 
+  preAutoreconf = "touch config.rpath";
+
   patches =
     stdenv.lib.optional
       (!isFuse3 && stdenv.isAarch64)
@@ -30,8 +33,7 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = if isFuse3
     then [ meson ninja pkgconfig ]
-    else [ autoconf automake libtool ];
-  buildInputs = stdenv.lib.optional (!isFuse3) gettext;
+    else [ autoreconfHook gettext ];
 
   outputs = [ "out" ] ++ stdenv.lib.optional isFuse3 "common";
 
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 7856f6389c7..97744968d7b 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -9,7 +9,7 @@ in {
   fuse_2 = mkFuse {
     version = "2.9.7";
     sha256Hash = "1wyjjfb7p4jrkk15zryzv33096a5fmsdyr2p4b00dd819wnly2n2";
-    maintainers = [ maintainers.mornfall ];
+    maintainers = [ ];
   };
 
   fuse_3 = mkFuse {
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
new file mode 100644
index 00000000000..4c393a0f326
--- /dev/null
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchzip, autoreconfHook, pkgconfig, glib, libtool, pcre
+, json_c, flex, bison, dtc, pciutils, dmidecode, iasl }:
+
+stdenv.mkDerivation rec {
+  name = "fwts-${version}";
+  version = "18.01.00";
+
+  src = fetchzip {
+    url = "http://fwts.ubuntu.com/release/fwts-V${version}.tar.gz";
+    sha256 = "043wkq4hz5pz79masppya67b8i5jw61p1j8dw17jwc8w6gp8csfb";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig libtool ];
+  buildInputs = [ glib pcre json_c flex bison dtc pciutils dmidecode iasl ];
+
+  postPatch = ''
+    substituteInPlace src/lib/include/fwts_binpaths.h --replace "/usr/bin/lspci"      "${pciutils}/bin/lspci"
+    substituteInPlace src/lib/include/fwts_binpaths.h --replace "/usr/sbin/dmidecode" "${dmidecode}/bin/dmidecode"
+    substituteInPlace src/lib/include/fwts_binpaths.h --replace "/usr/bin/iasl"       "${iasl}/bin/iasl"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://wiki.ubuntu.com/FirmwareTestSuite";
+    description = "Firmware Test Suite";
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ tadfisher ];
+  };
+}
diff --git a/pkgs/os-specific/linux/gogoclient/default.nix b/pkgs/os-specific/linux/gogoclient/default.nix
index 7383db95c37..521b81cd690 100644
--- a/pkgs/os-specific/linux/gogoclient/default.nix
+++ b/pkgs/os-specific/linux/gogoclient/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     #url = http://gogo6.com/downloads/gogoc-1_2-RELEASE.tar.gz;
-    url = http://pkgs.fedoraproject.org/repo/pkgs/gogoc/gogoc-1_2-RELEASE.tar.gz/41177ed683cf511cc206c7782c37baa9/gogoc-1_2-RELEASE.tar.gz;
+    url = http://src.fedoraproject.org/repo/pkgs/gogoc/gogoc-1_2-RELEASE.tar.gz/41177ed683cf511cc206c7782c37baa9/gogoc-1_2-RELEASE.tar.gz;
     sha256 = "a0ef45c0bd1fc9964dc8ac059b7d78c12674bf67ef641740554e166fa99a2f49";
   };
   patches = [./gcc46-include-fix.patch ./config-paths.patch ];
diff --git a/pkgs/os-specific/linux/hal-flash/default.nix b/pkgs/os-specific/linux/hal-flash/default.nix
index a299fd0f433..27b85fbfc89 100644
--- a/pkgs/os-specific/linux/hal-flash/default.nix
+++ b/pkgs/os-specific/linux/hal-flash/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoconf, automake, dbus, glib, libtool, pkgconfig, udisks2 }:
 
 stdenv.mkDerivation {
-  name = "hal-flash-0.3.0";
+  name = "hal-flash-0.3.3";
 
   src = fetchurl {
-    url = "https://github.com/cshorler/hal-flash/archive/v0.3.0.tar.gz";
-    sha256 = "163pqy39cca8cnf8rm8zr63ndsnr7rki9pf9j7dl9gyxmi7sx88s";
+    url = "https://github.com/cshorler/hal-flash/archive/v0.3.3.tar.gz";
+    sha256 = "0dw9bx190mrh0dycw4rfvfmwwvh2sgypffr99nfnr36b38jrd6y6";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/hdparm/default.nix b/pkgs/os-specific/linux/hdparm/default.nix
index 0f0eab1fa20..87cb17329e8 100644
--- a/pkgs/os-specific/linux/hdparm/default.nix
+++ b/pkgs/os-specific/linux/hdparm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "hdparm-9.52";
+  name = "hdparm-9.54";
 
   src = fetchurl {
     url = "mirror://sourceforge/hdparm/${name}.tar.gz";
-    sha256 = "1djgxhfadd865dcrl6dp7dvjxpaisy7mk17mbdbglwg24ga9qhn3";
+    sha256 = "0ghnhdj7wfw6acfyhdawpfa5n9kvkvzgi1fw6i7sghgbjx5nhyjd";
 
   };
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index b058aa692f0..724242c588a 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "hwdata-${version}";
-  version = "0.300";
+  version = "0.310";
 
   src = fetchurl {
-    url = "http://pkgs.fedoraproject.org/repo/pkgs/hwdata/v0.300.tar.gz/sha512/34294fcf65c3cb17c19d625732d1656ec1992dde254a68ee35681ad2f310bc05028a85889efa2c1d1e8a2d10885ccc00185475a00f6f2fb82d07e2349e604a51/v0.300.tar.gz";
-    sha256 = "03xlj05qyixhnsybq1qnr7j5q2nvirs4jxpgg4sbw8swsqj3dgqi";
+    url = "https://github.com/vcrhonek/hwdata/archive/v0.310.tar.gz";
+    sha256 = "08mhwwc9g9cpfyxrwwviflkdk2jnqs6hc95iv4r5d59hqrj5kida";
   };
 
   preConfigure = "patchShebangs ./configure";
diff --git a/pkgs/os-specific/linux/iio-sensor-proxy/default.nix b/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
index cdcae22a18e..0ccc8acfdca 100644
--- a/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
+++ b/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchFromGitHub, autoconf-archive, gettext, libtool, intltool, autoconf, automake
-, glib, gtk3, gtk_doc, libgudev, pkgconfig, systemd }:
+, glib, gtk3, gtk-doc, libgudev, pkgconfig, systemd }:
 
 stdenv.mkDerivation rec {
   name = "iio-sensor-proxy-${version}";
-  version = "2.2";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner  = "hadess";
     repo   = "iio-sensor-proxy";
     rev    = version;
-    sha256 = "1x0whwm2r9g50hq5px0bgsrigy8naihqgi6qm0x5q87jz5lkhrnv";
+    sha256 = "1c8izq73c00gvv0jc6zby5hcircs4cb16a1d3ivp1i1iflknj46n";
   };
 
   configurePhase = ''
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     glib
     gtk3
-    gtk_doc
+    gtk-doc
     libgudev
     systemd
   ];
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index be9be49208a..269c59f5e6f 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -1,17 +1,19 @@
-{ fetchurl, stdenv, lib, flex, bison, db, iptables, pkgconfig }:
+{ fetchurl, stdenv, lib, flex, bash, bison, db, iptables, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "iproute2-${version}";
-  version = "4.14.1";
+  version = "4.15.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "0rq0n7yxb0hmk0s6wx5awzjgf7ikjbibd0a5ix20ldfcmxlc0fnl";
+    sha256 = "0mc3g4kj7h3jhwz2b2gdf41gp6bhqn7axh4mnyvhkdnpk5m63m28";
   };
 
   preConfigure = ''
     patchShebangs ./configure
     sed -e '/ARPDDIR/d' -i Makefile
+    # Don't build netem tools--they're not installed and require HOSTCC
+    substituteInPlace Makefile --replace " netem " " "
   '';
 
   makeFlags = [
@@ -37,6 +39,10 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  postInstall = ''
+    PATH=${bash}/bin:$PATH patchShebangs $out/sbin
+  '';
+
   meta = with stdenv.lib; {
     homepage = https://wiki.linuxfoundation.org/networking/iproute2;
     description = "A collection of utilities for controlling TCP/IP networking and traffic control in Linux";
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index 6039ada44e2..68692019ca9 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libmnl }:
 
 stdenv.mkDerivation rec {
-  name = "ipset-6.34";
+  name = "ipset-6.36";
 
   src = fetchurl {
     url = "http://ipset.netfilter.org/${name}.tar.bz2";
-    sha256 = "106nv1ngcvap0mqmb6jm07lc1q3w796rkzc1vrfs4yhbcwdq63np";
+    sha256 = "03fk40v0rbiv2b9ciy3zk8yix163803xvpmdlyvrfzbcvj84l8i2";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index ee1d21ddf2b..1668933db80 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "iptables-${version}";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "http://www.netfilter.org/projects/iptables/files/${name}.tar.bz2";
-    sha256 = "1x8c9y340x79djsq54bc1674ryv59jfphrk4f88i7qbvbnyxghhg";
+    sha256 = "0crp0lvh5m2f15pr8cw97h8yb8zjj10x95zj06j46cr68vx2vl2m";
   };
 
   nativeBuildInputs = [ bison flex pkgconfig ];
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index dd5770744bf..3fc4f3b2377 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -4,8 +4,6 @@
 , libidn, nettle
 , SGMLSpm, libgcrypt }:
 
-assert stdenv ? glibc;
-
 let
   time = "20161105";
 in
@@ -23,18 +21,24 @@ stdenv.mkDerivation rec {
       -i doc/Makefile
   '';
 
-  makeFlags = "USE_GNUTLS=no";
+  # Disable idn usage w/musl: https://github.com/iputils/iputils/pull/111
+  makeFlags = [ "USE_GNUTLS=no" ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "USE_IDN=no";
 
+  depsBuildBuild = [ opensp SGMLSpm docbook_sgml_dtd_31 ];
   buildInputs = [
-    libsysfs opensp openssl libcap docbook_sgml_dtd_31 SGMLSpm libgcrypt libidn nettle
-  ];
+    libsysfs openssl libcap libgcrypt nettle
+  ] ++ stdenv.lib.optional (!stdenv.hostPlatform.isMusl) libidn;
 
-  buildFlags = "man all ninfod";
+  # ninfod probably could build on cross, but the Makefile doesn't pass --host etc to the sub configure...
+  buildFlags = "man all" + stdenv.lib.optionalString (!stdenv.isCross) " ninfod";
 
   installPhase =
     ''
       mkdir -p $out/bin
-      cp -p ping tracepath clockdiff arping rdisc ninfod/ninfod $out/bin/
+      cp -p ping tracepath clockdiff arping rdisc $out/bin/
+      if [ -x ninfod/ninfod ]; then
+        cp -p ninfod/ninfod $out/bin
+      fi
 
       mkdir -p $out/share/man/man8
       cp -p \
diff --git a/pkgs/os-specific/linux/ipvsadm/default.nix b/pkgs/os-specific/linux/ipvsadm/default.nix
new file mode 100644
index 00000000000..0e99dd976c7
--- /dev/null
+++ b/pkgs/os-specific/linux/ipvsadm/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl, pkgconfig, libnl, popt, gnugrep }:
+
+stdenv.mkDerivation rec {
+  name = "ipvsadm-${version}";
+  version = "1.29";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/utils/kernel/ipvsadm/${name}.tar.xz";
+    sha256 = "c3de4a21d90a02c621f0c72ee36a7aa27374b6f29fd4178f33fbf71b4c66c149";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile --replace "-lnl" "$(pkg-config --libs libnl-genl-3.0)"
+  '';
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ libnl popt ];
+
+  preBuild = ''
+    makeFlagsArray+=(
+      INCLUDE=$(pkg-config --cflags libnl-genl-3.0)
+      BUILD_ROOT=$out
+      MANDIR=share/man
+    )
+  '';
+
+  postInstall = ''
+    sed -i -e "s|^PATH=.*|PATH=$out/bin:${gnugrep}/bin|" $out/sbin/ipvsadm-{restore,save}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Linux Virtual Server support programs";
+    homepage = http://www.linuxvirtualserver.org/software/ipvs.html;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix
index 26cedf41a5a..76c10f0a06e 100644
--- a/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/pkgs/os-specific/linux/irqbalance/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "irqbalance-${version}";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "irqbalance";
     repo = "irqbalance";
     rev = "v${version}";
-    sha256 = "1xznxjbjzg6sds3fymdq9rk3g4cgq7xj7rz3dwbqqjqvd3k2nxw6";
+    sha256 = "009777p5v72x4r58skqgaf03qv3app9b8lkxkpxq0226l0x3j4qh";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/os-specific/linux/jfbview/default.nix b/pkgs/os-specific/linux/jfbview/default.nix
index fab66a329e2..fdec72dd09c 100644
--- a/pkgs/os-specific/linux/jfbview/default.nix
+++ b/pkgs/os-specific/linux/jfbview/default.nix
@@ -64,6 +64,7 @@ stdenv.mkDerivation rec {
     homepage = https://seasonofcode.com/pages/jfbview.html;
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nckx ];
+    # incompatible with latest mupdf, see https://github.com/jichu4n/JFBView/issues/17
+    broken = true;
   };
 }
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index b97f48af414..d1e40371e37 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
       # We get a warning in armv5tel-linux and the fuloong2f, so we
       # disable -Werror in it.
-      ${stdenv.lib.optionalString (stdenv.isArm || stdenv.system == "mips64el-linux") ''
+      ${stdenv.lib.optionalString (stdenv.isArm || stdenv.hostPlatform.isMips) ''
         sed -i s/-Werror// src/Makefile.am
       ''}
     '';
diff --git a/pkgs/os-specific/linux/kernel-headers/4.4.nix b/pkgs/os-specific/linux/kernel-headers/4.4.nix
deleted file mode 100644
index e8e041f48eb..00000000000
--- a/pkgs/os-specific/linux/kernel-headers/4.4.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-{ stdenvNoCC, lib, buildPackages
-, buildPlatform, hostPlatform
-, fetchurl, perl
-}:
-
-assert hostPlatform.isLinux;
-
-let
-  version = "4.4.10";
-  inherit (hostPlatform.platform) kernelHeadersBaseConfig;
-in
-
-stdenvNoCC.mkDerivation {
-  name = "linux-headers-${version}";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1kpjvvd9q9wwr3314q5ymvxii4dv2d27295bzly225wlc552xhja";
-  };
-
-  targetConfig = if hostPlatform != buildPlatform then hostPlatform.config else null;
-
-  platform = hostPlatform.platform.kernelArch;
-
-  # It may look odd that we use `stdenvNoCC`, and yet explicit depend on a cc.
-  # We do this so we have a build->build, not build->host, C compiler.
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl ];
-
-  extraIncludeDirs = lib.optional hostPlatform.isPowerPC ["ppc"];
-
-  buildPhase = ''
-    if test -n "$targetConfig"; then
-       export ARCH=$platform
-    fi
-    make ${kernelHeadersBaseConfig} SHELL=bash
-    make mrproper headers_check SHELL=bash
-  '';
-
-  installPhase = ''
-    make INSTALL_HDR_PATH=$out headers_install
-
-    # Some builds (e.g. KVM) want a kernel.release.
-    mkdir -p $out/include/config
-    echo "${version}-default" > $out/include/config/kernel.release
-  '';
-
-  # !!! hacky
-  fixupPhase = ''
-    ln -s asm $out/include/asm-$platform
-    if test "$platform" = "i386" -o "$platform" = "x86_64"; then
-      ln -s asm $out/include/asm-x86
-    fi
-  '';
-
-  meta = with lib; {
-    description = "Header files and scripts for Linux kernel";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
new file mode 100644
index 00000000000..01cab57f719
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -0,0 +1,54 @@
+{ stdenvNoCC, lib, buildPackages
+, buildPlatform, hostPlatform
+, fetchurl, perl
+}:
+
+assert hostPlatform.isLinux;
+
+let
+  common = { version, sha256, patches ? null }: stdenvNoCC.mkDerivation {
+    name = "linux-headers-${version}";
+
+    src = fetchurl {
+      url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
+      inherit sha256;
+    };
+
+    ARCH = hostPlatform.platform.kernelArch;
+
+    # It may look odd that we use `stdenvNoCC`, and yet explicit depend on a cc.
+    # We do this so we have a build->build, not build->host, C compiler.
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    nativeBuildInputs = [ perl ];
+
+    extraIncludeDirs = lib.optional hostPlatform.isPowerPC ["ppc"];
+
+    # "patches" array defaults to 'null' to avoid changing hash
+    # and causing mass rebuild
+    inherit patches;
+
+    buildPhase = ''
+      make mrproper headers_check SHELL=bash
+    '';
+
+    installPhase = ''
+      make INSTALL_HDR_PATH=$out headers_install
+
+      # Some builds (e.g. KVM) want a kernel.release.
+      mkdir -p $out/include/config
+      echo "${version}-default" > $out/include/config/kernel.release
+    '';
+
+    meta = with lib; {
+      description = "Header files and scripts for Linux kernel";
+      license = licenses.gpl2;
+      platforms = platforms.linux;
+    };
+  };
+in {
+
+  linuxHeaders = common {
+    version = "4.15";
+    sha256 = "0sd7l9n9h7vf9c6gd6ciji28hawda60yj0llh17my06m0s4lf9js";
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 5fc22736d7f..5fbd9955c2a 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -16,7 +16,7 @@
 
 */
 
-{ stdenv, version, kernelPlatform, extraConfig, features }:
+{ stdenv, version, extraConfig, features }:
 
 with stdenv.lib;
 
@@ -51,7 +51,7 @@ with stdenv.lib;
 
   # Bump the maximum number of CPUs to support systems like EC2 x1.*
   # instances and Xeon Phi.
-  ${optionalString (stdenv.system == "x86_64-linux" || stdenv.system == "aarch64-linux") ''
+  ${optionalString (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") ''
     NR_CPUS 384
   ''}
 
@@ -134,6 +134,7 @@ with stdenv.lib;
   ''}
   NETFILTER y
   NETFILTER_ADVANCED y
+  CGROUP_BPF? y # Required by systemd per-cgroup firewalling
   IP_ROUTE_VERBOSE y
   IP_MROUTE_MULTIPLE_TABLES y
   IP_VS_PROTO_TCP y
@@ -232,18 +233,23 @@ with stdenv.lib;
 
   # USB serial devices.
   USB_SERIAL_GENERIC y # USB Generic Serial Driver
-  USB_SERIAL_KEYSPAN_MPR y # include firmware for various USB serial devices
-  USB_SERIAL_KEYSPAN_USA28 y
-  USB_SERIAL_KEYSPAN_USA28X y
-  USB_SERIAL_KEYSPAN_USA28XA y
-  USB_SERIAL_KEYSPAN_USA28XB y
-  USB_SERIAL_KEYSPAN_USA19 y
-  USB_SERIAL_KEYSPAN_USA18X y
-  USB_SERIAL_KEYSPAN_USA19W y
-  USB_SERIAL_KEYSPAN_USA19QW y
-  USB_SERIAL_KEYSPAN_USA19QI y
-  USB_SERIAL_KEYSPAN_USA49W y
-  USB_SERIAL_KEYSPAN_USA49WLC y
+
+  # Include firmware for various USB serial devices.
+  # Only applicable for kernels below 4.16, after that no firmware is shipped in the kernel tree.
+  ${optionalString (versionOlder version "4.16") ''
+    USB_SERIAL_KEYSPAN_MPR y
+    USB_SERIAL_KEYSPAN_USA28 y
+    USB_SERIAL_KEYSPAN_USA28X y
+    USB_SERIAL_KEYSPAN_USA28XA y
+    USB_SERIAL_KEYSPAN_USA28XB y
+    USB_SERIAL_KEYSPAN_USA19 y
+    USB_SERIAL_KEYSPAN_USA18X y
+    USB_SERIAL_KEYSPAN_USA19W y
+    USB_SERIAL_KEYSPAN_USA19QW y
+    USB_SERIAL_KEYSPAN_USA19QI y
+    USB_SERIAL_KEYSPAN_USA49W y
+    USB_SERIAL_KEYSPAN_USA49WLC y
+  ''}
 
   # Device mapper (RAID, LVM, etc.)
   MD y
@@ -343,15 +349,16 @@ with stdenv.lib;
 
   # Security related features.
   RANDOMIZE_BASE? y
-  STRICT_DEVMEM y # Filter access to /dev/mem
+  STRICT_DEVMEM? y # Filter access to /dev/mem
   SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
   SECURITY_YAMA? y # Prevent processes from ptracing non-children processes
   DEVKMEM n # Disable /dev/kmem
-  ${if versionOlder version "3.14" then ''
-    CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
-  '' else ''
-    CC_STACKPROTECTOR_REGULAR? y
-  ''}
+  ${optionalString (! stdenv.hostPlatform.isArm)
+    (if versionOlder version "3.14" then ''
+        CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
+      '' else ''
+        CC_STACKPROTECTOR_REGULAR? y
+      '')}
   ${optionalString (versionAtLeast version "3.12") ''
     USER_NS y # Support for user namespaces
   ''}
@@ -444,6 +451,7 @@ with stdenv.lib;
   RC_DEVICES? y # Enable IR devices
   RT2800USB_RT55XX y
   SCHED_AUTOGROUP y
+  CFS_BANDWIDTH y
   SCSI_LOGGING y # SCSI logging facility
   SERIAL_8250 y # 8250/16550 and compatible serial support
   SLIP_COMPRESSED y # CSLIP compressed headers
@@ -629,15 +637,17 @@ with stdenv.lib;
   FW_LOADER_USER_HELPER_FALLBACK? n
 
   # Disable various self-test modules that have no use in a production system
-  ${optionalString (versionOlder version "4.4") ''
-    ARM_KPROBES_TEST? n
-  ''}
-
+  # This menu disables all/most of them on >= 4.16
+  RUNTIME_TESTING_MENU? n
+  # For older kernels, painstakingly disable each symbol.
+  ARM_KPROBES_TEST? n
   ASYNC_RAID6_TEST? n
   ATOMIC64_SELFTEST? n
   BACKTRACE_SELF_TEST? n
   CRC32_SELFTEST? n
   CRYPTO_TEST? n
+  DRM_DEBUG_MM_SELFTEST? n
+  EFI_TEST? n
   GLOB_SELFTEST? n
   INTERVAL_TREE_TEST? n
   LNET_SELFTEST? n
@@ -646,41 +656,50 @@ with stdenv.lib;
   NOTIFIER_ERROR_INJECTION? n
   PERCPU_TEST? n
   RBTREE_TEST? n
+  RCU_PERF_TEST? n
   RCU_TORTURE_TEST? n
+  TEST_ASYNC_DRIVER_PROBE? n
+  TEST_BITMAP? n
   TEST_BPF? n
   TEST_FIRMWARE? n
+  TEST_HASH? n
   TEST_HEXDUMP? n
+  TEST_KMOD? n
   TEST_KSTRTOX? n
   TEST_LIST_SORT? n
   TEST_LKM? n
+  TEST_PARMAN? n
   TEST_PRINTF? n
   TEST_RHASHTABLE? n
+  TEST_SORT? n
   TEST_STATIC_KEYS? n
   TEST_STRING_HELPERS? n
   TEST_UDELAY? n
   TEST_USER_COPY? n
+  TEST_UUID? n
+  WW_MUTEX_SELFTEST? n
   XZ_DEC_TEST? n
 
-  ${optionalString (versionAtLeast version "4.13") ''
-    TEST_KMOD n
+  ${optionalString (features.criu or false)  ''
+    EXPERT y
+    CHECKPOINT_RESTORE y
   ''}
 
-  ${optionalString (versionOlder version "4.4") ''
-    EFI_TEST? n
-    RCU_PERF_TEST? n
-    TEST_ASYNC_DRIVER_PROBE? n
-    TEST_BITMAP? n
-    TEST_HASH? n
-    TEST_UUID? n
+  ${optionalString ((features.criu or false) && (features.criu_revert_expert or true))
+    # Revert some changes, introduced by EXPERT, when necessary for criu
+  ''
+    RFKILL_INPUT? y
+    HID_PICOLCD_FB? y
+    HID_PICOLCD_BACKLIGHT? y
+    HID_PICOLCD_LCD? y
+    HID_PICOLCD_LEDS? y
+    HID_PICOLCD_CIR? y
+    DEBUG_MEMORY_INIT? y
   ''}
 
-  ${optionalString (versionAtLeast version "4.11") ''
-    DRM_DEBUG_MM_SELFTEST? n
-    TEST_PARMAN? n
-    TEST_SORT? n
-    WW_MUTEX_SELFTEST? n
+  ${optionalString (features.debug or false)  ''
+    DEBUG_INFO y
   ''}
 
-  ${kernelPlatform.kernelExtraConfig or ""}
   ${extraConfig}
 ''
diff --git a/pkgs/os-specific/linux/kernel/generate-config.pl b/pkgs/os-specific/linux/kernel/generate-config.pl
index 5bce3af9429..f886fcfdc35 100644
--- a/pkgs/os-specific/linux/kernel/generate-config.pl
+++ b/pkgs/os-specific/linux/kernel/generate-config.pl
@@ -13,18 +13,18 @@ use strict;
 use IPC::Open2;
 use Cwd;
 
-my $wd = getcwd;
-
+# exported via nix
 my $debug = $ENV{'DEBUG'};
 my $autoModules = $ENV{'AUTO_MODULES'};
 my $preferBuiltin = $ENV{'PREFER_BUILTIN'};
-    
+my $ignoreConfigErrors = $ENV{'ignoreConfigErrors'};
+my $buildRoot = $ENV{'BUILD_ROOT'};
 $SIG{PIPE} = 'IGNORE';
 
 # Read the answers.
 my %answers;
 my %requiredAnswers;
-open ANSWERS, "<$ENV{KERNEL_CONFIG}" or die;
+open ANSWERS, "<$ENV{KERNEL_CONFIG}" or die "Could not open answer file";
 while (<ANSWERS>) {
     chomp;
     s/#.*//;
@@ -40,7 +40,7 @@ close ANSWERS;
 sub runConfig {
 
     # Run `make config'.
-    my $pid = open2(\*IN, \*OUT, "make -C $ENV{SRC} O=$wd config SHELL=bash ARCH=$ENV{ARCH}");
+    my $pid = open2(\*IN, \*OUT, "make -C $ENV{SRC} O=$buildRoot config SHELL=bash ARCH=$ENV{ARCH}");
 
     # Parse the output, look for questions and then send an
     # appropriate answer.
@@ -122,7 +122,7 @@ runConfig;
 # there.  `make config' often overrides answers if later questions
 # cause options to be selected.
 my %config;
-open CONFIG, "<.config" or die;
+open CONFIG, "<$buildRoot/.config" or die "Could not read .config";
 while (<CONFIG>) {
     chomp;
     if (/^CONFIG_([A-Za-z0-9_]+)="(.*)"$/) {
@@ -137,7 +137,7 @@ while (<CONFIG>) {
 close CONFIG;
 
 foreach my $name (sort (keys %answers)) {
-    my $f = $requiredAnswers{$name} && $ENV{'ignoreConfigErrors'} ne "1"
+    my $f = $requiredAnswers{$name} && $ignoreConfigErrors ne "1"
         ? sub { die "error: " . $_[0]; } : sub { warn "warning: " . $_[0]; };
     &$f("unused option: $name\n") unless defined $config{$name};
     &$f("option not set correctly: $name (wanted '$answers{$name}', got '$config{$name}')\n")
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 0d2b7655edb..1b8c3f76155 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -1,4 +1,10 @@
-{ stdenv, perl, buildLinux
+{ buildPackages
+, ncurses
+, callPackage
+, perl
+, bison ? null
+, flex ? null
+, stdenv
 
 , # The kernel source tarball.
   src
@@ -23,11 +29,18 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.platform.name != "pc"
+, ignoreConfigErrors ? hostPlatform.platform.name != "pc" ||
+                       hostPlatform != stdenv.buildPlatform
 , extraMeta ? {}
 , hostPlatform
+
+# easy overrides to hostPlatform.platform members
+, autoModules ? hostPlatform.platform.kernelAutoModules
+, preferBuiltin ? hostPlatform.platform.kernelPreferBuiltin or false
+, kernelArch ? hostPlatform.platform.kernelArch
+
 , ...
-}:
+} @ args:
 
 assert stdenv.isLinux;
 
@@ -43,14 +56,14 @@ let
     netfilterRPFilter = true;
   } // features) kernelPatches;
 
-  configWithPlatform = kernelPlatform: import ./common-config.nix {
-    inherit stdenv version kernelPlatform extraConfig;
+  config = import ./common-config.nix {
+    inherit stdenv version ;
+    # append extraConfig for backwards compatibility but also means the user can't override the kernelExtraConfig part
+    extraConfig = extraConfig + lib.optionalString (hostPlatform.platform ? kernelExtraConfig) hostPlatform.platform.kernelExtraConfig;
+
     features = kernelFeatures; # Ensure we know of all extra patches, etc.
   };
 
-  config = configWithPlatform stdenv.platform;
-  configCross = configWithPlatform hostPlatform.platform;
-
   kernelConfigFun = baseConfig:
     let
       configFromPatches =
@@ -58,38 +71,22 @@ let
     in lib.concatStringsSep "\n" ([baseConfig] ++ configFromPatches);
 
   configfile = stdenv.mkDerivation {
-    inherit ignoreConfigErrors;
+    inherit ignoreConfigErrors autoModules preferBuiltin kernelArch;
     name = "linux-config-${version}";
 
     generateConfig = ./generate-config.pl;
 
     kernelConfig = kernelConfigFun config;
 
-    nativeBuildInputs = [ perl ];
-
-    platformName = stdenv.platform.name;
-    kernelBaseConfig = stdenv.platform.kernelBaseConfig;
-    kernelTarget = stdenv.platform.kernelTarget;
-    autoModules = stdenv.platform.kernelAutoModules;
-    preferBuiltin = stdenv.platform.kernelPreferBuiltin or false;
-    arch = stdenv.platform.kernelArch;
-
-    crossAttrs = let
-        cp = hostPlatform.platform;
-      in {
-        arch = cp.kernelArch;
-        platformName = cp.name;
-        kernelBaseConfig = cp.kernelBaseConfig;
-        kernelTarget = cp.kernelTarget;
-        autoModules = cp.kernelAutoModules;
-
-        # Just ignore all options that don't apply (We are lazy).
-        ignoreConfigErrors = true;
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+    nativeBuildInputs = [ perl ]
+      ++ lib.optionals (stdenv.lib.versionAtLeast version "4.16") [ bison flex ];
 
-        kernelConfig = kernelConfigFun configCross;
-
-        inherit (kernel.crossDrv) src patches preUnpack;
-      };
+    platformName = hostPlatform.platform.name;
+    # e.g. "defconfig"
+    kernelBaseConfig = hostPlatform.platform.kernelBaseConfig;
+    # e.g. "bzImage"
+    kernelTarget = hostPlatform.platform.kernelTarget;
 
     prePatch = kernel.prePatch + ''
       # Patch kconfig to print "###" after every question so that
@@ -100,33 +97,27 @@ let
     inherit (kernel) src patches preUnpack;
 
     buildPhase = ''
-      cd $buildRoot
+      export buildRoot="''${buildRoot:-build}"
 
       # Get a basic config file for later refinement with $generateConfig.
-      make -C ../$sourceRoot O=$PWD $kernelBaseConfig ARCH=$arch
+      make HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc -C . O="$buildRoot" $kernelBaseConfig ARCH=$kernelArch
 
       # Create the config file.
       echo "generating kernel configuration..."
-      echo "$kernelConfig" > kernel-config
-      DEBUG=1 ARCH=$arch KERNEL_CONFIG=kernel-config AUTO_MODULES=$autoModules \
-           PREFER_BUILTIN=$preferBuiltin SRC=../$sourceRoot perl -w $generateConfig
+      echo "$kernelConfig" > "$buildRoot/kernel-config"
+      DEBUG=1 ARCH=$kernelArch KERNEL_CONFIG="$buildRoot/kernel-config" AUTO_MODULES=$autoModules \
+           PREFER_BUILTIN=$preferBuiltin BUILD_ROOT="$buildRoot" SRC=. perl -w $generateConfig
     '';
 
-    installPhase = "mv .config $out";
+    installPhase = "mv $buildRoot/.config $out";
 
     enableParallelBuilding = true;
   };
 
-  kernel = buildLinux {
-    inherit version modDirVersion src kernelPatches stdenv extraMeta;
-
-    configfile = configfile.nativeDrv or configfile;
-
-    crossConfigfile = configfile.crossDrv or configfile;
+  kernel = (callPackage ./manual-config.nix {}) {
+    inherit version modDirVersion src kernelPatches stdenv extraMeta configfile hostPlatform;
 
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
-
-    crossConfig = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
   };
 
   passthru = {
@@ -134,10 +125,4 @@ let
     passthru = kernel.passthru // (removeAttrs passthru [ "passthru" ]);
   };
 
-  nativeDrv = lib.addPassthru kernel.nativeDrv passthru;
-
-  crossDrv = lib.addPassthru kernel.crossDrv passthru;
-
-in if kernel ? crossDrv
-   then nativeDrv // { inherit nativeDrv crossDrv; }
-   else lib.addPassthru kernel passthru
+in lib.extendDerivation true passthru kernel
diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix
index b7959f9d359..3a82c00c501 100644
--- a/pkgs/os-specific/linux/kernel/hardened-config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened-config.nix
@@ -61,8 +61,8 @@ ${optionalString (versionAtLeast version "4.12") ''
 DEBUG_WX y # boot-time warning on RWX mappings
 
 # Stricter /dev/mem
-STRICT_DEVMEM y
-IO_STRICT_DEVMEM y
+STRICT_DEVMEM? y
+IO_STRICT_DEVMEM? y
 
 # Perform additional validation of commonly targeted structures.
 DEBUG_CREDENTIALS y
diff --git a/pkgs/os-specific/linux/kernel/linux-4.13.nix b/pkgs/os-specific/linux/kernel/linux-4.13.nix
deleted file mode 100644
index 767f7e35422..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.13.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
-
-import ./generic.nix (args // rec {
-  version = "4.13.16";
-  extraMeta.branch = "4.13";
-
-  # TODO: perhaps try being more concrete (ideally CVE numbers).
-  extraMeta.knownVulnerabilities = [
-    "ALSA: usb-audio: Fix potential out-of-bound access at parsing SU"
-    "eCryptfs: use after free in ecryptfs_release_messaging()"
-  ];
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0cf7prqzl1ajbgl98w0symdyn0k5wl5xaf1l5ldgy6l083yg69dh";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 550890b3557..adf9dbd818c 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -1,18 +1,15 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 with stdenv.lib;
 
-import ./generic.nix (args // rec {
-  version = "4.14.12";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
+buildLinux (args // rec {
+  version = "4.14.28";
 
   # branchVersion needs to be x.y
   extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1bsn73h3ilf7msyiqm5ny2zdj30b9r7k9sc8i03w3iggh3agf236";
+    sha256 = "0byx2824ml2ck97p66gfipnasbn9zz6rhjps61n6gprg3ac5fd07";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.15.nix b/pkgs/os-specific/linux/kernel/linux-4.15.nix
new file mode 100644
index 00000000000..5c4a452dd12
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-4.15.nix
@@ -0,0 +1,18 @@
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+
+with stdenv.lib;
+
+buildLinux (args // rec {
+  version = "4.15.11";
+
+  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
+  modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
+
+  # branchVersion needs to be x.y
+  extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
+    sha256 = "0rjzlkp24ch58vx0xljrf6l33i8xv2mal0x821kwfqp551npdxfc";
+  };
+} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index e2887b70d51..5994a081600 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
-import ./generic.nix (args // rec {
-  version = "4.4.110";
+buildLinux (args // rec {
+  version = "4.4.122";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0n6v872ahny9j29lh60c7ha5fa1as9pdag7jsb5fcy2nmid1g6fh";
+    sha256 = "1hxph2bn2wdamk1p5sxl2szgsk4aybb0245x1rvf85a6skhjqc7g";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 3b8fe6d7619..3bcfa3912aa 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
-import ./generic.nix (args // rec {
-  version = "4.9.75";
+buildLinux (args // rec {
+  version = "4.9.88";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1pyan45647wnliwhhp3dlmyvz7ibl1i56qplf3ilfh4dcsvk2v6y";
+    sha256 = "094cxc86ajnsai1vwy76mmg7l3b9lvhk6mw6746lsr3fnzv1fkq7";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-beagleboard.nix b/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
index 33885a082d6..4f0ff53c59c 100644
--- a/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
+++ b/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
@@ -1,10 +1,10 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ubootTools, dtc, ... } @ args:
 
 let
-  modDirVersion = "4.9.61";
-  tag = "r76";
+  modDirVersion = "4.14.12";
+  tag = "r23";
 in
-import ./generic.nix (args // rec {
+stdenv.lib.overrideDerivation (buildLinux (args // rec {
   version = "${modDirVersion}-ti-${tag}";
   inherit modDirVersion;
 
@@ -12,7 +12,7 @@ import ./generic.nix (args // rec {
     owner = "beagleboard";
     repo = "linux";
     rev = "${version}";
-    sha256 = "0hcz4fwjyic42mrn8qsvzm4jq1g5k51awjj3d2das7k8frjalaby";
+    sha256 = "07hdv2h12gsgafxsqqr7b0fir10rv9k66riklpjba2cg6x0p2nr4";
   };
 
   kernelPatches = args.kernelPatches;
@@ -21,5 +21,14 @@ import ./generic.nix (args // rec {
     efiBootStub = false;
   } // (args.features or {});
 
-  extraMeta.hydraPlatforms = [];
-} // (args.argsOverride or {}))
+  extraMeta.hydraPlatforms = [ "armv7l-linux" ];
+} // (args.argsOverride or {}))) (oldAttrs: {
+
+  # This kernel will run mkuboot.sh.
+  postPatch = ''
+    patchShebangs scripts/
+  '';
+
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ dtc ubootTools ];
+
+})
diff --git a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix b/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
index 5f4a5d5adb5..f59106746fe 100644
--- a/pkgs/os-specific/linux/kernel/linux-hardened-copperhead.nix
+++ b/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
@@ -1,11 +1,11 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 with stdenv.lib;
 
 let
-  version = "4.14.12";
+  version = "4.15.10";
   revision = "a";
-  sha256 = "002a3c177fix472wqc89zrpfzwk60l7dn76l869ivgnd60n6wqb2";
+  sha256 = "02plwrj6d7wzwf6w8q2cxspy2q58i3v46clm2vf8m9x6mm88jrzx";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
@@ -15,7 +15,7 @@ let
 
   modDirVersion = "${modVersion}-hardened";
 in
-import ./generic.nix (args // {
+buildLinux (args // {
   inherit modDirVersion;
 
   version = "${version}-${revision}";
diff --git a/pkgs/os-specific/linux/kernel/linux-mptcp.nix b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
index 92b202100a6..c4bade2abed 100644
--- a/pkgs/os-specific/linux/kernel/linux-mptcp.nix
+++ b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
@@ -1,9 +1,10 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
-import ./generic.nix (rec {
+buildLinux (rec {
   mptcpVersion = "0.93";
   modDirVersion = "4.9.60";
   version = "${modDirVersion}-mptcp_v${mptcpVersion}";
+  # autoModules= true;
 
   extraMeta = {
     branch = "4.4";
@@ -43,4 +44,4 @@ import ./generic.nix (rec {
     TCP_CONG_BALIA m
 
   '' + (args.extraConfig or "");
-} // args // (args.argsOverride or {}))
+} // args)
diff --git a/pkgs/os-specific/linux/kernel/linux-riscv.nix b/pkgs/os-specific/linux/kernel/linux-riscv.nix
new file mode 100644
index 00000000000..45795e24c54
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-riscv.nix
@@ -0,0 +1,18 @@
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, libelf, utillinux, ... } @ args:
+
+buildLinux (args // rec {
+  version = "4.16-rc2";
+  modDirVersion = "4.16.0-rc2";
+  extraMeta.branch = "4.16";
+
+  src = fetchFromGitHub {
+    owner = "shlevy";
+    repo ="riscv-linux";
+    rev = "f0c42cff9292c0a8e6ca702a54aafa04b35758a6";
+    sha256 = "050mdciyz1595z81zsss0v9vqsaysppyzqaqpfs5figackifv3iv";
+  };
+
+  # Should the testing kernels ever be built on Hydra?
+  extraMeta.hydraPlatforms = [];
+
+} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index fb97aa579df..a96a910c68c 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,10 +1,10 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
 
 let
   modDirVersion = "4.9.59";
   tag = "1.20171029";
 in
-stdenv.lib.overrideDerivation (import ./generic.nix (args // rec {
+stdenv.lib.overrideDerivation (buildLinux (args // rec {
   version = "${modDirVersion}-${tag}";
   inherit modDirVersion;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
index 32c684668d6..442c8967511 100644
--- a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
@@ -1,6 +1,6 @@
-{ stdenv, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
 
-import ./generic.nix (args // rec {
+buildLinux (args // rec {
   version = "4.12.2";
   extraMeta.branch = "4.12-2";
 
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index a104cc5393c..5aae37418ce 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,15 +1,15 @@
-{ stdenv, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
 
-import ./generic.nix (args // rec {
-  version = "4.11.2017.08.23";
-  modDirVersion = "4.11.0";
+buildLinux (args // rec {
+  version = "4.15.2018.02.09";
+  modDirVersion = "4.15.0";
   extraMeta.branch = "master";
   extraMeta.maintainers = [ stdenv.lib.maintainers.davidak ];
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs.git";
-    rev = "fb8082a13d49397346a04ce4d3904569b0287738";
-    sha256 = "18csg2zb4lnhid27h5w95j3g8np29m8y3zfpfgjl1jr2jks64kid";
+    rev = "4506cd5ead31209a6a646c2412cbc7be735ebda4";
+    sha256 = "0fcyf3y27k2lga5na4dhdyc47br840gkqynv8gix297pqxgidrib";
   };
 
   extraConfig = ''
@@ -20,4 +20,3 @@ import ./generic.nix (args // rec {
   extraMeta.hydraPlatforms = [];
 
 } // (args.argsOverride or {}))
-
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index e4dac2932bc..48aaeebc4d2 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
-{ stdenv, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
+{ stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
-import ./generic.nix (args // rec {
-  version = "4.15-rc4";
-  modDirVersion = "4.15.0-rc4";
-  extraMeta.branch = "4.15";
+buildLinux (args // rec {
+  version = "4.16-rc5";
+  modDirVersion = "4.16.0-rc5";
+  extraMeta.branch = "4.16";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "13mz21pdqk17hrwga9246cj9bkcz3xmmg0cb4mrbsrb1nv4niv0k";
+    sha256 = "0yfa0qrs6fwh88xgn252j7nc8q4x5qhf20dlax9hcnza0ai6nk3z";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index e1936495921..60fb0064513 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,8 +1,8 @@
-{ runCommand, nettools, bc, perl, gmp, libmpc, mpfr, kmod, openssl
-, libelf ? null
-, utillinux ? null
+{ buildPackages, runCommand, nettools, bc, bison, flex, perl, gmp, libmpc, mpfr, openssl
+, ncurses ? null
+, libelf
+, utillinux
 , writeTextFile, ubootTools
-, hostPlatform
 }:
 
 let
@@ -26,31 +26,25 @@ in {
   src,
   # Any patches
   kernelPatches ? [],
-  # Patches for native compiling only
-  nativeKernelPatches ? [],
-  # Patches for cross compiling only
-  crossKernelPatches ? [],
-  # The native kernel .config file
+  # The kernel .config file
   configfile,
-  # The cross kernel .config file
-  crossConfigfile ? configfile,
   # Manually specified nixexpr representing the config
   # If unspecified, this will be autodetected from the .config
   config ? stdenv.lib.optionalAttrs allowImportFromDerivation (readConfig configfile),
-  # Cross-compiling config
-  crossConfig ? if allowImportFromDerivation then (readConfig crossConfigfile) else config,
   # Use defaultMeta // extraMeta
   extraMeta ? {},
   # Whether to utilize the controversial import-from-derivation feature to parse the config
-  allowImportFromDerivation ? false
+  allowImportFromDerivation ? false,
+
+  hostPlatform
 }:
 
 let
   inherit (stdenv.lib)
-    hasAttr getAttr optional optionalString optionalAttrs maintainers platforms;
+    hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = stdenv.lib.optional (stdenv.lib.versionAtLeast version "4.14") libelf;
+  moduleBuildDependencies = optional (stdenv.lib.versionAtLeast version "4.14") libelf;
 
   installkernel = writeTextFile { name = "installkernel"; executable=true; text = ''
     #!${stdenv.shell} -e
@@ -61,8 +55,8 @@ let
 
   commonMakeFlags = [
     "O=$(buildRoot)"
-  ] ++ stdenv.lib.optionals (stdenv.platform ? kernelMakeFlags)
-    stdenv.platform.kernelMakeFlags;
+  ] ++ stdenv.lib.optionals (hostPlatform.platform ? kernelMakeFlags)
+    hostPlatform.platform.kernelMakeFlags;
 
   drvAttrs = config_: platform: kernelPatches: configfile:
     let
@@ -85,17 +79,17 @@ let
       isModular = config.isYes "MODULES";
 
       installsFirmware = (config.isEnabled "FW_LOADER") &&
-        (isModular || (config.isDisabled "FIRMWARE_IN_KERNEL"));
+        (isModular || (config.isDisabled "FIRMWARE_IN_KERNEL")) &&
+        (stdenv.lib.versionOlder version "4.14");
     in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
       passthru = {
-        inherit version modDirVersion config kernelPatches configfile moduleBuildDependencies;
+        inherit version modDirVersion config kernelPatches configfile
+          moduleBuildDependencies stdenv;
       };
 
       inherit src;
 
       preUnpack = ''
-        mkdir build
-        export buildRoot="$(pwd)/build"
       '';
 
       patches = map (p: p.patch) kernelPatches;
@@ -105,12 +99,30 @@ let
             echo "stripping FHS paths in \`$mf'..."
             sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g'
         done
-        sed -i Makefile -e 's|= depmod|= ${kmod}/bin/depmod|'
+        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
       '';
 
       configurePhase = ''
         runHook preConfigure
+
+        mkdir build
+        export buildRoot="$(pwd)/build"
+
+        echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
+
+        if [[ -z "$buildRoot" || ! -d "$buildRoot" ]]; then
+          echo "set $buildRoot to the build folder please"
+          exit 1
+        fi
+
+        if [ -f "$buildRoot/.config" ]; then
+          echo "Could not link $buildRoot/.config : file exists"
+          exit 1
+        fi
         ln -sv ${configfile} $buildRoot/.config
+
+        # reads the existing .config file and prompts the user for options in
+        # the current kernel source that are not found in the file.
         make $makeFlags "''${makeFlagsArray[@]}" oldconfig
         runHook postConfigure
 
@@ -123,6 +135,8 @@ let
 
         # Note: we can get rid of this once http://permalink.gmane.org/gmane.linux.kbuild.devel/13800 is merged.
         buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
+
+        cd $buildRoot
       '';
 
       buildFlags = [
@@ -142,14 +156,13 @@ let
                           if platform.kernelTarget == "zImage" || platform.kernelTarget == "Image.gz" then "zinstall" else
                           "install") ];
 
-      postInstall = ''
-        mkdir -p $dev
-        cp $buildRoot/vmlinux $dev/
-      '' + (optionalString installsFirmware ''
+      postInstall = (optionalString installsFirmware ''
         mkdir -p $out/lib/firmware
       '') + (if (platform ? kernelDTB && platform.kernelDTB) then ''
         make $makeFlags "''${makeFlagsArray[@]}" dtbs dtbs_install INSTALL_DTBS_PATH=$out/dtbs
       '' else "") + (if isModular then ''
+        mkdir -p $dev
+        cp vmlinux $dev/
         if [ -z "$dontStrip" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
         fi
@@ -159,7 +172,7 @@ let
         unlink $out/lib/modules/${modDirVersion}/source
 
         mkdir -p $dev/lib/modules/${modDirVersion}/build
-        cp -dpR ../$sourceRoot $dev/lib/modules/${modDirVersion}/source
+        cp -dpR .. $dev/lib/modules/${modDirVersion}/source
         cd $dev/lib/modules/${modDirVersion}/source
 
         cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
@@ -178,7 +191,7 @@ let
         # from drivers/ in the future; it adds 50M to keep all of its
         # headers on 3.10 though.
 
-        chmod u+w -R ../source
+        chmod u+w -R ..
         arch=$(cd $dev/lib/modules/${modDirVersion}/build/arch; ls)
 
         # Remove unused arches
@@ -211,7 +224,7 @@ let
         find -empty -type d -delete
 
         # Remove reference to kmod
-        sed -i Makefile -e 's|= ${kmod}/bin/depmod|= depmod|'
+        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
       '' else optionalString installsFirmware ''
         make firmware_install $makeFlags "''${makeFlagsArray[@]}" \
           $installFlags "''${installFlagsArray[@]}"
@@ -224,7 +237,7 @@ let
           "The Linux kernel" +
           (if kernelPatches == [] then "" else
             " (with patches: "
-            + stdenv.lib.concatStrings (stdenv.lib.intersperse ", " (map (x: x.name) kernelPatches))
+            + stdenv.lib.concatStringsSep ", " (map (x: x.name) kernelPatches)
             + ")");
         license = stdenv.lib.licenses.gpl2;
         homepage = https://www.kernel.org/;
@@ -239,34 +252,29 @@ in
 
 assert stdenv.lib.versionAtLeast version "4.14" -> libelf != null;
 assert stdenv.lib.versionAtLeast version "4.15" -> utillinux != null;
-stdenv.mkDerivation ((drvAttrs config stdenv.platform (kernelPatches ++ nativeKernelPatches) configfile) // {
+stdenv.mkDerivation ((drvAttrs config hostPlatform.platform kernelPatches configfile) // {
   name = "linux-${version}";
 
   enableParallelBuilding = true;
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl bc nettools openssl gmp libmpc mpfr ]
-      ++ optional (stdenv.platform.kernelTarget == "uImage") ubootTools
+      ++ optional (stdenv.hostPlatform.platform.kernelTarget == "uImage") buildPackages.ubootTools
       ++ optional (stdenv.lib.versionAtLeast version "4.14") libelf
       ++ optional (stdenv.lib.versionAtLeast version "4.15") utillinux
+      ++ optionals (stdenv.lib.versionAtLeast version "4.16") [ bison flex ]
       ;
 
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" ];
 
+  # Absolute paths for compilers avoid any PATH-clobbering issues.
   makeFlags = commonMakeFlags ++ [
-    "ARCH=${stdenv.platform.kernelArch}"
+    "CC=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
+    "HOSTCC=${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc"
+    "ARCH=${stdenv.hostPlatform.platform.kernelArch}"
+  ] ++ stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
-  karch = stdenv.platform.kernelArch;
-
-  crossAttrs = let cp = hostPlatform.platform; in
-    (drvAttrs crossConfig cp (kernelPatches ++ crossKernelPatches) crossConfigfile) // {
-      makeFlags = commonMakeFlags ++ [
-        "ARCH=${cp.kernelArch}"
-        "CROSS_COMPILE=$(crossConfig)-"
-      ];
-
-      karch = cp.kernelArch;
-
-      nativeBuildInputs = optional (cp.kernelTarget == "uImage") ubootTools;
-  };
+  karch = hostPlatform.platform.kernelArch;
 })
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 754a2372c6d..e163459d7f4 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -72,4 +72,5 @@ rec {
       sha256 = "09096npxpgvlwdz3pb3m9brvxh7vy0xc9z9p8hh85xyczyzcsjhr";
     };
   };
+
 }
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 4bcf6e037e0..06552eb3579 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto, makeWrapper
 , docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
-, libiberty, libaudit
-, zlib, withGtk ? false, gtk2 ? null }:
+, libiberty, libaudit, libbfd, openssl, systemtap, numactl
+, zlib, withGtk ? false, gtk2 ? null
+}:
 
 with lib;
 
@@ -11,21 +12,29 @@ assert versionAtLeast kernel.version "3.12";
 stdenv.mkDerivation {
   name = "perf-linux-${kernel.version}";
 
-  inherit (kernel) src;
+  inherit (kernel) src makeFlags;
 
   preConfigure = ''
     cd tools/perf
-    sed -i s,/usr/include/elfutils,$elfutils/include/elfutils, Makefile
+
+    substituteInPlace Makefile \
+      --replace /usr/include/elfutils $elfutils/include/elfutils
+
+    for x in util/build-id.c util/dso.c; do
+      substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
+    done
+
     [ -f bash_completion ] && sed -i 's,^have perf,_have perf,' bash_completion
-    export makeFlags="DESTDIR=$out $makeFlags"
+    export makeFlags="DESTDIR=$out WERROR=0 $makeFlags"
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -DTIPDIR=\"$out/share/doc/perf-tip\""
   '';
 
   # perf refers both to newt and slang
-  # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-      flex bison libiberty libaudit makeWrapper pkgconfig ];
-  buildInputs = [ elfutils python perl newt slang libunwind binutils zlib ] ++
-    stdenv.lib.optional withGtk gtk2;
+      flex bison libiberty libaudit makeWrapper pkgconfig python perl ];
+  buildInputs =
+    [ elfutils newt slang libunwind libbfd zlib openssl systemtap.stapBuild numactl
+    ] ++ stdenv.lib.optional withGtk gtk2;
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
@@ -40,6 +49,7 @@ stdenv.mkDerivation {
       "-Wno-error=unused-const-variable" "-Wno-error=misleading-indentation"
     ];
 
+  separateDebugInfo = true;
   installFlags = "install install-man ASCIIDOC8=1";
 
   preFixup = ''
@@ -47,15 +57,6 @@ stdenv.mkDerivation {
       --prefix PATH : "${binutils}/bin"
   '';
 
-  crossAttrs = {
-    /* I don't want cross-python or cross-perl -
-       I don't know if cross-python even works */
-    propagatedBuildInputs = [ elfutils.crossDrv newt.crossDrv ];
-    makeFlags = "CROSS_COMPILE=${stdenv.cc.targetPrefix}";
-    elfutils = elfutils.crossDrv;
-    inherit (kernel.crossDrv) src patches;
-  };
-
   meta = {
     homepage = https://perf.wiki.kernel.org/;
     description = "Linux tools to profile with performance counters";
diff --git a/pkgs/os-specific/linux/kernel/update.sh b/pkgs/os-specific/linux/kernel/update.sh
index d9db7f9f916..878c3c14fe4 100755
--- a/pkgs/os-specific/linux/kernel/update.sh
+++ b/pkgs/os-specific/linux/kernel/update.sh
@@ -50,13 +50,13 @@ ls $NIXPKGS/pkgs/os-specific/linux/kernel | while read FILE; do
   # Rewrite the expression
   sed -i -e '/version = /d' -e '/modDirVersion = /d' $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
   if grep -q '^[0-9]\+.[0-9]\+$' <<< "$V"; then
-    sed -i "\#import ./generic.nix (args // rec {#a \  modDirVersion = \"${V}.0\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
+    sed -i "\#buildLinux (args // rec {#a \  modDirVersion = \"${V}.0\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
   fi
-  sed -i "\#import ./generic.nix (args // rec {#a \  version = \"$V\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
+  sed -i "\#buildLinux (args // rec {#a \  version = \"$V\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
 
   # Commit the changes
   git add -u $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
   git commit -m "kernel: $OLDVER -> $V" >/dev/null 2>&1
-  
+
   echo "Updated $OLDVER -> $V"
 done
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index 3c5a0694a5d..c4c5b7cc3b9 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, zlib }:
+{ stdenv, buildPackages, fetchurl, zlib }:
 
 stdenv.mkDerivation rec {
   name = "kexec-tools-${version}";
@@ -14,12 +14,13 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "format" "pic" "relro" ];
 
+  configureFlags = [ "BUILD_CC=${buildPackages.stdenv.cc.targetPrefix}cc" ];
+  nativeBuildInputs = [ buildPackages.stdenv.cc ];
   buildInputs = [ zlib ];
 
   meta = with stdenv.lib; {
     homepage = http://horms.net/projects/kexec/kexec-tools;
     description = "Tools related to the kexec Linux feature";
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/kmod/default.nix b/pkgs/os-specific/linux/kmod/default.nix
index c55ebffa829..f9be8225570 100644
--- a/pkgs/os-specific/linux/kmod/default.nix
+++ b/pkgs/os-specific/linux/kmod/default.nix
@@ -6,11 +6,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "kmod-${version}";
-  version = "24";
+  version = "25";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/kernel/kmod/${name}.tar.xz";
-    sha256 = "15xkkkzvca9flvkm48gkh8y8f13vlm3sl7nz9ydc7b3jy4fqs2v1";
+    sha256 = "1kgixs4m3jvwk7fb3d18n6j77qhgi9qfv4csj35rs5ancr4ycrbi";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig libxslt ];
diff --git a/pkgs/os-specific/linux/kmscon/default.nix b/pkgs/os-specific/linux/kmscon/default.nix
index bc7b254e19e..d3d6cfd4c58 100644
--- a/pkgs/os-specific/linux/kmscon/default.nix
+++ b/pkgs/os-specific/linux/kmscon/default.nix
@@ -4,7 +4,7 @@
 , systemd
 , libxkbcommon
 , libdrm
-, mesa
+, libGLU_combined
 , pango
 , pixman
 , pkgconfig
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     systemd
     libxkbcommon
     libdrm
-    mesa
+    libGLU_combined
     pango
     pixman
     pkgconfig
diff --git a/pkgs/os-specific/linux/kmscube/default.nix b/pkgs/os-specific/linux/kmscube/default.nix
index c1389f30b05..2fb4fe93cc8 100644
--- a/pkgs/os-specific/linux/kmscube/default.nix
+++ b/pkgs/os-specific/linux/kmscube/default.nix
@@ -1,16 +1,16 @@
-{ stdenv, fetchgit, autoreconfHook, libdrm, libX11, mesa_noglu, pkgconfig }:
+{ stdenv, fetchgit, autoreconfHook, libdrm, libX11, libGL, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "kmscube-2017-03-19";
 
   src = fetchgit {
-    url = git://anongit.freedesktop.org/mesa/kmscube;
+    url = git://anongit.freedesktop.org/libGLU_combined/kmscube;
     rev = "b88a44d95eceaeebc5b9c6972ffcbfe9eca00aea";
     sha256 = "029ccslfavz6jllqv980sr6mj9bdbr0kx7bi21ra0q9yl2vh0yca";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ libdrm libX11 mesa_noglu ];
+  buildInputs = [ libdrm libX11 libGL ];
 
   meta = with stdenv.lib; {
     description = "Example OpenGL app using KMS/GBM";
diff --git a/pkgs/os-specific/linux/libaio/default.nix b/pkgs/os-specific/linux/libaio/default.nix
index 1e85182d6c3..e2be136adee 100644
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "0.3.110";
@@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0zjzfkwd1kdvq6zpawhzisv7qbq1ffs343i5fs9p498pcf7046g0";
   };
 
+  patches = [ (fetchpatch {
+    url = https://pagure.io/libaio/c/da47c32b2ff39e52fbed1622c34b86bc88d7c217.patch;
+    sha256 = "1kqpiswjn549s3w3m89bw5qkl7bw5pvq6gp5cdzd926ymlgivj5c";
+  }) ];
+
   makeFlags = "prefix=$(out)";
 
   hardeningDisable = stdenv.lib.optional (stdenv.isi686) "stackprotector";
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 17cd40e427b..f00d6272902 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, attr, perl, pam ? null }:
+{ stdenv, buildPackages, fetchurl, attr, perl, pam ? null }:
 assert pam != null -> stdenv.isLinux;
 
 stdenv.mkDerivation rec {
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "lib" "man" "doc" ]
     ++ stdenv.lib.optional (pam != null) "pam";
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl ];
 
   buildInputs = [ pam ];
@@ -22,6 +23,8 @@ stdenv.mkDerivation rec {
   makeFlags = [
     "lib=lib"
     (stdenv.lib.optional (pam != null) "PAM_CAP=yes")
+    "BUILD_CC=$(CC_FOR_BUILD)"
+    "CC:=$(CC)"
   ];
 
   prePatch = ''
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index 81a3af54628..f66df8163ff 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, autoreconfHook, bison, flex, pkgconfig }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, autoreconfHook, bison, flex, pkgconfig }:
 
 let version = "3.3.0"; in
 stdenv.mkDerivation {
@@ -13,6 +13,12 @@ stdenv.mkDerivation {
 
   outputs = [ "bin" "dev" "out" "man" ];
 
+  patches = stdenv.lib.optional stdenv.hostPlatform.isMusl
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/gentoo/musl/48d2a28710ae40877fd3e178ead1fb1bb0baa62c/dev-libs/libnl/files/libnl-3.3.0_rc1-musl.patch";
+      sha256 = "0dd7xxikib201i99k2if066hh7gwf2i4ffckrjplq6lr206jn00r";
+    });
+
   nativeBuildInputs = [ autoreconfHook bison flex pkgconfig ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index c60d96bba78..587349e4067 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -13,7 +13,13 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ bison flex ];
   buildInputs = [ libsepol libselinux ustr bzip2 libaudit ];
 
-  NIX_CFLAGS_COMPILE = "-fstack-protector-all -std=gnu89";
+  NIX_CFLAGS_COMPILE = [
+    "-fstack-protector-all"
+    "-std=gnu89"
+    # these were added to fix build with gcc7. review on update
+    "-Wno-error=format-truncation"
+    "-Wno-error=implicit-fallthrough"
+  ];
 
   preBuild = ''
     makeFlagsArray+=("PREFIX=$out")
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 0417bf59cfa..f7f393afb39 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
     makeFlagsArray+=("DESTDIR=$out")
   '';
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-error=implicit-fallthrough" ];
+
   passthru = { inherit se_release se_url; };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/libsmbios/default.nix b/pkgs/os-specific/linux/libsmbios/default.nix
index 5d3e0dc8c97..62898675f2b 100644
--- a/pkgs/os-specific/linux/libsmbios/default.nix
+++ b/pkgs/os-specific/linux/libsmbios/default.nix
@@ -1,38 +1,37 @@
-{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, libtool, gettext
+{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, help2man, gettext
 , libxml2, perl, doxygen }:
 
 
 stdenv.mkDerivation rec {
   name = "libsmbios-${version}";
-  version = "2.3.3";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "dell";
     repo = "libsmbios";
     rev = "v${version}";
-    sha256 = "1cl5nb6qk8ki87hwqf9n1dd9nlhkjnlpdxlhzvm82za16gs7apkl";
+    sha256 = "158w5fz777is7nr5yhpr69b17nn6i1pavycxq1q9899frrpkzbsc";
   };
 
-  nativeBuildInputs = [ autoreconfHook doxygen gettext libtool perl pkgconfig ];
-  buildInputs = [ libxml2 ];
+  nativeBuildInputs = [ autoreconfHook doxygen gettext libxml2 help2man perl pkgconfig ];
 
   configureFlags = [ "--disable-python" "--disable-graphviz" ];
 
   enableParallelBuilding = true;
 
-  postInstall =
-    ''
-      mkdir -p $out/include
-      cp -a src/include/smbios_c $out/include/
-      cp -a out/public-include/smbios_c $out/include/
-    '';
+  postInstall = ''
+    mkdir -p $out/include
+    cp -a src/include/smbios_c $out/include/
+    cp -a out/public-include/smbios_c $out/include/
+  '';
 
   preFixup = ''rm -rf "$(pwd)" ''; # Hack to avoid TMPDIR in RPATHs
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://github.com/dell/libsmbios;
     description = "A library to obtain BIOS information";
-    license = with stdenv.lib.licenses; [ osl21 gpl2Plus ];
+    license = with licenses; [ osl21 gpl2Plus ];
+    maintainers = with maintainers; [ ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/lm-sensors/default.nix b/pkgs/os-specific/linux/lm-sensors/default.nix
index 066946d8f0b..4f35d546538 100644
--- a/pkgs/os-specific/linux/lm-sensors/default.nix
+++ b/pkgs/os-specific/linux/lm-sensors/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     urls = [
       "http://dl.lm-sensors.org/lm-sensors/releases/lm_sensors-${version}.tar.bz2"
-      "http://pkgs.fedoraproject.org/repo/pkgs/lm_sensors/lm_sensors-${version}.tar.bz2/c03675ae9d43d60322110c679416901a/lm_sensors-${version}.tar.bz2"
+      "http://src.fedoraproject.org/repo/pkgs/lm_sensors/lm_sensors-${version}.tar.bz2/c03675ae9d43d60322110c679416901a/lm_sensors-${version}.tar.bz2"
     ];
     sha256 = "07q6811l4pp0f7pxr8bk3s97ippb84mx5qdg7v92s9hs10b90mz0";
   };
@@ -20,6 +20,8 @@ stdenv.mkDerivation rec {
   buildInputs = [ bison flex which perl ]
    ++ stdenv.lib.optional sensord rrdtool;
 
+  patches = [ ./musl-fix-includes.patch ];
+
   preBuild = ''
     makeFlagsArray=(PREFIX=$out ETCDIR=$out/etc
     ${stdenv.lib.optionalString sensord "PROG_EXTRA=sensord"})
diff --git a/pkgs/os-specific/linux/lm-sensors/musl-fix-includes.patch b/pkgs/os-specific/linux/lm-sensors/musl-fix-includes.patch
new file mode 100644
index 00000000000..501f2dd762c
--- /dev/null
+++ b/pkgs/os-specific/linux/lm-sensors/musl-fix-includes.patch
@@ -0,0 +1,62 @@
+--- lm_sensors-3.3.4.orig/prog/dump/isadump.c
++++ lm_sensors-3.3.4/prog/dump/isadump.c
+@@ -36,13 +36,7 @@
+ #include "util.h"
+ #include "superio.h"
+ 
+-
+-/* To keep glibc2 happy */
+-#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ >= 0
+ #include <sys/io.h>
+-#else
+-#include <asm/io.h>
+-#endif
+ 
+ #ifdef __powerpc__
+ unsigned long isa_io_base = 0; /* XXX for now */
+--- lm_sensors-3.3.4.orig/prog/dump/isaset.c
++++ lm_sensors-3.3.4/prog/dump/isaset.c
+@@ -32,13 +32,7 @@
+ #include <string.h>
+ #include "util.h"
+ 
+-
+-/* To keep glibc2 happy */
+-#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ >= 0
+ #include <sys/io.h>
+-#else
+-#include <asm/io.h>
+-#endif
+ 
+ #ifdef __powerpc__
+ unsigned long isa_io_base = 0; /* XXX for now */
+--- lm_sensors-3.3.4.orig/prog/dump/superio.c
++++ lm_sensors-3.3.4/prog/dump/superio.c
+@@ -20,12 +20,7 @@
+ */
+ 
+ #include <stdlib.h>
+-
+-#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ >= 0
+ #include <sys/io.h>
+-#else
+-#include <asm/io.h>
+-#endif
+ 
+ #include "superio.h"
+ 
+--- lm_sensors-3.3.4.orig/prog/dump/util.c
++++ lm_sensors-3.3.4/prog/dump/util.c
+@@ -11,12 +11,7 @@
+ #include <stdio.h>
+ #include "util.h"
+ 
+-/* To keep glibc2 happy */
+-#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ >= 0
+ #include <sys/io.h>
+-#else
+-#include <asm/io.h>
+-#endif
+ 
+ /* Return 1 if we should continue, 0 if we should abort */
+ int user_ack(int def)
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 435a11f1599..ff6db1b41ee 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   pname = "lttng-modules-${version}";
   name = "${pname}-${kernel.version}";
-  version = "2.10.0";
+  version = "2.10.5";
 
   src = fetchurl {
     url = "http://lttng.org/files/lttng-modules/lttng-modules-${version}.tar.bz2";
-    sha256 = "1gzi7j97zymzfj6b7mlih35djflwfgg93b63q9rbs5w1kclmsrgz";
+    sha256 = "07rs01zwr4bmjamplix5qz1c6mb6wdawb68vyn0w6wx68ppbpnxq";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index 310ce51936c..bd84e121a7d 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, pkgconfig, systemd, libudev, utillinux, coreutils, libuuid
+{ stdenv, fetchurl, fetchpatch, pkgconfig, systemd, libudev, utillinux, coreutils, libuuid
 , thin-provisioning-tools, enable_dmeventd ? false }:
 
 let
-  version = "2.02.176";
+  version = "2.02.177";
 in
 
 stdenv.mkDerivation {
@@ -10,7 +10,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "ftp://sources.redhat.com/pub/lvm2/releases/LVM2.${version}.tgz";
-    sha256 = "0wx4rvy4frdmb66znh2xms2j2n06sm361ki6l5ks4y1ciii87kny";
+    sha256 = "1wl0isn0yz5wvglwylnlqkppafwmvhliq5bd92vjqp5ir4za49a0";
   };
 
   configureFlags = [
@@ -41,6 +41,23 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   #patches = [ ./purity.patch ];
+  patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [
+    (fetchpatch {
+      name = "fix-stdio-usage.patch";
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/lvm2/fix-stdio-usage.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
+      sha256 = "0m6wr6qrvxqi2d2h054cnv974jq1v65lqxy05g1znz946ga73k3p";
+    })
+    (fetchpatch {
+      name = "mallinfo.patch";
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/lvm2/mallinfo.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
+      sha256 = "0g6wlqi215i5s30bnbkn8w7axrs27y3bnygbpbnf64wwx7rxxlj0";
+    })
+    (fetchpatch {
+      name = "mlockall-default-config.patch";
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/lvm2/mlockall-default-config.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
+      sha256 = "1ivbj3sphgf8n1ykfiv5rbw7s8dgnj5jcr9jl2v8cwf28lkacw5l";
+    })
+  ];
 
   # To prevent make install from failing.
   preInstall = "installFlags=\"OWNER= GROUP= confdir=$out/etc\"";
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 2660f299262..2e2ef610de6 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -12,11 +12,11 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "lxc-${version}";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz";
-    sha256 = "1qld0gi19mximxm0qyr6vzav32gymhc7fvp0bzwv37j0b8q0fi1r";
+    sha256 = "1xpghrinxhm2072fwmn42pxhjwh7qx6cbsipw4s6g38a8mkklrk8";
   };
 
   nativeBuildInputs = [
@@ -29,12 +29,6 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./support-db2x.patch
-    # Fix build error against glibc 2.26
-    (fetchpatch {
-      url = "https://github.com/lxc/lxc/commit/"
-          + "180c477a326ce85632249ff16990e8c29db1b6fa.patch";
-      sha256 = "05jkiiixxk9ibj1fwzmy56rkkign28bd9mrmgiz12g92r2qahm2z";
-    })
   ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/mbpfan/default.nix b/pkgs/os-specific/linux/mbpfan/default.nix
index 200654909c2..a825314683e 100644
--- a/pkgs/os-specific/linux/mbpfan/default.nix
+++ b/pkgs/os-specific/linux/mbpfan/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "mbpfan-${version}";
-  version = "2.0.1";
+  version = "2.0.2";
   src = fetchFromGitHub {
     owner = "dgraziotin";
     repo = "mbpfan";
     rev = "v${version}";
-    sha256 = "1iri1py9ym0zz7fcacbf0d9y3i3ay77jmajckchagamkfha16zyp";
+    sha256 = "1l8fj92jxfp0sldvznsdsm3pn675b35clq3371h6d5wk4jx67fvg";
   };
   installPhase = ''
     mkdir -p $out/bin $out/etc
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index a7f5ffaae4a..ac176c7d3b3 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "mcelog-${version}";
-  version = "153";
+  version = "154";
 
   src = fetchFromGitHub {
     owner  = "andikleen";
     repo   = "mcelog";
     rev    = "v${version}";
-    sha256 = "1wz55dzqdiam511d6p1958al6vzlhrhs73s7gly0mzm6kpji0gxa";
+    sha256 = "0vq7r3zknr62rmi9g0zd7mmxframm79vmrdw029pc7z6wrlv40cy";
   };
 
   postPatch = ''
@@ -47,6 +47,5 @@ stdenv.mkDerivation rec {
     homepage = http://mcelog.org/;
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/mdadm/4.nix b/pkgs/os-specific/linux/mdadm/4.nix
deleted file mode 100644
index f9c2a5e09af..00000000000
--- a/pkgs/os-specific/linux/mdadm/4.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ stdenv
-, fetchurl, groff
-, buildPlatform, hostPlatform
-}:
-
-assert stdenv.isLinux;
-
-stdenv.mkDerivation rec {
-  name = "mdadm-4.0";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/utils/raid/mdadm/${name}.tar.xz";
-    sha256 = "1ad3mma641946wn5lsllwf0lifw9lps34fv1nnkhyfpd9krffshx";
-  };
-
-  # This is to avoid self-references, which causes the initrd to explode
-  # in size and in turn prevents mdraid systems from booting.
-  allowedReferences = [ stdenv.glibc.out ];
-
-  patches = [ ./no-self-references.patch ];
-
-  makeFlags = [
-    "NIXOS=1" "INSTALL=install" "INSTALL_BINDIR=$(out)/sbin"
-    "MANDIR=$(out)/share/man" "RUN_DIR=/dev/.mdadm"
-    "STRIP="
-  ] ++ stdenv.lib.optionals (hostPlatform != buildPlatform) [
-    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
-  ];
-
-  nativeBuildInputs = [ groff ];
-
-  preConfigure = ''
-    sed -e 's@/lib/udev@''${out}/lib/udev@' \
-        -e 's@ -Werror @ @' \
-        -e 's@/usr/sbin/sendmail@/run/wrappers/bin/sendmail@' -i Makefile
-  '';
-
-  meta = {
-    description = "Programs for managing RAID arrays under Linux";
-    homepage = http://neil.brown.name/blog/mdadm;
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index 1e2c1dafb2d..85a65b8f824 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -6,16 +6,16 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "mdadm-3.3.4";
+  name = "mdadm-4.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/raid/mdadm/${name}.tar.xz";
-    sha256 = "0s6a4bq7v7zxiqzv6wn06fv9f6g502dp047lj471jwxq0r9z9rca";
+    sha256 = "1ad3mma641946wn5lsllwf0lifw9lps34fv1nnkhyfpd9krffshx";
   };
 
   # This is to avoid self-references, which causes the initrd to explode
   # in size and in turn prevents mdraid systems from booting.
-  allowedReferences = [ stdenv.glibc.out ];
+  allowedReferences = [ stdenv.cc.libc.out ];
 
   patches = [ ./no-self-references.patch ];
 
@@ -29,9 +29,6 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ groff ];
 
-  # Attempt removing if building with gcc5 when updating
-  NIX_CFLAGS_COMPILE = "-std=gnu89";
-
   preConfigure = ''
     sed -e 's@/lib/udev@''${out}/lib/udev@' \
         -e 's@ -Werror @ @' \
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index 97843b2253f..857a3b580a8 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "microcode-intel-${version}";
-  version = "20171117";
+  version = "20180312";
 
   src = fetchurl {
-    url = "https://downloadmirror.intel.com/27337/eng/microcode-${version}.tgz";
-    sha256 = "1p14ypbg28bdkbza6dx6dpjrdr5p13vmgrh2cw0y1v2qzalivgck";
+    url = "https://downloadmirror.intel.com/27591/eng/microcode-${version}.tgz";
+    sha256 = "0yg7q5blcqgq8jyjxhn9n48rxws77ylqzyn4kn10l6yzwan1yf0b";
   };
 
   buildInputs = [ libarchive ];
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index aaef5315b0f..0f8f088945a 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -1,12 +1,30 @@
-{ stdenv, fetchurl, fetchpatch }:
+{ stdenv, lib, fetchurl
+, buildPackages
+, linuxHeaders ? null
+, useBSDCompatHeaders ? true
+}:
+let
+  cdefs_h = fetchurl {
+    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-cdefs.h";
+    sha256 = "16l3dqnfq0f20rzbkhc38v74nqcsh9n3f343bpczqq8b1rz6vfrh";
+  };
+  queue_h = fetchurl {
+    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-queue.h";
+    sha256 = "12qm82id7zys92a1qh2l1qf2wqgq6jr4qlbjmqyfffz3s3nhfd61";
+  };
+  tree_h = fetchurl {
+    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-tree.h";
+    sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
+  };
 
+in
 stdenv.mkDerivation rec {
   name    = "musl-${version}";
-  version = "1.1.18";
+  version = "1.1.19";
 
   src = fetchurl {
-    url    = "http://www.musl-libc.org/releases/${name}.tar.gz";
-    sha256 = "0651lnj5spckqjf83nz116s8qhhydgqdy3rkl4icbh5f05fyw5yh";
+    url    = "http://www.musl-libc.org/releases/musl-${version}.tar.gz";
+    sha256 = "1nf1wh44bhm8gdcfr75ayib29b99vpq62zmjymrq7f96h9bshnfv";
   };
 
   enableParallelBuilding = true;
@@ -23,15 +41,38 @@ stdenv.mkDerivation rec {
     "--enable-shared"
     "--enable-static"
     "CFLAGS=-fstack-protector-strong"
+    # Fix cycle between outputs
+    "--disable-wrapper"
   ];
 
+  outputs = [ "out" "dev" ];
+
   dontDisableStatic = true;
+  dontStrip = true;
+
+  postInstall =
+  ''
+    # Not sure why, but link in all but scsi directory as that's what uclibc/glibc do.
+    # Apparently glibc provides scsi itself?
+    (cd $dev/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
+  '' +
+  ''
+    mkdir -p $out/bin
+    # Create 'ldd' symlink, builtin
+    ln -s $out/lib/libc.so $out/bin/ldd
+  '' + lib.optionalString useBSDCompatHeaders ''
+    install -D ${queue_h} $dev/include/sys/queue.h
+    install -D ${cdefs_h} $dev/include/sys/cdefs.h
+    install -D ${tree_h} $dev/include/sys/tree.h
+  '';
+
+  passthru.linuxHeaders = linuxHeaders;
 
   meta = {
     description = "An efficient, small, quality libc implementation";
     homepage    = "http://www.musl-libc.org";
-    license     = stdenv.lib.licenses.mit;
-    platforms   = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.thoughtpolice ];
+    license     = lib.licenses.mit;
+    platforms   = lib.platforms.linux;
+    maintainers = [ lib.maintainers.thoughtpolice ];
   };
 }
diff --git a/pkgs/os-specific/linux/musl/fts.nix b/pkgs/os-specific/linux/musl/fts.nix
new file mode 100644
index 00000000000..083541e5e93
--- /dev/null
+++ b/pkgs/os-specific/linux/musl/fts.nix
@@ -0,0 +1,14 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  name = "musl-fts-${version}";
+  version = "2017-01-13";
+  src = fetchFromGitHub {
+    owner = "pullmoll";
+    repo = "musl-fts";
+    rev = "0bde52df588e8969879a2cae51c3a4774ec62472";
+    sha256 = "1q8cpzisziysrs08b89wj0rm4p6dsyl177cclpfa0f7spjm3jg03";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+}
diff --git a/pkgs/os-specific/linux/musl/getconf.nix b/pkgs/os-specific/linux/musl/getconf.nix
new file mode 100644
index 00000000000..dbfaca296bf
--- /dev/null
+++ b/pkgs/os-specific/linux/musl/getconf.nix
@@ -0,0 +1,19 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+  name = "musl-getconf";
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/alpinelinux/aports/48b16204aeeda5bc1f87e49c6b8e23d9abb07c73/main/musl/getconf.c";
+    sha256 = "0z14ml5343p5gapxw9fnbn2r72r7v2gk8662iifjrblh6sxhqzfq";
+  };
+
+  unpackPhase = ":";
+
+  buildPhase = ''$CC $src -o getconf'';
+  installPhase = ''
+    mkdir -p $out/bin
+    cp getconf $out/bin/
+  '';
+}
+
+
diff --git a/pkgs/os-specific/linux/musl/getent.nix b/pkgs/os-specific/linux/musl/getent.nix
new file mode 100644
index 00000000000..6eed17a76b0
--- /dev/null
+++ b/pkgs/os-specific/linux/musl/getent.nix
@@ -0,0 +1,18 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation {
+  name = "musl-getent";
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/alpinelinux/aports/89a718d88ec7466e721f3bbe9ede5ffe58061d78/main/musl/getent.c";
+    sha256 = "0b4jqnsmv1hjgcz7db3vd61k682aphl59c3yhwya2q7mkc6g48xk";
+  };
+
+  unpackPhase = ":";
+
+  buildPhase = ''$CC $src -o getent'';
+  installPhase = ''
+    mkdir -p $out/bin
+    cp getent $out/bin/
+  '';
+}
+
diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index 9fbf3055715..ce287dc1841 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "net-tools-1.60_p20161110235919";
+  name = "net-tools-${version}";
+  version = "1.60_p20170221182432";
 
   src = fetchurl {
     url = "mirror://gentoo/distfiles/${name}.tar.xz";
-    sha256 = "1kbgwkys45kb5wqhchi1kf0sfw93c1cl0hgyw7yhacxzdfxjmdfr";
+    sha256 = "08r4r2a24g5bm8jwgfa998gs1fld7fgbdf7pilrpsw1m974xn04a";
   };
 
   preBuild =
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 9d645fb1d84..be52cbc2029 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -2,11 +2,12 @@
 , flex, bison, libmnl, libnftnl, gmp, readline }:
 
 stdenv.mkDerivation rec {
-  name = "nftables-0.8";
+  version = "0.8.3";
+  name = "nftables-${version}";
 
   src = fetchurl {
     url = "http://netfilter.org/projects/nftables/files/${name}.tar.bz2";
-    sha256 = "16iq9x0qxikdhp1nan500rk33ycqddl1k57876m4dfv3n7kqhnrz";
+    sha256 = "0f2yv7as1ybkfvn75f72x0z9y1ydibw4s3hbzhlmvsc8vgsy2syi";
   };
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index a5ed242e323..9928897ae4d 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -1,15 +1,28 @@
-{ stdenv, fetchurl, autoreconfHook }:
+{ stdenv, fetchFromGitHub, fetchpatch, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "numactl-2.0.10";
+  name = "numactl-${version}";
+  version = "2.0.11";
 
-  src = fetchurl {
-    url = "ftp://oss.sgi.com/www/projects/libnuma/download/${name}.tar.gz";
-    sha256 = "0qfv2ks6d3gm0mw5sj4cbhsd7cbsb7qm58xvchl2wfzifkzcinnv";
+  src = fetchFromGitHub {
+    owner = "numactl";
+    repo = "numactl";
+    rev = "v${version}";
+    sha256 = "0bcffqawwbyrnza8np0whii25mfd0dria35zal9v3l55xcrya3j9";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
 
+  patches = [
+    (fetchpatch {
+      url = https://raw.githubusercontent.com/gentoo/gentoo/b64d15e731e3d6a7671f0ec6c34a20203cf2609d/sys-process/numactl/files/numactl-2.0.11-sysmacros.patch;
+      sha256 = "05277kv3x12n2xlh3fgnmxclxfc384mkwb0v9pd91046khj6h843";
+    })
+  ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl (fetchpatch {
+      url = https://git.alpinelinux.org/cgit/aports/plain/testing/numactl/musl.patch?id=0592b128c71c3e70d493bc7a13caed0d7fae91dd;
+      sha256 = "080b0sygmg7104qbbh1amh3b322yyiajwi2d3d0vayffgva0720v";
+    });
+
   meta = with stdenv.lib; {
     description = "Library and tools for non-uniform memory access (NUMA) machines";
     homepage = http://oss.sgi.com/projects/libnuma/;
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 22d415213c4..d0348bd67d4 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -14,23 +14,17 @@ let
         sha256 = "18clfpw03g8dxm61bmdkmccyaxir3gnq451z6xqa2ilm3j820aa5";
       });
 in
-{
+rec {
   # Policy: use the highest stable version as the default (on our master).
   stable = generic {
-    version = "387.34";
-    sha256_32bit = "1haqk5h1fcmwp7kn9644k280wn409kh0xbivrj1ks8r8f4nbvfmq";
-    sha256_64bit = "06w8dw6hb40ymz6ax7v82j29ihmp3d7yxsi8ah9ch10jldl973z4";
-    settingsSha256 = "0dpm22ggpr93ypz24ap9vgx43ik7lw6cxcb29v8ys2iinhs7zm7s";
-    persistencedSha256 = "02lf9b6j85amc1vr84lj98q74a680nrx4fmpxj17cz597yq8s200";
+    version = "390.25";
+    sha256_32bit = "0fkbpx01l46pprrd4nlc2y6hfmkb55ddlwm1r84kr6j08qmmb0qi";
+    sha256_64bit = "0whsls1mm6vkll5qmxnyz8vjgspp1rmqpsampgi83k62n514c08r";
+    settingsSha256 = "1jhbr68z36s3fr9vx3ga2f6yrzlwpc0j5mw8h12g65p7wdsbk6y7";
+    persistencedSha256 = "033azbhi50f1b0lw759sncgf7ckh2m2c0khj5v15sch9kl1fzk8i";
   };
 
-  beta = generic {
-    version = "381.22";
-    sha256_32bit = "024x3c6hrivg2bkbzv1xd0585hvpa2kbn1y2gwvca7c73kpdczbv";
-    sha256_64bit = "13fj9ndy5rmh410d0vi2b0crfl7rbsm6rn7cwms0frdzkyhshghs";
-    settingsSha256 = "1gls187zfd201b29qfvwvqvl5gvp5wl9lq966vd28crwqh174jrh";
-    persistencedSha256 = "08315rb9l932fgvy758an5vh3jgks0qc4g36xip4l32pkxd9k963";
-  };
+  beta = stable; # not enough interest to maintain beta ATM
 
 
   legacy_340 = generic {
diff --git a/pkgs/os-specific/linux/nvidiabl/default.nix b/pkgs/os-specific/linux/nvidiabl/default.nix
index 6f9af040b8a..02161f7133c 100644
--- a/pkgs/os-specific/linux/nvidiabl/default.nix
+++ b/pkgs/os-specific/linux/nvidiabl/default.nix
@@ -2,18 +2,19 @@
 
 stdenv.mkDerivation rec {
   name = "nvidiabl-${version}-${kernel.version}";
-  version = "0.87";
+  version = "2017-09-26";
 
+  # We use a fork which adds support for newer kernels -- upstream has been abandoned.
   src = fetchFromGitHub {
-    owner = "guillaumezin";
+    owner = "yorickvP";
     repo = "nvidiabl";
-    rev = "v${version}";
-    sha256 = "1hs61dxn84vsyvrd2s899dhgg342mhfkbdn1nkhcvly45hdp2nca";
+    rev = "2d909f4dfceb24ce98479fd571411c6ec3b71bea";
+    sha256 = "0dsar8fsaxwywjh6rbrxkhdp142vqjnsyxfz6bgpbqml6slpiqs1";
   };
 
   hardeningDisable = [ "pic" ];
 
-  patches = [ ./linux4compat.patch ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   preConfigure = ''
     sed -i 's|/sbin/depmod|#/sbin/depmod|' Makefile
@@ -25,11 +26,11 @@ stdenv.mkDerivation rec {
     "KVER=${kernel.modDirVersion}"
   ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Linux driver for setting the backlight brightness on laptops using NVIDIA GPU";
     homepage = https://github.com/guillaumezin/nvidiabl;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
-    broken = !stdenv.lib.versionOlder kernel.version "4.9";
+    license = licenses.gpl2;
+    platforms = [ "x86_64-linux" "i686-linux" ];
+    maintainers = with maintainers; [ yorickvp ];
   };
 }
diff --git a/pkgs/os-specific/linux/nvidiabl/linux4compat.patch b/pkgs/os-specific/linux/nvidiabl/linux4compat.patch
deleted file mode 100644
index ad8236a2b63..00000000000
--- a/pkgs/os-specific/linux/nvidiabl/linux4compat.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 2bf6f08b2492cc04a2c39fdcb22a2d0c18963d1c Mon Sep 17 00:00:00 2001
-From: sonic414 <sonic414@gmail.com>
-Date: Tue, 28 Apr 2015 19:30:15 +0530
-Subject: [PATCH] strnicmp to strncasecmp in Linux 4.0.0
-
----
- nvidiabl-module.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/nvidiabl-module.c b/nvidiabl-module.c
-index b789ea4..b306579 100644
---- a/nvidiabl-module.c
-+++ b/nvidiabl-module.c
-@@ -214,7 +214,7 @@ static int __init nvidiabl_init(void)
- #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,39)
- 	
- 	for (iii = 0 ; iii < sizeof(backlight_type_ids) ; iii++) {
--		if (strnicmp(bl_type, backlight_type_ids[iii].id, sizeof(bl_type)) == 0) {
-+		if (strncasecmp(bl_type, backlight_type_ids[iii].id, sizeof(bl_type)) == 0) {
- 			props.type = backlight_type_ids[iii].type;
- 			printk(KERN_INFO "nvidiabl: backlight type is %s\n", backlight_type_ids[iii].id);
- 		}
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index 7912c67aa0b..044479c5629 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "nvme-cli-${version}";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    sha256 = "00jrr1mya9wkapiapph3nch3kpqas6vlc8kl8dbrjjfb5hg35gqf";
+    sha256 = "1nl5hl5am8djwmrw1xxnd9ahp7kyzyj0yh1nxgmx43pn3d61n0vz";
   };
 
   makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
index 4b5e7bbf3e3..ac8a1c7de4a 100644
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/pkgs/os-specific/linux/openvswitch/default.nix
@@ -7,12 +7,12 @@ with stdenv.lib;
 let
   _kernel = kernel;
 in stdenv.mkDerivation rec {
-  version = "2.5.2";
+  version = "2.5.4";
   name = "openvswitch-${version}";
 
   src = fetchurl {
     url = "http://openvswitch.org/releases/${name}.tar.gz";
-    sha256 = "0ifx758zl97dpad9vpd5i5dqj6i03k632mvgxs82hqkcsb3r6y7q";
+    sha256 = "1lji87wg953lqcdf02f1zv2m54vhd2x9jd03bb91lnlb4qlhifiv";
   };
 
   kernel = optional (_kernel != null) _kernel.dev;
diff --git a/pkgs/os-specific/linux/pagemon/default.nix b/pkgs/os-specific/linux/pagemon/default.nix
index 414338702cc..99caa813b2e 100644
--- a/pkgs/os-specific/linux/pagemon/default.nix
+++ b/pkgs/os-specific/linux/pagemon/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "pagemon-${version}";
-  version = "0.01.10";
+  version = "0.01.12";
 
   src = fetchFromGitHub {
-    sha256 = "04dbcr7bzgp4kvhw1rsn084cz4qbfhf7ifyh3ikgdka9w98057h1";
+    sha256 = "0bddn22daf33dbghwfjxxgsn4gmr5knr6h9sbqhs7g7p85dla6wa";
     rev = "V${version}";
     repo = "pagemon";
     owner = "ColinIanKing";
@@ -33,6 +33,5 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index 3de7916bff6..5f92dfcc839 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, flex, cracklib }:
+{ stdenv, buildPackages, hostPlatform, fetchurl, fetchpatch, flex, cracklib }:
 
 stdenv.mkDerivation rec {
   name = "linux-pam-${version}";
@@ -9,8 +9,24 @@ stdenv.mkDerivation rec {
     sha256 = "1fyi04d5nsh8ivd0rn2y0z83ylgc0licz7kifbb6xxi2ylgfs6i4";
   };
 
+  patches = stdenv.lib.optionals (hostPlatform.libc == "musl") [
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/linux-pam/fix-compat.patch?id=05a62bda8ec255d7049a2bd4cf0fdc4b32bdb2cc";
+      sha256 = "1h5yp5h2mqp1fcwiwwklyfpa69a3i03ya32pivs60fd7g5bqa7sf";
+    })
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/linux-pam/libpam-fix-build-with-eglibc-2.16.patch?id=05a62bda8ec255d7049a2bd4cf0fdc4b32bdb2cc";
+      sha256 = "1ib6shhvgzinjsc603k2x1lxh9dic6qq449fnk110gc359m23j81";
+    })
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/linux-pam/musl-fix-pam_exec.patch?id=05a62bda8ec255d7049a2bd4cf0fdc4b32bdb2cc";
+      sha256 = "04dx6s9d8cxl40r7m7dc4si47ds4niaqm7902y1d6wcjvs11vrf0";
+    })
+  ];
+
   outputs = [ "out" "doc" "man" /* "modules" */ ];
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ flex ];
 
   buildInputs = [ cracklib ];
@@ -20,7 +36,7 @@ stdenv.mkDerivation rec {
   crossAttrs = {
     propagatedBuildInputs = [ flex.crossDrv cracklib.crossDrv ];
     preConfigure = preConfigure + ''
-      ar x ${flex.crossDrv}/lib/libfl.a
+      $crossConfig-ar x ${flex.crossDrv}/lib/libfl.a
       mv libyywrap.o libyywrap-target.o
       ar x ${flex}/lib/libfl.a
       mv libyywrap.o libyywrap-host.o
@@ -46,6 +62,12 @@ stdenv.mkDerivation rec {
 
   preConfigure = ''
     configureFlags="$configureFlags --includedir=$out/include/security"
+  '' + stdenv.lib.optionalString (hostPlatform.libc == "musl") ''
+      # export ac_cv_search_crypt=no
+      # (taken from Alpine linux, apparently insecure but also doesn't build O:))
+      # disable insecure modules
+      # sed -e 's/pam_rhosts//g' -i modules/Makefile.am
+      sed -e 's/pam_rhosts//g' -i modules/Makefile.in
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/pam_krb5/default.nix b/pkgs/os-specific/linux/pam_krb5/default.nix
index abbf3398ced..3f8c3c28f31 100644
--- a/pkgs/os-specific/linux/pam_krb5/default.nix
+++ b/pkgs/os-specific/linux/pam_krb5/default.nix
@@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
     '';
     platforms = platforms.linux;
     license = licenses.bsd3;
-    maintainers = with maintainers; [ wkennington mornfall ];
+    maintainers = with maintainers; [ wkennington ];
   };
 }
diff --git a/pkgs/os-specific/linux/pam_mount/default.nix b/pkgs/os-specific/linux/pam_mount/default.nix
index dfcd53ec778..c38990bdf8f 100644
--- a/pkgs/os-specific/linux/pam_mount/default.nix
+++ b/pkgs/os-specific/linux/pam_mount/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, autoconf, automake, pkgconfig, libtool, pam, libHX, libxml2, pcre, perl, openssl, cryptsetup, utillinux }:
 
 stdenv.mkDerivation rec {
-  name = "pam_mount-2.15";
+  name = "pam_mount-2.16";
 
   src = fetchurl {
-    url = "mirror://sourceforge/pam-mount/pam_mount/2.15/${name}.tar.xz";
-    sha256 = "091aq5zyc60wh21m1ryanjwknwxlaj9nvlswn5vjrmcdir5gnkm5";
+    url = "mirror://sourceforge/pam-mount/pam_mount/2.16/${name}.tar.xz";
+    sha256 = "1rvi4irb7ylsbhvx1cr6islm2xxw1a4b19q6z4a9864ndkm0f0mf";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/pcm/default.nix b/pkgs/os-specific/linux/pcm/default.nix
new file mode 100644
index 00000000000..43810210a88
--- /dev/null
+++ b/pkgs/os-specific/linux/pcm/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  version = "201710";
+  name = "pcm-${version}";
+
+  src = fetchFromGitHub {
+    owner = "opcm";
+    repo = "pcm";
+    rev = "${version}";
+    sha256 = "02rq8739zwwbfrhagvcgf6qpmnswxl9b0qsld26rg6zp91v2npbj";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp pcm*.x $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Processor counter monitor";
+    homepage = https://www.intel.com/software/pcm;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ roosemberth ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/perf-tools/default.nix b/pkgs/os-specific/linux/perf-tools/default.nix
index 873cb7b2b7d..31f86965ee8 100644
--- a/pkgs/os-specific/linux/perf-tools/default.nix
+++ b/pkgs/os-specific/linux/perf-tools/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, perl }:
 
 stdenv.mkDerivation {
-  name = "perf-tools-20160418";
+  name = "perf-tools-20171219";
 
   src = fetchFromGitHub {
     owner = "brendangregg";
     repo = "perf-tools";
-    rev = "5a511f5f775cfbc0569e6039435361cecd22dd86";
-    sha256 = "1ab735idi0h62yvhzd7822jj3555vygixv4xjrfrdvi8d2hhz6qn";
+    rev = "98d42a2a1493d2d1c651a5c396e015d4f082eb20";
+    sha256 = "09qnss9pd4kr6qadvp62m2g8sfrj86fksi1rr8m8w4314pzfb93c";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/os-specific/linux/phc-intel/default.nix b/pkgs/os-specific/linux/phc-intel/default.nix
index 356939fe294..81db8a9f26d 100644
--- a/pkgs/os-specific/linux/phc-intel/default.nix
+++ b/pkgs/os-specific/linux/phc-intel/default.nix
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     name = "phc-intel-pack-${revbump}.tar.bz2";
   };
 
-  buildInputs = [ which ];
+  nativeBuildInputs = [ which ] ++ kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
@@ -49,6 +49,5 @@ in stdenv.mkDerivation rec {
     downloadPage = "http://www.linux-phc.org/forum/viewtopic.php?f=7&t=267";
     license = licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/pipework/default.nix b/pkgs/os-specific/linux/pipework/default.nix
index 57ef22083fe..523f7382a2c 100644
--- a/pkgs/os-specific/linux/pipework/default.nix
+++ b/pkgs/os-specific/linux/pipework/default.nix
@@ -4,17 +4,16 @@
 
 stdenv.mkDerivation rec {
   name = "pipework-${version}";
-  version = "2015-07-30";
+  version = "2017-08-22";
   src = fetchFromGitHub {
     owner = "jpetazzo";
     repo = "pipework";
-    rev = "5a46ecb5f8f933fd268ef315f58a1eb1c46bd93d";
-    sha256 = "02znyg5ir37s8xqjcqqz6xnwyqxapn7c4scyqkcapxr932hf1frh";
+    rev = "ae42f1b5fef82b3bc23fe93c95c345e7af65fef3";
+    sha256 = "0c342m0bpq6ranr7dsxk9qi5mg3j5aw9wv85ql8gprdb2pz59qy8";
   };
   buildInputs = [ makeWrapper ];
   installPhase = ''
-    mkdir -p $out/bin
-    cp pipework $out/bin
+    install -D pipework $out/bin/pipework
     wrapProgram $out/bin/pipework --prefix PATH : \
       ${lib.makeBinPath [ bridge-utils iproute lxc openvswitch docker busybox dhcpcd dhcp ]};
   '';
diff --git a/pkgs/os-specific/linux/pmount/default.nix b/pkgs/os-specific/linux/pmount/default.nix
index c1049d78f42..63d159e1884 100644
--- a/pkgs/os-specific/linux/pmount/default.nix
+++ b/pkgs/os-specific/linux/pmount/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cryptsetup, dbus, dbus_glib, intltool, ntfs3g, utillinux
+{ stdenv, fetchurl, cryptsetup, dbus, dbus-glib, intltool, ntfs3g, utillinux
 , mediaDir ? "/media/"
 , lockDir ? "/var/lock/pmount"
 , whiteList ? "/etc/pmount.allow"
diff --git a/pkgs/os-specific/linux/pommed/default.nix b/pkgs/os-specific/linux/pommed/default.nix
index 1cdf9044b8f..3698b2b281f 100644
--- a/pkgs/os-specific/linux/pommed/default.nix
+++ b/pkgs/os-specific/linux/pommed/default.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , pciutils
 , confuse
-, dbus, dbus_glib
+, dbus, dbus-glib
 , alsaLib
 , audiofile
 , pkgconfig
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     dbus
     alsaLib
     audiofile
-    dbus_glib
+    dbus-glib
     pkgconfig
     gtk2
     gettext
diff --git a/pkgs/os-specific/linux/powerstat/default.nix b/pkgs/os-specific/linux/powerstat/default.nix
index 8e52bdf936e..88151fca2f5 100644
--- a/pkgs/os-specific/linux/powerstat/default.nix
+++ b/pkgs/os-specific/linux/powerstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "powerstat-${version}";
-  version = "0.02.12";
+  version = "0.02.15";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/powerstat/powerstat-${version}.tar.gz";
-    sha256 = "16ls3rs1wfckl0b2szqqgiv072afy4qjd3r4kz4vf2qj77kjm06w";
+    sha256 = "0m8662qv77nzbwkdpydiz87kd75cjjajgp30j6mc5padyw65bxxx";
   };
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 5a10f455ea0..7679262a989 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -9,6 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "0l4jjlf05li2mc6g8nrss3h435wjhmnqd8m7v3kha3x0x7cbfzxa";
   };
 
+  outputs = [ "out" "man" ];
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gettext libnl ncurses pciutils zlib ];
 
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 12b361e953e..000d11af87d 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -1,10 +1,13 @@
 { stdenv, lib, requireFile, makeWrapper, substituteAll, p7zip
-, gawk, utillinux, xorg, glib, dbus_glib, zlib
+, gawk, utillinux, xorg, glib, dbus-glib, zlib
 , kernel ? null, libsOnly ? false
 , undmg, fetchurl
+, libelf
 }:
 
 assert (!libsOnly) -> kernel != null;
+# Disable for kernels 4.15 and above due to compatibility issues
+assert kernel != null -> stdenv.lib.versionOlder kernel.version "4.15";
 
 let xorgFullVer = (builtins.parseDrvName xorg.xorgserver.name).version;
     xorgVer = lib.concatStringsSep "." (lib.take 2 (lib.splitString "." xorgFullVer));
@@ -27,7 +30,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "pic" "format" ];
 
   # also maybe python2 to generate xorg.conf
-  nativeBuildInputs = [ p7zip undmg ] ++ lib.optionals (!libsOnly) [ makeWrapper ];
+  nativeBuildInputs = [ p7zip undmg ] ++ lib.optionals (!libsOnly) [ makeWrapper ] ++ kernel.moduleBuildDependencies;
 
   inherit libsOnly;
 
@@ -65,7 +68,7 @@ stdenv.mkDerivation rec {
 
   libPath = with xorg;
             stdenv.lib.makeLibraryPath ([ stdenv.cc.cc libXrandr libXext libX11 libXcomposite libXinerama ]
-            ++ lib.optionals (!libsOnly) [ libXi glib dbus_glib zlib ]);
+            ++ lib.optionals (!libsOnly) [ libXi glib dbus-glib zlib ]);
 
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 4023ea5c69f..cc5e3dd5190 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -16,7 +16,10 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   # Too red
-  configureFlags = [ "--disable-modern-top" ];
+  configureFlags = [ "--disable-modern-top" ]
+    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform)
+    [ "ac_cv_func_malloc_0_nonnull=yes"
+      "ac_cv_func_realloc_0_nonnull=yes" ];
 
   meta = {
     homepage = https://sourceforge.net/projects/procps-ng/;
diff --git a/pkgs/os-specific/linux/radeontop/default.nix b/pkgs/os-specific/linux/radeontop/default.nix
index cb720c20634..c87bec3a526 100644
--- a/pkgs/os-specific/linux/radeontop/default.nix
+++ b/pkgs/os-specific/linux/radeontop/default.nix
@@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
     homepage = https://github.com/clbr/radeontop;
     platforms = platforms.linux;
     license = licenses.gpl3;
-    maintainers = with maintainers; [ rycee nckx ];
+    maintainers = with maintainers; [ rycee ];
   };
 }
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
new file mode 100644
index 00000000000..b25ed85ce4b
--- /dev/null
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig
+, ethtool, nettools, libnl, libudev, python, perl
+} :
+
+let
+  version = "17";
+
+in stdenv.mkDerivation {
+  name = "rdma-core-${version}";
+
+  src = fetchFromGitHub {
+    owner = "linux-rdma";
+    repo = "rdma-core";
+    rev = "v${version}";
+    sha256 = "1xql46favv8i4ni4zqkk9ra2kcqq2dyn7jyi940c869lndmjw9ni";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ libnl ethtool nettools libudev python perl ];
+
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_RUNDIR=/run"
+    "-DCMAKE_INSTALL_SHAREDSTATEDIR=/var/lib"
+  ];
+
+  postPatch = ''
+    substituteInPlace providers/rxe/rxe_cfg.in \
+      --replace ethtool "${ethtool}/bin/ethtool" \
+      --replace ifconfig "${nettools}/bin/ifconfig"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "RDMA Core Userspace Libraries and Daemons";
+    homepage = https://github.com/linux-rdma/rdma-core;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ markuskowa ];
+  };
+}
+
diff --git a/pkgs/os-specific/linux/reptyr/default.nix b/pkgs/os-specific/linux/reptyr/default.nix
index 779337e85f8..4b83e478dd1 100644
--- a/pkgs/os-specific/linux/reptyr/default.nix
+++ b/pkgs/os-specific/linux/reptyr/default.nix
@@ -13,6 +13,9 @@ stdenv.mkDerivation rec {
     sed 1i'#include <sys/sysmacros.h>' -i platform/linux/linux.c
   '';
 
+  # Needed with GCC 7
+  NIX_CFLAGS_COMPILE = "-Wno-error=format-truncation";
+
   makeFlags = ["PREFIX=$(out)"];
   meta = {
     platforms = [ "i686-linux" "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/rewritefs/default.nix b/pkgs/os-specific/linux/rewritefs/default.nix
index 5b16799a89c..8c7b75a881f 100644
--- a/pkgs/os-specific/linux/rewritefs/default.nix
+++ b/pkgs/os-specific/linux/rewritefs/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = ''A FUSE filesystem intended to be used
       like Apache mod_rewrite'';
-    homepage    = "https://github.com/sloonz/rewritefs";
+    homepage    = https://github.com/sloonz/rewritefs;
     license     = licenses.gpl2;
     maintainers = with maintainers; [ rnhmjoj ];
     platforms   = platforms.linux;
diff --git a/pkgs/os-specific/linux/rtl8192eu/default.nix b/pkgs/os-specific/linux/rtl8192eu/default.nix
new file mode 100644
index 00000000000..52542aabfde
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, lib, fetchFromGitHub, kernel }:
+
+with lib;
+
+let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless/realtek/rtl8192eu";
+
+in stdenv.mkDerivation rec {
+  name = "rtl8192eu-${kernel.version}-${version}";
+  version = "4.4.1";
+
+  src = fetchFromGitHub {
+    owner = "Mange";
+    repo = "rtl8192eu-linux-driver";
+    rev = "4094004";
+    sha256 = "0rgcsp8bd5i5ik9b35qipdhq0xd8pva8kdijixxfaxm4vw6kbrvr";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    mkdir -p ${modDestDir}
+    find . -name '*.ko' -exec cp --parents {} ${modDestDir} \;
+    find ${modDestDir} -name '*.ko' -exec xz -f {} \;
+  '';
+
+  meta = {
+    description = "Realtek rtl8192eu driver";
+    homepage = https://github.com/Mange/rtl8192eu-linux-driver;
+    license = stdenv.lib.licenses.gpl2;
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = with maintainers; [ troydm ];
+  };
+}
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index c79de39d5da..96306a9d5c6 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -1,39 +1,20 @@
-{ stdenv, fetchFromGitHub, fetchpatch, kernel }:
+{ stdenv, fetchFromGitHub, fetchpatch, kernel, bc }:
 
 stdenv.mkDerivation rec {
   name = "rtl8812au-${kernel.version}-${version}";
-  version = "4.3.20";
+  version = "5.2.20_25672.20171213";
 
   src = fetchFromGitHub {
-    owner = "Grawp";
-    repo = "rtl8812au_rtl8821au";
-    rev = "d716b38abf5ca7da72d2be0adfcebe98cceeda8f";
-    sha256 = "01z5p2vps3an69bbzca7ig14llc5rd6067pgs47kkhfjbsbws4ry";
+    owner = "zebulon2";
+    repo = "rtl8812au-driver-5.2.20";
+    rev = "aca1e0677bfe56c6c4914358df007c97486e7095";
+    sha256 = "19av8fkh3mvs2f57iibrg0cfyhjnnx4cbnfzv5aj7v5gb0j3dp0p";
   };
 
-  patches = [
-    (fetchpatch { # From PR # 42
-      name = "rtl8812au-4.11.x-fix.patch";
-      url = https://github.com/Grawp/rtl8812au_rtl8821au/commit/3224e74ad9c230b74a658e80dad66ab95c9e2ef5.patch;
-      sha256 = "12g4yvivg4d0qm5cgxs7k54p3y7h1dc2jw6rp1xbppwf3j1z6xks";
-    })
-    (fetchpatch { # From PR #46
-      name = "rtl8812au-4.11.9-fix.patch";
-      url = https://github.com/Grawp/rtl8812au_rtl8821au/commit/58fc45a4511b8b9d6b52813168e3eee657517b1f.patch;
-      sha256 = "18bag2mif5112lap2xvx2bb0wxrd13f9y9cwqv1qzp5nyqiniziz";
-    })
-    (fetchpatch { # From PR #43
-      name = "rtl8812au-4.12-fix.patch";
-      url = https://github.com/Grawp/rtl8812au_rtl8821au/commit/a5475c9f1f54099ca35c8680f2dedee11fa9edec.patch;
-      sha256 = "01xa51whq1xa0sh3y2bhm65f0cryzmv46v530axqjrpnd924432d";
-    })
-  ];
-
+  nativeBuildInputs = [ bc ];
   buildInputs = kernel.moduleBuildDependencies;
 
-  hardeningDisable = [ "pic" ];
-
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  hardeningDisable = [ "pic" "format" ];
 
   prePatch = ''
     substituteInPlace ./Makefile --replace /lib/modules/ "${kernel.dev}/lib/modules/"
@@ -46,10 +27,11 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Driver for Realtek 802.11ac, rtl8812au, provides the 8812au mod";
-    homepage = https://github.com/Grawp/rtl8812au_rtl8821au;
-    license = stdenv.lib.licenses.gpl2;
+    homepage = https://github.com/zebulon2/rtl8812au-driver-5.2.20;
+    license = licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
+    maintainers = with maintainers; [ danielfullmer ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
new file mode 100644
index 00000000000..99b42fc7400
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -0,0 +1,39 @@
+{ stdenv, fetchFromGitHub, fetchpatch, kernel }:
+
+stdenv.mkDerivation rec {
+  name = "rtl8814au-${kernel.version}-${version}";
+  version = "4.3.21";
+
+  src = fetchFromGitHub {
+    owner = "zebulon2";
+    repo = "rtl8814au";
+    rev = "a58c56a5a6cb99ffb872f07cb67b68197911854f";
+    sha256 = "1ffm67da183nz009gm5v9w1bab081hrm113kk8knl9s5qbqnn13q";
+  };
+
+  buildInputs = kernel.moduleBuildDependencies;
+
+  hardeningDisable = [ "pic" ];
+
+  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+
+  prePatch = ''
+    substituteInPlace ./Makefile \
+      --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
+      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
+      --replace /sbin/depmod \# \
+      --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Realtek 8814AU USB WiFi driver";
+    homepage = https://github.com/zebulon2/rtl8814au;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.lassulus ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/rtlwifi_new/default.nix b/pkgs/os-specific/linux/rtlwifi_new/default.nix
index 4bf3ef82978..b29b1f639cf 100644
--- a/pkgs/os-specific/linux/rtlwifi_new/default.nix
+++ b/pkgs/os-specific/linux/rtlwifi_new/default.nix
@@ -6,13 +6,13 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 
 in stdenv.mkDerivation rec {
   name = "rtlwifi_new-${version}";
-  version = "2017-07-18";
+  version = "2018-02-17";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtlwifi_new";
-    rev = "a24cb561b4d23187ea103255336daa7ca88791a7";
-    sha256 = "1w9rx5wafcp1vc4yh7lj332bv78szl6gmx3ckr8yl6c39alqcv0d";
+    rev = "0588ac0cc5f530e7764705416370b70d3c2afedc";
+    sha256 = "1vs8rfw19lcs04bapa97zlnl5x0kf02sdw5ik0hdm27wgk0z969m";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/os-specific/linux/sdparm/default.nix b/pkgs/os-specific/linux/sdparm/default.nix
index 39bec26e07f..a8d5112c63b 100644
--- a/pkgs/os-specific/linux/sdparm/default.nix
+++ b/pkgs/os-specific/linux/sdparm/default.nix
@@ -13,7 +13,6 @@ stdenv.mkDerivation rec {
     homepage = http://sg.danny.cz/sg/sdparm.html;
     description = "A utility to access SCSI device parameters";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ nckx ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index 64d7a694fc1..ca15571d1ed 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt, libxml2
-, docbook_xml_dtd_412, docbook_xsl, gnome_doc_utils, flex, bison
+, docbook_xml_dtd_412, docbook_xsl, gnome-doc-utils, flex, bison
 , pam ? null, glibcCross ? null
 , buildPlatform, hostPlatform
 }:
@@ -9,7 +9,7 @@ let
   glibc =
     if hostPlatform != buildPlatform
     then glibcCross
-    else assert stdenv ? glibc; stdenv.glibc;
+    else assert hostPlatform.libc == "glibc"; stdenv.cc.libc;
 
   dots_in_usernames = fetchpatch {
     url = http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch;
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = stdenv.lib.optional (pam != null && stdenv.isLinux) pam;
   nativeBuildInputs = [autoreconfHook libxslt libxml2
-    docbook_xml_dtd_412 docbook_xsl gnome_doc_utils flex bison
+    docbook_xml_dtd_412 docbook_xsl gnome-doc-utils flex bison
     ];
 
   patches =
@@ -60,9 +60,10 @@ stdenv.mkDerivation rec {
     configureFlags="$configureFlags --with-xml-catalog=$PWD/xmlcatalog ";
   '';
 
-  configureFlags = " --enable-man ";
+  configureFlags = " --enable-man "
+    + stdenv.lib.optionalString (hostPlatform.libc != "glibc") " --disable-nscd ";
 
-  preBuild = assert glibc != null;
+  preBuild = stdenv.lib.optionalString (hostPlatform.libc == "glibc")
     ''
       substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc.bin}/bin/nscd
     '';
diff --git a/pkgs/os-specific/linux/smemstat/default.nix b/pkgs/os-specific/linux/smemstat/default.nix
index 04f5bf53f93..b4b8606197e 100644
--- a/pkgs/os-specific/linux/smemstat/default.nix
+++ b/pkgs/os-specific/linux/smemstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "smemstat-${version}";
-  version = "0.01.17";
+  version = "0.01.18";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/smemstat/smemstat-${version}.tar.gz";
-    sha256 = "093ifrz688cm0kmzz1c6himhbdr75ig1mcaapmqy8jadc1gaw2im";
+    sha256 = "0g262gilj2jk365wj4yl93ifppgvc9rx7dmlw6ychbv72v2pbv6w";
   };
   buildInputs = [ ncurses ];
   installFlags = [ "DESTDIR=$(out)" ];
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index e0d1754dd74..57698b5ad45 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -61,13 +61,19 @@ in
   assert kernel != null;
 {
     splStable = common {
-      version = "0.7.5";
-      sha256 = "0njb3274bc5pfr80pzj94sljq457pr71n50s0gsccbz8ghk28rlr";
+      version = "0.7.6";
+      sha256 = "1l641d89k48ngmarx9mxh8gw2zzrf7fw7n8zmslhz4h1152plddb";
     };
 
     splUnstable = common {
-      version = "2017-12-21";
-      rev = "c9821f1ccc647dfbd506f381b736c664d862d126";
-      sha256 = "08r6sa36jaj6n54ap18npm6w85v5yn3x8ljg792h37f49b8kir6c";
+      version = "2018-01-24";
+      rev = "23602fdb39e1254c669707ec9d2d0e6bcdbf1771";
+      sha256 = "09py2dwj77f6s2qcnkwdslg5nxb3hq2bq39zpxpm6msqyifhl69h";
+    };
+
+    splLegacyCrypto = common {
+      version = "2018-01-24";
+      rev = "23602fdb39e1254c669707ec9d2d0e6bcdbf1771";
+      sha256 = "09py2dwj77f6s2qcnkwdslg5nxb3hq2bq39zpxpm6msqyifhl69h";
     };
 }
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index 516f0b92df6..3d89fdfdc28 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "sssd-${version}";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchurl {
     url = "https://fedorahosted.org/released/sssd/${name}.tar.gz";
-    sha256 = "03wllgbxxz2zv14dcqr8d2xssppi7ibckh0rlky8gvsw6vjsd0f5";
+    sha256 = "0vjh1c5960wh86zjsamdjhljls7bb5fz5jpcazgzrpmga5w6ggrd";
   };
 
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 919ddc1c3df..5c7b2e69edf 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -3,13 +3,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "sysdig-${version}";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "04bsb7g6mh6dwk023v1rbdcjwp898y6ixdvrd7nxzm186qpycpnn";
+    sha256 = "0nbsfm2jh5gjy2wh79f35rqk3c3z15lymmcz3gviw0jaxdv6drzw";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index adfcc76c31c..d8e95ff74c4 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "sysstat-11.2.5";
+  name = "sysstat-11.7.2";
 
   src = fetchurl {
     url = "http://perso.orange.fr/sebastien.godard/${name}.tar.xz";
-    sha256 = "1r7869pnylamjry5f5l5m1jn68v61js9wdkz8yn37a9a2bcrqp2d";
+    sha256 = "169yh9d0ags9xrn5g0k42wd1c895117zbzs257cjxqnb2vk0a38v";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix b/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix
index dc0a23be98f..f69269347e3 100644
--- a/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix
+++ b/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix
@@ -10,21 +10,15 @@ stdenv.lib.overrideDerivation systemd (p: {
   outputs = [ "out" ];
 
   buildPhase = ''
-    make $makeFlags built-sources
-    make $makeFlags systemd-cryptsetup
-    make $makeFlags systemd-cryptsetup-generator
+    ninja systemd-cryptsetup systemd-cryptsetup-generator
   '';
 
-  # For some reason systemd-cryptsetup-generator is a wrapper-script
-  # with the current release of systemd. We want the real one.
-
-  # TODO: Remove `.libs` prefix when the wrapper-script is gone
   installPhase = ''
     mkdir -p $out/lib/systemd/
-    cp .libs/systemd-cryptsetup $out/lib/systemd/systemd-cryptsetup
-    cp .libs/*.so $out/lib/
+    cp systemd-cryptsetup $out/lib/systemd/systemd-cryptsetup
+    cp src/shared/*.so $out/lib/systemd/
 
     mkdir -p $out/lib/systemd/system-generators/
-    cp .libs/systemd-cryptsetup-generator $out/lib/systemd/system-generators/systemd-cryptsetup-generator
+    cp systemd-cryptsetup-generator $out/lib/systemd/system-generators/systemd-cryptsetup-generator
   '';
 })
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index aeda85584e7..1e4df0d3f0e 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,126 +1,160 @@
 { stdenv, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
 , zlib, xz, pam, acl, cryptsetup, libuuid, m4, utillinux, libffi
-, glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libapparmor, audit, lz4
-, kexectools, libmicrohttpd, linuxHeaders ? stdenv.cc.libc.linuxHeaders, libseccomp
-, iptables, gnu-efi
+, glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
+, audit, lz4, bzip2, kexectools, libmicrohttpd
+, linuxHeaders ? stdenv.cc.libc.linuxHeaders
+, libseccomp, iptables, gnu-efi
 , autoreconfHook, gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
+, ninja, meson, python3Packages, glibcLocales
+, patchelf
+, getent
+, hostPlatform
+, buildPackages
 }:
 
 assert stdenv.isLinux;
 
-stdenv.mkDerivation rec {
-  version = "234";
+let
+  pythonLxmlEnv = buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]);
+
+in stdenv.mkDerivation rec {
+  version = "237";
   name = "systemd-${version}";
 
   src = fetchFromGitHub {
-    owner = "nixos";
+    owner = "NixOS";
     repo = "systemd";
-    rev = "eef5613fda5";
-    sha256 = "0wgh5y319v56hcs82mhs58ipb100cz4x41vz3kh4bq1n7sx88cdz";
+    rev = "98067cc806ae0d2759cdd2334f230cd8548e5317";
+    sha256 = "077svfs2xy3g30s62q69wcv5pb9vfhzh8i7lhfri73vvhwbpzd5q";
   };
 
   outputs = [ "out" "lib" "man" "dev" ];
 
   nativeBuildInputs =
-    [ pkgconfig intltool gperf libxslt
-      /* FIXME: we may be able to prevent the following dependencies
-         by generating an autoconf'd tarball, but that's probably not
-         worth it. */
-      autoreconfHook gettext docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
+    [ pkgconfig intltool gperf libxslt gettext docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
+      ninja meson
+      coreutils # meson calls date, stat etc.
+      glibcLocales
+      patchelf getent m4
     ];
   buildInputs =
     [ linuxHeaders libcap kmod xz pam acl
-      /* cryptsetup */ libuuid m4 glib libgcrypt libgpgerror
-      libmicrohttpd kexectools libseccomp libffi audit lz4 libapparmor
+      /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2
+      libmicrohttpd kexectools libseccomp libffi audit lz4 bzip2 libapparmor
       iptables gnu-efi
+      # This is actually native, but we already pull it from buildPackages
+      pythonLxmlEnv
     ];
 
-  configureFlags =
-    [ "--localstatedir=/var"
-      "--sysconfdir=/etc"
-      "--with-rootprefix=$(out)"
-      "--with-kbd-loadkeys=${kbd}/bin/loadkeys"
-      "--with-kbd-setfont=${kbd}/bin/setfont"
-      "--with-rootprefix=$(out)"
-      "--with-dbuspolicydir=$(out)/etc/dbus-1/system.d"
-      "--with-dbussystemservicedir=$(out)/share/dbus-1/system-services"
-      "--with-dbussessionservicedir=$(out)/share/dbus-1/services"
-      "--with-tty-gid=3" # tty in NixOS has gid 3
-      "--disable-tests"
-
-      "--enable-lz4"
-      "--enable-hostnamed"
-      "--enable-networkd"
-      "--disable-sysusers"
-      "--enable-timedated"
-      "--enable-timesyncd"
-      "--disable-firstboot"
-      "--enable-localed"
-      "--enable-resolved"
-      "--disable-split-usr"
-      "--disable-libcurl"
-      "--disable-libidn"
-      "--disable-quotacheck"
-      "--disable-ldconfig"
-      "--disable-smack"
-
-      (if stdenv.isArm then "--disable-gnuefi" else "--enable-gnuefi")
-      "--with-efi-libdir=${gnu-efi}/lib"
-      "--with-efi-includedir=${gnu-efi}/include"
-      "--with-efi-ldsdir=${gnu-efi}/lib"
-
-      "--with-sysvinit-path="
-      "--with-sysvrcnd-path="
-      "--with-rc-local-script-path-stop=/etc/halt.local"
-    ];
-
-  hardeningDisable = [ "stackprotector" ];
-
-  patches = [
-    # TODO: Remove this patch when we have a systemd version
-    # with https://github.com/systemd/systemd/pull/6678
-    (fetchpatch {
-        url = "https://github.com/systemd/systemd/commit/58a78ae77063eddfcd23ea272bd2e0ddc9ea3ff7.patch";
-        sha256 = "0g3pvqigs69mciw6lj3zg12dmxnhwxndwxdjg78af52xrp0djfg8";
-    })
+  #dontAddPrefix = true;
+
+  mesonFlags = [
+    "-Dloadkeys-path=${kbd}/bin/loadkeys"
+    "-Dsetfont-path=${kbd}/bin/setfont"
+    "-Dtty-gid=3" # tty in NixOS has gid 3
+    # "-Dtests=" # TODO
+    "-Dlz4=true"
+    "-Dhostnamed=true"
+    "-Dnetworkd=true"
+    "-Dsysusers=false"
+    "-Dtimedated=true"
+    "-Dtimesyncd=true"
+    "-Dfirstboot=false"
+    "-Dlocaled=true"
+    "-Dresolve=true"
+    "-Dsplit-usr=false"
+    "-Dlibcurl=false"
+    "-Dlibidn=false"
+    "-Dlibidn2=true"
+    "-Dquotacheck=false"
+    "-Dldconfig=false"
+    "-Dsmack=true"
+    "-Dsystem-uid-max=499" #TODO: debug why awking around in /etc/login.defs doesn't work
+    "-Dsystem-gid-max=499"
+    # "-Dtime-epoch=1"
+
+    (if stdenv.isArm || !hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
+    "-Defi-libdir=${toString gnu-efi}/lib"
+    "-Defi-includedir=${toString gnu-efi}/include/efi"
+    "-Defi-ldsdir=${toString gnu-efi}/lib"
+
+    "-Dsysvinit-path="
+    "-Dsysvrcnd-path="
+
+    "-Dkill-path=${coreutils}/bin/kill"
+    "-Dkmod-path=${kmod}/bin/kmod"
+    "-Dsulogin-path=${utillinux}/bin/sulogin"
+    "-Dmount-path=${utillinux}/bin/mount"
+    "-Dumount-path=${utillinux}/bin/umount"
   ];
 
-  preConfigure =
-    ''
-      unset RANLIB
-
-      ./autogen.sh
-
-      # FIXME: patch this in systemd properly (and send upstream).
-      for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.in src/journal/cat.c src/core/shutdown.c src/nspawn/nspawn.c src/shared/generator.c; do
-        test -e $i
-        substituteInPlace $i \
-          --replace /usr/bin/getent ${stdenv.glibc.bin}/bin/getent \
-          --replace /bin/mount ${utillinux.bin}/bin/mount \
-          --replace /bin/umount ${utillinux.bin}/bin/umount \
-          --replace /sbin/swapon ${utillinux.bin}/sbin/swapon \
-          --replace /sbin/swapoff ${utillinux.bin}/sbin/swapoff \
-          --replace /sbin/fsck ${utillinux.bin}/sbin/fsck \
-          --replace /bin/echo ${coreutils}/bin/echo \
-          --replace /bin/cat ${coreutils}/bin/cat \
-          --replace /sbin/sulogin ${utillinux.bin}/sbin/sulogin \
-          --replace /usr/lib/systemd/systemd-fsck $out/lib/systemd/systemd-fsck \
-          --replace /bin/plymouth /run/current-system/sw/bin/plymouth # To avoid dependency
-      done
-
-      substituteInPlace src/journal/catalog.c \
-        --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
-
-      configureFlagsArray+=("--with-ntp-servers=0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
-    '';
-
-  PYTHON_BINARY = "${coreutils}/bin/env python"; # don't want a build time dependency on Python
+  preConfigure = ''
+    mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
+    mesonFlagsArray+=(-Ddbuspolicydir=$out/etc/dbus-1/system.d)
+    mesonFlagsArray+=(-Ddbussessionservicedir=$out/share/dbus-1/services)
+    mesonFlagsArray+=(-Ddbussystemservicedir=$out/share/dbus-1/system-services)
+    mesonFlagsArray+=(-Dpamconfdir=$out/etc/pam.d)
+    mesonFlagsArray+=(-Drootprefix=$out)
+    mesonFlagsArray+=(-Dlibdir=$lib/lib)
+    mesonFlagsArray+=(-Drootlibdir=$lib/lib)
+    mesonFlagsArray+=(-Dmandir=$man/lib)
+    mesonFlagsArray+=(-Dincludedir=$dev/include)
+    mesonFlagsArray+=(-Dpkgconfiglibdir=$dev/lib/pkgconfig)
+    mesonFlagsArray+=(-Dpkgconfigdatadir=$dev/share/pkgconfig)
+
+    # FIXME: Why aren't includedir and libdir picked up from mesonFlags while other options are?
+    substituteInPlace meson.build \
+      --replace "includedir = join_paths(prefixdir, get_option('includedir'))" \
+                "includedir = '$dev/include'" \
+      --replace "libdir = join_paths(prefixdir, get_option('libdir'))" \
+                "libdir = '$lib/lib'"
+
+    export LC_ALL="en_US.UTF-8";
+    # FIXME: patch this in systemd properly (and send upstream).
+    # already fixed in f00929ad622c978f8ad83590a15a765b4beecac9: (u)mount
+    for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.in src/journal/cat.c src/core/shutdown.c src/nspawn/nspawn.c src/shared/generator.c; do
+      test -e $i
+      substituteInPlace $i \
+        --replace /usr/bin/getent ${getent}/bin/getent \
+        --replace /sbin/swapon ${utillinux.bin}/sbin/swapon \
+        --replace /sbin/swapoff ${utillinux.bin}/sbin/swapoff \
+        --replace /sbin/fsck ${utillinux.bin}/sbin/fsck \
+        --replace /bin/echo ${coreutils}/bin/echo \
+        --replace /bin/cat ${coreutils}/bin/cat \
+        --replace /sbin/sulogin ${utillinux.bin}/sbin/sulogin \
+        --replace /usr/lib/systemd/systemd-fsck $out/lib/systemd/systemd-fsck \
+        --replace /bin/plymouth /run/current-system/sw/bin/plymouth # To avoid dependency
+    done
+
+    for i in tools/xml_helper.py tools/make-directive-index.py tools/make-man-index.py test/sys-script.py; do
+      substituteInPlace $i \
+        --replace "#!/usr/bin/env python" "#!${pythonLxmlEnv}/bin/python"
+    done
+
+    for i in src/basic/generate-gperfs.py src/resolve/generate-dns_type-gperf.py src/test/generate-sym-test.py ; do
+      substituteInPlace $i \
+        --replace "#!/usr/bin/env python" "#!${buildPackages.python3Packages.python}/bin/python"
+    done
+
+    substituteInPlace src/journal/catalog.c \
+      --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
+  '';
+
+  # These defines are overridden by CFLAGS and would trigger annoying
+  # warning messages
+  postConfigure = ''
+    substituteInPlace config.h \
+      --replace "POLKIT_AGENT_BINARY_PATH" "_POLKIT_AGENT_BINARY_PATH" \
+      --replace "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" \
+      --replace "SYSTEMD_CGROUP_AGENT_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
+  '';
+
+  hardeningDisable = [ "stackprotector" ];
 
   NIX_CFLAGS_COMPILE =
     [ # Can't say ${polkit.bin}/bin/pkttyagent here because that would
       # lead to a cyclic dependency.
       "-UPOLKIT_AGENT_BINARY_PATH" "-DPOLKIT_AGENT_BINARY_PATH=\"/run/current-system/sw/bin/pkttyagent\""
-      "-fno-stack-protector"
 
       # Set the release_agent on /sys/fs/cgroup/systemd to the
       # currently running systemd (/run/current-system/systemd) so
@@ -130,53 +164,55 @@ stdenv.mkDerivation rec {
       "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
     ];
 
-  installFlags =
-    [ "localstatedir=$(TMPDIR)/var"
-      "sysconfdir=$(out)/etc"
-      "sysvinitdir=$(TMPDIR)/etc/init.d"
-      "pamconfdir=$(out)/etc/pam.d"
-    ];
-
-  postInstall =
-    ''
-      # sysinit.target: Don't depend on
-      # systemd-tmpfiles-setup.service. This interferes with NixOps's
-      # send-keys feature (since sshd.service depends indirectly on
-      # sysinit.target).
-      mv $out/lib/systemd/system/sysinit.target.wants/systemd-tmpfiles-setup-dev.service $out/lib/systemd/system/multi-user.target.wants/
+  postInstall = ''
+    # sysinit.target: Don't depend on
+    # systemd-tmpfiles-setup.service. This interferes with NixOps's
+    # send-keys feature (since sshd.service depends indirectly on
+    # sysinit.target).
+    mv $out/lib/systemd/system/sysinit.target.wants/systemd-tmpfiles-setup-dev.service $out/lib/systemd/system/multi-user.target.wants/
 
-      mkdir -p $out/example/systemd
-      mv $out/lib/{modules-load.d,binfmt.d,sysctl.d,tmpfiles.d} $out/example
-      mv $out/lib/systemd/{system,user} $out/example/systemd
+    mkdir -p $out/example/systemd
+    mv $out/lib/{modules-load.d,binfmt.d,sysctl.d,tmpfiles.d} $out/example
+    mv $out/lib/systemd/{system,user} $out/example/systemd
 
-      rm -rf $out/etc/systemd/system
+    rm -rf $out/etc/systemd/system
 
-      # Install SysV compatibility commands.
-      mkdir -p $out/sbin
-      ln -s $out/lib/systemd/systemd $out/sbin/telinit
-      for i in init halt poweroff runlevel reboot shutdown; do
-        ln -s $out/bin/systemctl $out/sbin/$i
-      done
+    # Install SysV compatibility commands.
+    mkdir -p $out/sbin
+    ln -s $out/lib/systemd/systemd $out/sbin/telinit
+    for i in init halt poweroff runlevel reboot shutdown; do
+      ln -s $out/bin/systemctl $out/sbin/$i
+    done
 
-      # Fix reference to /bin/false in the D-Bus services.
-      for i in $out/share/dbus-1/system-services/*.service; do
-        substituteInPlace $i --replace /bin/false ${coreutils}/bin/false
-      done
+    # Fix reference to /bin/false in the D-Bus services.
+    for i in $out/share/dbus-1/system-services/*.service; do
+      substituteInPlace $i --replace /bin/false ${coreutils}/bin/false
+    done
 
-      rm -rf $out/etc/rpm
+    rm -rf $out/etc/rpm
 
-      rm $lib/lib/*.la
+    # "kernel-install" shouldn't be used on NixOS.
+    find $out -name "*kernel-install*" -exec rm {} \;
 
-      # "kernel-install" shouldn't be used on NixOS.
-      find $out -name "*kernel-install*" -exec rm {} \;
-
-      # Keep only libudev and libsystemd in the lib output.
-      mkdir -p $out/lib
-      mv $lib/lib/security $lib/lib/libnss* $out/lib/
-    ''; # */
+    # Keep only libudev and libsystemd in the lib output.
+    mkdir -p $out/lib
+    mv $lib/lib/security $lib/lib/libnss* $out/lib/
+  ''; # */
 
   enableParallelBuilding = true;
 
+  # The rpath to the shared systemd library is not added by meson. The
+  # functionality was removed by a nixpkgs patch because it would overwrite
+  # the existing rpath.
+  postFixup = ''
+    sharedLib=libsystemd-shared-${version}.so
+    for prog in `find $out -type f -executable`; do
+      (patchelf --print-needed $prog | grep $sharedLib > /dev/null) && (
+        patchelf --set-rpath `patchelf --print-rpath $prog`:"$out/lib/systemd" $prog
+      ) || true
+    done
+  '';
+
   # The interface version prevents NixOS from switching to an
   # incompatible systemd at runtime.  (Switching across reboots is
   # fine, of course.)  It should be increased whenever systemd changes
diff --git a/pkgs/os-specific/linux/tp_smapi/default.nix b/pkgs/os-specific/linux/tp_smapi/default.nix
index c3adcc6cdba..25eeb889cc2 100644
--- a/pkgs/os-specific/linux/tp_smapi/default.nix
+++ b/pkgs/os-specific/linux/tp_smapi/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "tp_smapi-${version}-${kernel.version}";
-  version = "0.42";
+  version = "0.43";
 
   src = fetchFromGitHub {
     owner = "evgeni";
     repo = "tp_smapi";
     rev = "tp-smapi/${version}";
-    sha256 = "12lnig90lrmkmqwl386q7ssqs9p0jikqhwl2wsmcmii1gn92hzfy";
+    sha256 = "1rjb0njckczc2mj05cagvj0lkyvmyk6bw7wkiinv81lw8m90g77g";
     name = "tp-smapi-${version}";
   };
 
@@ -39,11 +39,10 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "IBM ThinkPad hardware functions driver";
-    homepage = https://github.com/evgeni/tp_smapi/tree/tp-smapi/0.41;
+    homepage = https://github.com/evgeni/tp_smapi;
     license = stdenv.lib.licenses.gpl2;
     maintainers = [ stdenv.lib.maintainers.garbas ];
     # driver is only ment for linux thinkpads i think  bellow platforms should cover it.
     platforms = [ "x86_64-linux" "i686-linux" ];
   };
 }
-
diff --git a/pkgs/os-specific/linux/trinity/default.nix b/pkgs/os-specific/linux/trinity/default.nix
index 48f6ce4be76..4c3a92cd87e 100644
--- a/pkgs/os-specific/linux/trinity/default.nix
+++ b/pkgs/os-specific/linux/trinity/default.nix
@@ -2,15 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "trinity-${version}";
-  version = "1.8";
+  version = "1.8-git-2017-02-13";
 
   src = fetchFromGitHub {
     owner = "kernelslacker";
     repo = "trinity";
-    rev = "v${version}";
-    sha256 = "1ss6ir3ki2hnj4c8068v5bz8bpa43xqg9zlmzhgagi94g9l05qlf";
+    rev = "2989c11ce77bc7bec23da62987e2c3a0dd8a83c9";
+    sha256 = "19asyrypjhx2cgjdmwfvmgc0hk3xg00zvgkl89vwxngdb40bkwfq";
   };
 
+  # Fails on 32-bit otherwise
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
   postPatch = ''
     patchShebangs ./configure
     patchShebangs ./scripts/
diff --git a/pkgs/os-specific/linux/udisks-glue/default.nix b/pkgs/os-specific/linux/udisks-glue/default.nix
index 8b3ebd46c32..56e237a9fad 100644
--- a/pkgs/os-specific/linux/udisks-glue/default.nix
+++ b/pkgs/os-specific/linux/udisks-glue/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, automake, autoconf, udisks, dbus_glib, glib, confuse }:
+{ stdenv, fetchurl, pkgconfig, automake, autoconf, udisks1, dbus-glib, glib, confuse }:
 
 stdenv.mkDerivation {
   name = "udisks-glue-1.3.5";
@@ -8,8 +8,8 @@ stdenv.mkDerivation {
     sha256 = "317d25bf249278dc8f6a5dcf18f760512427c772b9afe3cfe34e6e1baa258176";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ automake autoconf udisks dbus_glib glib confuse ];
+  nativeBuildInputs = [ pkgconfig automake autoconf ];
+  buildInputs = [ udisks1 dbus-glib glib confuse ];
 
   preConfigure = "sh autogen.sh";
 
diff --git a/pkgs/os-specific/linux/udisks/1-default.nix b/pkgs/os-specific/linux/udisks/1-default.nix
index 98cb616e2d5..aeb9deac89d 100644
--- a/pkgs/os-specific/linux/udisks/1-default.nix
+++ b/pkgs/os-specific/linux/udisks/1-default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, sg3_utils, udev, glib, dbus, dbus_glib
+{ stdenv, fetchurl, pkgconfig, sg3_utils, udev, glib, dbus, dbus-glib
 , polkit, parted, lvm2, libatasmart, intltool, libuuid, mdadm
 , libxslt, docbook_xsl, utillinux, libgudev }:
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     '';
 
   buildInputs =
-    [ sg3_utils udev glib dbus dbus_glib polkit parted libgudev
+    [ sg3_utils udev glib dbus dbus-glib polkit parted libgudev
       lvm2 libatasmart intltool libuuid libxslt docbook_xsl
     ];
 
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index a265395f96e..725b1cd2564 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -1,6 +1,7 @@
 { stdenv, fetchurl, pkgconfig, intltool, gnused
 , expat, acl, systemd, glib, libatasmart, polkit
 , libxslt, docbook_xsl, utillinux, mdadm, libgudev
+, gobjectIntrospection
 }:
 
 stdenv.mkDerivation rec {
@@ -11,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "0spl155k0g2l2hvqf8xyjv08i68gfyhzpjva6cwlzxx0bz4gbify";
   };
 
-  outputs = [ "out" "man" ];
+  outputs = [ "out" "man" "dev" ];
 
   patches = [ ./force-path.patch ];
 
@@ -28,7 +29,7 @@ stdenv.mkDerivation rec {
         --replace " sed " " ${gnused}/bin/sed "
     '';
 
-  nativeBuildInputs = [ pkgconfig intltool ];
+  nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection ];
 
   buildInputs = [ libxslt docbook_xsl libgudev expat acl systemd glib libatasmart polkit ];
 
@@ -38,6 +39,11 @@ stdenv.mkDerivation rec {
     "--with-udevdir=$(out)/lib/udev"
   ];
 
+  makeFlags = [
+    "INTROSPECTION_GIRDIR=$(dev)/share/gir-1.0"
+    "INTROSPECTION_TYPELIBDIR=$(out)/lib/girepository-1.0"
+  ];
+
   meta = {
     homepage = http://www.freedesktop.org/wiki/Software/udisks;
     description = "A daemon and command-line utility for querying and manipulating storage devices";
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index b1a8ac7d518..713ef974f9f 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, dbus_glib
+{ stdenv, fetchurl, pkgconfig, glib, dbus-glib
 , intltool, libxslt, docbook_xsl, udev, libgudev, libusb1
 , useSystemd ? true, systemd, gobjectIntrospection
 }:
@@ -6,15 +6,15 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "upower-0.99.4";
+  name = "upower-0.99.7";
 
   src = fetchurl {
     url = "https://upower.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "1c1ph1j1fnrf3vipxb7ncmdfc36dpvcvpsv8n8lmal7grjk2b8ww";
+    sha256 = "00d4830yvg84brdhz4kn60lr3r8rn2y8gdbhmhxm78i5mgvc5g14";
   };
 
   buildInputs =
-    [ dbus_glib intltool libxslt docbook_xsl udev libgudev libusb1 gobjectIntrospection ]
+    [ dbus-glib intltool libxslt docbook_xsl udev libgudev libusb1 gobjectIntrospection ]
     ++ stdenv.lib.optional useSystemd systemd;
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch b/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch
deleted file mode 100644
index eb4d5df698a..00000000000
--- a/pkgs/os-specific/linux/usbguard/daemon_read_only_config.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/Library/ConfigFilePrivate.cpp b/src/Library/ConfigFilePrivate.cpp
-index 8aefa65..40914f7 100644
---- a/src/Library/ConfigFilePrivate.cpp
-+++ b/src/Library/ConfigFilePrivate.cpp
-@@ -51,7 +51,7 @@ namespace usbguard
- 
-   void ConfigFilePrivate::open(const std::string& path)
-   {
--    _stream.open(path, std::ios::in|std::ios::out);
-+    _stream.open(path, std::ios::in);
-     if (!_stream.is_open()) {
-       throw std::runtime_error("Can't open " + path);
-     }
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
index b88d96e02a4..2ca825a27d7 100644
--- a/pkgs/os-specific/linux/usbguard/default.nix
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -1,7 +1,8 @@
 {
   stdenv, fetchurl, lib,
-  libxslt, pandoc, pkgconfig,
-  dbus_glib, libcap_ng, libqb, libseccomp, polkit, protobuf, qtbase, qttools, qtsvg,
+  libxslt, pandoc, asciidoctor, pkgconfig,
+  dbus-glib, libcap_ng, libqb, libseccomp, polkit, protobuf, qtbase, qttools, qtsvg,
+  audit,
   libgcrypt ? null,
   libsodium ? null
 }:
@@ -11,34 +12,31 @@ with stdenv.lib;
 assert libgcrypt != null -> libsodium == null;
 
 stdenv.mkDerivation rec {
-  version = "0.7.0";
+  version = "0.7.2";
   name = "usbguard-${version}";
 
-  repo = "https://github.com/dkopecek/usbguard";
+  repo = "https://github.com/USBGuard/usbguard";
 
   src = fetchurl {
     url = "${repo}/releases/download/${name}/${name}.tar.gz";
-    sha256 = "1e1485a2b47ba3bde9de2851b371d2552a807047a21e0b81553cf80d7f722709";
+    sha256 = "5bd3e5219c590c3ae27b21315bd10b60e823cef64e5deff3305ff5b4087fc2d6";
   };
 
-  patches = [
-    ./daemon_read_only_config.patch
-    ./documentation.patch
-  ];
-
   nativeBuildInputs = [
     libxslt
+    asciidoctor
     pandoc # for rendering documentation
     pkgconfig
   ];
 
   buildInputs = [
-    dbus_glib
+    dbus-glib
     libcap_ng
     libqb
     libseccomp
     polkit
     protobuf
+    audit
 
     qtbase
     qtsvg
@@ -61,7 +59,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "The USBGuard software framework helps to protect your computer against BadUSB.";
-    homepage = "https://dkopecek.github.io/usbguard/";
+    homepage = "https://usbguard.github.io/";
     license = licenses.gpl2;
     maintainers = [ maintainers.tnias ];
   };
diff --git a/pkgs/os-specific/linux/usbguard/documentation.patch b/pkgs/os-specific/linux/usbguard/documentation.patch
deleted file mode 100644
index 89de627131f..00000000000
--- a/pkgs/os-specific/linux/usbguard/documentation.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-diff --git a/doc/usbguard-daemon.conf.5.md b/doc/usbguard-daemon.conf.5.md
-index ea86ad1..63aec70 100644
---- a/doc/usbguard-daemon.conf.5.md
-+++ b/doc/usbguard-daemon.conf.5.md
-@@ -30,21 +30,21 @@ The **usbguard-daemon.conf** file is loaded by the USBGuard daemon after it pars
- **RestoreControllerDeviceState**=<*boolean*>
- :   The USBGuard daemon modifies some attributes of controller devices like the default authorization state of new child device instances. Using this setting, you can control whether the daemon will try to restore the attribute values to the state before modification on shutdown.
- 
-+**DeviceManagerBackend**=<*backend*>
-+:   Which device manager backend implementation to use. Backend should be one of `uevent` (default) or `dummy`.
-+
- **IPCAllowedUsers**=<*username*> [<*username*> ...]
- :   A space delimited list of usernames that the daemon will accept IPC connections from.
- 
- **IPCAllowedGroups**=<*groupname*> [<*groupname*> ...]
- :   A space delimited list of groupnames that the daemon will accept IPC connections from.
- 
--**IPCAccessControlFiles**=<*path*>
--:   Path to a directory holding the IPC access control files.
--
--**DeviceManagerBackend**=<*backend*>
--:   Which device manager backend implementation to use. Backend should be one of `uevent` (default) or `dummy`.
--
- **IPCAccessControlFiles**=<*path*>
- :   The files at this location will be interpreted by the daemon as IPC access control definition files. See the **IPC ACCESS CONTROL** section for more details.
- 
-+**DeviceRulesWithPort**=<*boolean*>
-+:   Generate device specific rules including the "via-port" attribute.
-+
- **AuditFilePath**=<*filepath*>
- :   USBGuard audit events log file path.
- 
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index f54f3ab311a..618ba42e741 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -5,14 +5,14 @@ let
   version = lib.concatStringsSep "." ([ majorVersion ]
     ++ lib.optional (patchVersion != "") patchVersion);
   majorVersion = "2.31";
-  patchVersion = "";
+  patchVersion = "1";
 
 in stdenv.mkDerivation rec {
   name = "util-linux-${version}";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${majorVersion}/${name}.tar.xz";
-    sha256 = "12nw108xjhm63sh2n5a0qs33vpvbvb6rln96l9j50p7wykf7rgpr";
+    sha256 = "04fzrnrr3pvqskvjn9f81y0knh0jvvqx4lmbz5pd4lfdm5pv2l8s";
   };
 
   patches = [
@@ -30,7 +30,8 @@ in stdenv.mkDerivation rec {
 
   crossAttrs = {
     # Work around use of `AC_RUN_IFELSE'.
-    preConfigure = "export scanf_cv_type_modifier=ms";
+    preConfigure = "export scanf_cv_type_modifier=ms" + lib.optionalString (systemd != null)
+      "\nconfigureFlags+=\" --with-systemd --with-systemdsystemunitdir=$bin/lib/systemd/system/\"";
   };
 
   preConfigure = lib.optionalString (systemd != null) ''
diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index 3adedf8c1dd..84b31d4d516 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, pkgconfig, perl
 , libjpeg, udev
 , withUtils ? true
-, withGUI ? true, alsaLib, libX11, qtbase, mesa_glu
+, withGUI ? true, alsaLib, libX11, qtbase, libGLU
 }:
 
 # See libv4l in all-packages.nix for the libs only (overrides alsa, libX11 & QT)
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig perl ];
 
-  buildInputs = [ udev ] ++ lib.optionals (withUtils && withGUI) [ alsaLib libX11 qtbase mesa_glu ];
+  buildInputs = [ udev ] ++ lib.optionals (withUtils && withGUI) [ alsaLib libX11 qtbase libGLU ];
 
   propagatedBuildInputs = [ libjpeg ];
 
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 57f4b9ab674..920c8c0bdee 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -17,6 +17,7 @@ stdenv.mkDerivation rec {
     export PATH=${kmod}/sbin:$PATH
   '';
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
   buildInputs = [ kmod ];
 
   makeFlags = [
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 70811347be5..0650bfd36f3 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.10";
 let
   name = "wireguard-${version}";
 
-  version = "0.0.20171221";
+  version = "0.0.20180304";
 
   src = fetchurl {
     url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "1vf5dbwc2lgcf28k1m919w94hil2gcl0l4h4da1sh6r7kdz6k5rb";
+    sha256 = "11vp6aiqxrnwqlaslxy13cpmw2l2pdm9nhs021rv4zx61lpnbcgg";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/wireless-tools/default.nix b/pkgs/os-specific/linux/wireless-tools/default.nix
index f5a51a4e096..f883bf0d226 100644
--- a/pkgs/os-specific/linux/wireless-tools/default.nix
+++ b/pkgs/os-specific/linux/wireless-tools/default.nix
@@ -1,18 +1,20 @@
 {stdenv, fetchurl}:
 
-stdenv.mkDerivation {
-  name = "wireless-tools-29";
+stdenv.mkDerivation rec {
+  name = "wireless-tools-${version}";
+  version = "30.pre2";
 
   src = fetchurl {
-    url = http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.29.tar.gz;
-    sha256 = "18g5wa3rih89i776nc2n2s50gcds4611gi723h9ki190zqshkf3g";
+    url = "http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.${version}.tar.gz";
+    sha256 = "01lgf592nk8fnk7l5afqvar4szkngwpgcv4xh58qsg9wkkjlhnls";
   };
 
   preBuild = "
-    makeFlagsArray=(PREFIX=$out)
+    makeFlagsArray=(PREFIX=$out CC=$CC LDCONFIG=: AR=$AR RANLIB=$RANLIB)
   ";
 
   meta = {
     platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.gpl2;
   };
 }
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 75e281281d3..868e354c7b5 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -5,7 +5,7 @@
 , zlib, libuuid, python, attr, openssl
 
 # Kernel dependencies
-, kernel ? null, spl ? null, splUnstable ? null
+, kernel ? null, spl ? null, splUnstable ? null, splLegacyCrypto ? null
 }:
 
 with stdenv.lib;
@@ -19,6 +19,7 @@ let
     , spl
     , rev ? "zfs-${version}"
     , isUnstable ? false
+    , isLegacyCrypto ? false
     , incompatibleKernelVersion ? null } @ args:
     if buildKernel &&
       (incompatibleKernelVersion != null) &&
@@ -43,7 +44,7 @@ let
       buildInputs =
            optionals buildKernel [ spl ]
         ++ optionals buildUser [ zlib libuuid python attr ]
-        ++ optionals (buildUser && isUnstable) [ openssl ];
+        ++ optionals (buildUser && (isUnstable || isLegacyCrypto)) [ openssl ];
 
       # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
       NIX_CFLAGS_LINK = "-lgcc_s";
@@ -141,9 +142,9 @@ in {
     incompatibleKernelVersion = null;
 
     # this package should point to the latest release.
-    version = "0.7.5";
+    version = "0.7.6";
 
-    sha256 = "086g4xjx05sy4fwn5709sm46m2yv35wb915xfmqjvpry46245nig";
+    sha256 = "1k3a69zfdk4ia4z2l69lbz0mj26bwdanxd2wynkdpm2kl3zjj18h";
 
     extraPatches = [
       (fetchpatch {
@@ -160,19 +161,41 @@ in {
     incompatibleKernelVersion = null;
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2017-12-28";
+    version = "2018-02-02";
 
-    rev = "390d679acdfa6a2498280a4dcd33b7600ace27ce";
-    sha256 = "09lh1cpsf87yl1sr6inam5av60cy5wv89x6a952vfxrs64ph2m6n";
+    rev = "fbd42542686af053f0d162ec4630ffd4fff1cc30";
+    sha256 = "0qzkwnnk7kz1hwvcaqlpzi5yspfhhmd2alklc07k056ddzbx52qb";
     isUnstable = true;
 
     extraPatches = [
       (fetchpatch {
-        url = "https://github.com/Mic92/zfs/compare/ded8f06a3cfee...nixos-zfs-2017-09-12.patch";
-        sha256 = "033wf4jn0h0kp0h47ai98rywnkv5jwvf3xwym30phnaf8xxdx8aj";
+        url = "https://github.com/Mic92/zfs/compare/fbd42542686af053f0d162ec4630ffd4fff1cc30...nixos-zfs-2018-02-02.patch";
+        sha256 = "05wqwjm9648x60vkwxbp8l6z1q73r2a5l2ni28i2f4pla8s3ahln";
       })
     ];
 
     spl = splUnstable;
   };
+
+  zfsLegacyCrypto = common {
+    # comment/uncomment if breaking kernel versions are known
+    incompatibleKernelVersion = null;
+
+    # this package should point to a version / git revision compatible with the latest kernel release
+    version = "2018-02-01";
+
+    rev = "4c46b99d24a6e71b3c72462c11cb051d0930ad60";
+    sha256 = "011lcp2x44jgfzqqk2gjmyii1v7rxcprggv20prxa3c552drsx3c";
+    isUnstable = true;
+
+    extraPatches = [
+      (fetchpatch {
+        url = "https://github.com/Mic92/zfs/compare/4c46b99d24a6e71b3c72462c11cb051d0930ad60...nixos-zfs-2018-02-01.patch";
+        sha256 = "1gqmgqi39qhk5kbbvidh8f2xqq25vj58i9x0wjqvcx6a71qj49ch";
+      })
+    ];
+
+    spl = splLegacyCrypto;
+  };
+
 }