summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/darwin/adv_cmds/ps.nix35
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CF/add-cf-initialize.patch18
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CF/add-cfmachport.patch22
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CF/default.nix41
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix20
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix16
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/CoreOSMakefiles/default.nix30
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix27
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix187
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix15
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix30
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix16
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix13
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix11
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix147
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols1530
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols929
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Security/default.nix116
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix30
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix23
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix44
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/configd/default.nix205
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix83
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix50
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix18
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix11
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix14
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libauto/auto_dtrace.h129
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix74
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix13
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix15
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix13
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix51
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix29
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix35
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/objc4/objc-probes.h65
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/objc4/pure.nix118
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/objc4/spinlocks.patch107
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix16
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix117
-rw-r--r--pkgs/os-specific/darwin/cctools-port/default.nix64
-rw-r--r--pkgs/os-specific/darwin/cctools/ld-ignore-rpath-link.patch (renamed from pkgs/os-specific/darwin/cctools-port/ld-ignore-rpath-link.patch)0
-rw-r--r--pkgs/os-specific/darwin/cctools/ld-rpath-nonfinal.patch (renamed from pkgs/os-specific/darwin/cctools-port/ld-rpath-nonfinal.patch)0
-rw-r--r--pkgs/os-specific/darwin/cctools/port.nix102
-rw-r--r--pkgs/os-specific/darwin/command-line-tools/default.nix43
-rw-r--r--pkgs/os-specific/darwin/osx-private-sdk/default.nix34
-rw-r--r--pkgs/os-specific/darwin/osx-sdk/default.nix26
-rw-r--r--pkgs/os-specific/darwin/otool/default.nix2
-rw-r--r--pkgs/os-specific/darwin/security-tool/default.nix30
-rw-r--r--pkgs/os-specific/linux/acpi-call/default.nix1
-rw-r--r--pkgs/os-specific/linux/acpi/default.nix2
-rw-r--r--pkgs/os-specific/linux/acpid/default.nix4
-rw-r--r--pkgs/os-specific/linux/afuse/default.nix14
-rw-r--r--pkgs/os-specific/linux/alsa-firmware/default.nix35
-rw-r--r--pkgs/os-specific/linux/alsa-lib/alsa-plugin-conf-multilib.patch232
-rw-r--r--pkgs/os-specific/linux/alsa-lib/alsa-plugin-dirs.patch110
-rw-r--r--pkgs/os-specific/linux/alsa-lib/default.nix7
-rw-r--r--pkgs/os-specific/linux/android-udev-rules/default.nix23
-rw-r--r--pkgs/os-specific/linux/apparmor/2.9/default.nix183
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix12
-rw-r--r--pkgs/os-specific/linux/ati-drivers/builder.sh242
-rw-r--r--pkgs/os-specific/linux/ati-drivers/default.nix43
-rw-r--r--pkgs/os-specific/linux/ati-drivers/fglrx_3.17rc6-no_hotplug.patch31
-rw-r--r--pkgs/os-specific/linux/ati-drivers/gentoo-patches.patch51
-rw-r--r--pkgs/os-specific/linux/atop/default.nix9
-rw-r--r--pkgs/os-specific/linux/atop/default.upstream4
-rw-r--r--pkgs/os-specific/linux/audit/default.nix5
-rw-r--r--pkgs/os-specific/linux/autofs/autofs-v5.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/alfred.nix27
-rw-r--r--pkgs/os-specific/linux/batman-adv/batctl.nix4
-rw-r--r--pkgs/os-specific/linux/batman-adv/default.nix8
-rw-r--r--pkgs/os-specific/linux/bbswitch/default.nix13
-rw-r--r--pkgs/os-specific/linux/blcr/default.nix10
-rw-r--r--pkgs/os-specific/linux/bluez/bluez5.nix9
-rw-r--r--pkgs/os-specific/linux/bluez/bluez5_28.nix79
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix6
-rw-r--r--pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch11
-rw-r--r--pkgs/os-specific/linux/bridge-utils/default.nix19
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/cfg80211_inform_bss-3.18.patch21
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/default.nix15
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/linux-recent.patch126
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/netdev-3.17.patch15
-rw-r--r--pkgs/os-specific/linux/busybox/busybox-in-store.patch16
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix54
-rw-r--r--pkgs/os-specific/linux/busybox/include-missing-sys-resource-header.patch12
-rw-r--r--pkgs/os-specific/linux/cgmanager/default.nix36
-rw-r--r--pkgs/os-specific/linux/cifs-utils/default.nix15
-rw-r--r--pkgs/os-specific/linux/conky/default.nix113
-rw-r--r--pkgs/os-specific/linux/conntrack-tools/default.nix24
-rw-r--r--pkgs/os-specific/linux/consoletools/default.nix14
-rw-r--r--pkgs/os-specific/linux/conspy/default.nix8
-rw-r--r--pkgs/os-specific/linux/conspy/default.upstream6
-rw-r--r--pkgs/os-specific/linux/cpufrequtils/default.nix2
-rw-r--r--pkgs/os-specific/linux/cpupower/default.nix2
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix6
-rw-r--r--pkgs/os-specific/linux/disk-indicator/default.nix2
-rw-r--r--pkgs/os-specific/linux/dmraid/default.nix8
-rw-r--r--pkgs/os-specific/linux/dmtcp/default.nix22
-rw-r--r--pkgs/os-specific/linux/e3cfsprogs/default.nix12
-rw-r--r--pkgs/os-specific/linux/eudev/default.nix49
-rw-r--r--pkgs/os-specific/linux/fatrace/default.nix31
-rw-r--r--pkgs/os-specific/linux/firejail/default.nix12
-rw-r--r--pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix7
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix78
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/zd1211/default.nix4
-rw-r--r--pkgs/os-specific/linux/flashbench/default.nix27
-rw-r--r--pkgs/os-specific/linux/freefall/default.nix42
-rw-r--r--pkgs/os-specific/linux/ftop/default.nix37
-rw-r--r--pkgs/os-specific/linux/ftop/ftop-fix_buffer_overflow.patch11
-rw-r--r--pkgs/os-specific/linux/ftop/ftop-fix_printf_format.patch20
-rw-r--r--pkgs/os-specific/linux/fuse/default.nix2
-rw-r--r--pkgs/os-specific/linux/gradm/default.nix4
-rw-r--r--pkgs/os-specific/linux/hdparm/default.nix6
-rw-r--r--pkgs/os-specific/linux/hostapd/default.nix7
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix8
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix33
-rw-r--r--pkgs/os-specific/linux/ipsec-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipset/default.nix22
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix6
-rw-r--r--pkgs/os-specific/linux/iw/default.nix6
-rw-r--r--pkgs/os-specific/linux/jfbview/default.nix44
-rw-r--r--pkgs/os-specific/linux/kbd/console-fix.patch18
-rw-r--r--pkgs/os-specific/linux/kbd/default.nix44
-rw-r--r--pkgs/os-specific/linux/kernel-headers/3.12.nix (renamed from pkgs/os-specific/linux/kernel-headers/3.7.nix)6
-rw-r--r--pkgs/os-specific/linux/kernel/3.17-buildfix.patch62
-rw-r--r--pkgs/os-specific/linux/kernel/bridge-stp-helper.patch13
-rw-r--r--pkgs/os-specific/linux/kernel/btrfs-fix-deadlock.patch43
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix139
-rw-r--r--pkgs/os-specific/linux/kernel/crc-regression.patch24
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/grsec-path.patch13
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.10.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.12.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.14.nix12
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.18.nix (renamed from pkgs/os-specific/linux/kernel/linux-3.15.nix)13
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.19.nix (renamed from pkgs/os-specific/linux/kernel/linux-3.16.nix)14
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.2.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.4.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix (renamed from pkgs/os-specific/linux/kernel/linux-rpi-3.6.nix)8
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix12
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix11
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix27
-rw-r--r--pkgs/os-specific/linux/kernel/perf.nix7
-rwxr-xr-xpkgs/os-specific/linux/kernel/update.sh62
-rw-r--r--pkgs/os-specific/linux/klibc/default.nix4
-rw-r--r--pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix4
-rw-r--r--pkgs/os-specific/linux/kmod/default.nix4
-rw-r--r--pkgs/os-specific/linux/ktap/default.nix4
-rw-r--r--pkgs/os-specific/linux/libaio/default.nix14
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix6
-rw-r--r--pkgs/os-specific/linux/libcap/progs.nix8
-rw-r--r--pkgs/os-specific/linux/libnl/3.2.19.nix20
-rw-r--r--pkgs/os-specific/linux/libnl/default.nix4
-rw-r--r--pkgs/os-specific/linux/libsepol/default.nix2
-rw-r--r--pkgs/os-specific/linux/light/default.nix20
-rw-r--r--pkgs/os-specific/linux/lightum/default.nix33
-rw-r--r--pkgs/os-specific/linux/lockdep/default.nix7
-rw-r--r--pkgs/os-specific/linux/lttng-modules/default.nix18
-rw-r--r--pkgs/os-specific/linux/lttng-modules/lttng-fix-build-error-on-linux-3.2.patch33
-rw-r--r--pkgs/os-specific/linux/lvm2/default.nix17
-rw-r--r--pkgs/os-specific/linux/lvm2/default.upstream4
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix59
-rw-r--r--pkgs/os-specific/linux/lxc/install-localstatedir-in-store.patch15
-rw-r--r--pkgs/os-specific/linux/macchanger/default.nix27
-rw-r--r--pkgs/os-specific/linux/mdadm/default.nix9
-rw-r--r--pkgs/os-specific/linux/microcode/amd.nix33
-rw-r--r--pkgs/os-specific/linux/microcode/converter.nix29
-rw-r--r--pkgs/os-specific/linux/microcode/intel-microcode2ucode.c154
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix27
-rw-r--r--pkgs/os-specific/linux/mingetty/default.nix5
-rw-r--r--pkgs/os-specific/linux/module-init-tools/default.nix9
-rw-r--r--pkgs/os-specific/linux/mstpd/default.nix24
-rw-r--r--pkgs/os-specific/linux/mstpd/fixes.patch72
-rw-r--r--pkgs/os-specific/linux/multipath-tools/default.nix2
-rw-r--r--pkgs/os-specific/linux/musl/default.nix14
-rw-r--r--pkgs/os-specific/linux/netatop/default.nix2
-rw-r--r--pkgs/os-specific/linux/nfs-utils/default.nix7
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix8
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/beta.nix64
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh (renamed from pkgs/os-specific/linux/nvidia-x11/builder-legacy.sh)2
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder-legacy304.sh2
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder-legacy340.sh107
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder.sh81
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix19
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/legacy173.nix10
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/legacy304.nix8
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/legacy340.nix64
-rw-r--r--pkgs/os-specific/linux/nvidiabl/default.nix1
-rw-r--r--pkgs/os-specific/linux/opengl/xorg-sys/default.nix2
-rw-r--r--pkgs/os-specific/linux/openvswitch/default.nix50
-rw-r--r--pkgs/os-specific/linux/pam_console/configure.ac27
-rw-r--r--pkgs/os-specific/linux/pam_console/default.nix31
-rw-r--r--pkgs/os-specific/linux/pam_krb5/default.nix24
-rw-r--r--pkgs/os-specific/linux/pam_ldap/default.nix2
-rw-r--r--pkgs/os-specific/linux/pam_login/default.nix20
-rw-r--r--pkgs/os-specific/linux/pam_login/sys-stat-h.patch12
-rw-r--r--pkgs/os-specific/linux/pam_mount/default.nix29
-rw-r--r--pkgs/os-specific/linux/pax-utils/default.nix4
-rw-r--r--pkgs/os-specific/linux/paxctl/default.nix4
-rw-r--r--pkgs/os-specific/linux/pcmciautils/default.nix8
-rw-r--r--pkgs/os-specific/linux/perf-tools/default.nix43
-rw-r--r--pkgs/os-specific/linux/plymouth/default.nix41
-rw-r--r--pkgs/os-specific/linux/powertop/default.nix4
-rw-r--r--pkgs/os-specific/linux/prl-tools/autostart.desktop8
-rw-r--r--pkgs/os-specific/linux/prl-tools/default.nix197
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix27
-rw-r--r--pkgs/os-specific/linux/radeontop/default.nix38
-rw-r--r--pkgs/os-specific/linux/s6-linux-utils/default.nix33
-rw-r--r--pkgs/os-specific/linux/sdparm/default.nix11
-rw-r--r--pkgs/os-specific/linux/seturgent/default.nix27
-rw-r--r--pkgs/os-specific/linux/sinit/default.nix36
-rw-r--r--pkgs/os-specific/linux/smem/default.nix33
-rw-r--r--pkgs/os-specific/linux/spl/default.nix53
-rw-r--r--pkgs/os-specific/linux/spl/generic.nix61
-rw-r--r--pkgs/os-specific/linux/spl/git.nix49
-rw-r--r--pkgs/os-specific/linux/spl/install_prefix.patch447
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix10
-rw-r--r--pkgs/os-specific/linux/sysfsutils/default.nix2
-rw-r--r--pkgs/os-specific/linux/sysklogd/default.nix7
-rw-r--r--pkgs/os-specific/linux/syslinux/default.nix4
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix19
-rw-r--r--pkgs/os-specific/linux/sysstat/install.patch13
-rw-r--r--pkgs/os-specific/linux/sysstat/no-install-statedir.patch37
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix42
-rw-r--r--pkgs/os-specific/linux/systemd/fixes.patch3317
-rw-r--r--pkgs/os-specific/linux/sysvinit/default.nix1
-rw-r--r--pkgs/os-specific/linux/uclibc/default.nix31
-rw-r--r--pkgs/os-specific/linux/udisks-glue/default.nix2
-rw-r--r--pkgs/os-specific/linux/udisks/1-default.nix13
-rw-r--r--pkgs/os-specific/linux/udisks/2-default.nix10
-rw-r--r--pkgs/os-specific/linux/upower/0.99.nix10
-rw-r--r--pkgs/os-specific/linux/upower/default.nix2
-rw-r--r--pkgs/os-specific/linux/upstart/default.nix2
-rw-r--r--pkgs/os-specific/linux/usbutils/default.nix21
-rw-r--r--pkgs/os-specific/linux/usermount/default.nix2
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix22
-rw-r--r--pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch30
-rw-r--r--pkgs/os-specific/linux/v4l-utils/default.nix57
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/default.nix2
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/kernel-3.18-fix.patch31
-rw-r--r--pkgs/os-specific/linux/v86d/default.nix2
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/default.nix7
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/libnl.patch13
-rw-r--r--pkgs/os-specific/linux/x86info/default.nix7
-rw-r--r--pkgs/os-specific/linux/xf86-input-wacom/default.nix4
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix59
-rw-r--r--pkgs/os-specific/linux/zfs/generic.nix94
-rw-r--r--pkgs/os-specific/linux/zfs/git.nix55
-rw-r--r--pkgs/os-specific/linux/zfs/mount_zfs_prefix.patch24
-rw-r--r--pkgs/os-specific/linux/zfs/nix-build.patch347
255 files changed, 9584 insertions, 4633 deletions
diff --git a/pkgs/os-specific/darwin/adv_cmds/ps.nix b/pkgs/os-specific/darwin/adv_cmds/ps.nix
new file mode 100644
index 00000000000..c3d3d158862
--- /dev/null
+++ b/pkgs/os-specific/darwin/adv_cmds/ps.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "ps-${version}";
+  version = "153";
+
+  src = fetchurl {
+    url    = "http://opensource.apple.com/tarballs/adv_cmds/adv_cmds-${version}.tar.gz";
+    sha256 = "174v6a4zkcm2pafzgdm6kvs48z5f911zl7k49hv7kjq6gm58w99v";
+  };
+
+  buildPhase = ''
+    cd ps
+    cc -Os -Wall -I. -c -o fmt.o fmt.c
+    cc -Os -Wall -I. -c -o keyword.o keyword.c
+    cc -Os -Wall -I. -c -o nlist.o nlist.c
+    cc -Os -Wall -I. -c -o print.o print.c
+    cc -Os -Wall -I. -c -o ps.o ps.c
+    cc -Os -Wall -I. -c -o tasks.o tasks.c
+    cc -o ps fmt.o keyword.o nlist.o print.o ps.o tasks.o
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/man/man1
+
+    cp ps   $out/bin/ps
+    cp ps.1 $out/share/man/man1
+  '';
+
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CF/add-cf-initialize.patch b/pkgs/os-specific/darwin/apple-source-releases/CF/add-cf-initialize.patch
new file mode 100644
index 00000000000..46c230cfd1d
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/CF/add-cf-initialize.patch
@@ -0,0 +1,18 @@
+--- CF-855.17/CFRuntime.c	2014-11-26 21:29:48.000000000 -0800
++++ CF-855.17/CFRuntime.c.new	2014-11-26 21:30:01.000000000 -0800
+@@ -756,6 +756,7 @@
+ extern void __CFErrorInitialize(void);
+ extern void __CFTreeInitialize(void);
+ extern void __CFURLInitialize(void);
++extern void __CFPreferencesDomainInitialize(void);
+ #if DEPLOYMENT_TARGET_MACOSX || DEPLOYMENT_TARGET_EMBEDDED || DEPLOYMENT_TARGET_EMBEDDED_MINI
+ extern void __CFMachPortInitialize(void);
+ #endif
+@@ -1015,6 +1016,7 @@
+         __CFErrorInitialize();
+         __CFTreeInitialize();
+         __CFURLInitialize();
++        __CFPreferencesDomainInitialize();
+         
+ #if DEPLOYMENT_TARGET_MACOSX || DEPLOYMENT_TARGET_EMBEDDED || DEPLOYMENT_TARGET_WINDOWS
+         __CFBundleInitialize();
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CF/add-cfmachport.patch b/pkgs/os-specific/darwin/apple-source-releases/CF/add-cfmachport.patch
new file mode 100644
index 00000000000..a1018d389c1
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/CF/add-cfmachport.patch
@@ -0,0 +1,22 @@
+--- CF-855.17/CoreFoundation.h  2015-01-03 00:17:41.000000000 -0500
++++ CF-855.17/CoreFoundation.h.new  2015-01-03 00:18:35.000000000 -0500
+@@ -72,6 +72,7 @@
+ #include <CoreFoundation/CFDictionary.h>
+ #include <CoreFoundation/CFError.h>
+ #include <CoreFoundation/CFLocale.h>
++#include <CoreFoundation/CFMachPort.h>
+ #include <CoreFoundation/CFNumber.h>
+ #include <CoreFoundation/CFNumberFormatter.h>
+ #include <CoreFoundation/CFPreferences.h>
+
+--- CF-855.17/Makefile  2015-01-03 00:32:52.000000000 -0500
++++ CF-855.17/Makefile.new  2015-01-03 00:33:07.000000000 -0500
+@@ -9,7 +9,7 @@
+ HFILES = $(wildcard *.h)
+ INTERMEDIATE_HFILES = $(addprefix $(OBJBASE)/CoreFoundation/,$(HFILES))
+ 
+-PUBLIC_HEADERS=CFArray.h CFBag.h CFBase.h CFBinaryHeap.h CFBitVector.h CFBundle.h CFByteOrder.h CFCalendar.h CFCharacterSet.h CFData.h CFDate.h CFDateFormatter.h CFDictionary.h CFError.h CFLocale.h CFMessagePort.h CFNumber.h CFNumberFormatter.h CFPlugIn.h CFPlugInCOM.h CFPreferences.h CFPropertyList.h CFRunLoop.h CFSet.h CFSocket.h CFStream.h CFString.h CFStringEncodingExt.h CFTimeZone.h CFTree.h CFURL.h CFURLAccess.h CFUUID.h CFUserNotification.h CFXMLNode.h CFXMLParser.h CFAvailability.h CFUtilities.h CoreFoundation.h
++PUBLIC_HEADERS=CFArray.h CFBag.h CFBase.h CFBinaryHeap.h CFBitVector.h CFBundle.h CFByteOrder.h CFCalendar.h CFCharacterSet.h CFData.h CFDate.h CFDateFormatter.h CFDictionary.h CFError.h CFLocale.h CFMachPort.h CFMessagePort.h CFNumber.h CFNumberFormatter.h CFPlugIn.h CFPlugInCOM.h CFPreferences.h CFPropertyList.h CFRunLoop.h CFSet.h CFSocket.h CFStream.h CFString.h CFStringEncodingExt.h CFTimeZone.h CFTree.h CFURL.h CFURLAccess.h CFUUID.h CFUserNotification.h CFXMLNode.h CFXMLParser.h CFAvailability.h CFUtilities.h CoreFoundation.h
+ 
+ PRIVATE_HEADERS=CFBundlePriv.h CFCharacterSetPriv.h CFError_Private.h CFLogUtilities.h CFPriv.h CFRuntime.h CFStorage.h CFStreamAbstract.h CFStreamPriv.h CFStreamInternal.h CFStringDefaultEncoding.h CFStringEncodingConverter.h CFStringEncodingConverterExt.h CFUniChar.h CFUnicodeDecomposition.h CFUnicodePrecomposition.h ForFoundationOnly.h CFBurstTrie.h CFICULogging.h
+ 
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
new file mode 100644
index 00000000000..3d4ac89e0a7
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, appleDerivation, icu, dyld, libdispatch, launchd, libclosure }:
+
+appleDerivation {
+  buildInputs = [ dyld icu libdispatch launchd libclosure ];
+
+  patches = [ ./add-cf-initialize.patch ./add-cfmachport.patch ];
+
+  preBuild = ''
+    substituteInPlace Makefile \
+      --replace "/usr/bin/clang" "clang" \
+      --replace "-arch i386 " "" \
+      --replace "/usr/bin/" "" \
+      --replace "/usr/sbin/" "" \
+      --replace "/bin/" "" \
+      --replace "INSTALLNAME=/System" "INSTALLNAME=$out" \
+      --replace "install_name_tool -id /System" "install_name_tool -id $out" \
+      --replace "-licucore.A" "-licui18n -licuuc" \
+      --replace 'chown -RH -f root:wheel $(DSTBASE)/CoreFoundation.framework' "" \
+      --replace 'chmod -RH' 'chmod -R'
+
+    replacement=''$'#define __PTK_FRAMEWORK_COREFOUNDATION_KEY5 55\n#define _pthread_getspecific_direct(key) pthread_getspecific((key))\n#define _pthread_setspecific_direct(key, val) pthread_setspecific((key), (val))'
+
+    substituteInPlace CFPlatform.c --replace "#include <pthread/tsd_private.h>" "$replacement"
+
+    substituteInPlace CFRunLoop.c --replace "#include <pthread/private.h>" ""
+
+    substituteInPlace CFURLPriv.h \
+      --replace "#include <CoreFoundation/CFFileSecurity.h>" "" \
+      --replace "#include <CoreFoundation/CFURLEnumerator.h>" "" \
+      --replace "CFFileSecurityRef" "void *" \
+      --replace "CFURLEnumeratorResult" "void *" \
+      --replace "CFURLEnumeratorRef" "void *"
+
+    export DSTROOT=$out
+  '';
+
+  postInstall = ''
+    mv $out/System/* $out
+    rmdir $out/System
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix
new file mode 100644
index 00000000000..38215fa8f90
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/CarbonHeaders/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp MacTypes.h          $out/include
+    cp ConditionalMacros.h $out/include
+
+    substituteInPlace $out/include/MacTypes.h \
+      --replace "CarbonCore/" ""
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix
new file mode 100644
index 00000000000..5bcf94a18ce
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/CommonCrypto/default.nix
@@ -0,0 +1,16 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include/CommonCrypto
+    cp include/* $out/include/CommonCrypto
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CoreOSMakefiles/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CoreOSMakefiles/default.nix
new file mode 100644
index 00000000000..9f6031771c2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/CoreOSMakefiles/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, appleDerivation, unifdef }:
+
+appleDerivation {
+  buildinputs = [ unifdef ];
+
+  phases = [ "unpackPhase" "installPhase" ];
+
+  preInstall = ''
+    substituteInPlace Makefile \
+      --replace "rsync -a --exclude=.svn --exclude=.git" "cp -r"
+
+    substituteInPlace Standard/Commands.in \
+      --replace "/bin/sh" "bash" \
+      --replace "/usr/bin/compress" "compress" \
+      --replace "/usr/bin/gzip" "gzip" \
+      --replace "/bin/pax" "pax" \
+      --replace "/usr/bin/tar" "tar" \
+      --replace "xcrun -find" "echo" \
+      --replace '$(Install_Program_Group)   -s' '$(Install_Program_Group)' \
+      --replace '$(Install_Program_Mode)   -s'  '$(Install_Program_Mode)'
+
+    substituteInPlace ReleaseControl/Common.make \
+      --replace "/tmp" "$TMPDIR"
+
+    substituteInPlace ReleaseControl/BSDCommon.make \
+      --replace '$(shell xcrun -find -sdk $(SDKROOT) cc)' "cc"
+
+    export DSTROOT=$out
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
new file mode 100644
index 00000000000..893e9f2b2eb
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Csu/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  postUnpack = ''
+    substituteInPlace $sourceRoot/Makefile \
+      --replace "/usr/lib" "/lib" \
+      --replace "/usr/local/lib" "/lib" \
+      --replace "/usr/bin" "" \
+      --replace "/bin/" ""
+  '';
+
+  # Mac OS didn't support rpaths back before 10.5, and this package intentionally builds stubs targeting versions prior to that
+  NIX_DONT_SET_RPATH = "1";
+  NIX_NO_SELF_RPATH  = "1";
+
+  installPhase = ''
+    export DSTROOT=$out
+    make install
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Apple's common startup stubs for darwin";
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
new file mode 100644
index 00000000000..12f38cd195f
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/IOKit/default.nix
@@ -0,0 +1,187 @@
+{ stdenv, appleDerivation, IOKitSrcs, xnu }:
+
+# Someday it'll make sense to split these out into their own packages, but today is not that day.
+appleDerivation {
+  srcs = stdenv.lib.attrValues IOKitSrcs;
+  sourceRoot = ".";
+
+  phases = [ "unpackPhase" "installPhase" ];
+
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/IOKit.framework/IOKit"
+    "/System/Library/Frameworks/IOKit.framework/Resources"
+    "/System/Library/Frameworks/IOKit.framework/Versions"
+  ];
+
+  installPhase = ''
+    ###### IMPURITIES
+    mkdir -p $out/Library/Frameworks/IOKit.framework
+    pushd $out/Library/Frameworks/IOKit.framework
+    ln -s /System/Library/Frameworks/IOKit.framework/IOKit
+    ln -s /System/Library/Frameworks/IOKit.framework/Resources
+    popd
+
+    ###### HEADERS
+
+    export dest=$out/Library/Frameworks/IOKit.framework/Headers
+    mkdir -p $dest
+
+    pushd $dest
+    mkdir audio avc DV firewire graphics hid hidsystem i2c kext ndrvsupport
+    mkdir network ps pwr_mgt sbp2 scsi serial storage stream usb video
+    popd
+
+    # root: complete
+    cp IOKitUser-907.100.13/IOCFBundle.h                                       $dest
+    cp IOKitUser-907.100.13/IOCFPlugIn.h                                       $dest
+    cp IOKitUser-907.100.13/IOCFSerialize.h                                    $dest
+    cp IOKitUser-907.100.13/IOCFUnserialize.h                                  $dest
+    cp IOKitUser-907.100.13/IOCFURLAccess.h                                    $dest
+    cp IOKitUser-907.100.13/IODataQueueClient.h                                $dest
+    cp IOKitUser-907.100.13/IOKitLib.h                                         $dest
+    cp IOKitUser-907.100.13/iokitmig.h                                         $dest
+    cp ${xnu}/Library/PrivateFrameworks/IOKit.framework/Versions/A/Headers/*.h $dest
+
+    # audio: complete
+    cp IOAudioFamily-197.4.2/IOAudioDefines.h          $dest/audio
+    cp IOKitUser-907.100.13/audio.subproj/IOAudioLib.h $dest/audio
+    cp IOAudioFamily-197.4.2/IOAudioTypes.h            $dest/audio
+
+    # avc: complete
+    cp IOFireWireAVC-422.4.0/IOFireWireAVC/IOFireWireAVCConsts.h $dest/avc
+    cp IOFireWireAVC-422.4.0/IOFireWireAVCLib/IOFireWireAVCLib.h $dest/avc
+
+    # DV: complete
+    cp IOFWDVComponents-207.4.1/DVFamily.h $dest/DV
+
+    # firewire: complete
+    cp IOFireWireFamily-455.4.0/IOFireWireFamily.kmodproj/IOFireWireFamilyCommon.h $dest/firewire
+    cp IOFireWireFamily-455.4.0/IOFireWireLib.CFPlugInProj/IOFireWireLib.h         $dest/firewire
+    cp IOFireWireFamily-455.4.0/IOFireWireLib.CFPlugInProj/IOFireWireLibIsoch.h    $dest/firewire
+    cp IOFireWireFamily-455.4.0/IOFireWireFamily.kmodproj/IOFWIsoch.h              $dest/firewire
+
+    # graphics: missing AppleGraphicsDeviceControlUserCommand.h
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/graphics/IOAccelClientConnect.h     $dest/graphics
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/graphics/IOAccelSurfaceConnect.h    $dest/graphics
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/graphics/IOAccelTypes.h             $dest/graphics
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/graphics/IOFramebufferShared.h      $dest/graphics
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/graphics/IOGraphicsEngine.h         $dest/graphics
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/graphics/IOGraphicsInterface.h      $dest/graphics
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/graphics/IOGraphicsInterfaceTypes.h $dest/graphics
+    cp IOKitUser-907.100.13/graphics.subproj/IOGraphicsLib.h                          $dest/graphics
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/graphics/IOGraphicsTypes.h          $dest/graphics
+
+    # hid: complete
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDBase.h         $dest/hid
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDDevice.h       $dest/hid
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDDevicePlugIn.h $dest/hid
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDElement.h      $dest/hid
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDLib.h          $dest/hid
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDManager.h      $dest/hid
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDQueue.h        $dest/hid
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDTransaction.h  $dest/hid
+    cp IOKitUser-907.100.13/hid.subproj/IOHIDValue.h        $dest/hid
+    cp IOHIDFamily-503.215.2/IOHIDFamily/IOHIDKeys.h        $dest/hid
+    cp IOHIDFamily-503.215.2/IOHIDFamily/IOHIDUsageTables.h $dest/hid
+    cp IOHIDFamily-503.215.2/IOHIDLib/IOHIDLibObsolete.h    $dest/hid
+
+    # hidsystem: complete
+    cp IOHIDFamily-503.215.2/IOHIDSystem/IOKit/hidsystem/ev_keymap.h      $dest/hidsystem
+    cp IOKitUser-907.100.13/hidsystem.subproj/event_status_driver.h       $dest/hidsystem
+    cp IOKitUser-907.100.13/hidsystem.subproj/IOHIDLib.h                  $dest/hidsystem
+    cp IOHIDFamily-503.215.2/IOHIDSystem/IOKit/hidsystem/IOHIDParameter.h $dest/hidsystem
+    cp IOHIDFamily-503.215.2/IOHIDSystem/IOKit/hidsystem/IOHIDShared.h    $dest/hidsystem
+    cp IOHIDFamily-503.215.2/IOHIDSystem/IOKit/hidsystem/IOHIDTypes.h     $dest/hidsystem
+    cp IOHIDFamily-503.215.2/IOHIDSystem/IOKit/hidsystem/IOLLEvent.h      $dest/hidsystem
+
+
+    # i2c: complete
+    cp IOGraphics-471.92.1/IOGraphicsFamily/IOKit/i2c/IOI2CInterface.h $dest/i2c
+
+    # kext: complete
+    cp IOKitUser-907.100.13/kext.subproj/KextManager.h $dest/kext
+
+    # ndrvsupport: complete
+    cp IOGraphics-471.92.1/IONDRVSupport/IOKit/ndrvsupport/IOMacOSTypes.h $dest/ndrvsupport
+    cp IOGraphics-471.92.1/IONDRVSupport/IOKit/ndrvsupport/IOMacOSVideo.h $dest/ndrvsupport
+
+    # network: complete
+    cp IONetworkingFamily-100/IOEthernetController.h       $dest/network
+    cp IONetworkingFamily-100/IOEthernetInterface.h        $dest/network
+    cp IONetworkingFamily-100/IOEthernetStats.h            $dest/network
+    cp IONetworkingFamily-100/IONetworkController.h        $dest/network
+    cp IONetworkingFamily-100/IONetworkData.h              $dest/network
+    cp IONetworkingFamily-100/IONetworkInterface.h         $dest/network
+    cp IOKitUser-907.100.13/network.subproj/IONetworkLib.h $dest/network
+    cp IONetworkingFamily-100/IONetworkMedium.h            $dest/network
+    cp IONetworkingFamily-100/IONetworkStack.h             $dest/network
+    cp IONetworkingFamily-100/IONetworkStats.h             $dest/network
+    cp IONetworkingFamily-100/IONetworkUserClient.h        $dest/network
+
+    # ps: missing IOUPSPlugIn.h
+    cp IOKitUser-907.100.13/ps.subproj/IOPowerSources.h $dest/ps
+    cp IOKitUser-907.100.13/ps.subproj/IOPSKeys.h       $dest/ps
+
+    # pwr_mgt: complete
+    cp IOKitUser-907.100.13/pwr_mgt.subproj/IOPMKeys.h                                 $dest/pwr_mgt
+    cp IOKitUser-907.100.13/pwr_mgt.subproj/IOPMLib.h                                  $dest/pwr_mgt
+    cp ${xnu}/Library/PrivateFrameworks/IOKit.framework/Versions/A/Headers/pwr_mgt/*.h $dest/pwr_mgt
+    cp IOKitUser-907.100.13/pwr_mgt.subproj/IOPMLibPrivate.h                           $dest/pwr_mgt # Private
+
+    # sbp2: complete
+    cp IOFireWireSBP2-426.4.1/IOFireWireSBP2Lib/IOFireWireSBP2Lib.h $dest/sbp2
+
+    # scsi: omitted for now
+
+    # serial: complete
+    cp IOSerialFamily-64.1.1/IOSerialFamily.kmodproj/IOSerialKeys.h $dest/serial
+    cp IOSerialFamily-64.1.1/IOSerialFamily.kmodproj/ioss.h         $dest/serial
+
+    # storage: complete
+    # Needs ata subdirectory
+    cp IOStorageFamily-172/IOAppleLabelScheme.h                                        $dest/storage
+    cp IOStorageFamily-172/IOApplePartitionScheme.h                                    $dest/storage
+    cp IOBDStorageFamily-14/IOBDBlockStorageDevice.h                                   $dest/storage
+    cp IOBDStorageFamily-14/IOBDMedia.h                                                $dest/storage
+    cp IOBDStorageFamily-14/IOBDMediaBSDClient.h                                       $dest/storage
+    cp IOBDStorageFamily-14/IOBDTypes.h                                                $dest/storage
+    cp IOStorageFamily-172/IOBlockStorageDevice.h                                      $dest/storage
+    cp IOStorageFamily-172/IOBlockStorageDriver.h                                      $dest/storage
+    cp IOCDStorageFamily-51/IOCDBlockStorageDevice.h                                   $dest/storage
+    cp IOCDStorageFamily-51/IOCDMedia.h                                                $dest/storage
+    cp IOCDStorageFamily-51/IOCDMediaBSDClient.h                                       $dest/storage
+    cp IOCDStorageFamily-51/IOCDPartitionScheme.h                                      $dest/storage
+    cp IOCDStorageFamily-51/IOCDTypes.h                                                $dest/storage
+    cp IODVDStorageFamily-35/IODVDBlockStorageDevice.h                                 $dest/storage
+    cp IODVDStorageFamily-35/IODVDMedia.h                                              $dest/storage
+    cp IODVDStorageFamily-35/IODVDMediaBSDClient.h                                     $dest/storage
+    cp IODVDStorageFamily-35/IODVDTypes.h                                              $dest/storage
+    cp IOStorageFamily-172/IOFDiskPartitionScheme.h                                    $dest/storage
+    cp IOStorageFamily-172/IOFilterScheme.h                                            $dest/storage
+    cp IOFireWireSerialBusProtocolTransport-251.0.1/IOFireWireStorageCharacteristics.h $dest/storage
+    cp IOStorageFamily-172/IOGUIDPartitionScheme.h                                     $dest/storage
+    cp IOStorageFamily-172/IOMedia.h                                                   $dest/storage
+    cp IOStorageFamily-172/IOMediaBSDClient.h                                          $dest/storage
+    cp IOStorageFamily-172/IOPartitionScheme.h                                         $dest/storage
+    cp IOStorageFamily-172/IOStorage.h                                                 $dest/storage
+    cp IOStorageFamily-172/IOStorageCardCharacteristics.h                              $dest/storage
+    cp IOStorageFamily-172/IOStorageDeviceCharacteristics.h                            $dest/storage
+    cp IOStorageFamily-172/IOStorageProtocolCharacteristics.h                          $dest/storage
+
+    # stream: missing altogether
+
+    # usb: complete
+    cp IOUSBFamily-630.4.5/IOUSBFamily/Headers/IOUSBLib.h            $dest/usb
+    cp IOUSBFamily-630.4.5/IOUSBUserClient/Headers/IOUSBUserClient.h $dest/usb
+    cp IOUSBFamily-560.4.2/IOUSBFamily/Headers/USB.h                 $dest/usb # This file is empty in 630.4.5!
+    cp IOUSBFamily-630.4.5/IOUSBFamily/Headers/USBSpec.h             $dest/usb
+
+    # video: missing altogether
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ joelteon copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix b/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix
new file mode 100644
index 00000000000..b5e7e512393
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libc/825_40_1.nix
@@ -0,0 +1,15 @@
+{ stdenv, appleDerivation, ed, unifdef }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  buildInputs = [ ed unifdef ];
+
+  installPhase = ''
+    export SRCROOT=$PWD
+    export DSTROOT=$out
+    export PUBLIC_HEADERS_FOLDER_PATH=include
+    export PRIVATE_HEADERS_FOLDER_PATH=include
+    bash xcodescripts/headers.sh
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
new file mode 100644
index 00000000000..16cfa9e554b
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libc/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, appleDerivation, ed, unifdef, Libc_old }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  buildInputs = [ ed unifdef ];
+
+  # TODO: asl.h actually comes from syslog project now
+  installPhase = ''
+    export SRCROOT=$PWD
+    export DSTROOT=$out
+    export PUBLIC_HEADERS_FOLDER_PATH=include
+    export PRIVATE_HEADERS_FOLDER_PATH=include
+    bash xcodescripts/headers.sh
+
+    # Ugh Apple stopped releasing this stuff so we need an older one...
+    cp    ${Libc_old}/include/spawn.h    $out/include
+    cp    ${Libc_old}/include/setjmp.h   $out/include
+    cp    ${Libc_old}/include/ucontext.h $out/include
+    cp    ${Libc_old}/include/pthread*.h $out/include
+    cp    ${Libc_old}/include/sched.h    $out/include
+    cp -R ${Libc_old}/include/malloc     $out/include
+
+    mkdir -p $out/include/libkern
+    cp ${Libc_old}/include/asl.h                    $out/include
+    cp ${Libc_old}/include/libproc.h                $out/include
+    cp ${Libc_old}/include/libkern/OSAtomic.h       $out/include/libkern
+    cp ${Libc_old}/include/libkern/OSCacheControl.h $out/include/libkern
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix
new file mode 100644
index 00000000000..2756857ba67
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libinfo/default.nix
@@ -0,0 +1,16 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    substituteInPlace xcodescripts/install_files.sh \
+      --replace "/usr/local/" "/" \
+      --replace "/usr/" "/" \
+      --replace '-o "$INSTALL_OWNER" -g "$INSTALL_GROUP"' "" \
+      --replace "ln -h" "ln -n"
+
+    export DSTROOT=$out
+    sh xcodescripts/install_files.sh
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
new file mode 100644
index 00000000000..b409a7347ef
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libm/default.nix
@@ -0,0 +1,13 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include
+
+    cp Source/Intel/math.h $out/include
+    cp Source/Intel/fenv.h $out/include
+    cp Source/complex.h    $out/include
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix
new file mode 100644
index 00000000000..810c8e8315a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libnotify/default.nix
@@ -0,0 +1,11 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp notify.h      $out/include
+    cp notify_keys.h $out/include
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
new file mode 100644
index 00000000000..ecab0941332
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -0,0 +1,147 @@
+{ stdenv, appleDerivation, cpio, bootstrap_cmds, xnu, Libc, Libm, libdispatch, cctools, Libinfo,
+  dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto, copyfile,
+  removefile, libresolv, Libnotify, libpthread, mDNSResponder, launchd, version }:
+
+appleDerivation rec {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  buildInputs = [ cpio libpthread ];
+
+  systemlibs = [ "cache"
+                 "commonCrypto"
+                 "compiler_rt"
+                 "copyfile"
+                 "corecrypto"
+                 "dispatch"
+                 "dyld"
+                 "keymgr"
+                 "kxld"
+                 "launch"
+                 "macho"
+                 "quarantine"
+                 "removefile"
+                 "system_asl"
+                 "system_blocks"
+                 # "system_c" # special re-export here to hide newer functions
+                 "system_configuration"
+                 "system_dnssd"
+                 "system_info"
+                 # "system_kernel" # special re-export here to hide newer functions
+                 "system_m"
+                 "system_malloc"
+                 "system_network"
+                 "system_notify"
+                 "system_platform"
+                 "system_pthread"
+                 "system_sandbox"
+                 "system_stats"
+                 "unc"
+                 "unwind"
+                 "xpc"
+               ];
+
+  installPhase = ''
+    export NIX_ENFORCE_PURITY=
+
+    mkdir -p $out/lib $out/include
+
+    # Set up our include directories
+    (cd ${xnu}/include && find . -name '*.h' -or -name '*.defs' | cpio -pdm $out/include)
+    cp ${xnu}/Library/Frameworks/Kernel.framework/Versions/A/Headers/Availability*.h $out/include
+    cp ${xnu}/Library/Frameworks/Kernel.framework/Versions/A/Headers/stdarg.h        $out/include
+
+    for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} ${libclosure} ${CarbonHeaders} \
+               ${libdispatch} ${ncurses} ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
+               ${Libnotify} ${mDNSResponder} ${launchd}; do
+      (cd $dep/include && find . -name '*.h' | cpio -pdm $out/include)
+    done
+
+    (cd ${cctools}/include/mach-o && find . -name '*.h' | cpio -pdm $out/include/mach-o)
+
+    cat <<EOF > $out/include/TargetConditionals.h
+    #ifndef __TARGETCONDITIONALS__
+    #define __TARGETCONDITIONALS__
+    #define TARGET_OS_MAC           1
+    #define TARGET_OS_WIN32         0
+    #define TARGET_OS_UNIX          0
+    #define TARGET_OS_EMBEDDED      0
+    #define TARGET_OS_IPHONE        0
+    #define TARGET_IPHONE_SIMULATOR 0
+    #define TARGET_OS_LINUX         0
+
+    #define TARGET_CPU_PPC          0
+    #define TARGET_CPU_PPC64        0
+    #define TARGET_CPU_68K          0
+    #define TARGET_CPU_X86          0
+    #define TARGET_CPU_X86_64       1
+    #define TARGET_CPU_ARM          0
+    #define TARGET_CPU_MIPS         0
+    #define TARGET_CPU_SPARC        0
+    #define TARGET_CPU_ALPHA        0
+    #define TARGET_RT_MAC_CFM       0
+    #define TARGET_RT_MAC_MACHO     1
+    #define TARGET_RT_LITTLE_ENDIAN 1
+    #define TARGET_RT_BIG_ENDIAN    0
+    #define TARGET_RT_64_BIT        1
+    #endif  /* __TARGETCONDITIONALS__ */
+    EOF
+
+    # The startup object files
+    cp ${Csu}/lib/* $out/lib
+
+    # selectively re-export functions from libsystem_c and libsystem_kernel
+    # to provide a consistent interface across OSX verions
+    mkdir -p $out/lib/system
+    ld -macosx_version_min 10.7 -arch x86_64 -dylib \
+       -o $out/lib/system/libsystem_c.dylib \
+       /usr/lib/libSystem.dylib \
+       -reexported_symbols_list ${./system_c_symbols}
+
+    ld -macosx_version_min 10.7 -arch x86_64 -dylib \
+       -o $out/lib/system/libsystem_kernel.dylib \
+       /usr/lib/libSystem.dylib \
+       -reexported_symbols_list ${./system_kernel_symbols}
+
+    # Set up the actual library link
+    clang -c -o CompatibilityHacks.o -Os CompatibilityHacks.c
+    clang -c -o init.o -Os init.c
+    ld -macosx_version_min 10.7 \
+       -arch x86_64 \
+       -dylib \
+       -o $out/lib/libSystem.dylib \
+       CompatibilityHacks.o init.o \
+       -compatibility_version 1.0 \
+       -current_version ${version} \
+       -reexport_library $out/lib/system/libsystem_c.dylib \
+       -reexport_library $out/lib/system/libsystem_kernel.dylib \
+        ${stdenv.lib.concatStringsSep " "
+          (map (l: "-reexport_library /usr/lib/system/lib${l}.dylib") systemlibs)}
+
+    # Set up links to pretend we work like a conventional unix (Apple's design, not mine!)
+    for name in c dbm dl info m mx poll proc pthread rpcsvc gcc_s.10.4 gcc_s.10.5; do
+      ln -s libSystem.dylib $out/lib/lib$name.dylib
+    done
+
+    # This probably doesn't belong here, but we want to stay similar to glibc, which includes resolv internally...
+    cp ${libresolv}/lib/libresolv.9.dylib $out/lib/libresolv.9.dylib
+    resolv_libSystem=$(otool -L "$out/lib/libresolv.9.dylib" | tail -n +3 | grep -o "$NIX_STORE.*-\S*") || true
+    echo $libs
+
+    chmod +w $out/lib/libresolv.9.dylib
+    install_name_tool \
+      -id $out/lib/libresolv.9.dylib \
+      -change "$resolv_libSystem" $out/lib/libSystem.dylib \
+      -delete_rpath ${libresolv}/lib \
+      $out/lib/libresolv.9.dylib
+    ln -s libresolv.9.dylib $out/lib/libresolv.dylib
+
+    otool -L $out/lib/libresolv.dylib
+  '';
+
+  meta = with stdenv.lib; {
+    description = "The Mac OS libc/libSystem (impure symlinks to binaries with pure headers)";
+    maintainers = with maintainers; [ copumpkin gridaphobe ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
new file mode 100644
index 00000000000..0c814899c3c
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_c_symbols
@@ -0,0 +1,1530 @@
+_NSGetNextSearchPathEnumeration
+_NSStartSearchPathEnumeration
+_OSAtomicAdd32
+_OSAtomicAdd32Barrier
+_OSAtomicAnd32
+_OSAtomicDequeue
+_OSAtomicEnqueue
+_OSSpinLockLock
+_OSSpinLockUnlock
+__Block_copy
+__Block_release
+__CurrentRuneLocale
+__DefaultRuneLocale
+__Exit
+__NSGetArgc
+__NSGetArgv
+__NSGetEnviron
+__NSGetMachExecuteHeader
+__NSGetProgname
+__PathLocale
+__Read_RuneMagi
+___Balloc_D2A
+___Bfree_D2A
+___ULtod_D2A
+____mb_cur_max
+____mb_cur_max_l
+____runetype
+____runetype_l
+____tolower
+____tolower_l
+____toupper
+____toupper_l
+___add_ovflpage
+___addel
+___any_on_D2A
+___assert_rtn
+___b2d_D2A
+___big_delete
+___big_insert
+___big_keydata
+___big_return
+___big_split
+___bigtens_D2A
+___bt_close
+___bt_cmp
+___bt_defcmp
+___bt_defpfx
+___bt_delete
+___bt_dleaf
+___bt_fd
+___bt_free
+___bt_get
+___bt_new
+___bt_open
+___bt_pgin
+___bt_pgout
+___bt_put
+___bt_ret
+___bt_search
+___bt_seq
+___bt_setcur
+___bt_split
+___bt_sync
+___buf_free
+___bzero
+___cVersionNumber
+___cVersionString
+___call_hash
+___chmod_extended
+___cleanup
+___cmp_D2A
+___collate_equiv_match
+___collate_load_error
+___collate_lookup
+___commpage_gettimeofday
+___copybits_D2A
+___cxa_atexit
+___cxa_finalize
+___cxa_thread_atexit
+___d2b_D2A
+___dbpanic
+___decrement_D2A
+___default_hash
+___default_utx
+___delpair
+___diff_D2A
+___dtoa
+___error
+___exit
+___expand_table
+___fchmod_extended
+___fcntl
+___fcntl_nocancel
+___fflush
+___fgetwc
+___find_bigpair
+___find_last_page
+___fix_locale_grouping_str
+___fork
+___fpclassifyd
+___fpclassifyl
+___fread
+___free_ovflpage
+___freedtoa
+___fstat64_extended
+___fstat_extended
+___gdtoa
+___gdtoa_locks
+___get_buf
+___get_page
+___getdirentries64
+___gethex_D2A
+___getlogin
+___getonlyClocaleconv
+___gettimeofday
+___hash_open
+___hdtoa
+___hexdig_D2A
+___hexdig_init_D2A
+___hexnan_D2A
+___hi0bits_D2A
+___hldtoa
+___i2b_D2A
+___ibitmap
+___increment_D2A
+___isctype
+___istype
+___istype_l
+___kill
+___ldtoa
+___libc_init
+___lo0bits_D2A
+___log2
+___lshift_D2A
+___lstat64_extended
+___lstat_extended
+___maskrune
+___maskrune_l
+___match_D2A
+___mb_cur_max
+___mb_sb_limit
+___memccpy_chk
+___memcpy_chk
+___memmove_chk
+___memset_chk
+___mkdir_extended
+___mkfifo_extended
+___mult_D2A
+___multadd_D2A
+___nrv_alloc_D2A
+___open
+___open_extended
+___open_nocancel
+___opendir2
+___opendir2$INODE64
+___ovfl_delete
+___ovfl_get
+___ovfl_put
+___pow5mult_D2A
+___pthread_sigmask
+___pthread_workqueue_setkill
+___put_page
+___quorem_D2A
+___ratio_D2A
+___rec_close
+___rec_delete
+___rec_dleaf
+___rec_fd
+___rec_fmap
+___rec_fpipe
+___rec_get
+___rec_iput
+___rec_open
+___rec_put
+___rec_ret
+___rec_search
+___rec_seq
+___rec_sync
+___rec_vmap
+___rec_vpipe
+___reclaim_buf
+___recvfrom
+___recvfrom_nocancel
+___rshift_D2A
+___rv_alloc_D2A
+___s2b_D2A
+___sF
+___sclose
+___sdidinit
+___semwait_signal
+___semwait_signal_nocancel
+___sendto
+___sendto_nocancel
+___set_ones_D2A
+___setlogin
+___setonlyClocaleconv
+___settimeofday
+___sflags
+___sflush
+___sfp
+___sfvwrite
+___sglue
+___sigaction
+___sigaltstack
+___sinit
+___slbexpand
+___smakebuf
+___snprintf_chk
+___split_page
+___sprintf_chk
+___sread
+___srefill
+___srget
+___sseek
+___stack_chk_fail
+___stack_chk_guard
+___stat64_extended
+___stat_extended
+___stderrp
+___stdinp
+___stdoutp
+___stpcpy_chk
+___stpncpy_chk
+___strcat_chk
+___strcp_D2A
+___strcpy_chk
+___strlcat_chk
+___strlcpy_chk
+___strncat_chk
+___strncpy_chk
+___strtodg
+___strtopdd
+___strtopx
+___sum_D2A
+___svfscanf
+___swbuf
+___swhatbuf
+___swrite
+___swsetup
+___sysctl
+___tens_D2A
+___tinytens_D2A
+___tolower
+___tolower_l
+___toupper
+___toupper_l
+___trailz_D2A
+___ulp_D2A
+___umask_extended
+___ungetc
+___ungetwc
+___unix_conforming
+___vsnprintf_chk
+___vsprintf_chk
+___wait4
+___wait4_nocancel
+___wcwidth
+___wcwidth_l
+__allocenvstate
+__c_locale
+__cleanup
+__closeutx
+__copyenv
+__cthread_init_routine
+__deallocenvstate
+__dyld_register_func_for_add_image
+__endutxent
+__exit
+__flockfile_debug_stub
+__fseeko
+__ftello
+__fwalk
+__get_cpu_capabilities
+__getenvp
+__getutxent
+__getutxid
+__getutxline
+__inet_aton_check
+__init_clock_port
+__int_to_time
+__libc_fork_child
+__long_to_time
+__mkpath_np
+__mktemp
+__openutx
+__os_alloc_once
+__os_alloc_once_table
+__os_assert_log
+__os_assert_log_ctx
+__os_assumes_log
+__os_assumes_log_ctx
+__os_avoid_tail_call
+__osx_assert_log
+__osx_assert_log_ctx
+__osx_assumes_log
+__osx_assumes_log_ctx
+__osx_avoid_tail_call
+__platform_bzero
+__platform_memccpy
+__platform_memchr
+__platform_memcmp
+__platform_memmove
+__platform_memset
+__platform_memset_pattern16
+__platform_memset_pattern4
+__platform_memset_pattern8
+__platform_strchr
+__platform_strcmp
+__platform_strncmp
+__putenvp
+__pututxline
+__rand48_add
+__rand48_mult
+__rand48_seed
+__readdir_unlocked
+__readdir_unlocked$INODE64
+__reclaim_telldir
+__seekdir
+__seekdir$INODE64
+__setenvp
+__setutxent
+__sigaction_nobind
+__sigintr
+__signal_nobind
+__sigtramp
+__sigvec_nobind
+__simple_asl_log
+__simple_asl_log_prog
+__simple_asl_msg_new
+__simple_asl_msg_set
+__simple_asl_send
+__simple_dprintf
+__simple_salloc
+__simple_sappend
+__simple_sfree
+__simple_sprintf
+__simple_string
+__simple_vsprintf
+__sread
+__sseek
+__swrite
+__time32_to_time
+__time64_to_time
+__time_to_int
+__time_to_long
+__time_to_time32
+__time_to_time64
+__tlv_atexit
+__tlv_exit
+__unsetenvp
+__utmpxname
+_a64l
+_abort
+_abs
+_access
+_acl_add_flag_np
+_acl_add_perm
+_acl_calc_mask
+_acl_clear_flags_np
+_acl_clear_perms
+_acl_copy_entry
+_acl_copy_ext
+_acl_copy_ext_native
+_acl_copy_int
+_acl_copy_int_native
+_acl_create_entry
+_acl_create_entry_np
+_acl_delete_def_file
+_acl_delete_entry
+_acl_delete_fd_np
+_acl_delete_file_np
+_acl_delete_flag_np
+_acl_delete_link_np
+_acl_delete_perm
+_acl_dup
+_acl_free
+_acl_from_text
+_acl_get_entry
+_acl_get_fd
+_acl_get_fd_np
+_acl_get_file
+_acl_get_flag_np
+_acl_get_flagset_np
+_acl_get_link_np
+_acl_get_perm_np
+_acl_get_permset
+_acl_get_permset_mask_np
+_acl_get_qualifier
+_acl_get_tag_type
+_acl_init
+_acl_maximal_permset_mask_np
+_acl_set_fd
+_acl_set_fd_np
+_acl_set_file
+_acl_set_flagset_np
+_acl_set_link_np
+_acl_set_permset
+_acl_set_permset_mask_np
+_acl_set_qualifier
+_acl_set_tag_type
+_acl_size
+_acl_to_text
+_acl_valid
+_acl_valid_fd_np
+_acl_valid_file_np
+_acl_valid_link
+_addr2ascii
+_alarm
+_alphasort
+_alphasort$INODE64
+_arc4random
+_arc4random_addrandom
+_arc4random_buf
+_arc4random_stir
+_arc4random_uniform
+_ascii2addr
+_asctime
+_asctime_r
+_asl_get
+_asl_new
+_asl_open
+_asl_send
+_asl_set
+_asl_set_query
+_asprintf
+_asprintf_l
+_asxprintf
+_asxprintf_exec
+_atexit
+_atexit_b
+_atof
+_atof_l
+_atoi
+_atoi_l
+_atol
+_atol_l
+_atoll
+_atoll_l
+_backtrace
+_backtrace_symbols
+_backtrace_symbols_fd
+_basename
+_bcmp
+_bcopy
+_bootstrap_parent
+_bootstrap_port
+_brk
+_bsd_signal
+_bsearch
+_bsearch_b
+_btowc
+_btowc_l
+_bzero
+_calloc
+_catclose
+_catgets
+_catopen
+_cfgetispeed
+_cfgetospeed
+_cfmakeraw
+_cfsetispeed
+_cfsetospeed
+_cfsetspeed
+_cgetcap
+_cgetclose
+_cgetent
+_cgetfirst
+_cgetmatch
+_cgetnext
+_cgetnum
+_cgetset
+_cgetstr
+_cgetustr
+_chdir
+_chflags
+_chmod
+_chmodx_np
+_clearerr
+_clearerr_unlocked
+_clock
+_clock_get_time
+_clock_port
+_clock_sem
+_close$NOCANCEL
+_closedir
+_compat_mode
+_confstr
+_copy_printf_domain
+_creat
+_creat$NOCANCEL
+_crypt
+_ctermid
+_ctermid_r
+_ctime
+_ctime_r
+_daemon
+_daemon$1050
+_daylight
+_dbm_clearerr
+_dbm_close
+_dbm_delete
+_dbm_dirfno
+_dbm_error
+_dbm_fetch
+_dbm_firstkey
+_dbm_nextkey
+_dbm_open
+_dbm_store
+_dbopen
+_devname
+_devname_r
+_difftime
+_digittoint
+_digittoint_l
+_dirfd
+_dirname
+_dispatch_get_global_queue
+_div
+_dladdr
+_dlsym
+_dprintf
+_dprintf_l
+_drand48
+_dup2
+_duplocale
+_dxprintf
+_dxprintf_exec
+_dyld_get_program_sdk_version
+_dyld_get_sdk_version
+_ecvt
+_encrypt
+_endttyent
+_endusershell
+_endutxent
+_endutxent_wtmp
+_erand48
+_err
+_err_set_exit
+_err_set_exit_b
+_err_set_file
+_errc
+_errx
+_execl
+_execle
+_execlp
+_execv
+_execvP
+_execve
+_execvp
+_exit
+_f_prealloc
+_fchdir
+_fchmodx_np
+_fclose
+_fcntl$NOCANCEL
+_fcvt
+_fdopen
+_fdopen$DARWIN_EXTSN
+_fegetenv
+_feof
+_feof_unlocked
+_ferror
+_ferror_unlocked
+_fesetenv
+_fflagstostr
+_fflush
+_ffsctl
+_fgetc
+_fgetln
+_fgetpos
+_fgetrune
+_fgets
+_fgetwc
+_fgetwc_l
+_fgetwln
+_fgetwln_l
+_fgetws
+_fgetws_l
+_fileno
+_fileno_unlocked
+_filesec_dup
+_filesec_free
+_filesec_get_property
+_filesec_init
+_filesec_query_property
+_filesec_set_property
+_filesec_unset_property
+_flockfile
+_flsl
+_fmtcheck
+_fmtmsg
+_fnmatch
+_fopen
+_fopen$DARWIN_EXTSN
+_fork
+_forkpty
+_fparseln
+_fprintf
+_fprintf_l
+_fpurge
+_fputc
+_fputrune
+_fputs
+_fputwc
+_fputwc_l
+_fputws
+_fputws_l
+_fread
+_free
+_free_printf_comp
+_free_printf_domain
+_freeifaddrs
+_freelocale
+_freopen
+_fscanf
+_fscanf_l
+_fsctl
+_fseek
+_fseeko
+_fsetpos
+_fstat
+_fstat$INODE64
+_fstatfs
+_fstatfs$INODE64
+_fstatvfs
+_fstatx64_np
+_fstatx_np
+_fstatx_np$INODE64
+_fsync$NOCANCEL
+_fsync_volume_np
+_ftell
+_ftello
+_ftime
+_ftok
+_ftruncate
+_ftrylockfile
+_fts_children
+_fts_children$INODE64
+_fts_close
+_fts_close$INODE64
+_fts_open
+_fts_open$INODE64
+_fts_open_b
+_fts_open_b$INODE64
+_fts_read
+_fts_read$INODE64
+_fts_set
+_fts_set$INODE64
+_ftw
+_ftw$INODE64
+_fungetrune
+_funlockfile
+_funopen
+_fwide
+_fwprintf
+_fwprintf_l
+_fwrite
+_fwscanf
+_fwscanf_l
+_fxprintf
+_fxprintf_exec
+_gcvt
+_getattrlist
+_getbsize
+_getc
+_getc_unlocked
+_getchar
+_getchar_unlocked
+_getcwd
+_getdate
+_getdate_err
+_getdelim
+_getdirentries
+_getdiskbyname
+_getdtablesize
+_getenv
+_geteuid
+_getfsstat
+_getfsstat$INODE64
+_getfsstat64
+_getgrgid
+_getgrnam
+_getgroupcount
+_getgrouplist
+_getgroups$DARWIN_EXTSN
+_gethostid
+_gethostname
+_getifaddrs
+_getipv4sourcefilter
+_getlastlogx
+_getlastlogxbyname
+_getline
+_getloadavg
+_getlogin
+_getlogin_r
+_getmntinfo
+_getmntinfo$INODE64
+_getmntinfo64
+_getmode
+_getopt
+_getopt_long
+_getopt_long_only
+_getpagesize
+_getpass
+_getpeereid
+_getpgrp
+_getpid
+_getpriority
+_getprogname
+_getpwnam
+_getpwuid
+_getpwuid_r
+_getrlimit
+_getrusage
+_gets
+_getsectiondata
+_getsockopt
+_getsourcefilter
+_getsubopt
+_gettimeofday
+_getttyent
+_getttynam
+_getuid
+_getusershell
+_getutmp
+_getutmpx
+_getutxent
+_getutxent_wtmp
+_getutxid
+_getutxline
+_getvfsbyname
+_getw
+_getwc
+_getwc_l
+_getwchar
+_getwchar_l
+_getwd
+_glob
+_glob$INODE64
+_glob_b
+_glob_b$INODE64
+_globfree
+_gmtime
+_gmtime_r
+_grantpt
+_hash_create
+_hash_destroy
+_hash_purge
+_hash_search
+_hash_stats
+_hash_traverse
+_hcreate
+_hdestroy
+_heapsort
+_heapsort_b
+_host_get_clock_service
+_hsearch
+_if_nametoindex
+_imaxabs
+_imaxdiv
+_index
+_inet_addr
+_inet_aton
+_inet_lnaof
+_inet_makeaddr
+_inet_net_ntop
+_inet_net_pton
+_inet_neta
+_inet_netof
+_inet_network
+_inet_nsap_addr
+_inet_nsap_ntoa
+_inet_ntoa
+_inet_ntop
+_inet_ntop4
+_inet_ntop6
+_inet_pton
+_initstate
+_insque
+_ioctl
+_isalnum
+_isalnum_l
+_isalpha
+_isalpha_l
+_isascii
+_isatty
+_isblank
+_isblank_l
+_iscntrl
+_iscntrl_l
+_isdigit
+_isdigit_l
+_isgraph
+_isgraph_l
+_ishexnumber
+_ishexnumber_l
+_isideogram
+_isideogram_l
+_islower
+_islower_l
+_isnumber
+_isnumber_l
+_isphonogram
+_isphonogram_l
+_isprint
+_isprint_l
+_ispunct
+_ispunct_l
+_isrune
+_isrune_l
+_issetugid
+_isspace
+_isspace_l
+_isspecial
+_isspecial_l
+_isupper
+_isupper_l
+_iswalnum
+_iswalnum_l
+_iswalpha
+_iswalpha_l
+_iswascii
+_iswblank
+_iswblank_l
+_iswcntrl
+_iswcntrl_l
+_iswctype
+_iswctype_l
+_iswdigit
+_iswdigit_l
+_iswgraph
+_iswgraph_l
+_iswhexnumber
+_iswhexnumber_l
+_iswideogram
+_iswideogram_l
+_iswlower
+_iswlower_l
+_iswnumber
+_iswnumber_l
+_iswphonogram
+_iswphonogram_l
+_iswprint
+_iswprint_l
+_iswpunct
+_iswpunct_l
+_iswrune
+_iswrune_l
+_iswspace
+_iswspace_l
+_iswspecial
+_iswspecial_l
+_iswupper
+_iswupper_l
+_iswxdigit
+_iswxdigit_l
+_isxdigit
+_isxdigit_l
+_jrand48
+_kill
+_killpg
+_l64a
+_labs
+_lchflags
+_lchmod
+_lcong48
+_ldiv
+_lfind
+_link_addr
+_link_ntoa
+_llabs
+_lldiv
+_localeconv
+_localeconv_l
+_localtime
+_localtime_r
+_lockf
+_lockf$NOCANCEL
+_login
+_login_tty
+_logout
+_logwtmp
+_lrand48
+_lsearch
+_lseek
+_lstat
+_lstat$INODE64
+_lstatx64_np
+_lstatx_np
+_lstatx_np$INODE64
+_lutimes
+_mach_absolute_time
+_mach_error_string
+_mach_host_self
+_mach_port_deallocate
+_mach_task_self_
+_mach_timebase_info
+_malloc
+_mblen
+_mblen_l
+_mbmb
+_mbr_gid_to_uuid
+_mbr_uid_to_uuid
+_mbr_uuid_to_id
+_mbrlen
+_mbrlen_l
+_mbrrune
+_mbrtowc
+_mbrtowc_l
+_mbrune
+_mbsinit
+_mbsinit_l
+_mbsnrtowcs
+_mbsnrtowcs_l
+_mbsrtowcs
+_mbsrtowcs_l
+_mbstowcs
+_mbstowcs_l
+_mbtowc
+_mbtowc_l
+_memccpy
+_memchr
+_memcmp
+_memcpy
+_memmem
+_memmove
+_memset
+_memset_pattern16
+_memset_pattern4
+_memset_pattern8
+_memset_s
+_mergesort
+_mergesort_b
+_mkdir
+_mkdirx_np
+_mkdtemp
+_mkfifox_np
+_mkpath_np
+_mkstemp
+_mkstemps
+_mktemp
+_mktime
+_mmap
+_monaddition
+_moncontrol
+_moncount
+_moninit
+_monitor
+_monoutput
+_monreset
+_monstartup
+_mpool_close
+_mpool_filter
+_mpool_get
+_mpool_new
+_mpool_open
+_mpool_put
+_mpool_sync
+_mrand48
+_munmap
+_nan
+_nanf
+_nanl
+_nanosleep
+_nanosleep$NOCANCEL
+_new_printf_comp
+_new_printf_domain
+_newlocale
+_nextwctype
+_nextwctype_l
+_nftw
+_nftw$INODE64
+_nice
+_nl_langinfo
+_nl_langinfo_l
+_notify_cancel
+_notify_check
+_notify_monitor_file
+_notify_post
+_notify_register_check
+_nrand48
+_off32
+_off64
+_offtime
+_open$NOCANCEL
+_opendev
+_opendir
+_opendir$INODE64
+_openpty
+_openx_np
+_optarg
+_opterr
+_optind
+_optopt
+_optreset
+_pathconf
+_pause
+_pause$NOCANCEL
+_pclose
+_perror
+_pipe
+_popen
+_popen$DARWIN_EXTSN
+_posix2time
+_posix_openpt
+_posix_spawn
+_posix_spawn_file_actions_addclose
+_posix_spawn_file_actions_adddup2
+_posix_spawn_file_actions_destroy
+_posix_spawn_file_actions_init
+_posix_spawnattr_destroy
+_posix_spawnattr_init
+_posix_spawnattr_setflags
+_posix_spawnattr_setsigdefault
+_posix_spawnattr_setsigmask
+_posix_spawnp
+_pread$NOCANCEL
+_printf
+_printf_l
+_proc_name
+_pselect
+_pselect$1050
+_pselect$DARWIN_EXTSN
+_pselect$DARWIN_EXTSN$NOCANCEL
+_pselect$NOCANCEL
+_psignal
+_psort
+_psort_b
+_psort_r
+_pthread_get_stackaddr_np
+_pthread_get_stacksize_np
+_pthread_getspecific
+_pthread_key_create
+_pthread_key_init_np
+_pthread_kill
+_pthread_mutex_destroy
+_pthread_mutex_init
+_pthread_mutex_lock
+_pthread_mutex_trylock
+_pthread_mutex_unlock
+_pthread_once
+_pthread_rwlock_destroy
+_pthread_rwlock_rdlock
+_pthread_rwlock_unlock
+_pthread_rwlock_wrlock
+_pthread_self
+_pthread_setspecific
+_pthread_sigmask
+_pthread_testcancel
+_ptsname
+_putc
+_putc_unlocked
+_putchar
+_putchar_unlocked
+_putenv
+_puts
+_pututxline
+_putw
+_putwc
+_putwc_l
+_putwchar
+_putwchar_l
+_pwrite$NOCANCEL
+_qsort
+_qsort_b
+_qsort_r
+_querylocale
+_radixsort
+_raise
+_rand
+_rand_r
+_random
+_rb_tree_count
+_rb_tree_find_node
+_rb_tree_find_node_geq
+_rb_tree_find_node_leq
+_rb_tree_init
+_rb_tree_insert_node
+_rb_tree_iterate
+_rb_tree_remove_node
+_read$NOCANCEL
+_readdir
+_readdir$INODE64
+_readdir_r
+_readdir_r$INODE64
+_readlink
+_readpassphrase
+_realloc
+_reallocf
+_realpath
+_realpath$DARWIN_EXTSN
+_recv
+_recv$NOCANCEL
+_regcomp
+_regcomp_l
+_regerror
+_regexec
+_regfree
+_register_printf_domain_function
+_register_printf_domain_render_std
+_regncomp
+_regncomp_l
+_regnexec
+_regwcomp
+_regwcomp_l
+_regwexec
+_regwncomp
+_regwncomp_l
+_regwnexec
+_remove
+_remque
+_rewind
+_rewinddir
+_rewinddir$INODE64
+_rindex
+_rmdir
+_sbrk
+_scandir
+_scandir$INODE64
+_scandir_b
+_scandir_b$INODE64
+_scanf
+_scanf_l
+_seed48
+_seekdir
+_seekdir$INODE64
+_select
+_select$1050
+_select$DARWIN_EXTSN
+_select$DARWIN_EXTSN$NOCANCEL
+_select$NOCANCEL
+_semaphore_create
+_send
+_send$NOCANCEL
+_setattrlist
+_setbuf
+_setbuffer
+_setenv
+_sethostid
+_sethostname
+_setinvalidrune
+_setipv4sourcefilter
+_setitimer
+_setkey
+_setlinebuf
+_setlocale
+_setlogin
+_setmode
+_setpgid
+_setpgrp
+_setpriority
+_setprogname
+_setregid
+_setreuid
+_setrgid
+_setrlimit
+_setruid
+_setrunelocale
+_setsid
+_setsockopt
+_setsourcefilter
+_setstate
+_settimeofday
+_setttyent
+_setusershell
+_setutxent
+_setutxent_wtmp
+_setvbuf
+_sigaction
+_sigaddset
+_sigaltstack
+_sigblock
+_sigdelset
+_sigemptyset
+_sigfillset
+_sighold
+_sigignore
+_siginterrupt
+_sigismember
+_signal
+_sigpause
+_sigpause$NOCANCEL
+_sigprocmask
+_sigrelse
+_sigset
+_sigsetmask
+_sigsuspend
+_sigsuspend$NOCANCEL
+_sigvec
+_skip
+_sl_add
+_sl_find
+_sl_free
+_sl_init
+_sleep
+_sleep$NOCANCEL
+_snprintf
+_snprintf_l
+_sockatmark
+_socket
+_socketpair
+_spin_lock
+_spin_unlock
+_sprintf
+_sprintf_l
+_sradixsort
+_srand
+_srand48
+_sranddev
+_srandom
+_srandomdev
+_sscanf
+_sscanf_l
+_stat
+_stat$INODE64
+_statfs$INODE64
+_statvfs
+_statx64_np
+_statx_np
+_statx_np$INODE64
+_stpcpy
+_stpncpy
+_strcasecmp
+_strcasecmp_l
+_strcasestr
+_strcasestr_l
+_strcat
+_strchr
+_strcmp
+_strcoll
+_strcoll_l
+_strcpy
+_strcspn
+_strdup
+_strerror
+_strerror_r
+_strfmon
+_strfmon_l
+_strftime
+_strftime_l
+_strlcat
+_strlcpy
+_strlen
+_strmode
+_strncasecmp
+_strncasecmp_l
+_strncat
+_strncmp
+_strncpy
+_strndup
+_strnlen
+_strnstr
+_strpbrk
+_strptime
+_strptime_l
+_strrchr
+_strsep
+_strsignal
+_strspn
+_strstr
+_strtod
+_strtod_l
+_strtof
+_strtof_l
+_strtofflags
+_strtoimax
+_strtoimax_l
+_strtok
+_strtok_r
+_strtol
+_strtol_l
+_strtold
+_strtold_l
+_strtoll
+_strtoll_l
+_strtoq
+_strtoq_l
+_strtoul
+_strtoul_l
+_strtoull
+_strtoull_l
+_strtoumax
+_strtoumax_l
+_strtouq
+_strtouq_l
+_strunvis
+_strunvisx
+_strvis
+_strvisx
+_strxfrm
+_strxfrm_l
+_suboptarg
+_swab
+_swprintf
+_swprintf_l
+_swscanf
+_swscanf_l
+_sxprintf
+_sxprintf_exec
+_sync_volume_np
+_sys_errlist
+_sys_nerr
+_sys_siglist
+_sys_signame
+_sysconf
+_sysctl
+_sysctlbyname
+_sysctlnametomib
+_syslog
+_system
+_system$NOCANCEL
+_task_set_special_port
+_tcdrain
+_tcdrain$NOCANCEL
+_tcflow
+_tcflush
+_tcgetattr
+_tcgetpgrp
+_tcgetsid
+_tcsendbreak
+_tcsetattr
+_tcsetpgrp
+_tdelete
+_telldir
+_telldir$INODE64
+_tempnam
+_tfind
+_thread_stack_pcs
+_time
+_time2posix
+_timegm
+_timelocal
+_timeoff
+_times
+_timezone
+_tmpfile
+_tmpnam
+_toascii
+_tolower
+_tolower_l
+_toupper
+_toupper_l
+_towctrans
+_towctrans_l
+_towlower
+_towlower_l
+_towupper
+_towupper_l
+_tsearch
+_ttyname
+_ttyname_r
+_ttyslot
+_twalk
+_tzname
+_tzset
+_tzsetwall
+_ualarm
+_ulimit
+_umask
+_umaskx_np
+_uname
+_ungetc
+_ungetwc
+_ungetwc_l
+_unlink
+_unlockpt
+_unsetenv
+_unvis
+_uselocale
+_usleep
+_usleep$NOCANCEL
+_utime
+_utimes
+_utmpxname
+_uuid_clear
+_uuid_compare
+_uuid_copy
+_uuid_generate
+_uuid_generate_random
+_uuid_generate_time
+_uuid_is_null
+_uuid_pack
+_uuid_parse
+_uuid_unpack
+_uuid_unparse
+_uuid_unparse_lower
+_uuid_unparse_upper
+_vasprintf
+_vasprintf_l
+_vasxprintf
+_vasxprintf_exec
+_vdprintf
+_vdprintf_l
+_vdxprintf
+_vdxprintf_exec
+_verr
+_verrc
+_verrx
+_vfprintf
+_vfprintf_l
+_vfscanf
+_vfscanf_l
+_vfwprintf
+_vfwprintf_l
+_vfwscanf
+_vfwscanf_l
+_vfxprintf
+_vfxprintf_exec
+_vis
+_vm_allocate
+_vprintf
+_vprintf_l
+_vscanf
+_vscanf_l
+_vsnprintf
+_vsnprintf_l
+_vsprintf
+_vsprintf_l
+_vsscanf
+_vsscanf_l
+_vswprintf
+_vswprintf_l
+_vswscanf
+_vswscanf_l
+_vsxprintf
+_vsxprintf_exec
+_vwarn
+_vwarnc
+_vwarnx
+_vwprintf
+_vwprintf_l
+_vwscanf
+_vwscanf_l
+_vxprintf
+_vxprintf_exec
+_wait
+_wait$NOCANCEL
+_wait3
+_wait4
+_waitpid
+_waitpid$NOCANCEL
+_warn
+_warnc
+_warnx
+_wcpcpy
+_wcpncpy
+_wcrtomb
+_wcrtomb_l
+_wcscasecmp
+_wcscasecmp_l
+_wcscat
+_wcschr
+_wcscmp
+_wcscoll
+_wcscoll_l
+_wcscpy
+_wcscspn
+_wcsdup
+_wcsftime
+_wcsftime_l
+_wcslcat
+_wcslcpy
+_wcslen
+_wcsncasecmp
+_wcsncasecmp_l
+_wcsncat
+_wcsncmp
+_wcsncpy
+_wcsnlen
+_wcsnrtombs
+_wcsnrtombs_l
+_wcspbrk
+_wcsrchr
+_wcsrtombs
+_wcsrtombs_l
+_wcsspn
+_wcsstr
+_wcstod
+_wcstod_l
+_wcstof
+_wcstof_l
+_wcstoimax
+_wcstoimax_l
+_wcstok
+_wcstol
+_wcstol_l
+_wcstold
+_wcstold_l
+_wcstoll
+_wcstoll_l
+_wcstombs
+_wcstombs_l
+_wcstoul
+_wcstoul_l
+_wcstoull
+_wcstoull_l
+_wcstoumax
+_wcstoumax_l
+_wcswidth
+_wcswidth_l
+_wcsxfrm
+_wcsxfrm_l
+_wctob
+_wctob_l
+_wctomb
+_wctomb_l
+_wctrans
+_wctrans_l
+_wctype
+_wctype_l
+_wcwidth
+_wcwidth_l
+_wmemchr
+_wmemcmp
+_wmemcpy
+_wmemmove
+_wmemset
+_wordexp
+_wordfree
+_wprintf
+_wprintf_l
+_write$NOCANCEL
+_writev$NOCANCEL
+_wscanf
+_wscanf_l
+_wtmpxname
+_xprintf
+_xprintf_exec
+dyld_stub_binder
+mcount
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
new file mode 100644
index 00000000000..9d53dea7025
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/system_kernel_symbols
@@ -0,0 +1,929 @@
+_NDR_record
+_____old_semwait_signal_nocancel
+_____sigwait_nocancel
+____kernelVersionNumber
+____kernelVersionString
+___accept
+___accept_nocancel
+___access_extended
+___aio_suspend_nocancel
+___bind
+___bsdthread_create
+___bsdthread_register
+___bsdthread_terminate
+___carbon_delete
+___chmod
+___chmod_extended
+___chud
+___close_nocancel
+___commpage_gettimeofday
+___connect
+___connect_nocancel
+___copyfile
+___delete
+___disable_threadsignal
+___error
+___exit
+___fchmod
+___fchmod_extended
+___fcntl
+___fcntl_nocancel
+___fork
+___fsgetpath
+___fstat64_extended
+___fstat_extended
+___fsync_nocancel
+___get_remove_counter
+___getattrlist
+___getdirentries64
+___gethostuuid
+___getlcid
+___getlogin
+___getpeername
+___getpid
+___getrlimit
+___getsgroups
+___getsockname
+___gettid
+___gettimeofday
+___getwgroups
+___guarded_open_np
+___identitysvc
+___inc_remove_counter
+___initgroups
+___ioctl
+___iopolicysys
+___kdebug_trace
+___kernelVersionNumber
+___kernelVersionString
+___kill
+___lchown
+___libkernel_init
+___listen
+___lseek
+___lstat64_extended
+___lstat_extended
+___mac_execve
+___mac_get_fd
+___mac_get_file
+___mac_get_lcid
+___mac_get_lctx
+___mac_get_link
+___mac_get_mount
+___mac_get_pid
+___mac_get_proc
+___mac_getfsstat
+___mac_mount
+___mac_set_fd
+___mac_set_file
+___mac_set_lctx
+___mac_set_link
+___mac_set_proc
+___mac_syscall
+___mkdir_extended
+___mkfifo_extended
+___mmap
+___mprotect
+___msgctl
+___msgrcv_nocancel
+___msgsnd_nocancel
+___msgsys
+___msync
+___msync_nocancel
+___munmap
+___old_semwait_signal
+___open
+___open_dprotected_np
+___open_extended
+___open_nocancel
+___pipe
+___poll_nocancel
+___posix_spawn
+___pread_nocancel
+___proc_info
+___process_policy
+___psynch_cvbroad
+___psynch_cvclrprepost
+___psynch_cvsignal
+___psynch_cvwait
+___psynch_mutexdrop
+___psynch_mutexwait
+___psynch_rw_downgrade
+___psynch_rw_longrdlock
+___psynch_rw_rdlock
+___psynch_rw_unlock
+___psynch_rw_unlock2
+___psynch_rw_upgrade
+___psynch_rw_wrlock
+___psynch_rw_yieldwrlock
+___pthread_canceled
+___pthread_chdir
+___pthread_fchdir
+___pthread_kill
+___pthread_markcancel
+___pthread_sigmask
+___ptrace
+___pwrite_nocancel
+___read_nocancel
+___readv_nocancel
+___recvfrom
+___recvfrom_nocancel
+___recvmsg
+___recvmsg_nocancel
+___rename
+___rmdir
+___sandbox_me
+___sandbox_mm
+___sandbox_ms
+___sandbox_msp
+___select
+___select_nocancel
+___sem_open
+___sem_wait_nocancel
+___semctl
+___semsys
+___semwait_signal
+___semwait_signal_nocancel
+___sendmsg
+___sendmsg_nocancel
+___sendto
+___sendto_nocancel
+___setattrlist
+___setlcid
+___setlogin
+___setregid
+___setreuid
+___setrlimit
+___setsgroups
+___settid
+___settid_with_pid
+___settimeofday
+___setwgroups
+___shared_region_check_np
+___shared_region_map_and_slide_np
+___shm_open
+___shmctl
+___shmsys
+___sigaction
+___sigaltstack
+___sigreturn
+___sigsuspend
+___sigsuspend_nocancel
+___sigwait
+___socketpair
+___stack_snapshot
+___stat64_extended
+___stat_extended
+___syscall
+___syscall_logger
+___sysctl
+___telemetry
+___thread_selfid
+___umask_extended
+___unlink
+___vfork
+___wait4
+___wait4_nocancel
+___waitid_nocancel
+___workq_kernreturn
+___workq_open
+___write_nocancel
+___writev_nocancel
+__cpu_capabilities
+__cpu_has_altivec
+__exit
+__get_cpu_capabilities
+__getprivatesystemidentifier
+__host_page_size
+__init_cpu_capabilities
+__kernelrpc_mach_port_allocate
+__kernelrpc_mach_port_allocate_full
+__kernelrpc_mach_port_allocate_name
+__kernelrpc_mach_port_allocate_qos
+__kernelrpc_mach_port_allocate_trap
+__kernelrpc_mach_port_construct
+__kernelrpc_mach_port_construct_trap
+__kernelrpc_mach_port_deallocate
+__kernelrpc_mach_port_deallocate_trap
+__kernelrpc_mach_port_destroy
+__kernelrpc_mach_port_destroy_trap
+__kernelrpc_mach_port_destruct
+__kernelrpc_mach_port_destruct_trap
+__kernelrpc_mach_port_dnrequest_info
+__kernelrpc_mach_port_extract_member
+__kernelrpc_mach_port_extract_member_trap
+__kernelrpc_mach_port_extract_right
+__kernelrpc_mach_port_get_attributes
+__kernelrpc_mach_port_get_context
+__kernelrpc_mach_port_get_refs
+__kernelrpc_mach_port_get_set_status
+__kernelrpc_mach_port_get_srights
+__kernelrpc_mach_port_guard
+__kernelrpc_mach_port_guard_trap
+__kernelrpc_mach_port_insert_member
+__kernelrpc_mach_port_insert_member_trap
+__kernelrpc_mach_port_insert_right
+__kernelrpc_mach_port_insert_right_trap
+__kernelrpc_mach_port_kernel_object
+__kernelrpc_mach_port_kobject
+__kernelrpc_mach_port_mod_refs
+__kernelrpc_mach_port_mod_refs_trap
+__kernelrpc_mach_port_move_member
+__kernelrpc_mach_port_move_member_trap
+__kernelrpc_mach_port_names
+__kernelrpc_mach_port_peek
+__kernelrpc_mach_port_rename
+__kernelrpc_mach_port_request_notification
+__kernelrpc_mach_port_set_attributes
+__kernelrpc_mach_port_set_context
+__kernelrpc_mach_port_set_mscount
+__kernelrpc_mach_port_set_seqno
+__kernelrpc_mach_port_space_info
+__kernelrpc_mach_port_type
+__kernelrpc_mach_port_unguard
+__kernelrpc_mach_port_unguard_trap
+__kernelrpc_mach_vm_allocate
+__kernelrpc_mach_vm_allocate_trap
+__kernelrpc_mach_vm_deallocate
+__kernelrpc_mach_vm_deallocate_trap
+__kernelrpc_mach_vm_map
+__kernelrpc_mach_vm_map_trap
+__kernelrpc_mach_vm_protect
+__kernelrpc_mach_vm_protect_trap
+__kernelrpc_mach_vm_read
+__kernelrpc_mach_vm_remap
+__kernelrpc_task_set_port_space
+__kernelrpc_vm_map
+__kernelrpc_vm_read
+__kernelrpc_vm_remap
+__mach_errors
+__mach_fork_child
+__mach_snprintf
+__mach_vsnprintf
+__os_alloc_once_table
+__register_gethostuuid_callback
+_accept
+_accept$NOCANCEL
+_access
+_accessx_np
+_acct
+_act_get_state
+_act_set_state
+_adjtime
+_aio_cancel
+_aio_error
+_aio_fsync
+_aio_read
+_aio_return
+_aio_suspend
+_aio_suspend$NOCANCEL
+_aio_write
+_audit
+_audit_session_join
+_audit_session_port
+_audit_session_self
+_auditctl
+_auditon
+_bind
+_bootstrap_port
+_cerror
+_cerror_nocancel
+_change_fdguard_np
+_chdir
+_chflags
+_chmod
+_chown
+_chroot
+_clock_alarm
+_clock_alarm_reply
+_clock_get_attributes
+_clock_get_time
+_clock_set_attributes
+_clock_set_time
+_clock_sleep
+_clock_sleep_trap
+_close
+_close$NOCANCEL
+_connect
+_connect$NOCANCEL
+_connectx
+_csops
+_csops_audittoken
+_disconnectx
+_dup
+_dup2
+_errno
+_etap_trace_thread
+_exc_server
+_exc_server_routine
+_exception_raise
+_exception_raise_state
+_exception_raise_state_identity
+_exchangedata
+_execve
+_fchdir
+_fchflags
+_fchmod
+_fchown
+_fcntl
+_fcntl$NOCANCEL
+_fdatasync
+_ffsctl
+_fgetattrlist
+_fgetxattr
+_fhopen
+_fileport_makefd
+_fileport_makeport
+_flistxattr
+_flock
+_fpathconf
+_fremovexattr
+_fsctl
+_fsetattrlist
+_fsetxattr
+_fstat
+_fstat$INODE64
+_fstat64
+_fstatfs
+_fstatfs$INODE64
+_fstatfs64
+_fsync
+_fsync$NOCANCEL
+_ftruncate
+_futimes
+_get_dp_control_port
+_getattrlist
+_getaudit
+_getaudit_addr
+_getauid
+_getdirentries
+_getdirentriesattr
+_getdtablesize
+_getegid
+_geteuid
+_getfh
+_getfsstat
+_getfsstat$INODE64
+_getfsstat64
+_getgid
+_getgroups
+_gethostuuid
+_getiopolicy_np
+_getitimer
+_getpeername
+_getpgid
+_getpgrp
+_getpid
+_getppid
+_getpriority
+_getrlimit
+_getrusage
+_getsgroups_np
+_getsid
+_getsockname
+_getsockopt
+_getuid
+_getwgroups_np
+_getxattr
+_guarded_close_np
+_guarded_kqueue_np
+_guarded_open_np
+_host_default_memory_manager
+_host_get_UNDServer
+_host_get_boot_info
+_host_get_clock_control
+_host_get_clock_service
+_host_get_exception_ports
+_host_get_io_master
+_host_get_special_port
+_host_info
+_host_kernel_version
+_host_lockgroup_info
+_host_page_size
+_host_priv_statistics
+_host_processor_info
+_host_processor_set_priv
+_host_processor_sets
+_host_processors
+_host_reboot
+_host_request_notification
+_host_security_create_task_token
+_host_security_set_task_token
+_host_self
+_host_self_trap
+_host_set_UNDServer
+_host_set_exception_ports
+_host_set_special_port
+_host_statistics
+_host_statistics64
+_host_swap_exception_ports
+_host_virtual_physical_table_info
+_host_zone_info
+_i386_get_ldt
+_i386_set_ldt
+_important_boost_assertion_token
+_internal_catch_exc_subsystem
+_ioctl
+_issetugid
+_kas_info
+_kevent
+_kevent64
+_kext_request
+_kill
+_kmod_control
+_kmod_create
+_kmod_destroy
+_kmod_get_info
+_kqueue
+_lchown
+_ledger
+_link
+_lio_listio
+_listen
+_listxattr
+_lock_acquire
+_lock_handoff
+_lock_handoff_accept
+_lock_make_stable
+_lock_release
+_lock_set_create
+_lock_set_destroy
+_lock_try
+_lseek
+_lstat
+_lstat$INODE64
+_lstat64
+_mach_absolute_time
+_mach_error
+_mach_error_full_diag
+_mach_error_string
+_mach_error_type
+_mach_host_self
+_mach_init
+_mach_make_memory_entry
+_mach_make_memory_entry_64
+_mach_memory_object_memory_entry
+_mach_memory_object_memory_entry_64
+_mach_msg
+_mach_msg_destroy
+_mach_msg_overwrite
+_mach_msg_overwrite_trap
+_mach_msg_receive
+_mach_msg_send
+_mach_msg_server
+_mach_msg_server_importance
+_mach_msg_server_once
+_mach_msg_trap
+_mach_notify_dead_name
+_mach_notify_no_senders
+_mach_notify_port_deleted
+_mach_notify_port_destroyed
+_mach_notify_send_once
+_mach_port_allocate
+_mach_port_allocate_full
+_mach_port_allocate_name
+_mach_port_allocate_qos
+_mach_port_construct
+_mach_port_deallocate
+_mach_port_destroy
+_mach_port_destruct
+_mach_port_dnrequest_info
+_mach_port_extract_member
+_mach_port_extract_right
+_mach_port_get_attributes
+_mach_port_get_context
+_mach_port_get_refs
+_mach_port_get_set_status
+_mach_port_get_srights
+_mach_port_guard
+_mach_port_insert_member
+_mach_port_insert_right
+_mach_port_kernel_object
+_mach_port_kobject
+_mach_port_mod_refs
+_mach_port_move_member
+_mach_port_names
+_mach_port_peek
+_mach_port_rename
+_mach_port_request_notification
+_mach_port_set_attributes
+_mach_port_set_context
+_mach_port_set_mscount
+_mach_port_set_seqno
+_mach_port_space_info
+_mach_port_type
+_mach_port_unguard
+_mach_ports_lookup
+_mach_ports_register
+_mach_reply_port
+_mach_task_self
+_mach_task_self_
+_mach_thread_self
+_mach_timebase_info
+_mach_vm_allocate
+_mach_vm_behavior_set
+_mach_vm_copy
+_mach_vm_deallocate
+_mach_vm_inherit
+_mach_vm_machine_attribute
+_mach_vm_map
+_mach_vm_msync
+_mach_vm_page_info
+_mach_vm_page_query
+_mach_vm_protect
+_mach_vm_purgable_control
+_mach_vm_read
+_mach_vm_read_list
+_mach_vm_read_overwrite
+_mach_vm_region
+_mach_vm_region_recurse
+_mach_vm_remap
+_mach_vm_wire
+_mach_vm_write
+_mach_wait_until
+_mach_zone_force_gc
+_mach_zone_info
+_macx_backing_store_recovery
+_macx_backing_store_suspend
+_macx_swapoff
+_macx_swapon
+_macx_triggers
+_madvise
+_memorystatus_control
+_memorystatus_get_level
+_mig_allocate
+_mig_dealloc_reply_port
+_mig_deallocate
+_mig_get_reply_port
+_mig_put_reply_port
+_mig_reply_setup
+_mig_strncpy
+_mincore
+_minherit
+_mk_timer_arm
+_mk_timer_cancel
+_mk_timer_create
+_mk_timer_destroy
+_mkdir
+_mkfifo
+_mknod
+_mlock
+_mlockall
+_mmap
+_modwatch
+_mount
+_mprotect
+_msg_receive
+_msg_rpc
+_msg_send
+_msgctl
+_msgget
+_msgrcv
+_msgrcv$NOCANCEL
+_msgsnd
+_msgsnd$NOCANCEL
+_msgsys
+_msync
+_msync$NOCANCEL
+_munlock
+_munlockall
+_munmap
+_netname_check_in
+_netname_check_out
+_netname_look_up
+_netname_version
+_nfsclnt
+_nfssvc
+_non_boost_assertion_token
+_normal_boost_assertion_token
+_open
+_open$NOCANCEL
+_open_dprotected_np
+_panic
+_panic_init
+_pathconf
+_peeloff
+_pid_for_task
+_pid_resume
+_pid_suspend
+_pipe
+_poll
+_poll$NOCANCEL
+_port_obj_init
+_port_obj_table
+_port_obj_table_size
+_posix_madvise
+_posix_spawn
+_posix_spawn_file_actions_addclose
+_posix_spawn_file_actions_adddup2
+_posix_spawn_file_actions_addinherit_np
+_posix_spawn_file_actions_addopen
+_posix_spawn_file_actions_destroy
+_posix_spawn_file_actions_init
+_posix_spawnattr_destroy
+_posix_spawnattr_getbinpref_np
+_posix_spawnattr_getcpumonitor
+_posix_spawnattr_getflags
+_posix_spawnattr_getmacpolicyinfo_np
+_posix_spawnattr_getpcontrol_np
+_posix_spawnattr_getpgroup
+_posix_spawnattr_getprocesstype_np
+_posix_spawnattr_getsigdefault
+_posix_spawnattr_getsigmask
+_posix_spawnattr_init
+_posix_spawnattr_set_importancewatch_port_np
+_posix_spawnattr_setauditsessionport_np
+_posix_spawnattr_setbinpref_np
+_posix_spawnattr_setcpumonitor
+_posix_spawnattr_setcpumonitor_default
+_posix_spawnattr_setexceptionports_np
+_posix_spawnattr_setflags
+_posix_spawnattr_setmacpolicyinfo_np
+_posix_spawnattr_setpcontrol_np
+_posix_spawnattr_setpgroup
+_posix_spawnattr_setprocesstype_np
+_posix_spawnattr_setsigdefault
+_posix_spawnattr_setsigmask
+_posix_spawnattr_setspecialport_np
+_pread
+_pread$NOCANCEL
+_proc_clear_delayidlesleep
+_proc_clear_vmpressure
+_proc_disable_apptype
+_proc_disable_cpumon
+_proc_disable_wakemon
+_proc_donate_importance_boost
+_proc_enable_apptype
+_proc_get_cpumon_params
+_proc_get_dirty
+_proc_get_wakemon_params
+_proc_importance_assertion_begin_with_msg
+_proc_importance_assertion_complete
+_proc_kmsgbuf
+_proc_libversion
+_proc_listallpids
+_proc_listchildpids
+_proc_listpgrppids
+_proc_listpids
+_proc_listpidspath
+_proc_name
+_proc_pid_rusage
+_proc_pidfdinfo
+_proc_pidfileportinfo
+_proc_pidinfo
+_proc_pidpath
+_proc_regionfilename
+_proc_rlimit_control
+_proc_set_cpumon_defaults
+_proc_set_cpumon_params
+_proc_set_delayidlesleep
+_proc_set_dirty
+_proc_set_owner_vmpressure
+_proc_set_wakemon_defaults
+_proc_set_wakemon_params
+_proc_setpcontrol
+_proc_suppress
+_proc_terminate
+_proc_track_dirty
+_proc_uuid_policy
+_processor_assign
+_processor_control
+_processor_exit
+_processor_get_assignment
+_processor_info
+_processor_set_create
+_processor_set_default
+_processor_set_destroy
+_processor_set_info
+_processor_set_max_priority
+_processor_set_policy_control
+_processor_set_policy_disable
+_processor_set_policy_enable
+_processor_set_stack_usage
+_processor_set_statistics
+_processor_set_tasks
+_processor_set_threads
+_processor_start
+_pthread_getugid_np
+_pthread_setugid_np
+_ptrace
+_pwrite
+_pwrite$NOCANCEL
+_quota
+_quotactl
+_read
+_read$NOCANCEL
+_readlink
+_readv
+_readv$NOCANCEL
+_reboot
+_recvfrom
+_recvfrom$NOCANCEL
+_recvmsg
+_recvmsg$NOCANCEL
+_removexattr
+_rename
+_revoke
+_rmdir
+_searchfs
+_select
+_select$1050
+_select$DARWIN_EXTSN
+_select$DARWIN_EXTSN$NOCANCEL
+_select$NOCANCEL
+_sem_close
+_sem_destroy
+_sem_getvalue
+_sem_init
+_sem_open
+_sem_post
+_sem_trywait
+_sem_unlink
+_sem_wait
+_sem_wait$NOCANCEL
+_semaphore_create
+_semaphore_destroy
+_semaphore_signal
+_semaphore_signal_all
+_semaphore_signal_all_trap
+_semaphore_signal_thread
+_semaphore_signal_thread_trap
+_semaphore_signal_trap
+_semaphore_timedwait
+_semaphore_timedwait_signal
+_semaphore_timedwait_signal_trap
+_semaphore_timedwait_trap
+_semaphore_wait
+_semaphore_wait_signal
+_semaphore_wait_signal_trap
+_semaphore_wait_trap
+_semctl
+_semget
+_semop
+_semsys
+_sendfile
+_sendmsg
+_sendmsg$NOCANCEL
+_sendto
+_sendto$NOCANCEL
+_set_dp_control_port
+_setattrlist
+_setaudit
+_setaudit_addr
+_setauid
+_setegid
+_seteuid
+_setgid
+_setgroups
+_setiopolicy_np
+_setitimer
+_setpgid
+_setpriority
+_setprivexec
+_setquota
+_setregid
+_setreuid
+_setrlimit
+_setsgroups_np
+_setsid
+_setsockopt
+_setuid
+_setwgroups_np
+_setxattr
+_shm_open
+_shm_unlink
+_shmat
+_shmctl
+_shmdt
+_shmget
+_shmsys
+_shutdown
+_sigpending
+_sigprocmask
+_sigsuspend
+_sigsuspend$NOCANCEL
+_socket
+_socket_delegate
+_socketpair
+_stat
+_stat$INODE64
+_stat64
+_statfs
+_statfs$INODE64
+_statfs64
+_swapon
+_swtch
+_swtch_pri
+_symlink
+_sync
+_syscall
+_syscall_thread_switch
+_system_override
+_task_assign
+_task_assign_default
+_task_create
+_task_for_pid
+_task_get_assignment
+_task_get_emulation_vector
+_task_get_exception_ports
+_task_get_special_port
+_task_get_state
+_task_info
+_task_name_for_pid
+_task_policy
+_task_policy_get
+_task_policy_set
+_task_purgable_info
+_task_resume
+_task_resume2
+_task_sample
+_task_self_
+_task_self_trap
+_task_set_emulation
+_task_set_emulation_vector
+_task_set_exception_ports
+_task_set_info
+_task_set_phys_footprint_limit
+_task_set_policy
+_task_set_port_space
+_task_set_ras_pc
+_task_set_special_port
+_task_set_state
+_task_suspend
+_task_suspend2
+_task_swap_exception_ports
+_task_terminate
+_task_threads
+_task_zone_info
+_thread_abort
+_thread_abort_safely
+_thread_assign
+_thread_assign_default
+_thread_create
+_thread_create_running
+_thread_depress_abort
+_thread_get_assignment
+_thread_get_exception_ports
+_thread_get_special_port
+_thread_get_state
+_thread_info
+_thread_policy
+_thread_policy_get
+_thread_policy_set
+_thread_resume
+_thread_sample
+_thread_self_trap
+_thread_set_exception_ports
+_thread_set_policy
+_thread_set_special_port
+_thread_set_state
+_thread_suspend
+_thread_swap_exception_ports
+_thread_switch
+_thread_terminate
+_thread_wire
+_truncate
+_umask
+_undelete
+_unlink
+_unmount
+_utimes
+_vfork
+_vfs_purge
+_vm_allocate
+_vm_allocate_cpm
+_vm_behavior_set
+_vm_copy
+_vm_deallocate
+_vm_inherit
+_vm_kernel_page_mask
+_vm_kernel_page_shift
+_vm_kernel_page_size
+_vm_machine_attribute
+_vm_map
+_vm_map_page_query
+_vm_msync
+_vm_page_mask
+_vm_page_shift
+_vm_page_size
+_vm_pressure_monitor
+_vm_protect
+_vm_purgable_control
+_vm_read
+_vm_read_list
+_vm_read_overwrite
+_vm_region_64
+_vm_region_recurse_64
+_vm_remap
+_vm_wire
+_vm_write
+_vprintf_stderr_func
+_wait4
+_waitevent
+_waitid
+_waitid$NOCANCEL
+_watchevent
+_write
+_write$NOCANCEL
+_writev
+_writev$NOCANCEL
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
new file mode 100644
index 00000000000..f09842630fd
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/Security/default.nix
@@ -0,0 +1,116 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  __propagatedImpureHostDeps = [
+    "/System/Library/Frameworks/Security.framework/Security"
+    "/System/Library/Frameworks/Security.framework/Resources"
+    "/System/Library/Frameworks/Security.framework/PlugIns"
+    "/System/Library/Frameworks/Security.framework/XPCServices"
+    "/System/Library/Frameworks/Security.framework/Versions"
+  ];
+
+  installPhase = ''
+    ###### IMPURITIES
+    mkdir -p $out/Library/Frameworks/Security.framework
+    pushd $out/Library/Frameworks/Security.framework
+    ln -s /System/Library/Frameworks/Security.framework/Security
+    ln -s /System/Library/Frameworks/Security.framework/Resources
+    ln -s /System/Library/Frameworks/Security.framework/PlugIns
+    ln -s /System/Library/Frameworks/Security.framework/XPCServices
+    popd
+
+    ###### HEADERS
+
+    export dest=$out/Library/Frameworks/Security.framework/Headers
+    mkdir -p $dest
+
+    cp libsecurity_asn1/lib/SecAsn1Coder.h     $dest
+    cp libsecurity_asn1/lib/SecAsn1Templates.h $dest
+    cp libsecurity_asn1/lib/SecAsn1Types.h     $dest
+    cp libsecurity_asn1/lib/oidsalg.h          $dest
+    cp libsecurity_asn1/lib/oidsattr.h         $dest
+
+    cp libsecurity_authorization/lib/AuthSession.h         $dest
+    cp libsecurity_authorization/lib/Authorization.h       $dest
+    cp libsecurity_authorization/lib/AuthorizationDB.h     $dest
+    cp libsecurity_authorization/lib/AuthorizationPlugin.h $dest
+    cp libsecurity_authorization/lib/AuthorizationTags.h   $dest
+
+    cp libsecurity_cms/lib/CMSDecoder.h $dest
+    cp libsecurity_cms/lib/CMSEncoder.h $dest
+
+    cp libsecurity_codesigning/lib/CSCommon.h       $dest
+    cp libsecurity_codesigning/lib/CodeSigning.h    $dest
+    cp libsecurity_codesigning/lib/SecCode.h        $dest
+    cp libsecurity_codesigning/lib/SecCodeHost.h    $dest
+    cp libsecurity_codesigning/lib/SecRequirement.h $dest
+    cp libsecurity_codesigning/lib/SecStaticCode.h  $dest
+    cp libsecurity_codesigning/lib/SecTask.h        $dest
+
+    cp libsecurity_cssm/lib/certextensions.h $dest
+    cp libsecurity_cssm/lib/cssm.h           $dest
+    cp libsecurity_cssm/lib/cssmaci.h        $dest
+    cp libsecurity_cssm/lib/cssmapi.h        $dest
+    cp libsecurity_cssm/lib/cssmapple.h      $dest
+    cp libsecurity_cssm/lib/cssmcli.h        $dest
+    cp libsecurity_cssm/lib/cssmconfig.h     $dest
+    cp libsecurity_cssm/lib/cssmcspi.h       $dest
+    cp libsecurity_cssm/lib/cssmdli.h        $dest
+    cp libsecurity_cssm/lib/cssmerr.h        $dest
+    cp libsecurity_cssm/lib/cssmkrapi.h      $dest
+    cp libsecurity_cssm/lib/cssmkrspi.h      $dest
+    cp libsecurity_cssm/lib/cssmspi.h        $dest
+    cp libsecurity_cssm/lib/cssmtpi.h        $dest
+    cp libsecurity_cssm/lib/cssmtype.h       $dest
+    cp libsecurity_cssm/lib/eisl.h           $dest
+    cp libsecurity_cssm/lib/emmspi.h         $dest
+    cp libsecurity_cssm/lib/emmtype.h        $dest
+    cp libsecurity_cssm/lib/oidsbase.h       $dest
+    cp libsecurity_cssm/lib/oidscert.h       $dest
+    cp libsecurity_cssm/lib/oidscrl.h        $dest
+    cp libsecurity_cssm/lib/x509defs.h       $dest
+
+    cp libsecurity_keychain/lib/SecACL.h                $dest
+    cp libsecurity_keychain/lib/SecAccess.h             $dest
+    cp libsecurity_keychain/lib/SecBase.h               $dest
+    cp libsecurity_keychain/lib/SecCertificate.h        $dest
+    cp libsecurity_keychain/lib/SecCertificatePriv.h    $dest # Private
+    cp libsecurity_keychain/lib/SecCertificateOIDs.h    $dest
+    cp libsecurity_keychain/lib/SecIdentity.h           $dest
+    cp libsecurity_keychain/lib/SecIdentitySearch.h     $dest
+    cp libsecurity_keychain/lib/SecImportExport.h       $dest
+    cp libsecurity_keychain/lib/SecItem.h               $dest
+    cp libsecurity_keychain/lib/SecKey.h                $dest
+    cp libsecurity_keychain/lib/SecKeychain.h           $dest
+    cp libsecurity_keychain/lib/SecKeychainItem.h       $dest
+    cp libsecurity_keychain/lib/SecKeychainSearch.h     $dest
+    cp libsecurity_keychain/lib/SecPolicy.h             $dest
+    cp libsecurity_keychain/lib/SecPolicySearch.h       $dest
+    cp libsecurity_keychain/lib/SecRandom.h             $dest
+    cp libsecurity_keychain/lib/SecTrust.h              $dest
+    cp libsecurity_keychain/lib/SecTrustSettings.h      $dest
+    cp libsecurity_keychain/lib/SecTrustedApplication.h $dest
+    cp libsecurity_keychain/lib/Security.h              $dest
+
+    cp libsecurity_manifest/lib/SecureDownload.h $dest
+
+    cp libsecurity_mds/lib/mds.h        $dest
+    cp libsecurity_mds/lib/mds_schema.h $dest
+
+    cp libsecurity_ssl/lib/CipherSuite.h     $dest
+    cp libsecurity_ssl/lib/SecureTransport.h $dest
+
+    cp libsecurity_transform/lib/SecCustomTransform.h        $dest
+    cp libsecurity_transform/lib/SecDecodeTransform.h        $dest
+    cp libsecurity_transform/lib/SecDigestTransform.h        $dest
+    cp libsecurity_transform/lib/SecEncodeTransform.h        $dest
+    cp libsecurity_transform/lib/SecEncryptTransform.h       $dest
+    cp libsecurity_transform/lib/SecReadTransform.h          $dest
+    cp libsecurity_transform/lib/SecSignVerifyTransform.h    $dest
+    cp libsecurity_transform/lib/SecTransform.h              $dest
+    cp libsecurity_transform/lib/SecTransformReadTransform.h $dest
+
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
new file mode 100644
index 00000000000..db467254f17
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, appleDerivation, version }:
+
+appleDerivation {
+  # Will override the name until we provide all of adv_cmds
+  name = "ps-${version}";
+
+  buildPhase = ''
+    cd ps
+    cc -Os -Wall -I. -c -o fmt.o fmt.c
+    cc -Os -Wall -I. -c -o keyword.o keyword.c
+    cc -Os -Wall -I. -c -o nlist.o nlist.c
+    cc -Os -Wall -I. -c -o print.o print.c
+    cc -Os -Wall -I. -c -o ps.o ps.c
+    cc -Os -Wall -I. -c -o tasks.o tasks.c
+    cc -o ps fmt.o keyword.o nlist.o print.o ps.o tasks.o
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/man/man1
+
+    cp ps   $out/bin/ps
+    cp ps.1 $out/share/man/man1
+  '';
+
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ gridaphobe ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix b/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
new file mode 100644
index 00000000000..edb7869269a
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/architecture/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  postUnpack = ''
+    substituteInPlace $sourceRoot/Makefile \
+      --replace "/usr/include" "/include" \
+      --replace "/usr/bin/" "" \
+      --replace "/bin/" ""
+  '';
+
+  installPhase = ''
+    export DSTROOT=$out
+    make install
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
new file mode 100644
index 00000000000..8dce3fd3609
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/bootstrap_cmds/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, appleDerivation, yacc, flex }:
+
+appleDerivation {
+  buildInputs = [ yacc flex ];
+
+  buildPhase = ''
+    cd migcom.tproj
+    yacc -d parser.y
+    flex --header-file=lexxer.yy.h -o lexxer.yy.c lexxer.l
+
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o error.o error.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o global.o global.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o handler.o header.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o header.o header.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o mig.o mig.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o routine.o routine.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o server.o server.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o statement.o statement.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o string.o string.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o type.o type.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o user.o user.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o utils.o utils.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o lexxer.yy.o lexxer.yy.c
+    cc -Os -pipe -DMIG_VERSION="" -Wall -mdynamic-no-pic -I. -c -o y.tab.o y.tab.c
+
+    cc -dead_strip -o migcom error.o global.o header.o mig.o routine.o server.o statement.o string.o type.o user.o utils.o lexxer.yy.o y.tab.o
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/libexec $out/share/man/man1
+
+    chmod +x mig.sh
+    cp mig.sh   $out/bin/mig
+    cp migcom   $out/libexec
+    cp mig.1    $out/share/man/man1
+    cp migcom.1 $out/share/man/man1
+
+    substituteInPlace $out/bin/mig \
+      --replace 'arch=`/usr/bin/arch`' 'arch=i386' \
+      --replace '/usr/bin/' "" \
+      --replace '/bin/rmdir' "rmdir" \
+      --replace 'C=''${MIGCC}' "C=cc"
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
new file mode 100644
index 00000000000..3427081bfaa
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/configd/default.nix
@@ -0,0 +1,205 @@
+{ stdenv, appleDerivation, launchd, bootstrap_cmds, xnu, ppp, IOKit, eap8021x, Security }:
+
+appleDerivation {
+  buildInputs = [ launchd bootstrap_cmds xnu ppp IOKit eap8021x ];
+
+  propagatedBuildInputs = [ Security ];
+
+  patchPhase = ''
+    substituteInPlace SystemConfiguration.fproj/SCNetworkReachabilityInternal.h \
+      --replace '#include <xpc/xpc.h>' ""
+
+    substituteInPlace SystemConfiguration.fproj/SCNetworkReachability.c \
+      --replace ''$'#define\tHAVE_VPN_STATUS' ""
+
+    substituteInPlace SystemConfiguration.fproj/reachability/SCNetworkReachabilityServer_client.c \
+      --replace '#include <xpc/xpc.h>' '#include "fake_xpc.h"' \
+      --replace '#include <xpc/private.h>' "" \
+
+    # Our neutered CoreFoundation doesn't have this function, but I think we'll live...
+    substituteInPlace SystemConfiguration.fproj/SCNetworkConnectionPrivate.c \
+      --replace 'CFPreferencesAppValueIsForced(serviceID, USER_PREFERENCES_APPLICATION_ID)' 'FALSE' \
+      --replace 'CFPreferencesAppValueIsForced(userPrivate->serviceID, USER_PREFERENCES_APPLICATION_ID)' 'FALSE'
+
+    cat >SystemConfiguration.fproj/fake_xpc.h <<EOF
+    typedef void *xpc_type_t;
+    typedef void *xpc_object_t;
+    typedef void *xpc_connection_t;
+
+    xpc_type_t xpc_get_type(xpc_object_t object);
+    xpc_object_t xpc_dictionary_create(const char * const *keys, const xpc_object_t *values, size_t count);
+    char *xpc_copy_description(xpc_object_t object);
+    int64_t  xpc_dictionary_get_int64(xpc_object_t xdict, const char *key);
+    uint64_t xpc_dictionary_get_uint64(xpc_object_t xdict, const char *key);
+    void xpc_connection_set_event_handler(xpc_connection_t connection, void *handler);
+
+    extern const struct _xpc_type_s _xpc_type_error;
+    #define XPC_TYPE_ERROR (&_xpc_type_error)
+
+    extern const struct _xpc_type_s _xpc_type_dictionary;
+    #define XPC_TYPE_DICTIONARY (&_xpc_type_dictionary)
+
+    extern const struct _xpc_type_s _xpc_type_array;
+    #define XPC_TYPE_ARRAY (&_xpc_type_array)
+
+    extern const struct _xpc_dictionary_s _xpc_error_connection_interrupted;
+    #define XPC_ERROR_CONNECTION_INTERRUPTED (&_xpc_error_connection_interrupted)
+
+    extern const struct _xpc_dictionary_s _xpc_error_connection_invalid;
+    #define XPC_ERROR_CONNECTION_INVALID (&_xpc_error_connection_invalid)
+
+    extern const char *const _xpc_error_key_description;
+    #define XPC_ERROR_KEY_DESCRIPTION _xpc_error_key_description
+
+    #define XPC_CONNECTION_MACH_SERVICE_PRIVILEGED (1 << 1)
+    EOF
+  '';
+
+  buildPhase = ''
+    pushd SystemConfiguration.fproj >/dev/null
+
+    mkdir -p SystemConfiguration.framework/Resources
+    cp ../get-mobility-info       SystemConfiguration.framework/Resources
+    cp Info.plist                 SystemConfiguration.framework/Resources
+    cp -r English.lproj           SystemConfiguration.framework/Resources
+    cp NetworkConfiguration.plist SystemConfiguration.framework/Resources
+
+    mkdir -p SystemConfiguration.framework/Headers
+    mkdir -p SystemConfiguration.framework/PrivateHeaders
+
+    # The standard public headers
+    cp SCSchemaDefinitions.h        SystemConfiguration.framework/Headers
+    cp SystemConfiguration.h        SystemConfiguration.framework/Headers
+    cp SCDynamicStore.h             SystemConfiguration.framework/Headers
+    cp SCDynamicStoreCopySpecific.h SystemConfiguration.framework/Headers
+    cp SCPreferences.h              SystemConfiguration.framework/Headers
+    cp CaptiveNetwork.h             SystemConfiguration.framework/Headers
+    cp SCPreferencesPath.h          SystemConfiguration.framework/Headers
+    cp SCDynamicStoreKey.h          SystemConfiguration.framework/Headers
+    cp SCPreferencesSetSpecific.h   SystemConfiguration.framework/Headers
+    cp SCNetworkConfiguration.h     SystemConfiguration.framework/Headers
+    cp SCNetworkConnection.h        SystemConfiguration.framework/Headers
+    cp SCNetworkReachability.h      SystemConfiguration.framework/Headers
+    cp DHCPClientPreferences.h      SystemConfiguration.framework/Headers
+    cp SCNetwork.h                  SystemConfiguration.framework/Headers
+    cp SCDynamicStoreCopyDHCPInfo.h SystemConfiguration.framework/Headers
+
+    # TODO: Do we want to preserve private headers or just make them public?
+    cp SCDPlugin.h                         SystemConfiguration.framework/PrivateHeaders
+    cp SCPrivate.h                         SystemConfiguration.framework/PrivateHeaders
+    cp SCDynamicStorePrivate.h             SystemConfiguration.framework/PrivateHeaders
+    cp SCDynamicStoreCopySpecificPrivate.h SystemConfiguration.framework/PrivateHeaders
+    cp SCDynamicStoreSetSpecificPrivate.h  SystemConfiguration.framework/PrivateHeaders
+    cp SCValidation.h                      SystemConfiguration.framework/PrivateHeaders
+    cp SCPreferencesPrivate.h              SystemConfiguration.framework/PrivateHeaders
+    cp DeviceOnHold.h                      SystemConfiguration.framework/PrivateHeaders
+    cp LinkConfiguration.h                 SystemConfiguration.framework/PrivateHeaders
+    cp SCPreferencesPathKey.h              SystemConfiguration.framework/PrivateHeaders
+    cp SCPreferencesSetSpecificPrivate.h   SystemConfiguration.framework/PrivateHeaders
+    cp SCNetworkConnectionPrivate.h        SystemConfiguration.framework/PrivateHeaders
+    cp SCPreferencesGetSpecificPrivate.h   SystemConfiguration.framework/PrivateHeaders
+    cp SCSchemaDefinitionsPrivate.h        SystemConfiguration.framework/PrivateHeaders
+    cp SCNetworkConfigurationPrivate.h     SystemConfiguration.framework/PrivateHeaders
+    cp SCPreferencesKeychainPrivate.h      SystemConfiguration.framework/PrivateHeaders
+    cp SCNetworkSignature.h                SystemConfiguration.framework/PrivateHeaders
+    cp SCNetworkSignaturePrivate.h         SystemConfiguration.framework/PrivateHeaders
+    cp VPNPrivate.h                        SystemConfiguration.framework/PrivateHeaders
+    cp VPNConfiguration.h                  SystemConfiguration.framework/PrivateHeaders
+    cp VPNTunnelPrivate.h                  SystemConfiguration.framework/PrivateHeaders
+    cp VPNTunnel.h                         SystemConfiguration.framework/PrivateHeaders
+
+    mkdir derived
+
+    cat >derived/SystemConfiguration_vers.c <<EOF
+    const unsigned char SystemConfigurationVersionString[] __attribute__ ((used)) = "@(#)PROGRAM:SystemConfiguration  PROJECT:configd-" "\n"; const double SystemConfigurationVersionNumber __attribute__ ((used)) = (double)0.;
+    EOF
+
+    mig -arch x86_64 -header derived/shared_dns_info.h -user derived/shared_dns_infoUser.c -sheader /dev/null -server /dev/null ../dnsinfo/shared_dns_info.defs
+    mig -arch x86_64 -header derived/config.h          -user derived/configUser.c          -sheader /dev/null -server /dev/null config.defs
+    mig -arch x86_64 -header derived/helper.h          -user derived/helperUser.c          -sheader /dev/null -server /dev/null helper/helper.defs
+    mig -arch x86_64 -header derived/pppcontroller.h   -user derived/pppcontrollerUser.c   -sheader /dev/null -server /dev/null pppcontroller.defs
+
+    cc -I. -Ihelper -Iderived -F. -c SCSchemaDefinitions.c -o SCSchemaDefinitions.o
+    cc -I. -Ihelper -Iderived -F. -c SCD.c -o SCD.o
+    cc -I. -Ihelper -Iderived -F. -c SCDKeys.c -o SCDKeys.o
+    cc -I. -Ihelper -Iderived -F. -c SCDPrivate.c -o SCDPrivate.o
+    cc -I. -Ihelper -Iderived -F. -c SCDPlugin.c -o SCDPlugin.o
+    cc -I. -Ihelper -Iderived -F. -c CaptiveNetwork.c -o CaptiveNetwork.o
+    cc -I. -Ihelper -Iderived -F. -c SCDOpen.c -o SCDOpen.o
+    cc -I. -Ihelper -Iderived -F. -c SCDList.c -o SCDList.o
+    cc -I. -Ihelper -Iderived -F. -c SCDAdd.c -o SCDAdd.o
+    cc -I. -Ihelper -Iderived -F. -c SCDGet.c -o SCDGet.o
+    cc -I. -Ihelper -Iderived -F. -c SCDSet.c -o SCDSet.o
+    cc -I. -Ihelper -Iderived -F. -c SCDRemove.c -o SCDRemove.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotify.c -o SCDNotify.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierSetKeys.c -o SCDNotifierSetKeys.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierAdd.c -o SCDNotifierAdd.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierRemove.c -o SCDNotifierRemove.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierGetChanges.c -o SCDNotifierGetChanges.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierWait.c -o SCDNotifierWait.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaCallback.c -o SCDNotifierInformViaCallback.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaFD.c -o SCDNotifierInformViaFD.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierInformViaSignal.c -o SCDNotifierInformViaSignal.o
+    cc -I. -Ihelper -Iderived -F. -c SCDNotifierCancel.c -o SCDNotifierCancel.o
+    cc -I. -Ihelper -Iderived -F. -c SCDSnapshot.c -o SCDSnapshot.o
+    cc -I. -Ihelper -Iderived -F. -c SCP.c -o SCP.o
+    cc -I. -Ihelper -Iderived -F. -c SCPOpen.c -o SCPOpen.o
+    cc -I. -Ihelper -Iderived -F. -c SCPLock.c -o SCPLock.o
+    cc -I. -Ihelper -Iderived -F. -c SCPUnlock.c -o SCPUnlock.o
+    cc -I. -Ihelper -Iderived -F. -c SCPList.c -o SCPList.o
+    cc -I. -Ihelper -Iderived -F. -c SCPGet.c -o SCPGet.o
+    cc -I. -Ihelper -Iderived -F. -c SCPAdd.c -o SCPAdd.o
+    cc -I. -Ihelper -Iderived -F. -c SCPSet.c -o SCPSet.o
+    cc -I. -Ihelper -Iderived -F. -c SCPRemove.c -o SCPRemove.o
+    cc -I. -Ihelper -Iderived -F. -c SCPCommit.c -o SCPCommit.o
+    cc -I. -Ihelper -Iderived -F. -c SCPApply.c -o SCPApply.o
+    cc -I. -Ihelper -Iderived -F. -c SCPPath.c -o SCPPath.o
+    cc -I. -Ihelper -Iderived -F. -c SCDConsoleUser.c -o SCDConsoleUser.o
+    cc -I. -Ihelper -Iderived -F. -c SCDHostName.c -o SCDHostName.o
+    cc -I. -Ihelper -Iderived -F. -c SCLocation.c -o SCLocation.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetwork.c -o SCNetwork.o
+    cc -I. -Ihelper -Iderived -F. -c derived/pppcontrollerUser.c -o pppcontrollerUser.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetworkConnection.c -o SCNetworkConnection.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetworkConnectionPrivate.c -o SCNetworkConnectionPrivate.o
+    cc -I. -Ihelper -Iderived -I../dnsinfo -F. -c SCNetworkReachability.c -o SCNetworkReachability.o
+    cc -I. -Ihelper -Iderived -F. -c SCProxies.c -o SCProxies.o
+    cc -I. -Ihelper -Iderived -F. -c DHCP.c -o DHCP.o
+    cc -I. -Ihelper -Iderived -F. -c moh.c -o moh.o
+    cc -I. -Ihelper -Iderived -F. -c DeviceOnHold.c -o DeviceOnHold.o
+    cc -I. -Ihelper -Iderived -I${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders -F. -c LinkConfiguration.c -o LinkConfiguration.o
+    cc -I. -Ihelper -Iderived -F. -c dy_framework.c -o dy_framework.o
+    cc -I. -Ihelper -Iderived -I${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders -F. -c VLANConfiguration.c -o VLANConfiguration.o
+    cc -I. -Ihelper -Iderived -F. -c derived/configUser.c -o configUser.o
+    cc -I. -Ihelper -Iderived -F. -c SCPreferencesPathKey.c -o SCPreferencesPathKey.o
+    cc -I. -Ihelper -Iderived -I../dnsinfo -F. -c derived/shared_dns_infoUser.c -o shared_dns_infoUser.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetworkConfigurationInternal.c -o SCNetworkConfigurationInternal.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetworkInterface.c -o SCNetworkInterface.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetworkProtocol.c -o SCNetworkProtocol.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetworkService.c -o SCNetworkService.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetworkSet.c -o SCNetworkSet.o
+    cc -I. -Ihelper -Iderived -I${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders -F. -c BondConfiguration.c -o BondConfiguration.o
+    cc -I. -Ihelper -Iderived -I${xnu}/Library/Frameworks/System.framework/Versions/B/PrivateHeaders -F. -c BridgeConfiguration.c -o BridgeConfiguration.o
+    cc -I. -Ihelper -Iderived -F. -c helper/SCHelper_client.c -o SCHelper_client.o
+    cc -I. -Ihelper -Iderived -F. -c SCPreferencesKeychainPrivate.c -o SCPreferencesKeychainPrivate.o
+    cc -I. -Ihelper -Iderived -F. -c SCNetworkSignature.c -o SCNetworkSignature.o
+    cc -I. -Ihelper -Iderived -F. -c VPNPrivate.c -o VPNPrivate.o
+    cc -I. -Ihelper -Iderived -F. -c VPNConfiguration.c -o VPNConfiguration.o
+    cc -I. -Ihelper -Iderived -F. -c VPNTunnel.c -o VPNTunnel.o
+    cc -I. -Ihelper -Iderived -F. -c derived/helperUser.c -o helperUser.o
+    cc -I. -Ihelper -Iderived -F. -c reachability/SCNetworkReachabilityServer_client.c -o SCNetworkReachabilityServer_client.o
+    cc -I. -Ihelper -Iderived -F. -c reachability/rb.c -o rb.o
+    cc -I. -Ihelper -Iderived -F. -c derived/SystemConfiguration_vers.c -o SystemConfiguration_vers.o
+
+    cc -dynamiclib *.o -install_name $out/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration -dead_strip -framework CoreFoundation -single_module -o SystemConfiguration.framework/SystemConfiguration
+
+    popd >/dev/null
+  '';
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp dnsinfo/*.h $out/include/
+
+    mkdir -p $out/Library/Frameworks/
+    mv SystemConfiguration.fproj/SystemConfiguration.framework $out/Library/Frameworks
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix b/pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix
new file mode 100644
index 00000000000..c1a2acccaa9
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/copyfile/default.nix
@@ -0,0 +1,10 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include/
+    cp copyfile.h $out/include/
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
new file mode 100644
index 00000000000..92ee9e52726
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -0,0 +1,83 @@
+{ stdenv, fetchurl, pkgs }:
+
+let
+  fetchApple = version: sha256: name: fetchurl {
+    url = "http://www.opensource.apple.com/tarballs/${name}/${name}-${version}.tar.gz";
+    inherit sha256;
+  };
+
+  applePackage = namePath: version: sha256:
+    let
+      name = builtins.elemAt (stdenv.lib.splitString "/" namePath) 0;
+
+      appleDerivation = attrs: stdenv.mkDerivation ({
+        inherit version;
+        name = "${name}-${version}";
+      } // (if attrs ? srcs then {} else {
+        src  = fetchApple version sha256 name;
+      }) // attrs);
+      callPackage = pkgs.newScope (packages // pkgs.darwin // { inherit appleDerivation name version; });
+    in callPackage (./. + builtins.toPath "/${namePath}");
+
+  IOKitSpecs = {
+    IOAudioFamily                        = fetchApple "197.4.2"    "1dmrczdmbdkvnhjbv233wx4xczgpf5wjrhr83aizrwpks5avkxbr";
+    IOFireWireFamily                     = fetchApple "455.4.0"    "034n2v6z7lf1cx3sp3309z4sn8mkchjcrsf177iag46yzlzcjgfl";
+    IOFWDVComponents                     = fetchApple "207.4.1"    "1brr0yn6mxgapw3bvlhyissfksifzj2mqsvj9vmps6zwcsxjfw7m";
+    IOFireWireAVC                        = fetchApple "422.4.0"    "1anw8cfmwkavnrs28bzshwa3cwk4r1p3x72561zljx57d0na9164";
+    IOFireWireSBP2                       = fetchApple "426.4.1"    "0asik6qjhf3jjp22awsiyyd6rj02zwnx47l0afbwmxpn5bchfk60";
+    IOFireWireSerialBusProtocolTransport = fetchApple "251.0.1"    "09kiq907qpk94zbij1mrcfcnyyc5ncvlxavxjrj4v5braxm78lhi";
+    IOGraphics                           = fetchApple "471.92.1"   "1c110c9chafy5ilvnc08my9ka530aljggbn66gh3sjsg7lzck9nb";
+    IOHIDFamily                          = fetchApple "503.215.2"  "0nx9mzdw848y6ppcfvip3ybczd1fxkr413zhi9qhw7gnpvac5g3n";
+    IONetworkingFamily                   = fetchApple "100"        "10r769mqq7aiksdsvyz76xjln0lg7dj4pkg2x067ygyf9md55hlz";
+    IOSerialFamily                       = fetchApple "64.1.1"     "1bfkqmg7clwm23byr3iji812j7v1p6565b1ri6p78zviqxnxh7cx";
+    IOStorageFamily                      = fetchApple "172"        "0w5yr8ppl82anwph2zba0ppjji6ipf5x410zhcm1drzwn4bbkxrj";
+    IOBDStorageFamily                    = fetchApple "14"         "1rbvmh311n853j5qb6hfda94vym9wkws5w736w2r7dwbrjyppc1q";
+    IOCDStorageFamily                    = fetchApple "51"         "1905sxwmpxdcnm6yggklc5zimx1558ygm3ycj6b34f9h48xfxzgy";
+    IODVDStorageFamily                   = fetchApple "35"         "1fv82rn199mi998l41c0qpnlp3irhqp2rb7v53pxbx7cra4zx3i6";
+    # There should be an IOStreamFamily project here, but they haven't released it :(
+    IOUSBFamily                          = fetchApple "630.4.5"    "1znqb6frxgab9mkyv7csa08c26p9p0ip6hqb4wm9c7j85kf71f4j"; # This is from 10.8 :(
+    IOUSBFamily_older                    = fetchApple "560.4.2"    "113lmpz8n6sibd27p42h8bl7a6c3myc6zngwri7gnvf8qlajzyml" "IOUSBFamily"; # This is even older :(
+    IOKitUser                            = fetchApple "907.100.13" "0kcbrlyxcyirvg5p95hjd9k8a01k161zg0bsfgfhkb90kh2s8x0m";
+    # There should be an IOVideo here, but they haven't released it :(
+  };
+
+  IOKitSrcs = stdenv.lib.mapAttrs (name: value: if builtins.isFunction value then value name else value) IOKitSpecs;
+
+  packages = {
+    adv_cmds        = applePackage "adv_cmds"          "153"         "174v6a4zkcm2pafzgdm6kvs48z5f911zl7k49hv7kjq6gm58w99v" {};
+    architecture    = applePackage "architecture"      "265"         "05wz8wmxlqssfp29x203fwfb8pgbdjj1mpz12v508658166yzqj8" {};
+    bootstrap_cmds  = applePackage "bootstrap_cmds"    "86"          "0xr0296jm1r3q7kbam98h85g23qlfi763z54ahj563n636kyk2wb" {};
+    CarbonHeaders   = applePackage "CarbonHeaders"     "9A581"       "1hc0yijlpwq39x5bic6nnywqp2m1wj1f11j33m2q7p505h1h740c" {};
+    CF              = applePackage "CF"                "855.17"      "1sadmxi9fsvsmdyxvg2133sdzvkzwil5fvyyidxsyk1iyfzqsvln" {};
+    CommonCrypto    = applePackage "CommonCrypto"      "60049"       "1azin6w7cnzl0iv8kd2qzgwcp6a45zy64y5z1i6jysjcl6xmlw2h" {};
+    configd         = applePackage "configd"           "453.19"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {};
+    copyfile        = applePackage "copyfile"          "103.92.1"    "15i2hw5aqx0fklvmq6avin5s00adacvzqc740vviwc2y742vrdcd" {};
+    CoreOSMakefiles = applePackage "CoreOSMakefiles"   "76"          "0sw3w3sjil0kvxz8y86b81sz82rcd1nijayki1a1bsnsf0hz6qbf" {};
+    Csu             = applePackage "Csu"               "79"          "1hif4dz23isgx85sgh11yg8amvp2ksvvhz3y5v07zppml7df2lnh" {};
+    dtrace          = applePackage "dtrace"            "118.1"       "0pp5x8dgvzmg9vvg32hpy2brm17dpmbwrcr4prsmdmfvd4767wcf" {};
+    dyld            = applePackage "dyld"              "239.4"       "07z7lyv6x0f6gllb5hymccl31zisrdhz4gqp722xcs9nhsqaqvn7" {};
+    eap8021x        = applePackage "eap8021x"          "180"         "1ynkq8zmhgqhpkdg2syj085lzya0fz55d3423hvf9kcgpbjcd9ic" {};
+    IOKit           = applePackage "IOKit"             "907.100.13"  "0kcbrlyxcyirvg5p95hjd9k8a01k161zg0bsfgfhkb90kh2s8x0m" { inherit IOKitSrcs; };
+    launchd         = applePackage "launchd"           "842.92.1"    "0w30hvwqq8j5n90s3qyp0fccxflvrmmjnicjri4i1vd2g196jdgj" {};
+    libauto         = applePackage "libauto"           "185.5"       "17z27yq5d7zfkwr49r7f0vn9pxvj95884sd2k6lq6rfaz9gxqhy3" {};
+    Libc            = applePackage "Libc"              "997.90.3"    "1jz5bx9l4q484vn28c6n9b28psja3rpxiqbj6zwrwvlndzmq1yz5" {};
+    Libc_old        = applePackage "Libc/825_40_1.nix" "825.40.1"    "0xsx1im52gwlmcrv4lnhhhn9dyk5ci6g27k6yvibn9vj8fzjxwcf" {};
+    libclosure      = applePackage "libclosure"        "63"          "083v5xhihkkajj2yvz0dwgbi0jl2qvzk22p7pqq1zp3ry85xagrx" {};
+    libdispatch     = applePackage "libdispatch"       "339.92.1"    "1lc5033cmkwxy3r26gh9plimxshxfcbgw6i0j7mgjlnpk86iy5bk" {};
+    libiconv        = applePackage "libiconv"          "41"          "10q7yd35flr893nysn9i04njgks4m3gis7jivb9ra9dcb77gqdcn" {};
+    Libinfo         = applePackage "Libinfo"           "449.1.3"     "1ix6f7xwjnq9bqgv8w27k4j64bqn1mfhh91nc7ciiv55axpdb9hq" {};
+    Libm            = applePackage "Libm"              "2026"        "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {};
+    Libnotify       = applePackage "Libnotify"         "121.20.1"    "164rx4za5z74s0mk9x0m1815r1m9kfal8dz3bfaw7figyjd6nqad" {};
+    libpthread      = applePackage "libpthread"        "105.1.4"     "09vwwahcvmxvx2xl0890gkp91n61dld29j73y2pa597bqkag2qpg" {};
+    libresolv       = applePackage "libresolv"         "54"          "028mp2smd744ryxwl8cqz4njv8h540sdw3an1yl7yxqcs04r0p4b" {};
+    Libsystem       = applePackage "Libsystem"         "1197.1.1"    "1yfj2qdrf9vrzs7p9m4wlb7zzxcrim1gw43x4lvz4qydpp5kg2rh" {};
+    libunwind       = applePackage "libunwind"         "35.3"        "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
+    mDNSResponder   = applePackage "mDNSResponder"     "522.92.1"    "1cp87qda1s7brriv413i71yggm8yqfwv64vknrnqv24fcb8hzbmy" {};
+    objc4           = applePackage "objc4"             "551.1"       "1jrdb6yyb5jwwj27c1r0nr2y2ihqjln8ynj61mpkvp144c1cm5bg" {};
+    objc4_pure      = applePackage "objc4/pure.nix"    "551.1"       "1jrdb6yyb5jwwj27c1r0nr2y2ihqjln8ynj61mpkvp144c1cm5bg" {};
+    ppp             = applePackage "ppp"               "727.90.1"    "166xz1q7al12hm3q3drlp2r6fgdrsq3pmazjp3nsqg3vnglyh4gk" {};
+    removefile      = applePackage "removefile"        "33"          "0ycvp7cnv40952a1jyhm258p6gg5xzh30x86z5gb204x80knw30y" {};
+    Security        = applePackage "Security"          "55471.14.18" "1nv0dczf67dhk17hscx52izgdcyacgyy12ag0jh6nl5hmfzsn8yy" {};
+    xnu             = applePackage "xnu"               "2422.115.4"  "1ssw5fzvgix20bw6y13c39ib0zs7ykpig3irlwbaccpjpci5jl0s" {};
+  };
+in packages
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
new file mode 100644
index 00000000000..5fcd04266d5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/default.nix
@@ -0,0 +1,50 @@
+{ stdenv, appleDerivation, cctools, zlib }:
+
+appleDerivation {
+  buildInputs = [ cctools zlib ];
+
+  buildPhase = ''
+    export CFLAGS=" -I$PWD/head -I$PWD/sys -I$PWD/libelf -I$PWD/libdwarf"
+
+    pushd libelf
+    for f in *.c; do
+      if [ "$f" != "lintsup.c" ]; then # Apple doesn't use it, so I don't either
+        cc -D_INT64_TYPE -D_LONGLONG_TYPE -D_ILP32 $CFLAGS -c $f
+      fi
+    done
+    libtool -static -o libelf.a *.o
+    popd
+
+    pushd libdwarf
+    ./configure CFLAGS="$CFLAGS -Icmplrs"
+    make
+    popd
+
+    cp libelf/libelf.a     tools/ctfconvert
+    cp libdwarf/libdwarf.a tools/ctfconvert
+
+    pushd tools/ctfconvert
+    for f in ../../darwin_shim.c *.c; do
+      cc -DNDEBUG -DNS_BLOCK_ASSERTIONS $CFLAGS -c $f
+    done
+
+    export COMMON="alist.o ctf.o darwin_shim.o hash.o iidesc.o input.o list.o \
+      memory.o output.o stack.o strtab.o symbol.o tdata.o traverse.o util.o"
+
+    export CONVERT="ctfconvert.o dwarf.o merge.o st_bugs.o st_parse.o stabs.o"
+    export MERGE="barrier.o ctfmerge.o dwarf.o fifo.o merge.o st_bugs.o st_parse.o stabs.o utils.o"
+    export DUMP="dump.o fifo.o utils.o"
+
+    clang -o ctfconvert $CONVERT $COMMON -L. -lz -lelf -ldwarf
+    clang -o ctfmerge   $MERGE   $COMMON -L. -lz -lelf -ldwarf
+    clang -o ctfdump    $DUMP    $COMMON -L. -lz -lelf
+    popd
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp tools/ctfconvert/ctfconvert $out/bin
+    cp tools/ctfconvert/ctfmerge   $out/bin
+    cp tools/ctfconvert/ctfdump    $out/bin
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix b/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix
new file mode 100644
index 00000000000..56b0d93f99b
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/dyld/default.nix
@@ -0,0 +1,18 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/lib $out/include
+    ln -s /usr/lib/dyld $out/lib/dyld
+    cp -r include $out/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Impure primitive symlinks to the Mac OS native dyld, along with headers";
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix b/pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix
new file mode 100644
index 00000000000..af9493fe32e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/eap8021x/default.nix
@@ -0,0 +1,11 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/Library/Frameworks/EAP8021X.framework/Headers
+
+    cp EAP8021X.fproj/EAPClientProperties.h $out/Library/Frameworks/EAP8021X.framework/Headers
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix b/pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix
new file mode 100644
index 00000000000..c0e00ca1636
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/launchd/default.nix
@@ -0,0 +1,14 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  # No clue why the same file has two different names. Ask Apple!
+  installPhase = ''
+    mkdir -p $out/include/ $out/include/servers
+    cp liblaunch/*.h $out/include
+
+    cp liblaunch/bootstrap.h $out/include/servers
+    cp liblaunch/bootstrap.h $out/include/servers/bootstrap_defs.h
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libauto/auto_dtrace.h b/pkgs/os-specific/darwin/apple-source-releases/libauto/auto_dtrace.h
new file mode 100644
index 00000000000..bf367a3cabb
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libauto/auto_dtrace.h
@@ -0,0 +1,129 @@
+/*
+ * Generated by dtrace(1M).
+ */
+
+#ifndef _AUTO_DTRACE_H
+#define _AUTO_DTRACE_H
+
+#include <unistd.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+#define GARBAGE_COLLECTION_STABILITY "___dtrace_stability$garbage_collection$v1$1_1_0_1_1_0_1_1_0_1_1_0_1_1_0"
+
+#define GARBAGE_COLLECTION_TYPEDEFS "___dtrace_typedefs$garbage_collection$v2$6175746f5f636f6c6c656374696f6e5f70686173655f74$6175746f5f636f6c6c656374696f6e5f747970655f74$6d616c6c6f635f7a6f6e655f74"
+
+#if !defined(DTRACE_PROBES_DISABLED) || !DTRACE_PROBES_DISABLED
+
+#define GARBAGE_COLLECTION_AUTO_BLOCK_LOST_THREAD_LOCALITY(arg0, arg1) \
+do { \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
+  __dtrace_probe$garbage_collection$auto_block_lost_thread_locality$v1$766f6964202a$75696e7436345f74(arg0, arg1); \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
+} while (0)
+#define GARBAGE_COLLECTION_AUTO_BLOCK_LOST_THREAD_LOCALITY_ENABLED() \
+  ({ int _r = __dtrace_isenabled$garbage_collection$auto_block_lost_thread_locality$v1(); \
+    __asm__ volatile(""); \
+    _r; })
+#define GARBAGE_COLLECTION_AUTO_REFCOUNT_ONE_ALLOCATION(arg0) \
+do { \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
+  __dtrace_probe$garbage_collection$auto_refcount_one_allocation$v1$75696e7436345f74(arg0); \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
+} while (0)
+#define GARBAGE_COLLECTION_AUTO_REFCOUNT_ONE_ALLOCATION_ENABLED() \
+  ({ int _r = __dtrace_isenabled$garbage_collection$auto_refcount_one_allocation$v1(); \
+    __asm__ volatile(""); \
+    _r; })
+#define GARBAGE_COLLECTION_COLLECTION_BEGIN(arg0, arg1) \
+do { \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
+  __dtrace_probe$garbage_collection$collection_begin$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f747970655f74(arg0, arg1); \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
+} while (0)
+#define GARBAGE_COLLECTION_COLLECTION_BEGIN_ENABLED() \
+  ({ int _r = __dtrace_isenabled$garbage_collection$collection_begin$v1(); \
+    __asm__ volatile(""); \
+    _r; })
+#define GARBAGE_COLLECTION_COLLECTION_END(arg0, arg1, arg2, arg3, arg4) \
+do { \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
+  __dtrace_probe$garbage_collection$collection_end$v1$6d616c6c6f635f7a6f6e655f74202a$75696e7436345f74$75696e7436345f74$75696e7436345f74$75696e7436345f74(arg0, arg1, arg2, arg3, arg4); \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
+} while (0)
+#define GARBAGE_COLLECTION_COLLECTION_END_ENABLED() \
+  ({ int _r = __dtrace_isenabled$garbage_collection$collection_end$v1(); \
+    __asm__ volatile(""); \
+    _r; })
+#define GARBAGE_COLLECTION_COLLECTION_PHASE_BEGIN(arg0, arg1) \
+do { \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
+  __dtrace_probe$garbage_collection$collection_phase_begin$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f70686173655f74(arg0, arg1); \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
+} while (0)
+#define GARBAGE_COLLECTION_COLLECTION_PHASE_BEGIN_ENABLED() \
+  ({ int _r = __dtrace_isenabled$garbage_collection$collection_phase_begin$v1(); \
+    __asm__ volatile(""); \
+    _r; })
+#define GARBAGE_COLLECTION_COLLECTION_PHASE_END(arg0, arg1, arg2, arg3) \
+do { \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_TYPEDEFS); \
+  __dtrace_probe$garbage_collection$collection_phase_end$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f70686173655f74$75696e7436345f74$75696e7436345f74(arg0, arg1, arg2, arg3); \
+  __asm__ volatile(".reference " GARBAGE_COLLECTION_STABILITY); \
+} while (0)
+#define GARBAGE_COLLECTION_COLLECTION_PHASE_END_ENABLED() \
+  ({ int _r = __dtrace_isenabled$garbage_collection$collection_phase_end$v1(); \
+    __asm__ volatile(""); \
+    _r; })
+
+
+extern void __dtrace_probe$garbage_collection$auto_block_lost_thread_locality$v1$766f6964202a$75696e7436345f74(const void *, uint64_t);
+extern int __dtrace_isenabled$garbage_collection$auto_block_lost_thread_locality$v1(void);
+extern void __dtrace_probe$garbage_collection$auto_refcount_one_allocation$v1$75696e7436345f74(uint64_t);
+extern int __dtrace_isenabled$garbage_collection$auto_refcount_one_allocation$v1(void);
+extern void __dtrace_probe$garbage_collection$collection_begin$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f747970655f74(const malloc_zone_t *, auto_collection_type_t);
+extern int __dtrace_isenabled$garbage_collection$collection_begin$v1(void);
+extern void __dtrace_probe$garbage_collection$collection_end$v1$6d616c6c6f635f7a6f6e655f74202a$75696e7436345f74$75696e7436345f74$75696e7436345f74$75696e7436345f74(const malloc_zone_t *, uint64_t, uint64_t, uint64_t, uint64_t);
+extern int __dtrace_isenabled$garbage_collection$collection_end$v1(void);
+extern void __dtrace_probe$garbage_collection$collection_phase_begin$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f70686173655f74(const malloc_zone_t *, auto_collection_phase_t);
+extern int __dtrace_isenabled$garbage_collection$collection_phase_begin$v1(void);
+extern void __dtrace_probe$garbage_collection$collection_phase_end$v1$6d616c6c6f635f7a6f6e655f74202a$6175746f5f636f6c6c656374696f6e5f70686173655f74$75696e7436345f74$75696e7436345f74(const malloc_zone_t *, auto_collection_phase_t, uint64_t, uint64_t);
+extern int __dtrace_isenabled$garbage_collection$collection_phase_end$v1(void);
+
+#else
+
+#define GARBAGE_COLLECTION_AUTO_BLOCK_LOST_THREAD_LOCALITY(arg0, arg1) \
+do { \
+  } while (0)
+#define GARBAGE_COLLECTION_AUTO_BLOCK_LOST_THREAD_LOCALITY_ENABLED() (0)
+#define GARBAGE_COLLECTION_AUTO_REFCOUNT_ONE_ALLOCATION(arg0) \
+do { \
+  } while (0)
+#define GARBAGE_COLLECTION_AUTO_REFCOUNT_ONE_ALLOCATION_ENABLED() (0)
+#define GARBAGE_COLLECTION_COLLECTION_BEGIN(arg0, arg1) \
+do { \
+  } while (0)
+#define GARBAGE_COLLECTION_COLLECTION_BEGIN_ENABLED() (0)
+#define GARBAGE_COLLECTION_COLLECTION_END(arg0, arg1, arg2, arg3, arg4) \
+do { \
+  } while (0)
+#define GARBAGE_COLLECTION_COLLECTION_END_ENABLED() (0)
+#define GARBAGE_COLLECTION_COLLECTION_PHASE_BEGIN(arg0, arg1) \
+do { \
+  } while (0)
+#define GARBAGE_COLLECTION_COLLECTION_PHASE_BEGIN_ENABLED() (0)
+#define GARBAGE_COLLECTION_COLLECTION_PHASE_END(arg0, arg1, arg2, arg3) \
+do { \
+  } while (0)
+#define GARBAGE_COLLECTION_COLLECTION_PHASE_END_ENABLED() (0)
+
+#endif /* !defined(DTRACE_PROBES_DISABLED) || !DTRACE_PROBES_DISABLED */
+
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif  /* _AUTO_DTRACE_H */
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix
new file mode 100644
index 00000000000..1c61297c7d5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libauto/default.nix
@@ -0,0 +1,74 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  buildPhase = ''
+    cp ${./auto_dtrace.h} ./auto_dtrace.h
+
+    substituteInPlace auto_zone.cpp \
+      --replace "#include <msgtracer_client.h>" ''$'#include <asl.h>\nstatic void msgtracer_log_with_keys(...) { };'
+
+    substituteInPlace Definitions.h \
+      --replace "#include <System/pthread_machdep.h>" ""
+
+    # getspecific_direct is more efficient, but this should be equivalent...
+    substituteInPlace Zone.h \
+      --replace "_pthread_getspecific_direct" "pthread_getspecific" \
+      --replace "_pthread_has_direct_tsd()" "0" \
+      --replace "__PTK_FRAMEWORK_GC_KEY0" "110" \
+      --replace "__PTK_FRAMEWORK_GC_KEY1" "111" \
+      --replace "__PTK_FRAMEWORK_GC_KEY2" "112" \
+      --replace "__PTK_FRAMEWORK_GC_KEY3" "113" \
+      --replace "__PTK_FRAMEWORK_GC_KEY4" "114" \
+      --replace "__PTK_FRAMEWORK_GC_KEY5" "115" \
+      --replace "__PTK_FRAMEWORK_GC_KEY6" "116" \
+      --replace "__PTK_FRAMEWORK_GC_KEY7" "117" \
+      --replace "__PTK_FRAMEWORK_GC_KEY8" "118" \
+      --replace "__PTK_FRAMEWORK_GC_KEY9" "119"
+
+    substituteInPlace auto_zone.cpp \
+      --replace "__PTK_FRAMEWORK_GC_KEY9" "119" \
+      --replace "__PTK_FRAMEWORK_GC_KEY0" "110" \
+
+    substituteInPlace Zone.cpp \
+      --replace "_pthread_getspecific_direct" "pthread_getspecific" \
+      --replace "__PTK_FRAMEWORK_GC_KEY9" "119" \
+      --replace "__PTK_FRAMEWORK_GC_KEY0" "110" \
+      --replace "__PTK_LIBDISPATCH_KEY0"  "20" \
+      --replace "struct auto_zone_cursor {" ''$'extern "C" int pthread_key_init_np(int, void (*)(void *));\nstruct auto_zone_cursor {'
+
+    substituteInPlace auto_impl_utilities.c \
+      --replace "#   include <CrashReporterClient.h>" "void CRSetCrashLogMessage(void *msg) { };"
+
+    c++ -I. -O3 -c -Wno-c++11-extensions auto_zone.cpp
+    cc  -I. -O3 -Iauto_tester -c auto_impl_utilities.c
+    c++ -I. -O3 -c auto_weak.cpp
+    c++ -I. -O3 -c Admin.cpp
+    c++ -I. -O3 -c Bitmap.cpp
+    c++ -I. -O3 -c Definitions.cpp
+    c++ -I. -O3 -c Environment.cpp
+    c++ -I. -O3 -c Large.cpp
+    c++ -I. -O3 -c Region.cpp
+    c++ -I. -O3 -c Subzone.cpp
+    c++ -I. -O3 -c WriteBarrier.cpp
+    c++ -I. -O3 -c Zone.cpp
+    c++ -I. -O3 -c Thread.cpp
+    c++ -I. -O3 -c InUseEnumerator.cpp
+    c++ -I. -O3 -c auto_gdb_interface.cpp
+    c++ -I. -O3 -c PointerHash.cpp
+    c++ -I. -O3 -c ThreadLocalCollector.cpp
+    c++ -I. -O3 -c ZoneDump.cpp
+    c++ -I. -O3 -c ZoneCollectors.cpp
+    c++ -I. -O3 -c SubzonePartition.cpp
+    c++ -I. -O3 -c ZoneCollectionChecking.cpp
+    c++ -I. -O3 -c ZoneCompaction.cpp
+    c++ -I. -O3 -c BlockRef.cpp
+
+    c++ -Wl,-no_dtrace_dof --stdlib=libc++ -dynamiclib -install_name $out/lib/libauto.dylib -o libauto.dylib *.o
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib $out/include
+    cp auto_zone.h auto_weak.h auto_tester/auto_tester.h auto_gdb_interface.h $out/include
+    cp libauto.dylib $out/lib
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix
new file mode 100644
index 00000000000..a0201f9db2c
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libclosure/default.nix
@@ -0,0 +1,10 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp *.h $out/include/
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
new file mode 100644
index 00000000000..56c00557d43
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
@@ -0,0 +1,13 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include/dispatch $out/include/os
+
+    cp -r dispatch/*.h $out/include/dispatch
+    cp -r private/*.h  $out/include/dispatch
+    cp -r os/object.h  $out/include/os
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
new file mode 100644
index 00000000000..5b82835d3e6
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
@@ -0,0 +1,15 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  preConfigure = "cd libiconv";
+
+  postInstall = ''
+    mv $out/lib/libiconv.dylib $out/lib/libiconv-nocharset.dylib
+    install_name_tool -id $out/lib/libiconv-nocharset.dylib $out/lib/libiconv-nocharset.dylib
+
+    ld -dylib -o $out/lib/libiconv.dylib \
+      -reexport_library $out/lib/libiconv-nocharset.dylib \
+      -reexport_library $out/lib/libcharset.dylib \
+      -dylib_compatibility_version 7.0.0
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix
new file mode 100644
index 00000000000..027784e2ea6
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libpthread/default.nix
@@ -0,0 +1,13 @@
+{ stdenv, appleDerivation, libdispatch, xnu }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+  propagatedBuildInputs = [ libdispatch xnu ];
+
+  installPhase = ''
+    mkdir -p $out/include/pthread
+    cp pthread/*.h $out/include/pthread/
+    cp private/*.h $out/include/pthread/
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
new file mode 100644
index 00000000000..a74198e8ddd
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libresolv/default.nix
@@ -0,0 +1,51 @@
+{ stdenv, appleDerivation, Libinfo, configd, mDNSResponder }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "buildPhase" "installPhase" ];
+
+  buildInputs = [ Libinfo configd mDNSResponder ];
+
+  buildPhase = ''
+    cc -I. -c dns_util.c
+    cc -I. -c dns.c
+    cc -I. -c dns_async.c
+    cc -I. -c base64.c
+    cc -I. -c dst_api.c
+    cc -I. -c dst_hmac_link.c
+    cc -I. -c dst_support.c
+    cc -I. -c ns_date.c
+    cc -I. -c ns_name.c
+    cc -I. -c ns_netint.c
+    cc -I. -c ns_parse.c
+    cc -I. -c ns_print.c
+    cc -I. -c ns_samedomain.c
+    cc -I. -c ns_sign.c
+    cc -I. -c ns_ttl.c
+    cc -I. -c ns_verify.c
+    cc -I. -c res_comp.c
+    cc -I. -c res_data.c
+    cc -I. -c res_debug.c
+    cc -I. -c res_findzonecut.c
+    cc -I. -c res_init.c
+    cc -I. -c res_mkquery.c
+    cc -I. -c res_mkupdate.c
+    cc -I. -c res_query.c
+    cc -I. -c res_send.c
+    cc -I. -c res_sendsigned.c
+    cc -I. -c res_update.c
+    cc -dynamiclib -install_name $out/lib/libresolv.9.dylib -o libresolv.9.dylib *.o
+  '';
+
+  installPhase = ''
+    mkdir -p $out/include $out/include/arpa $out/lib
+
+    cp dns.h           $out/include/
+    cp dns_util.h      $out/include
+    cp nameser.h       $out/include
+    ln -s ../nameser.h $out/include/arpa
+    cp resolv.h        $out/include
+
+    cp libresolv.9.dylib $out/lib
+    ln -s libresolv.9.dylib $out/lib/libresolv.dylib
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix
new file mode 100644
index 00000000000..32c8d6717f0
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, appleDerivation, dyld }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "buildPhase" "installPhase" ];
+
+  buildInputs = [ dyld ];
+
+  buildPhase = ''
+    # cd src
+    # cc -I$PWD/../include -c libuwind.cxx
+    # cc -I$PWD/../include -c Registers.s
+    # cc -I$PWD/../include -c unw_getcontext.s
+    # cc -I$PWD/../include -c UnwindLevel1.c
+    # cc -I$PWD/../include -c UnwindLevel1-gcc-ext.c
+    # cc -I$PWD/../include -c Unwind-sjlj.c
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+
+    cp -r include $out
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix b/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
new file mode 100644
index 00000000000..63674808d93
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/mDNSResponder/default.nix
@@ -0,0 +1,10 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp mDNSShared/dns_sd.h $out/include
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix b/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
new file mode 100644
index 00000000000..cea5fc9a4e2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/objc4/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  # Not strictly necessary, since libSystem depends on it, but it's nice to be explicit so we
+  # can easily find out what's impure.
+  __propagatedImpureHostDeps = [
+    "/usr/lib/libauto.dylib"
+    "/usr/lib/libc++abi.dylib"
+    "/usr/lib/libc++.1.dylib"
+    "/usr/lib/libSystem.B.dylib"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/include/objc $out/lib
+    ln -s /usr/lib/libobjc.dylib $out/lib/libobjc.dylib
+    cp runtime/OldClasses.subproj/List.h $out/include/objc/List.h
+    cp runtime/NSObjCRuntime.h $out/include/objc/NSObjCRuntime.h
+    cp runtime/NSObject.h $out/include/objc/NSObject.h
+    cp runtime/Protocol.h $out/include/objc/Protocol.h
+    cp runtime/hashtable.h $out/include/objc/hashtable.h
+    cp runtime/hashtable2.h $out/include/objc/hashtable2.h
+    cp runtime/message.h $out/include/objc/message.h
+    cp runtime/objc-api.h $out/include/objc/objc-api.h
+    cp runtime/objc-auto.h $out/include/objc/objc-auto.h
+    cp runtime/objc-class.h $out/include/objc/objc-class.h
+    cp runtime/objc-exception.h $out/include/objc/objc-exception.h
+    cp runtime/objc-load.h $out/include/objc/objc-load.h
+    cp runtime/objc-runtime.h $out/include/objc/objc-runtime.h
+    cp runtime/objc-sync.h $out/include/objc/objc-sync.h
+    cp runtime/objc.h $out/include/objc/objc.h
+    cp runtime/runtime.h $out/include/objc/runtime.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/objc4/objc-probes.h b/pkgs/os-specific/darwin/apple-source-releases/objc4/objc-probes.h
new file mode 100644
index 00000000000..4ad9ba9ad10
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/objc4/objc-probes.h
@@ -0,0 +1,65 @@
+/*
+ * Generated by dtrace(1M).
+ */
+
+#ifndef _OBJC_PROBES_H
+#define _OBJC_PROBES_H
+
+#include <unistd.h>
+
+#ifdef  __cplusplus
+extern "C" {
+#endif
+
+#define OBJC_RUNTIME_STABILITY "___dtrace_stability$objc_runtime$v1$1_1_0_1_1_0_1_1_0_1_1_0_1_1_0"
+
+#define OBJC_RUNTIME_TYPEDEFS "___dtrace_typedefs$objc_runtime$v2"
+
+#if !defined(DTRACE_PROBES_DISABLED) || !DTRACE_PROBES_DISABLED
+
+#define OBJC_RUNTIME_OBJC_EXCEPTION_RETHROW() \
+do { \
+  __asm__ volatile(".reference " OBJC_RUNTIME_TYPEDEFS); \
+  __dtrace_probe$objc_runtime$objc_exception_rethrow$v1(); \
+  __asm__ volatile(".reference " OBJC_RUNTIME_STABILITY); \
+} while (0)
+#define OBJC_RUNTIME_OBJC_EXCEPTION_RETHROW_ENABLED() \
+  ({ int _r = __dtrace_isenabled$objc_runtime$objc_exception_rethrow$v1(); \
+    __asm__ volatile(""); \
+    _r; })
+#define OBJC_RUNTIME_OBJC_EXCEPTION_THROW(arg0) \
+do { \
+  __asm__ volatile(".reference " OBJC_RUNTIME_TYPEDEFS); \
+  __dtrace_probe$objc_runtime$objc_exception_throw$v1$766f6964202a(arg0); \
+  __asm__ volatile(".reference " OBJC_RUNTIME_STABILITY); \
+} while (0)
+#define OBJC_RUNTIME_OBJC_EXCEPTION_THROW_ENABLED() \
+  ({ int _r = __dtrace_isenabled$objc_runtime$objc_exception_throw$v1(); \
+    __asm__ volatile(""); \
+    _r; })
+
+
+extern void __dtrace_probe$objc_runtime$objc_exception_rethrow$v1(void);
+extern int __dtrace_isenabled$objc_runtime$objc_exception_rethrow$v1(void);
+extern void __dtrace_probe$objc_runtime$objc_exception_throw$v1$766f6964202a(const void *);
+extern int __dtrace_isenabled$objc_runtime$objc_exception_throw$v1(void);
+
+#else
+
+#define OBJC_RUNTIME_OBJC_EXCEPTION_RETHROW() \
+do { \
+  } while (0)
+#define OBJC_RUNTIME_OBJC_EXCEPTION_RETHROW_ENABLED() (0)
+#define OBJC_RUNTIME_OBJC_EXCEPTION_THROW(arg0) \
+do { \
+  } while (0)
+#define OBJC_RUNTIME_OBJC_EXCEPTION_THROW_ENABLED() (0)
+
+#endif /* !defined(DTRACE_PROBES_DISABLED) || !DTRACE_PROBES_DISABLED */
+
+
+#ifdef  __cplusplus
+}
+#endif
+
+#endif  /* _OBJC_PROBES_H */
diff --git a/pkgs/os-specific/darwin/apple-source-releases/objc4/pure.nix b/pkgs/os-specific/darwin/apple-source-releases/objc4/pure.nix
new file mode 100644
index 00000000000..28dcbdcb4a2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/objc4/pure.nix
@@ -0,0 +1,118 @@
+{ stdenv, fetchapplesource, libauto, launchd, libc_old, libunwind }:
+
+stdenv.mkDerivation rec {
+  version = "551.1";
+  name    = "objc4-${version}";
+
+  src = fetchapplesource {
+    inherit version;
+    name   = "objc4";
+    sha256 = "1jrdb6yyb5jwwj27c1r0nr2y2ihqjln8ynj61mpkvp144c1cm5bg";
+  };
+
+  patches = [ ./spinlocks.patch ];
+
+  buildInputs = [ libauto launchd libc_old libunwind ];
+
+  buildPhase = ''
+    cp ${./objc-probes.h} runtime/objc-probes.h
+
+    mkdir -p build/include/objc
+
+    cp runtime/hashtable.h               build/include/objc/hashtable.h
+    cp runtime/OldClasses.subproj/List.h build/include/objc/List.h
+    cp runtime/hashtable2.h              build/include/objc/hashtable2.h
+    cp runtime/message.h                 build/include/objc/message.h
+    cp runtime/objc-api.h                build/include/objc/objc-api.h
+    cp runtime/objc-auto.h               build/include/objc/objc-auto.h
+    cp runtime/objc-class.h              build/include/objc/objc-class.h
+    cp runtime/objc-exception.h          build/include/objc/objc-exception.h
+    cp runtime/objc-load.h               build/include/objc/objc-load.h
+    cp runtime/objc-sync.h               build/include/objc/objc-sync.h
+    cp runtime/objc.h                    build/include/objc/objc.h
+    cp runtime/objc-runtime.h            build/include/objc/objc-runtime.h
+    cp runtime/Object.h                  build/include/objc/Object.h
+    cp runtime/Protocol.h                build/include/objc/Protocol.h
+    cp runtime/runtime.h                 build/include/objc/runtime.h
+    cp runtime/NSObject.h                build/include/objc/NSObject.h
+    cp runtime/NSObjCRuntime.h           build/include/objc/NSObjCRuntime.h
+
+    # These would normally be in local/include but we don't do local, so they're
+    # going in with the others
+    cp runtime/maptable.h                build/include/objc/maptable.h
+    cp runtime/objc-abi.h                build/include/objc/objc-abi.h
+    cp runtime/objc-auto-dump.h          build/include/objc/objc-auto-dump.h
+    cp runtime/objc-gdb.h                build/include/objc/objc-gdb.h
+    cp runtime/objc-internal.h           build/include/objc/objc-internal.h
+
+    cc -o markgc markgc.c
+
+    FLAGS="-Wno-deprecated-register -Wno-unknown-pragmas -Wno-deprecated-objc-isa-usage -Wno-invalid-offsetof -Wno-inline-new-delete  -Wno-cast-of-sel-type -Iruntime -Ibuild/include -Iruntime/Accessors.subproj -D_LIBCPP_VISIBLE= -DOS_OBJECT_USE_OBJC=0 -DNDEBUG=1"
+
+    cc -std=gnu++11 $FLAGS -c runtime/hashtable2.mm
+    cc -std=gnu++11 $FLAGS -c runtime/maptable.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-auto.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-cache.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-class-old.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-class.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-errors.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-exception.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-file.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-initialize.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-layout.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-load.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-loadmethod.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-lockdebug.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-runtime-new.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-runtime-old.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-runtime.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-sel-set.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-sel.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-sync.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-typeencoding.mm
+    cc -std=gnu++11 $FLAGS -c runtime/Object.mm
+    cc -std=gnu++11 $FLAGS -c runtime/Protocol.mm
+
+    cc -std=gnu++11 $FLAGS -c runtime/objc-references.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-os.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-auto-dump.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-file-old.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-block-trampolines.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-externalref.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-weak.mm
+    cc -std=gnu++11 $FLAGS -c runtime/NSObject.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-opt.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-cache-old.mm
+    cc -std=gnu++11 $FLAGS -c runtime/objc-sel-old.mm
+
+    cc -std=gnu++11 $FLAGS -c runtime/Accessors.subproj/objc-accessors.mm
+
+    cc $FLAGS -c runtime/objc-sel-table.s
+
+    cc $FLAGS -c runtime/OldClasses.subproj/List.m
+    cc $FLAGS -c runtime/Messengers.subproj/objc-msg-arm.s
+    cc $FLAGS -c runtime/Messengers.subproj/objc-msg-i386.s
+    cc $FLAGS -c runtime/Messengers.subproj/objc-msg-x86_64.s
+    cc $FLAGS -c runtime/Messengers.subproj/objc-msg-simulator-i386.s
+
+    cc $FLAGS -c runtime/a1a2-blocktramps-i386.s
+    cc $FLAGS -c runtime/a2a3-blocktramps-i386.s
+
+    cc $FLAGS -c runtime/a1a2-blocktramps-x86_64.s
+    cc $FLAGS -c runtime/a2a3-blocktramps-x86_64.s
+
+    cc $FLAGS -c runtime/a1a2-blocktramps-arm.s
+    cc $FLAGS -c runtime/a2a3-blocktramps-arm.s
+
+    c++ -Wl,-no_dtrace_dof --stdlib=libc++ -dynamiclib -lauto -install_name $out/lib/libobjc.dylib -o libobjc.dylib *.o
+
+    ./markgc -p libobjc.dylib
+  '';
+
+  installPhase = ''
+    mkdir -p $out/include $out/lib
+
+    mv build/include/objc $out/include
+    mv libobjc.dylib $out/lib
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/objc4/spinlocks.patch b/pkgs/os-specific/darwin/apple-source-releases/objc4/spinlocks.patch
new file mode 100644
index 00000000000..50c6a983fe4
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/objc4/spinlocks.patch
@@ -0,0 +1,107 @@
+--- objc4-551.1/runtime/objc-os.h	2013-06-10 21:16:15.000000000 -0400
++++ ../objc4-551.1/runtime/objc-os.h	2015-01-19 01:01:36.000000000 -0500
+@@ -77,27 +77,72 @@
+ #   include <mach-o/getsect.h>
+ #   include <mach-o/dyld_priv.h>
+ #   include <malloc/malloc.h>
+-#   include <os/lock_private.h>
+ #   include <libkern/OSAtomic.h>
+ #   include <libkern/OSCacheControl.h>
+-#   include <System/pthread_machdep.h>
+ #   include "objc-probes.h"  // generated dtrace probe definitions.
+ 
++#define __PTK_FRAMEWORK_OBJC_KEY5 45
++#define __PTK_FRAMEWORK_OBJC_KEY6 46
++#define __PTK_FRAMEWORK_OBJC_KEY7 47
++#define __PTK_FRAMEWORK_OBJC_KEY8 48
++#define __PTK_FRAMEWORK_OBJC_KEY9 49
++
++extern "C" int pthread_key_init_np(int, void (*)(void *));
++
+ // Some libc functions call objc_msgSend() 
+ // so we can't use them without deadlocks.
+ void syslog(int, const char *, ...) UNAVAILABLE_ATTRIBUTE;
+ void vsyslog(int, const char *, va_list) UNAVAILABLE_ATTRIBUTE;
+ 
++#if defined(__i386__) || defined(__x86_64__)
++
++// Inlined spinlock.
++// Not for arm on iOS because it hurts uniprocessor performance.
++
++#define ARR_SPINLOCK_INIT 0
++// XXX -- Careful: OSSpinLock isn't volatile, but should be
++typedef volatile int ARRSpinLock;
++__attribute__((always_inline))
++static inline void ARRSpinLockLock(ARRSpinLock *l)
++{
++    unsigned y;
++again:
++    if (__builtin_expect(__sync_lock_test_and_set(l, 1), 0) == 0) {
++        return;
++    }
++    for (y = 1000; y; y--) {
++#if defined(__i386__) || defined(__x86_64__)
++        asm("pause");
++#endif
++        if (*l == 0) goto again;
++    }
++    thread_switch(THREAD_NULL, SWITCH_OPTION_DEPRESS, 1);
++    goto again;
++}
++__attribute__((always_inline))
++static inline void ARRSpinLockUnlock(ARRSpinLock *l)
++{
++    __sync_lock_release(l);
++}
++__attribute__((always_inline))
++static inline int ARRSpinLockTry(ARRSpinLock *l)
++{
++    return __sync_bool_compare_and_swap(l, 0, 1);
++}
++
++#define spinlock_t ARRSpinLock
++#define spinlock_trylock(l) ARRSpinLockTry(l)
++#define spinlock_lock(l) ARRSpinLockLock(l)
++#define spinlock_unlock(l) ARRSpinLockUnlock(l)
++#define SPINLOCK_INITIALIZER ARR_SPINLOCK_INIT 
+ 
+-#define spinlock_t os_lock_handoff_s
+-#define spinlock_trylock(l) os_lock_trylock(l)
+-#define spinlock_lock(l) os_lock_lock(l)
+-#define spinlock_unlock(l) os_lock_unlock(l)
+-#define SPINLOCK_INITIALIZER OS_LOCK_HANDOFF_INIT
++#endif
+ 
+ 
+ #if !TARGET_OS_IPHONE
+-#   include <CrashReporterClient.h>
++#define CRSetCrashLogMessage(msg)
++#define CRGetCrashLogMessage() 0
++#define CRSetCrashLogMessage2(msg)
+ #else
+     // CrashReporterClient not yet available on iOS
+     __BEGIN_DECLS
+@@ -594,21 +639,13 @@
+ { 
+     assert(is_valid_direct_key(k));
+ 
+-    if (_pthread_has_direct_tsd()) {
+-        return _pthread_getspecific_direct(k);
+-    } else {
+-        return pthread_getspecific(k);
+-    }
++    return pthread_getspecific(k);
+ }
+ static inline void tls_set_direct(tls_key_t k, void *value) 
+ { 
+     assert(is_valid_direct_key(k));
+ 
+-    if (_pthread_has_direct_tsd()) {
+-        _pthread_setspecific_direct(k, value);
+-    } else {
+-        pthread_setspecific(k, value);
+-    }
++    pthread_setspecific(k, value);
+ }
+ 
+ // not arm
diff --git a/pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix
new file mode 100644
index 00000000000..ffc19801c5d
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/ppp/default.nix
@@ -0,0 +1,16 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include/ppp
+
+    cp Controller/ppp_msg.h                    $out/include/ppp
+    cp Controller/pppcontroller_types.h        $out/include/ppp
+    cp Controller/pppcontroller_types.h        $out/include
+    cp Controller/pppcontroller.defs           $out/include/ppp
+    cp Controller/pppcontroller_mach_defines.h $out/include
+    cp Controller/PPPControllerPriv.h          $out/include/ppp
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix b/pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix
new file mode 100644
index 00000000000..315f93bef08
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/removefile/default.nix
@@ -0,0 +1,10 @@
+{ stdenv, appleDerivation }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include/
+    cp removefile.h checkint.h $out/include/
+  '';
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
new file mode 100644
index 00000000000..8276d2f4b42
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -0,0 +1,117 @@
+{ stdenv, appleDerivation, fetchzip, bootstrap_cmds, bison, flex, gnum4, unifdef, perl }:
+
+appleDerivation {
+  phases = [ "unpackPhase" "patchPhase" "installPhase" ];
+
+  buildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl ];
+
+  patchPhase = ''
+    substituteInPlace Makefile \
+      --replace "/bin/" "" \
+      --replace "MAKEJOBS := " '# MAKEJOBS := '
+
+    substituteInPlace makedefs/MakeInc.cmd \
+      --replace "/usr/bin/" "" \
+      --replace "/bin/" "" \
+      --replace "-Werror " ""
+
+    substituteInPlace makedefs/MakeInc.def \
+      --replace "-c -S -m" "-c -m"
+
+    substituteInPlace makedefs/MakeInc.top \
+      --replace "MEMORY_SIZE := " 'MEMORY_SIZE := 1073741824 # '
+
+    substituteInPlace libkern/kxld/Makefile \
+      --replace "-Werror " ""
+
+    substituteInPlace SETUP/kextsymboltool/Makefile \
+      --replace "-lstdc++" "-lc++"
+
+    substituteInPlace libsyscall/xcodescripts/mach_install_mig.sh \
+      --replace "/usr/include" "/include" \
+      --replace "/usr/local/include" "/include" \
+      --replace "MIG=" "# " \
+      --replace "MIGCC=" "# " \
+      --replace " -o 0" "" \
+      --replace '$SRC/$mig' '-I$DSTROOT/include $SRC/$mig' \
+      --replace '$SRC/servers/netname.defs' '-I$DSTROOT/include $SRC/servers/netname.defs'
+
+    patchShebangs .
+  '';
+
+  installPhase = ''
+    # This is a bit of a hack...
+    mkdir -p sdk/usr/local/libexec
+
+    cat > sdk/usr/local/libexec/availability.pl <<EOF
+      #!$SHELL
+      if [ "\$1" == "--macosx" ]; then
+        echo 10.0 10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 10.9
+      elif [ "\$1" == "--ios" ]; then
+        echo 2.0 2.1 2.2 3.0 3.1 3.2 4.0 4.1 4.2 4.3 5.0 5.1 6.0 6.1 7.0
+      fi
+    EOF
+    chmod +x sdk/usr/local/libexec/availability.pl
+
+    export SDKROOT_RESOLVED=$PWD/sdk
+    export HOST_SDKROOT_RESOLVED=$PWD/sdk
+    export PLATFORM=MacOSX
+    export SDKVERSION=10.7
+
+    export CC=cc
+    export CXX=c++
+    export MIG=${bootstrap_cmds}/bin/mig
+    export MIGCOM=${bootstrap_cmds}/libexec/migcom
+    export STRIP=sentinel-missing
+    export LIPO=sentinel-missing
+    export LIBTOOL=sentinel-missing
+    export NM=sentinel-missing
+    export UNIFDEF=${unifdef}/bin/unifdef
+    export DSYMUTIL=sentinel-missing
+    export CTFCONVERT=sentinel-missing
+    export CTFMERGE=sentinel-missing
+    export CTFINSERT=sentinel-missing
+    export NMEDIT=sentinel-missing
+
+    export HOST_OS_VERSION=10.7
+    export HOST_CC=cc
+    export HOST_FLEX=${flex}/bin/flex
+    export HOST_BISON=${bison}/bin/bison
+    export HOST_GM4=${gnum4}/bin/m4
+    export HOST_CODESIGN='echo dummy_codesign'
+    export HOST_CODESIGN_ALLOCATE=echo
+
+    export DSTROOT=$out
+    make installhdrs
+
+    mv $out/usr/include $out
+    rmdir $out/usr
+
+    # TODO: figure out why I need to do this
+    cp libsyscall/wrappers/*.h $out/include
+    mkdir -p $out/include/os
+    cp libsyscall/os/tsd.h $out/include/os/tsd.h
+    cp EXTERNAL_HEADERS/AssertMacros.h $out/include
+
+    # Build the mach headers we crave
+    export MIGCC=cc
+    export ARCHS="x86_64"
+    export SRCROOT=$PWD/libsyscall
+    export DERIVED_SOURCES_DIR=$out/include
+    export SDKROOT=$out
+    libsyscall/xcodescripts/mach_install_mig.sh
+
+    # Get rid of the System prefix
+    mv $out/System/* $out/
+
+    # Add some symlinks
+    ln -s $out/Library/Frameworks/System.framework/Versions/B \
+          $out/Library/Frameworks/System.framework/Versions/Current
+    ln -s $out/Library/Frameworks/System.framework/Versions/Current/PrivateHeaders \
+          $out/Library/Frameworks/System.framework/Headers
+
+    # IOKit (and possibly the others) is incomplete, so let's not make it visible from here...
+    mkdir $out/Library/PrivateFrameworks
+    mv $out/Library/Frameworks/IOKit.framework $out/Library/PrivateFrameworks
+  '';
+}
diff --git a/pkgs/os-specific/darwin/cctools-port/default.nix b/pkgs/os-specific/darwin/cctools-port/default.nix
deleted file mode 100644
index cdc259c1e2a..00000000000
--- a/pkgs/os-specific/darwin/cctools-port/default.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{ stdenv, cross, fetchurl, autoconf, automake, libtool
-, libcxx, llvm, clang, openssl, libuuid
-, maloader, makeWrapper, xctoolchain
-}:
-
-stdenv.mkDerivation rec {
-  name = "cctools-port-${version}";
-  version = "845";
-
-  src = fetchurl {
-    url = "https://github.com/tpoechtrager/cctools-port/archive/"
-        + "cctools-${version}-ld64-136-1.tar.gz";
-    sha256 = "06pg6h1g8avgx4j6cfykdpggf490li796gzhhyqn27jsagli307i";
-  };
-
-  buildInputs = [
-    autoconf automake libtool libcxx llvm clang openssl libuuid makeWrapper
-  ];
-
-  patches = [ ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch ];
-
-  enableParallelBuilding = true;
-
-  postPatch = ''
-    patchShebangs tools
-    sed -i -e 's/which/type -P/' tools/*.sh
-    sed -i -e 's|clang++|& -I${libcxx}/include/c++/v1|' cctools/autogen.sh
-
-    # Workaround for https://www.sourceware.org/bugzilla/show_bug.cgi?id=11157
-    cat > cctools/include/unistd.h <<EOF
-    #ifdef __block
-    #  undef __block
-    #  include_next "unistd.h"
-    #  define __block __attribute__((__blocks__(byref)))
-    #else
-    #  include_next "unistd.h"
-    #endif
-    EOF
-  '';
-
-  preConfigure = ''
-    cd cctools
-    sh autogen.sh
-  '';
-
-  configureFlags = [
-    "CXXFLAGS=-I${libcxx}/include/c++/v1"
-    "--target=${cross.config}"
-  ];
-
-  postInstall = ''
-    for tool in dyldinfo dwarfdump dsymutil; do
-      makeWrapper "${maloader}/bin/ld-mac" "$out/bin/${cross.config}-$tool" \
-        --add-flags "${xctoolchain}/bin/$tool"
-      ln -s "$out/bin/${cross.config}-$tool" "$out/bin/$tool"
-    done
-  '';
-
-  meta = {
-    homepage = "http://www.opensource.apple.com/source/cctools/";
-    description = "Mac OS X Compiler Tools (cross-platform port)";
-    license = stdenv.lib.licenses.apsl20;
-  };
-}
diff --git a/pkgs/os-specific/darwin/cctools-port/ld-ignore-rpath-link.patch b/pkgs/os-specific/darwin/cctools/ld-ignore-rpath-link.patch
index fc87f69ac32..fc87f69ac32 100644
--- a/pkgs/os-specific/darwin/cctools-port/ld-ignore-rpath-link.patch
+++ b/pkgs/os-specific/darwin/cctools/ld-ignore-rpath-link.patch
diff --git a/pkgs/os-specific/darwin/cctools-port/ld-rpath-nonfinal.patch b/pkgs/os-specific/darwin/cctools/ld-rpath-nonfinal.patch
index 265d0d30477..265d0d30477 100644
--- a/pkgs/os-specific/darwin/cctools-port/ld-rpath-nonfinal.patch
+++ b/pkgs/os-specific/darwin/cctools/ld-rpath-nonfinal.patch
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
new file mode 100644
index 00000000000..bfb389ef37c
--- /dev/null
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -0,0 +1,102 @@
+{ stdenv, fetchurl, autoconf, automake, libtool
+, llvm, libcxx, libcxxabi, clang, openssl, libuuid
+, libobjc ? null
+}:
+
+let
+  baseParams = rec {
+    name = "cctools-port-${version}";
+    version = "862";
+
+    src = let
+      # Should be fetchFromGitHub but it was whining so this will do for now
+      owner  = "tpoechtrager";
+      repo   = "cctools-port";
+      rev    = "59d21d2c793c51d205c8b4ab14b9b28e63c72445";
+    in fetchurl {
+      url    = "https://github.com/${owner}/${repo}/archive/${rev}.tar.gz";
+      sha256 = "01f31ijpnplbiyp7ldwzy8vbkn3j3m56n5blsvsav5nlp4lp2g71";
+    };
+
+    buildInputs = [ autoconf automake libtool openssl libuuid ] ++
+      # Only need llvm and clang if the stdenv isn't already clang-based (TODO: just make a stdenv.cc.isClang)
+      stdenv.lib.optionals (!stdenv.isDarwin) [ llvm clang ] ++
+      stdenv.lib.optionals stdenv.isDarwin [ libcxxabi libobjc ];
+
+    patches = [
+      ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch
+    ];
+
+    enableParallelBuilding = true;
+
+    configureFlags = stdenv.lib.optionals (!stdenv.isDarwin) [ "CXXFLAGS=-I${libcxx}/include/c++/v1" ];
+
+    postPatch = ''
+      sed -i -e 's/addStandardLibraryDirectories = true/addStandardLibraryDirectories = false/' cctools/ld64/src/ld/Options.cpp
+
+      # FIXME: there are far more absolute path references that I don't want to fix right now
+      substituteInPlace cctools/configure.ac \
+        --replace "-isystem /usr/local/include -isystem /usr/pkg/include" "" \
+        --replace "-L/usr/local/lib" "" \
+
+      substituteInPlace cctools/include/Makefile \
+        --replace "/bin/" ""
+
+      patchShebangs tools
+      sed -i -e 's/which/type -P/' tools/*.sh
+
+      # Workaround for https://www.sourceware.org/bugzilla/show_bug.cgi?id=11157
+      cat > cctools/include/unistd.h <<EOF
+      #ifdef __block
+      #  undef __block
+      #  include_next "unistd.h"
+      #  define __block __attribute__((__blocks__(byref)))
+      #else
+      #  include_next "unistd.h"
+      #endif
+      EOF
+    '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
+      sed -i -e 's|clang++|& -I${libcxx}/include/c++/v1|' cctools/autogen.sh
+    '';
+
+    preConfigure = ''
+      cd cctools
+      sh autogen.sh
+    '';
+
+    preInstall = ''
+      pushd include
+      make DSTROOT=$out/include RC_OS=common install
+      popd
+    '';
+
+    meta = {
+      homepage = "http://www.opensource.apple.com/source/cctools/";
+      description = "Mac OS X Compiler Tools (cross-platform port)";
+      license = stdenv.lib.licenses.apsl20;
+    };
+  };
+in {
+  native = stdenv.mkDerivation (baseParams // {
+    # A hack for now...
+    postInstall = ''
+      cat >$out/bin/dsymutil << EOF
+      #!${stdenv.shell}
+      EOF
+      chmod +x $out/bin/dsymutil
+    '';
+  });
+
+  cross =
+    { cross, maloader, makeWrapper, xctoolchain}: stdenv.mkDerivation (baseParams // {
+      configureFlags = baseParams.configureFlags ++ [ "--target=${cross.config}" ];
+
+      postInstall = ''
+        for tool in dyldinfo dwarfdump dsymutil; do
+          ${makeWrapper}/bin/makeWrapper "${maloader}/bin/ld-mac" "$out/bin/${cross.config}-$tool" \
+            --add-flags "${xctoolchain}/bin/$tool"
+          ln -s "$out/bin/${cross.config}-$tool" "$out/bin/$tool"
+        done
+      '';
+    });
+}
diff --git a/pkgs/os-specific/darwin/command-line-tools/default.nix b/pkgs/os-specific/darwin/command-line-tools/default.nix
new file mode 100644
index 00000000000..c437c76cfd6
--- /dev/null
+++ b/pkgs/os-specific/darwin/command-line-tools/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, fetchurl, xar, gzip, cpio }:
+
+let
+  pkg = { name, sha256 }: stdenv.mkDerivation {
+    inherit name;
+
+    src = fetchurl {
+      url = "http://swcdn.apple.com/content/downloads/00/14/031-07556/i7hoqm3awowxdy48l34uel4qvwhdq8lgam/${name}.pkg";
+      inherit sha256;
+    };
+
+    buildInputs = [ xar gzip cpio ];
+
+    phases = [ "unpackPhase" "installPhase" ];
+
+    unpackPhase = ''
+      xar -x -f $src
+    '';
+
+    installPhase = ''
+      start="$(pwd)"
+      mkdir -p $out
+      cd $out
+      cat $start/Payload | gzip -d | cpio -idm
+    '';
+
+    meta = with stdenv.lib; {
+      description = "Apple developer tools ${name}";
+      maintainers = with maintainers; [ copumpkin ];
+      platforms   = platforms.darwin;
+    };
+  };
+in rec {
+  tools = pkg {
+    name   = "CLTools_Executables";
+    sha256 = "1rqrgip9pwr9d6p1hkd027lzxpymr1qm54jjnkldjjb8m4nps7bp";
+  };
+
+  sdk = pkg {
+    name   = "DevSDK_OSX109";
+    sha256 = "0x6r61h78r5cxk9dbw6fnjpn6ydi4kcajvllpczx3mi52crlkm4x";
+  };
+}
diff --git a/pkgs/os-specific/darwin/osx-private-sdk/default.nix b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
new file mode 100644
index 00000000000..85e1dc50f35
--- /dev/null
+++ b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitHub, python, osx_sdk }:
+
+let
+  sdkVersion = "10.9";
+in stdenv.mkDerivation {
+  name = "PrivateMacOSX${sdkVersion}.sdk";
+
+  src = fetchFromGitHub {
+    owner  = "copumpkin";
+    repo   = "OSXPrivateSDK";
+    rev    = "bde9cba13e6ae62a8e4e0f405008ea719526e7ad";
+    sha256 = "1vj3fxwp32irxjk987p7a223sm5bl5rrlajcvgy69k0wb0fp0krc";
+  };
+
+  buildInputs = [ python ];
+
+  configurePhase = "true";
+
+  buildPhase = ''
+    python PrivateSDK.py -i ${osx_sdk}/Developer/SDKs/MacOSX${sdkVersion}.sdk -o PrivateMacOSX${sdkVersion}.sdk
+  '';
+
+  installPhase = ''
+    mkdir -p $out/Developer/SDKs/
+    mv PrivateMacOSX${sdkVersion}.sdk $out/Developer/SDKs
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A private Mac OS ${sdkVersion} SDK, suitable for building many of Apple's open source releases";
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.unfree;
+  };
+}
diff --git a/pkgs/os-specific/darwin/osx-sdk/default.nix b/pkgs/os-specific/darwin/osx-sdk/default.nix
new file mode 100644
index 00000000000..612bf003743
--- /dev/null
+++ b/pkgs/os-specific/darwin/osx-sdk/default.nix
@@ -0,0 +1,26 @@
+{ stdenv }:
+
+let
+  version = "10.9";
+in stdenv.mkDerivation {
+  name = "MacOSX10.9.sdk";
+
+  src = "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.9.sdk";
+
+  unpackPhase    = "true";
+  configurePhase = "true";
+  buildPhase     = "true";
+
+  installPhase = ''
+    mkdir -p $out/Developer/SDKs/
+    echo "Source is: $src"
+    cp -r $src $out/Developer/SDKs/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "The Mac OS ${version} SDK";
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.unfree;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/darwin/otool/default.nix b/pkgs/os-specific/darwin/otool/default.nix
index e0793664a9c..671e51542d0 100644
--- a/pkgs/os-specific/darwin/otool/default.nix
+++ b/pkgs/os-specific/darwin/otool/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
   meta = with stdenv.lib; {
     description = "Object file displaying tool";
     homepage    = https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/otool.1.html;
-    # TODO license     = with licenses; [ apsl20 gpl2Plus ];
+    license     = with licenses; [ apsl20 gpl2Plus ];
     maintainers = with maintainers; [ lovek323 ];
     platforms   = platforms.darwin;
 
diff --git a/pkgs/os-specific/darwin/security-tool/default.nix b/pkgs/os-specific/darwin/security-tool/default.nix
new file mode 100644
index 00000000000..49d61f392c5
--- /dev/null
+++ b/pkgs/os-specific/darwin/security-tool/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, fetchurl, osx_private_sdk }:
+
+stdenv.mkDerivation rec {
+	version = "55115";
+  name    = "SecurityTool-${version}";
+
+  src = fetchurl {
+    url = "http://opensource.apple.com/tarballs/SecurityTool/SecurityTool-${version}.tar.gz";
+    sha256 = "0apcz4vy2z5645jhrs60wj3w27mncjjqv42h5lln36g6qs2n9113";
+  };
+
+  configurePhase = "";
+
+  # Someday we shall purge this impurity!
+  buildPhase = ''
+    /usr/bin/xcodebuild SDKROOT=${osx_private_sdk}/Developer/SDKs/PrivateMacOSX10.9.sdk/
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin/
+    cp build/Release/security $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Command line interface to Mac OS X keychains and Security framework";
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/linux/acpi-call/default.nix b/pkgs/os-specific/linux/acpi-call/default.nix
index 63c55341b14..289b54f1b54 100644
--- a/pkgs/os-specific/linux/acpi-call/default.nix
+++ b/pkgs/os-specific/linux/acpi-call/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation {
     sed -e 's/break/true/' -i examples/turn_off_gpu.sh
     sed -e 's@/bin/bash@.bin/sh@' -i examples/turn_off_gpu.sh
     sed -e "s@/lib/modules/\$(.*)@${kernel.dev}/lib/modules/${kernel.modDirVersion}@" -i Makefile
+    sed -e 's@acpi/acpi[.]h@linux/acpi.h@g' -i acpi_call.c
   '';
  
   installPhase = ''
diff --git a/pkgs/os-specific/linux/acpi/default.nix b/pkgs/os-specific/linux/acpi/default.nix
index 0fc79922515..b815cd778fa 100644
--- a/pkgs/os-specific/linux/acpi/default.nix
+++ b/pkgs/os-specific/linux/acpi/default.nix
@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     homepage = http://sourceforge.net/projects/acpiclient/;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = maintainers.mornfall;
+    maintainers = [ maintainers.mornfall ];
   };
 }
diff --git a/pkgs/os-specific/linux/acpid/default.nix b/pkgs/os-specific/linux/acpid/default.nix
index c9d45835cfd..39b5565ffbd 100644
--- a/pkgs/os-specific/linux/acpid/default.nix
+++ b/pkgs/os-specific/linux/acpid/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "acpid-2.0.22";
+  name = "acpid-2.0.23";
 
   src = fetchurl {
     url = "mirror://sourceforge/acpid2/${name}.tar.xz";
-    sha256 = "0cdbcy5xjdcyp2x6hzgpv6a9vg9bbxmypmfvv1qzgj43897la49x";
+    sha256 = "1vl7c6vc724v4jwki17czgj6lnrknnj1a6llm8gkl32i2gnam5j3";
   };
 
   preBuild = ''
diff --git a/pkgs/os-specific/linux/afuse/default.nix b/pkgs/os-specific/linux/afuse/default.nix
index 70c8f36105c..4cf53311070 100644
--- a/pkgs/os-specific/linux/afuse/default.nix
+++ b/pkgs/os-specific/linux/afuse/default.nix
@@ -1,18 +1,18 @@
-{ stdenv, fetchurl, pkgconfig, fuse }:
+{ stdenv, fetchurl, pkgconfig, autoreconfHook, fuse }:
 
 stdenv.mkDerivation {
-  name = "afuse-0.2";
+  name = "afuse-0.4.1";
 
   src = fetchurl {
-    url = mirror://sourceforge/afuse/0.2/afuse-0.2.tar.gz;
-    sha256 = "1lj2jdks0bgwxbjqp5a9f7qdry19kar6pg7dh1ml98gapx9siylj";
+    url = https://github.com/pcarrier/afuse/archive/v0.4.1.tar.gz;
+    sha256 = "1sfhicmxppkvdd4z9klfn63snb71gr9hff6xij1gzk94xg6m0ycc";
   };
 
-  buildInputs = [ pkgconfig fuse ];
+  buildInputs = [ autoreconfHook pkgconfig fuse ];
 
-  meta = { 
+  meta = {
     description = "Automounter in userspace";
-    homepage = http://sourceforge.net/projects/afuse;
+    homepage = https://github.com/pcarrier/afuse;
     license = stdenv.lib.licenses.gpl2;
     maintainers = [ stdenv.lib.maintainers.marcweber ];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/alsa-firmware/default.nix b/pkgs/os-specific/linux/alsa-firmware/default.nix
new file mode 100644
index 00000000000..ab81ece5f71
--- /dev/null
+++ b/pkgs/os-specific/linux/alsa-firmware/default.nix
@@ -0,0 +1,35 @@
+{stdenv, fetchurl}:
+
+stdenv.mkDerivation rec {
+  name = "alsa-firmware-1.0.29";
+
+  src = fetchurl {
+    urls = [
+      "ftp://ftp.alsa-project.org/pub/firmware/${name}.tar.bz2"
+      "http://alsa.cybermirror.org/firmware/${name}.tar.bz2"
+    ];
+    sha256 = "0gfcyj5anckjn030wcxx5v2xk2s219nyf99s9m833275b5wz2piw";
+  };
+
+  configureFlags = ''
+    --with-hotplug-dir=$(out)/lib/firmware
+  '';
+
+  dontStrip = true;
+
+  postInstall = ''
+    # These are lifted from the Arch PKGBUILD
+    # remove files which conflicts with linux-firmware
+    rm -rf $out/lib/firmware/{ct{efx,speq}.bin,ess,korg,sb16,yamaha}
+    # remove broken symlinks (broken upstream)
+    rm -rf $out/lib/firmware/turtlebeach
+    # remove empty dir
+    rm -rf $out/bin
+  '';
+
+  meta = {
+    homepage = http://www.alsa-project.org/main/index.php/Main_Page;
+    description = "Soundcard firmwares from the alsa project";
+    license = stdenv.lib.licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/os-specific/linux/alsa-lib/alsa-plugin-conf-multilib.patch b/pkgs/os-specific/linux/alsa-lib/alsa-plugin-conf-multilib.patch
new file mode 100644
index 00000000000..b17df9a492e
--- /dev/null
+++ b/pkgs/os-specific/linux/alsa-lib/alsa-plugin-conf-multilib.patch
@@ -0,0 +1,232 @@
+diff --git a/src/control/control.c b/src/control/control.c
+index d66ed75..42cecad 100644
+--- a/src/control/control.c
++++ b/src/control/control.c
+@@ -838,6 +838,10 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
+ #ifndef PIC
+ 	extern void *snd_control_open_symbols(void);
+ #endif
++
++	snd_config_t *libs = NULL;
++	const char *libs_lib = NULL;
++
+ 	if (snd_config_get_type(ctl_conf) != SND_CONFIG_TYPE_COMPOUND) {
+ 		if (name)
+ 			SNDERR("Invalid type for CTL %s definition", name);
+@@ -879,6 +883,19 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
+ 					SNDERR("Invalid type for %s", id);
+ 					goto _err;
+ 				}
++
++				continue;
++			}
++			// Handle an array of extra libs.
++			if (strcmp(id, "libs") == 0) {
++				if (snd_config_get_type(n) != SND_CONFIG_TYPE_COMPOUND) {
++					SNDERR("Invalid type for libs definition in CTL %s definition",
++						str);
++					goto _err;
++				}
++
++				libs = n;
++
+ 				continue;
+ 			}
+ 			if (strcmp(id, "open") == 0) {
+@@ -903,7 +920,62 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
+ 		open_name = buf;
+ 		sprintf(buf, "_snd_ctl_%s_open", str);
+ 	}
+-	if (!lib) {
++
++#ifndef PIC
++	snd_control_open_symbols();
++#endif
++
++	// Normal alsa behaviour when there is no libs array.
++	if (!libs) {
++		if (lib) {
++			open_func = snd_dlobj_cache_get(lib, open_name,
++				SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 1);
++		}
++	}
++	// Handle libs array.
++	// Suppresses error messages if any function is loaded successfully.
++	else {
++		if (lib) {
++			open_func = snd_dlobj_cache_get(lib, open_name,
++				SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 0);
++		}
++
++		if (!open_func) {
++			snd_config_for_each(i, next, libs) {
++				snd_config_t *n = snd_config_iterator_entry(i);
++
++				err = snd_config_get_string(n, &libs_lib);
++				if (err < 0) {
++					SNDERR("Invalid entry in CTL %s libs definition", str);
++					goto _err;
++				}
++
++				if (!open_func) {
++					open_func = snd_dlobj_cache_get(libs_lib, open_name,
++						SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 0);
++				}
++			}
++		}
++
++		// Print error messages.
++		if (!open_func) {
++			if (lib) {
++				SNDERR("Either %s cannot be opened or %s was not defined inside",
++					lib, open_name);
++			}
++
++			snd_config_for_each(i, next, libs) {
++				snd_config_t *n = snd_config_iterator_entry(i);
++
++				snd_config_get_string(n, &libs_lib);
++				SNDERR("Either %s cannot be opened or %s was not defined inside",
++					libs_lib, open_name);
++			}
++		}
++	}
++
++	// Look in ALSA_PLUGIN_DIR iff we found nowhere else to look.
++	if (!lib && (!libs || !libs_lib)) {
+ 		const char *const *build_in = build_in_ctls;
+ 		while (*build_in) {
+ 			if (!strcmp(*build_in, str))
+@@ -919,12 +991,11 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
+ 			lib = buf1;
+ 			sprintf(buf1, "%s/libasound_module_ctl_%s.so", ALSA_PLUGIN_DIR, str);
+ 		}
+-	}
+-#ifndef PIC
+-	snd_control_open_symbols();
+-#endif
+-	open_func = snd_dlobj_cache_get(lib, open_name,
++
++		open_func = snd_dlobj_cache_get(lib, open_name,
+ 			SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 1);
++	}
++
+ 	if (open_func) {
+ 		err = open_func(ctlp, name, ctl_root, ctl_conf, mode);
+ 		if (err >= 0) {
+diff --git a/src/pcm/pcm.c b/src/pcm/pcm.c
+index 2e24338..7f489f4 100644
+--- a/src/pcm/pcm.c
++++ b/src/pcm/pcm.c
+@@ -2116,6 +2116,10 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
+ #ifndef PIC
+ 	extern void *snd_pcm_open_symbols(void);
+ #endif
++
++	snd_config_t *libs = NULL;
++	const char *libs_lib = NULL;
++
+ 	if (snd_config_get_type(pcm_conf) != SND_CONFIG_TYPE_COMPOUND) {
+ 		char *val;
+ 		id = NULL;
+@@ -2160,6 +2164,19 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
+ 					SNDERR("Invalid type for %s", id);
+ 					goto _err;
+ 				}
++
++				continue;
++			}
++			// Handle an array of extra libs.
++			if (strcmp(id, "libs") == 0) {
++				if (snd_config_get_type(n) != SND_CONFIG_TYPE_COMPOUND) {
++					SNDERR("Invalid type for libs definition in PCM %s definition",
++						str);
++					goto _err;
++				}
++
++				libs = n;
++
+ 				continue;
+ 			}
+ 			if (strcmp(id, "open") == 0) {
+@@ -2184,7 +2201,62 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
+ 		open_name = buf;
+ 		sprintf(buf, "_snd_pcm_%s_open", str);
+ 	}
+-	if (!lib) {
++
++#ifndef PIC
++	snd_pcm_open_symbols();	/* this call is for static linking only */
++#endif
++
++	// Normal alsa behaviour when there is no libs array.
++	if (!libs) {
++		if (lib) {
++			open_func = snd_dlobj_cache_get(lib, open_name,
++				SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 1);
++		}
++	}
++	// Handle libs array.
++	// Suppresses error messages if any function is loaded successfully.
++	else {
++		if (lib) {
++			open_func = snd_dlobj_cache_get(lib, open_name,
++				SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 0);
++		}
++
++		if (!open_func) {
++			snd_config_for_each(i, next, libs) {
++				snd_config_t *n = snd_config_iterator_entry(i);
++
++				err = snd_config_get_string(n, &libs_lib);
++				if (err < 0) {
++					SNDERR("Invalid entry in PCM %s libs definition", str);
++					goto _err;
++				}
++
++				if (!open_func) {
++					open_func = snd_dlobj_cache_get(libs_lib, open_name,
++						SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 0);
++				}
++			}
++		}
++
++		// Print error messages.
++		if (!open_func) {
++			if (lib) {
++				SNDERR("Either %s cannot be opened or %s was not defined inside",
++					lib, open_name);
++			}
++
++			snd_config_for_each(i, next, libs) {
++				snd_config_t *n = snd_config_iterator_entry(i);
++
++				snd_config_get_string(n, &libs_lib);
++				SNDERR("Either %s cannot be opened or %s was not defined inside",
++					libs_lib, open_name);
++			}
++		}
++	}
++
++	// Look in ALSA_PLUGIN_DIR iff we found nowhere else to look.
++	if (!lib && (!libs || !libs_lib)) {
+ 		const char *const *build_in = build_in_pcms;
+ 		while (*build_in) {
+ 			if (!strcmp(*build_in, str))
+@@ -2200,12 +2272,11 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
+ 			lib = buf1;
+ 			sprintf(buf1, "%s/libasound_module_pcm_%s.so", ALSA_PLUGIN_DIR, str);
+ 		}
+-	}
+-#ifndef PIC
+-	snd_pcm_open_symbols();	/* this call is for static linking only */
+-#endif
+-	open_func = snd_dlobj_cache_get(lib, open_name,
++
++		open_func = snd_dlobj_cache_get(lib, open_name,
+ 			SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 1);
++	}
++
+ 	if (open_func) {
+ 		err = open_func(pcmp, name, pcm_root, pcm_conf, stream, mode);
+ 		if (err >= 0) {
diff --git a/pkgs/os-specific/linux/alsa-lib/alsa-plugin-dirs.patch b/pkgs/os-specific/linux/alsa-lib/alsa-plugin-dirs.patch
deleted file mode 100644
index 3cee02aa0cd..00000000000
--- a/pkgs/os-specific/linux/alsa-lib/alsa-plugin-dirs.patch
+++ /dev/null
@@ -1,110 +0,0 @@
-diff --git a/src/pcm/pcm.c b/src/pcm/pcm.c
-index 74d1d1a..17ffb12 100644
---- a/src/pcm/pcm.c
-+++ b/src/pcm/pcm.c
-@@ -2042,6 +2042,19 @@ static const char *const build_in_pcms[] = {
- 	NULL
- };
- 
-+
-+// helper funcion used below
-+int file_exists(const char * filename)
-+{
-+	FILE * file;
-+	if (file = fopen(filename, "r"))
-+	{
-+		fclose(file);
-+		return 1;
-+	}
-+	return 0;
-+}
-+
- static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 			     snd_config_t *pcm_root, snd_config_t *pcm_conf,
- 			     snd_pcm_stream_t stream, int mode)
-@@ -2141,8 +2154,38 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 				err = -ENOMEM;
- 				goto _err;
- 			}
--			lib = buf1;
- 			sprintf(buf1, "%s/libasound_module_pcm_%s.so", ALSA_PLUGIN_DIR, str);
-+			if (!file_exists(buf1)){
-+				// try to locate plugin in one of ALSA_PLUGIN_DIRS which is colon separated list of paths
-+				char * pdirs = getenv("ALSA_PLUGIN_DIRS");
-+
-+				if (pdirs){ // env var set?
-+					char * saveptr;
-+					while (1) {
-+						char * dir_tok = strtok_r(pdirs, "::::", &saveptr); // "::::" to work around bug in glibc and -O2 ? ":" seems to cause a segfault
-+						if (dir_tok == NULL)
-+                            break;
-+						char * so_file = malloc(strlen(str) + strlen(dir_tok) + 32);
-+						if (so_file == NULL) {
-+							err = -ENOMEM;
-+							goto _err;
-+						}
-+
-+						sprintf(so_file, "%s/libasound_module_pcm_%s.so", dir_tok, str);
-+
-+						if (file_exists(so_file)){
-+
-+							free(buf1);
-+							buf1 = so_file;
-+							break;
-+						} else {
-+							free (so_file);
-+						}
-+						pdirs = NULL;
-+					}
-+				}
-+			}
-+			lib = buf1;
- 		}
- 	}
- #ifndef PIC
-
-
-diff --git a/src/control/control.c b/src/control/control.c
-index c090797..137fe57 100644
---- a/src/control/control.c
-+++ b/src/control/control.c
-@@ -854,8 +854,38 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 				err = -ENOMEM;
- 				goto _err;
- 			}
-+			sprintf(buf1, "%s/libasound_module_pcm_%s.so", ALSA_PLUGIN_DIR, str);
-+			if (!file_exists(buf1)){
-+				// try to locate plugin in one of ALSA_PLUGIN_DIRS which is colon separated list of paths
-+				char * pdirs = getenv("ALSA_PLUGIN_DIRS");
-+
-+				if (pdirs){ // env var set?
-+					char * saveptr;
-+					while (1) {
-+						char * dir_tok = strtok_r(pdirs, "::::", &saveptr); // "::::" to work around bug in glibc and -O2 ? ":" seems to cause a segfault
-+						if (dir_tok == NULL)
-+                            break;
-+						char * so_file = malloc(strlen(str) + strlen(dir_tok) + 32);
-+						if (so_file == NULL) {
-+							err = -ENOMEM;
-+							goto _err;
-+						}
-+
-+						sprintf(so_file, "%s/libasound_module_ctl_%s.so", dir_tok, str);
-+
-+						if (file_exists(so_file)){
-+
-+							free(buf1);
-+							buf1 = so_file;
-+							break;
-+						} else {
-+							free (so_file);
-+						}
-+						pdirs = NULL;
-+					}
-+				}
-+			}
- 			lib = buf1;
--			sprintf(buf1, "%s/libasound_module_ctl_%s.so", ALSA_PLUGIN_DIR, str);
- 		}
- 	}
- #ifndef PIC
diff --git a/pkgs/os-specific/linux/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-lib/default.nix
index f46e54448b9..41abf488673 100644
--- a/pkgs/os-specific/linux/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-lib/default.nix
@@ -12,12 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    /* allow specifying alternatives alsa plugin locations using
-       export ALSA_PLUGIN_DIRS=$(nix-build -A alsaPlugins)/lib/alsa-lib
-       This patch should be improved:
-       See http://thread.gmane.org/gmane.linux.distributions.nixos/3435
-    */
-    ./alsa-plugin-dirs.patch
+    ./alsa-plugin-conf-multilib.patch
   ];
 
   # Fix pcm.h file in order to prevent some compilation bugs
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
new file mode 100644
index 00000000000..b30e0f61b1b
--- /dev/null
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation {
+  name = "android-udev-rules";
+
+  src = fetchgit {
+    url = "git://github.com/M0Rf30/android-udev-rules";
+    rev = "2cc51a456ccfbca338c4e6b76211645aaac631e9";
+    sha256 = "dbf1614cebb466d1adbcc5f17cefc0c37f148f9e3b46443b3e82f6cd19a1514f";
+  };
+
+  installPhase = ''
+    install -D 51-android.rules $out/lib/udev/rules.d/51-android.rules
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/M0Rf30/android-udev-rules;
+    description = "Android udev rules list aimed to be the most comprehensive on the net";
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/os-specific/linux/apparmor/2.9/default.nix b/pkgs/os-specific/linux/apparmor/2.9/default.nix
new file mode 100644
index 00000000000..0243c2aa456
--- /dev/null
+++ b/pkgs/os-specific/linux/apparmor/2.9/default.nix
@@ -0,0 +1,183 @@
+{ stdenv, fetchurl, autoconf, automake, libtool, pkgconfig, perl, which
+, glibc, flex, bison, python27, swig, dbus, pam
+}:
+
+let
+  apparmor-series = "2.9";
+  apparmor-patchver = "1";
+  apparmor-version = "${apparmor-series}.${apparmor-patchver}";
+
+  apparmor-meta = component: with stdenv.lib; {
+      homepage = http://apparmor.net/;
+      description = "Linux application security system - ${component}";
+      license = licenses.gpl2;
+      maintainers = with maintainers; [ phreedom thoughtpolice joachifm ];
+      platforms = platforms.linux;
+  };
+
+  apparmor-sources = fetchurl {
+    url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
+    sha256 = "08ha7aigl40vm80f742rljcckdpfpw1s8g4yii1ysabcqcj8ffx6";
+  };
+
+  prePatchCommon = ''
+    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"
+    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"
+    substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"
+    substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"
+  '';
+
+  libapparmor = stdenv.mkDerivation {
+    name = "libapparmor-${apparmor-version}";
+    src = apparmor-sources;
+
+    buildInputs = [
+      autoconf
+      automake
+      bison
+      flex
+      dbus # requires patch to dbus ...
+      glibc
+      libtool
+      perl
+      pkgconfig
+      python27
+      swig
+      which
+    ];
+
+    prePatch = prePatchCommon + ''
+      substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h"
+      substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${glibc}/include/netinet/in.h"
+      '';
+
+    buildPhase = ''
+      cd ./libraries/libapparmor
+      ./autogen.sh
+      ./configure --prefix="$out" --with-python --with-perl
+      make
+      '';
+
+    installPhase = ''
+      make install
+    '';
+
+    meta = apparmor-meta "library";
+  };
+
+  apparmor-utils = stdenv.mkDerivation {
+    name = "apparmor-utils-${apparmor-version}";
+    src = apparmor-sources;
+
+    buildInputs = [
+      python27
+      libapparmor
+      which
+    ];
+
+    prePatch = prePatchCommon;
+
+    buildPhase = ''
+      cd ./utils
+      make LANGS=""
+    '';
+
+    installPhase = ''
+      make install LANGS="" DESTDIR="$out" BINDIR="$out/bin" VIM_INSTALL_PATH="$out/share" PYPREFIX=""
+    '';
+
+    meta = apparmor-meta "user-land utilities";
+  };
+
+  apparmor-parser = stdenv.mkDerivation {
+    name = "apparmor-parser-${apparmor-version}";
+    src = apparmor-sources;
+
+    buildInputs = [
+      libapparmor
+      bison
+      flex
+      which
+    ];
+
+    prePatch = prePatchCommon + ''
+      substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison"
+      substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex"
+      substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${glibc}/include/linux/capability.h"
+      ## techdoc.pdf still doesn't build ...
+      substituteInPlace ./parser/Makefile --replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
+    '';
+
+    buildPhase = ''
+      cd ./parser
+      make LANGS="" USE_SYSTEM=1 INCLUDEDIR=${libapparmor}/include
+    '';
+
+    installPhase = ''
+      make install LANGS="" USE_SYSTEM=1 INCLUDEDIR=${libapparmor}/include DESTDIR="$out" DISTRO="unknown"
+    '';
+
+    meta = apparmor-meta "rule parser";
+  };
+
+  apparmor-pam = stdenv.mkDerivation {
+    name = "apparmor-pam-${apparmor-version}";
+    src = apparmor-sources;
+
+    buildInputs = [
+      libapparmor
+      pam
+      pkgconfig
+      which
+    ];
+
+    buildPhase = ''
+      cd ./changehat/pam_apparmor
+      make USE_SYSTEM=1
+    '';
+
+    installPhase = ''
+      make install DESTDIR="$out"
+    '';
+
+    meta = apparmor-meta "PAM service";
+  };
+
+  apparmor-profiles = stdenv.mkDerivation {
+    name = "apparmor-profiles-${apparmor-version}";
+    src = apparmor-sources;
+
+    buildInputs = [ which ];
+
+    buildPhase = ''
+      cd ./profiles
+      make
+    '';
+
+    installPhase = ''
+      make install DESTDIR="$out" EXTRAS_DEST="$out/share/apparmor/extra-profiles"
+    '';
+
+    meta = apparmor-meta "profiles";
+  };
+
+  apparmor-kernel-patches = stdenv.mkDerivation {
+    name = "apparmor-kernel-patches-${apparmor-version}";
+    src = apparmor-sources;
+
+    phases = ''unpackPhase installPhase'';
+
+    installPhase = ''
+      mkdir "$out"
+      cp -R ./kernel-patches "$out"
+    '';
+
+    meta = apparmor-meta "kernel patches";
+  };
+
+in
+
+{
+  inherit libapparmor apparmor-utils apparmor-parser apparmor-pam
+  apparmor-profiles apparmor-kernel-patches;
+}
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 8048419a93b..f68b436bed1 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -5,11 +5,11 @@
 stdenv.mkDerivation rec {
 
   name = "apparmor-${version}";
-  version = "2.8.3";
+  version = "2.8.4";
 
   src = fetchurl {
     url = "http://launchpad.net/apparmor/2.8/${version}/+download/${name}.tar.gz";
-    sha256 = "0zjwhkq9wh76m59zmrzfp68sjy4fnz4h23r7asxyaw6inrzwmhl4";
+    sha256 = "1mki4c44ljmr7dpn55grzn33929kdjx149jx00s80yp1war83jwq";
   };
 
   buildInputs = [
@@ -77,9 +77,13 @@ stdenv.mkDerivation rec {
     cd ..
     cp -r  kernel-patches $out
   '';
-  installPhase = ''
+
+  installPhase = let
+    perlVersion = (builtins.parseDrvName perl.name).version;
+  in ''
     for i in $out/bin/*;  do
-      wrapProgram $i --prefix PERL5LIB : "$PERL5LIB:$out/lib/perl5/5.10.1/i686-linux-thread-multi/"
+      wrapProgram $i --prefix PERL5LIB : \
+        "$PERL5LIB:$out/lib/perl5/${perlVersion}/${stdenv.system}-thread-multi/"
     done
   '';
 
diff --git a/pkgs/os-specific/linux/ati-drivers/builder.sh b/pkgs/os-specific/linux/ati-drivers/builder.sh
index d1ca1b35452..8df03910146 100644
--- a/pkgs/os-specific/linux/ati-drivers/builder.sh
+++ b/pkgs/os-specific/linux/ati-drivers/builder.sh
@@ -8,126 +8,129 @@ die(){ echo $@; exit 1; }
 
 # custom unpack:
 unzip $src
-run_file=$(echo amd-catalyst-*)
+run_file=$(echo fglrx-*/amd-driver-installer-*)
 sh $run_file --extract .
 
 eval "$patchPhase"
 
-kernelVersion=$(cd ${kernel}/lib/modules && ls)
-kernelBuild=$(echo ${kernel}/lib/modules/$kernelVersion/build)
-linuxsources=$(echo ${kernel}/lib/modules/$kernelVersion/source)
+case "$system" in
+  x86_64-linux)
+    arch=x86_64
+    lib_arch=lib64
+    DIR_DEPENDING_ON_XORG_VERSION=xpic_64a
+  ;;
+  i686-linux)
+    arch=x86
+    lib_arch=lib
+    DIR_DEPENDING_ON_XORG_VERSION=xpic
+  ;;
+  *) exit 1;;
+esac
 
+# Handle/Build the kernel module.
+if test -z "$libsOnly"; then
 
-# note: maybe the .config file should be used to determine this ?
-# current kbuild infrastructure allows using CONFIG_* defines
-# but ati sources don't use them yet..
-# copy paste from make.sh
-setSMP(){
+  kernelVersion=$(cd ${kernel}/lib/modules && ls)
+  kernelBuild=$(echo ${kernel}/lib/modules/$kernelVersion/build)
+  linuxsources=$(echo ${kernel}/lib/modules/$kernelVersion/source)
 
-  linuxincludes=$kernelBuild/include
+  # note: maybe the .config file should be used to determine this ?
+  # current kbuild infrastructure allows using CONFIG_* defines
+  # but ati sources don't use them yet..
+  # copy paste from make.sh
+  setSMP(){
 
-  # copied and stripped. source: make.sh:
+    linuxincludes=$kernelBuild/include
 
-  # 3
-  # linux/autoconf.h may contain this: #define CONFIG_SMP 1
+    # copied and stripped. source: make.sh:
+    # 3
+    # linux/autoconf.h may contain this: #define CONFIG_SMP 1
 
-  # Before 2.6.33 autoconf.h is under linux/.
-  # For 2.6.33 and later autoconf.h is under generated/.
-  if [ -f $linuxincludes/generated/autoconf.h ]; then
-      autoconf_h=$linuxincludes/generated/autoconf.h
-  else
-      autoconf_h=$linuxincludes/linux/autoconf.h
-  fi
-  src_file=$autoconf_h
+    # Before 2.6.33 autoconf.h is under linux/.
+    # For 2.6.33 and later autoconf.h is under generated/.
+    if [ -f $linuxincludes/generated/autoconf.h ]; then
+        autoconf_h=$linuxincludes/generated/autoconf.h
+    else
+        autoconf_h=$linuxincludes/linux/autoconf.h
+    fi
+    src_file=$autoconf_h
 
-  [ -e $src_file ] || die "$src_file not found"
+    [ -e $src_file ] || die "$src_file not found"
 
-  if [ `cat $src_file | grep "#undef" | grep "CONFIG_SMP" -c` = 0 ]; then
-    SMP=`cat $src_file | grep CONFIG_SMP | cut -d' ' -f3`
-    echo "file $src_file says: SMP=$SMP"
-  fi
+    if [ `cat $src_file | grep "#undef" | grep "CONFIG_SMP" -c` = 0 ]; then
+      SMP=`cat $src_file | grep CONFIG_SMP | cut -d' ' -f3`
+      echo "file $src_file says: SMP=$SMP"
+    fi
 
-  if [ "$SMP" = 0 ]; then
-    echo "assuming default: SMP=$SMP"
-  fi
+    if [ "$SMP" = 0 ]; then
+      echo "assuming default: SMP=$SMP"
+    fi
 
-  # act on final result
-  if [ ! "$SMP" = 0 ]; then
-    smp="-SMP"
-    def_smp=-D__SMP__
-  fi
+    # act on final result
+    if [ ! "$SMP" = 0 ]; then
+      smp="-SMP"
+      def_smp=-D__SMP__
+    fi
 
-}
+  }
 
-setModVersions(){
-  ! grep CONFIG_MODVERSIONS=y $kernel/config ||
-  def_modversions="-DMODVERSIONS"
-  # make.sh contains much more code to determine this whether its enabled
-}
+  setModVersions(){
+    ! grep CONFIG_MODVERSIONS=y $kernelBuild/.config ||
+    def_modversions="-DMODVERSIONS"
+    # make.sh contains much more code to determine this whether its enabled
+  }
 
-# ==============================================================
-# resolve if we are building for a kernel with a fix for CVE-2010-3081
-# On kernels with the fix, use arch_compat_alloc_user_space instead
-# of compat_alloc_user_space since the latter is GPL-only
+  # ==============================================================
+  # resolve if we are building for a kernel with a fix for CVE-2010-3081
+  # On kernels with the fix, use arch_compat_alloc_user_space instead
+  # of compat_alloc_user_space since the latter is GPL-only
 
-COMPAT_ALLOC_USER_SPACE=arch_compat_alloc_user_space
+  COMPAT_ALLOC_USER_SPACE=arch_compat_alloc_user_space
 
-for src_file in \
+  for src_file in \
     $kernelBuild/arch/x86/include/asm/compat.h \
     $linuxsources/arch/x86/include/asm/compat.h \
     $kernelBuild/include/asm-x86_64/compat.h \
     $linuxsources/include/asm-x86_64/compat.h \
     $kernelBuild/include/asm/compat.h;
-do
-  if [ -e $src_file ];
-  then
-    break
-  fi
-done
-if [ ! -e $src_file ];
-then
-  echo "Warning: x86 compat.h not found in kernel headers"        
-  echo "neither arch/x86/include/asm/compat.h nor include/asm-x86_64/compat.h" 
-  echo "could be found in $kernelBuild or $linuxsources"            
-  echo ""                                                          
-else
-  if [ `cat $src_file | grep -c arch_compat_alloc_user_space` -gt 0 ]
-  then
-    COMPAT_ALLOC_USER_SPACE=arch_compat_alloc_user_space
+  do
+    if [ -e $src_file ];
+    then
+      break
+    fi
+  done
+  if [ ! -e $src_file ];
+    then
+    echo "Warning: x86 compat.h not found in kernel headers"
+    echo "neither arch/x86/include/asm/compat.h nor include/asm-x86_64/compat.h"
+    echo "could be found in $kernelBuild or $linuxsources"
+    echo ""
+  else
+    if [ `cat $src_file | grep -c arch_compat_alloc_user_space` -gt 0 ]
+    then
+      COMPAT_ALLOC_USER_SPACE=arch_compat_alloc_user_space
+    fi
+    echo "file $src_file says: COMPAT_ALLOC_USER_SPACE=$COMPAT_ALLOC_USER_SPACE"
   fi
-  echo "file $src_file says: COMPAT_ALLOC_USER_SPACE=$COMPAT_ALLOC_USER_SPACE" 
-fi
 
+  # make.sh contains some code figuring out whether to use these or not..
+  PAGE_ATTR_FIX=0
+  setSMP
+  setModVersions
+  CC=gcc
+  MODULE=fglrx
+  LIBIP_PREFIX=$TMP/arch/$arch/lib/modules/fglrx/build_mod
+  [ -d $LIBIP_PREFIX ]
+  GCC_MAJOR="`gcc --version | grep -o -e ") ." | head -1 | cut -d " " -f 2`"
 
-# make.sh contains some code figuring out whether to use these or not..
-PAGE_ATTR_FIX=0
-setSMP
-setModVersions
-CC=gcc
-MODULE=fglrx
-case "$system" in
-  x86_64-linux)
-    arch=x86_64
-    lib_arch=lib64
-  ;;
-  i686-linux)
-    arch=x86
-    lib_arch=lib
-  ;;
-  *) exit 1;;
-esac
-LIBIP_PREFIX=$TMP/arch/$arch/lib/modules/fglrx/build_mod
-[ -d $LIBIP_PREFIX ]
-GCC_MAJOR="`gcc --version | grep -o -e ") ." | head -1 | cut -d " " -f 2`"
+  { # build .ko module
+    cd ./common/lib/modules/fglrx/build_mod/2.6.x
+    echo .lib${MODULE}_ip.a.GCC${GCC_MAJOR}.cmd
+    echo 'This is a dummy file created to suppress this warning: could not find /lib/modules/fglrx/build_mod/2.6.x/.libfglrx_ip.a.GCC4.cmd for /lib/modules/fglrx/build_mod/2.6.x/libfglrx_ip.a.GCC4' > lib${MODULE}_ip.a.GCC${GCC_MAJOR}.cmd
 
-{ # build .ko module
-  cd ./common/lib/modules/fglrx/build_mod/2.6.x
-  echo .lib${MODULE}_ip.a.GCC${GCC_MAJOR}.cmd
-  echo 'This is a dummy file created to suppress this warning: could not find /lib/modules/fglrx/build_mod/2.6.x/.libfglrx_ip.a.GCC4.cmd for /lib/modules/fglrx/build_mod/2.6.x/libfglrx_ip.a.GCC4' > lib${MODULE}_ip.a.GCC${GCC_MAJOR}.cmd
+    sed -i -e "s@COMPAT_ALLOC_USER_SPACE@$COMPAT_ALLOC_USER_SPACE@" ../kcl_ioctl.c
 
-  sed -i -e "s@COMPAT_ALLOC_USER_SPACE@$COMPAT_ALLOC_USER_SPACE@" ../kcl_ioctl.c
-
-  make CC=${CC} \
+    make CC=${CC} \
       LIBIP_PREFIX=$(echo "$LIBIP_PREFIX" | sed -e 's|^\([^/]\)|../\1|') \
       MODFLAGS="-DMODULE -DATI -DFGL -DPAGE_ATTR_FIX=$PAGE_ATTR_FIX -DCOMPAT_ALLOC_USER_SPACE=$COMPAT_ALLOC_USER_SPACE $def_smp $def_modversions" \
       KVER=$kernelVersion \
@@ -135,8 +138,10 @@ GCC_MAJOR="`gcc --version | grep -o -e ") ." | head -1 | cut -d " " -f 2`"
       PAGE_ATTR_FIX=$PAGE_ATTR_FIX \
       -j4
 
-  cd $TMP
-}
+    cd $TMP
+  }
+
+fi
 
 { # install
 
@@ -152,13 +157,15 @@ GCC_MAJOR="`gcc --version | grep -o -e ") ." | head -1 | cut -d " " -f 2`"
   # what are those files used for?
   cp -r common/etc $out
 
-  DIR_DEPENDING_ON_XORG_VERSION=xpic_64a
   cp -r $DIR_DEPENDING_ON_XORG_VERSION/usr/X11R6/$lib_arch/* $out/lib/xorg
 
-  t=$out/lib/modules/${kernelVersion}/kernel/drivers/misc
-  mkdir -p $t
+  # install kernel module
+  if test -z "$libsOnly"; then
+    t=$out/lib/modules/${kernelVersion}/kernel/drivers/misc
+    mkdir -p $t
 
-  cp ./common/lib/modules/fglrx/build_mod/2.6.x/fglrx.ko $t
+    cp ./common/lib/modules/fglrx/build_mod/2.6.x/fglrx.ko $t
+  fi
 
   # should this be installed at all?
   # its used by the example fglrx_gamma only
@@ -181,10 +188,47 @@ GCC_MAJOR="`gcc --version | grep -o -e ") ." | head -1 | cut -d " " -f 2`"
   # make xorg use the ati version
   ln -s $out/lib/xorg/modules/extensions/{fglrx/fglrx-libglx.so,libglx.so}
 
+  # Correct some paths that are hardcoded into binary libs.
+  if [ "$arch" ==  "x86_64" ]; then
+    for lib in \
+      lib/xorg/modules/extensions/fglrx/fglrx-libglx.so \
+      lib/xorg/modules/glesx.so \
+      lib/dri/fglrx_dri.so \
+      lib/fglrx_dri.so \
+      lib/fglrx-libGL.so.1.2
+    do
+      oldPaths="/usr/X11R6/lib/modules/dri"
+      newPaths="/run/opengl-driver/lib/dri"
+      sed -i -e "s|$oldPaths|$newPaths|" $out/$lib
+    done
+  else
+    oldPaths="/usr/X11R6/lib32/modules/dri\x00/usr/lib32/dri"
+    newPaths="/run/opengl-driver-32/lib/dri\x00/dev/null/dri"
+    sed -i -e "s|$oldPaths|$newPaths|" \
+      $out/lib/xorg/modules/extensions/fglrx/fglrx-libglx.so
+
+    for lib in \
+      lib/dri/fglrx_dri.so \
+      lib/fglrx_dri.so \
+      lib/xorg/modules/glesx.so
+    do
+      oldPaths="/usr/X11R6/lib32/modules/dri/"
+      newPaths="/run/opengl-driver-32/lib/dri"
+      sed -i -e "s|$oldPaths|$newPaths|" $out/$lib
+    done
+
+    oldPaths="/usr/X11R6/lib32/modules/dri\x00"
+    newPaths="/run/opengl-driver-32/lib/dri"
+    sed -i -e "s|$oldPaths|$newPaths|" $out/lib/fglrx-libGL.so.1.2
+  fi
+
   # libstdc++ and gcc are needed by some libs
   patchelf --set-rpath $gcc/$lib_arch $out/lib/libatiadlxx.so
+  patchelf --set-rpath $gcc/$lib_arch $out/lib/xorg/modules/glesx.so
 }
 
+if test -z "$libsOnly"; then
+
 { # build samples
   mkdir -p $out/bin
 
@@ -221,7 +265,7 @@ GCC_MAJOR="`gcc --version | grep -o -e ") ." | head -1 | cut -d " " -f 2`"
     cp $BIN/* $out/bin
     for prog in $BIN/*; do
       patchelf --set-interpreter $(echo $glibc/lib/ld-linux*.so.2) $out/bin/$(basename $prog)
-      wrapProgram $out/bin/$(basename $prog) --prefix LD_LIBRARY_PATH : $out/lib:$LD_LIBRARY_PATH
+      wrapProgram $out/bin/$(basename $prog) --prefix LD_LIBRARY_PATH : $out/lib:$gcc/lib:$qt4/lib:$LD_LIBRARY_PATH
     done
   }
 
@@ -229,6 +273,8 @@ GCC_MAJOR="`gcc --version | grep -o -e ") ." | head -1 | cut -d " " -f 2`"
 
 }
 
+fi
+
 for p in $extraDRIlibs; do
   for lib in $p/lib/*.so*; do
     ln -s $lib $out/lib/
diff --git a/pkgs/os-specific/linux/ati-drivers/default.nix b/pkgs/os-specific/linux/ati-drivers/default.nix
index 0aa67dba237..179166bbc79 100644
--- a/pkgs/os-specific/linux/ati-drivers/default.nix
+++ b/pkgs/os-specific/linux/ati-drivers/default.nix
@@ -1,10 +1,17 @@
-{ stdenv, fetchurl, kernel, xlibs, which, imake
+{ stdenv, fetchurl, kernel ? null, xlibs, which, imake
 , mesa # for fgl_glxgears
 , libXxf86vm, xf86vidmodeproto # for fglrx_gamma
 , xorg, makeWrapper, glibc, patchelf
 , unzip
+, qt4 # for amdcccle
+, # Whether to build the libraries only (i.e. not the kernel module or
+  # driver utils). Used to support 32-bit binaries on 64-bit
+  # Linux.
+  libsOnly ? false
 }:
 
+assert (!libsOnly) -> kernel != null;
+
 # If you want to use a different Xorg version probably
 # DIR_DEPENDING_ON_XORG_VERSION in builder.sh has to be adopted (?)
 # make sure libglx.so of ati is used. xorg.xorgserver does provide it as well
@@ -21,26 +28,23 @@
 # There is one issue left:
 # /usr/lib/dri/fglrx_dri.so must point to /run/opengl-driver/lib/fglrx_dri.so
 
-# You eventually have to blacklist radeon module (?)
-
-assert stdenv.system == "x86_64-linux";
+with stdenv.lib;
 
 stdenv.mkDerivation {
-  name = "ati-drivers-13.12-${kernel.version}";
+  name = "ati-drivers-14.12" + (optionalString (!libsOnly) "-${kernel.version}");
 
   builder = ./builder.sh;
 
   inherit libXxf86vm xf86vidmodeproto;
-  gcc = stdenv.gcc.gcc;
+  gcc = stdenv.cc.cc;
 
   src = fetchurl {
-    url = http://www2.ati.com/drivers/linux/amd-catalyst-13.12-linux-x86.x86_64.zip;
-    sha256 = "1c3fn328340by4qn99dgfj8c2q34fxdb2alcak0vnyc6bw7l5sms";
+    url = http://www2.ati.com/drivers/linux/amd-catalyst-omega-14.12-linux-run-installers.zip;
+    sha256 = "0jd2scrdlyapynxfjdrarnwcdzxjqrk5fg5i10g3bm0ay8v9hrk8";
     curlOpts = "--referer http://support.amd.com/en-us/download/desktop?os=Linux%20x86_64";
   };
 
-  # most patches are taken from gentoo
-  patchPhase = "patch -p1 < ${./gentoo-patches.patch}";
+  patchPhase = "patch -p1 < ${./fglrx_3.17rc6-no_hotplug.patch}";
   patchPhaseSamples = "patch -p2 < ${./patch-samples.patch}";
 
   buildInputs =
@@ -49,9 +53,12 @@ stdenv.mkDerivation {
       patchelf
       unzip
       mesa
+      qt4
     ];
 
-  kernel = kernel.dev;
+  inherit libsOnly;
+
+  kernel = if libsOnly then null else kernel.dev;
 
   inherit glibc /* glibc only used for setting interpreter */;
 
@@ -68,22 +75,14 @@ stdenv.mkDerivation {
   # appear in /run/opengl-driver/lib which get's added to LD_LIBRARY_PATH
   extraDRIlibs = [ xorg.libXext ];
 
-  inherit mesa; # only required to build examples
+  inherit mesa qt4; # only required to build examples and amdcccle
 
   meta = with stdenv.lib; {
     description = "ATI drivers";
     homepage = http://support.amd.com/us/gpudownload/Pages/index.aspx;
     license = licenses.unfree;
-    maintainers = with maintainers; [marcweber offline];
-    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ marcweber offline jgeerds ];
+    platforms = platforms.linux;
     hydraPlatforms = [];
   };
-
-  # moved assertions here because the name is evaluated when the NixOS manual is generated
-  # Don't make that fail - fail lazily when a users tries to build this derivation only
-  dummy =
-    # assert xorg.xorgserver.name == "xorg-server-1.7.5";
-    assert stdenv.system == "x86_64-linux"; # i686-linux should work as well - however I didn't test it.
-    null;
-
 }
diff --git a/pkgs/os-specific/linux/ati-drivers/fglrx_3.17rc6-no_hotplug.patch b/pkgs/os-specific/linux/ati-drivers/fglrx_3.17rc6-no_hotplug.patch
new file mode 100644
index 00000000000..7afd54a59c5
--- /dev/null
+++ b/pkgs/os-specific/linux/ati-drivers/fglrx_3.17rc6-no_hotplug.patch
@@ -0,0 +1,31 @@
+source: https://aur.archlinux.org/packages/catalyst/
+
+diff -uNr 14.9/common/lib/modules/fglrx/build_mod/firegl_public.c 14.9/common/lib/modules/fglrx/build_mod/firegl_public.c
+--- 14.9/common/lib/modules/fglrx/build_mod/firegl_public.c	2014-09-09 16:10:17.000000000 +0200
++++ 14.9/common/lib/modules/fglrx/build_mod/firegl_public.c	2014-09-26 19:01:44.000000000 +0200
+@@ -1093,6 +1093,9 @@
+     // directly here to allow suspend/resume without X server start. 
+         firegl_pci_save_state((KCL_PCI_DevHandle)pdev, privdev);
+         pci_disable_device(pdev);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,17,0)
++	pci_ignore_hotplug(pdev);
++#endif
+         PMSG_EVENT(pdev->dev.power.power_state) = state;
+     }
+     else
+diff -uNr 14.9/common/lib/modules/fglrx/build_mod/kcl_acpi.c 14.9/common/lib/modules/fglrx/build_mod/kcl_acpi.c
+--- 14.9/common/lib/modules/fglrx/build_mod/kcl_acpi.c	2014-09-09 16:10:17.000000000 +0200
++++ 14.9/common/lib/modules/fglrx/build_mod/kcl_acpi.c	2014-09-26 18:57:27.000000000 +0200
+@@ -840,10 +840,12 @@
+    if(tdev != NULL)
+    {
+       device = (acpi_device_adr(tdev) >> 16) & 0xffff;
++#if LINUX_VERSION_CODE < KERNEL_VERSION(3,17,0)
+       if(PCI_SLOT(pdev->devfn) == device)
+       {
+          tdev->flags.no_hotplug = true;
+       }
++#endif
+    }
+ #endif
+    return 0;
diff --git a/pkgs/os-specific/linux/ati-drivers/gentoo-patches.patch b/pkgs/os-specific/linux/ati-drivers/gentoo-patches.patch
deleted file mode 100644
index 392c2a8c29e..00000000000
--- a/pkgs/os-specific/linux/ati-drivers/gentoo-patches.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-diff --git a/common/lib/modules/fglrx/build_mod/firegl_public.c b/common/lib/modules/fglrx/build_mod/firegl_public.c
-index d3ad3ce..9362b58 100755
---- a/common/lib/modules/fglrx/build_mod/firegl_public.c
-+++ b/common/lib/modules/fglrx/build_mod/firegl_public.c
-@@ -34,6 +34,11 @@
- #include <linux/autoconf.h>
- #endif
- 
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0)
-+#include <linux/uidgid.h>
-+#endif
-+
-+
- #if !defined(CONFIG_X86) 
- #if !defined(CONFIG_X86_PC) 
- #if !defined(CONFIG_X86_XEN) 
-@@ -1543,9 +1548,17 @@ KCL_TYPE_Pid ATI_API_CALL KCL_GetTgid(void)
- KCL_TYPE_Uid ATI_API_CALL KCL_GetEffectiveUid(void)
- {
- #ifdef current_euid
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0)
-+    return __kuid_val(current_euid());
-+# else
-     return current_euid();
-+# endif
- #else
-+# if LINUX_VERSION_CODE >= KERNEL_VERSION(3,5,0)
-+    return __kuid_val(current->euid);
-+# else
-     return current->euid;
-+# endif
- #endif
- }
- 
-
-diff -urN a/common/lib/modules/fglrx/build_mod/kcl_acpi.c common/lib/modules/fglrx/build_mod/kcl_acpi.c
---- a/common/lib/modules/fglrx/build_mod/kcl_acpi.c	2013-12-27 13:32:34.734832283 +0100
-+++ b/common/lib/modules/fglrx/build_mod/kcl_acpi.c	2013-12-27 13:33:31.849831765 +0100
-@@ -1002,7 +1002,11 @@
- #endif
-     {
-         return KCL_ACPI_ERROR;
--    }    
-+    }
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,9,1)
-+    ((acpi_tbl_table_handler)handler)(hdr);
-+#else
-     ((acpi_table_handler)handler)(hdr);
-+#endif
-     return KCL_ACPI_OK;
- }
diff --git a/pkgs/os-specific/linux/atop/default.nix b/pkgs/os-specific/linux/atop/default.nix
index fd4b6df9552..17adcabf223 100644
--- a/pkgs/os-specific/linux/atop/default.nix
+++ b/pkgs/os-specific/linux/atop/default.nix
@@ -1,12 +1,12 @@
 {stdenv, fetchurl, zlib, ncurses}:
 
 stdenv.mkDerivation rec {
-  version = "2.0.2";
+  version = "2.1-1";
   name = "atop-${version}";
 
   src = fetchurl {
     url = "http://www.atoptool.nl/download/atop-${version}.tar.gz";
-    sha256 = "029lfa2capz1lg3m3rnyrgb8v6jm4znin84vjh2f0zkwvvhdn856";
+    sha256 = "17wqqyym4d02cqmn1l1asah3sld939nlkc84g4ad939kpkzd98ir";
   };
 
   buildInputs = [zlib ncurses];
@@ -27,6 +27,10 @@ stdenv.mkDerivation rec {
     sed -e '/chkconfig/d' -i Makefile
   '';
 
+  preInstall = ''
+    mkdir -p "$out"/{bin,sbin}
+  '';
+
   meta = {
     platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [raskin];
@@ -37,6 +41,5 @@ stdenv.mkDerivation rec {
     '';
     inherit version;
     downloadPage = http://atoptool.nl/downloadatop.php;
-    updateWalker = true;
   };
 }
diff --git a/pkgs/os-specific/linux/atop/default.upstream b/pkgs/os-specific/linux/atop/default.upstream
new file mode 100644
index 00000000000..46099d9c959
--- /dev/null
+++ b/pkgs/os-specific/linux/atop/default.upstream
@@ -0,0 +1,4 @@
+url http://atoptool.nl/downloadatop.php
+version_link '[.]tar[.]'
+version '[^0-9]*[-.]([0-9]([-0-9.]*[0-9])?)[.].*' '\1'
+minimize_overwrite
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 9de84e228c4..05b9eb9e56f 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -5,11 +5,11 @@
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
-  name = "audit-2.3.2";
+  name = "audit-2.4.1";
 
   src = fetchurl {
     url = "http://people.redhat.com/sgrubb/audit/${name}.tar.gz";
-    sha256 = "0a8x10wz0xfj0iq1wgjl6hdhxvq58cb3906vc687i21876sy0wl8";
+    sha256 = "09ihn392pmac1pyjrs22966csia83yr84hq5ri6sybwj1vx4d4q5";
   };
 
   buildInputs = [ openldap ]
@@ -24,5 +24,6 @@ stdenv.mkDerivation rec {
     homepage = "http://people.redhat.com/sgrubb/audit/";
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
   };
 }
diff --git a/pkgs/os-specific/linux/autofs/autofs-v5.nix b/pkgs/os-specific/linux/autofs/autofs-v5.nix
index 5c5c2f026af..787cd34180e 100644
--- a/pkgs/os-specific/linux/autofs/autofs-v5.nix
+++ b/pkgs/os-specific/linux/autofs/autofs-v5.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     configureFlags="--disable-move-mount --with-path=$PATH"
     export MOUNT=/var/run/current-system/sw/bin/mount
     export UMOUNT=/var/run/current-system/sw/bin/umount
-    export MODPROBE=/var/run/current-system/sw/sbin/modprobe
+    export MODPROBE=/var/run/current-system/sw/bin/modprobe
     # Grrr, rpcgen can't find cpp. (NIXPKGS-48)
     mkdir rpcgen
     echo "#! $shell" > rpcgen/rpcgen
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
new file mode 100644
index 00000000000..2d9f5079586
--- /dev/null
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, pkgconfig, gpsd }:
+
+let
+  ver = "2014.4.0";
+in
+stdenv.mkDerivation rec {
+  name = "alfred-${ver}";
+
+  src = fetchurl {
+    url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
+    sha256 = "99e6c64e7069b0b7cb861369d5c198bfc7d74d41509b8edd8a17ba78e7c8d034";
+  };
+
+  buildInputs = [ pkgconfig gpsd ];
+
+  preBuild = ''
+    makeFlags="PREFIX=$out PKG_CONFIG=${pkgconfig}/bin/pkg-config"
+  '';
+
+  meta = {
+    homepage = http://www.open-mesh.org/projects/batman-adv/wiki/Wiki;
+    description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2, information distribution tool";
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = with stdenv.lib.maintainers; [ fpletz ];
+    platforms = with stdenv.lib.platforms; linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index 6e57e7651c4..5ac3e6b4117 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 {stdenv, fetchurl}:
 
 let
-  ver = "2013.4.0";
+  ver = "2014.4.0";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0k6b695h38m92a8wn5gvb3z746m3fm0ygv58yyn163adcsvf7sjd";
+    sha256 = "4deae3b6664d0d13acf7a8ece74175a31a72fe58fb15cb9112a9a2014b32cb4c";
   };
 
   preBuild = ''
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index fee955bcca2..341b6f3af1d 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,13 +1,15 @@
 { stdenv, fetchurl, kernel }:
 
-let base = "batman-adv-2013.4.0"; in
+assert stdenv.lib.versionOlder kernel.version "3.17";
+
+let base = "batman-adv-2014.4.0"; in
 
 stdenv.mkDerivation rec {
   name = "${base}-${kernel.version}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/${base}/${base}.tar.gz";
-    sha1 = "870a85df5410b3b5623be69e75297e642c91a7d4";
+    sha256 = "757b9ddd346680f6fd87dc28fde6da0ddc0423a65fbc88fdbaa7b247fed2c1a8";
   };
 
   preBuild = ''
@@ -20,7 +22,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.open-mesh.org/projects/batman-adv/wiki/Wiki;
     description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2";
     license = stdenv.lib.licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [viric];
+    maintainers = with stdenv.lib.maintainers; [ viric fpletz ];
     platforms = with stdenv.lib.platforms; linux;
   };
 }
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index 6c7d6d5330e..ec1e5f2e20b 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, kernel }:
+{ stdenv, fetchurl, fetchpatch, kernel }:
 
 let
   baseName = "bbswitch";
@@ -15,6 +15,11 @@ stdenv.mkDerivation {
     sha256 = "0xql1nv8dafnrcg54f3jsi3ny3cd2ca9iv73pxpgxd2gfczvvjkn";
   };
 
+  patches = [ (fetchpatch {
+    url = "https://github.com/Bumblebee-Project/bbswitch/pull/102.patch";
+    sha256 = "1lbr6pyyby4k9rn2ry5qc38kc738d0442jhhq57vmdjb6hxjya7m";
+  }) ];
+
   preBuild = ''
     substituteInPlace Makefile \
       --replace "\$(shell uname -r)" "${kernel.modDirVersion}" \
@@ -39,8 +44,10 @@ stdenv.mkDerivation {
     chmod +x $out/bin/discrete_vga_poweroff $out/bin/discrete_vga_poweron
   '';
 
-  meta = {
-    platforms = stdenv.lib.platforms.linux;
+  meta = with stdenv.lib; {
     description = "A module for powering off hybrid GPUs";
+    platforms = platforms.linux;
+    homepage = https://github.com/Bumblebee-Project/bbswitch;
+    maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/os-specific/linux/blcr/default.nix b/pkgs/os-specific/linux/blcr/default.nix
index 43673c899b4..7681e8e3c31 100644
--- a/pkgs/os-specific/linux/blcr/default.nix
+++ b/pkgs/os-specific/linux/blcr/default.nix
@@ -1,17 +1,17 @@
 { stdenv, fetchurl, kernel, perl, makeWrapper }:
 
-# BLCR 0.8.4 works for kernel version up to 2.6.38 (including 2.6.38.x)
 # BLCR 0.8.5 should works for kernel version up to 3.7.1
+# BLCR 0.8.6 should works for kernel version up to 3.17.x
 
 assert stdenv.isLinux;
-assert builtins.compareVersions "3.7.2" kernel.version == 1;
+assert builtins.compareVersions "3.18" kernel.version == 1;
 
 stdenv.mkDerivation {
-  name = "blcr_${kernel.version}-0.8.5";
+  name = "blcr_${kernel.version}-0.8.6pre4";
 
   src = fetchurl {
-    url = http://crd.lbl.gov/assets/Uploads/FTG/Projects/CheckpointRestart/downloads/blcr-0.8.5.tar.gz;
-    sha256 = "01a809nfbr715pnidlslv55pxadm3021l97p98zkqy8chyrnkjb0";
+    url = https://upc-bugs.lbl.gov/blcr-dist/blcr-0.8.6_b4.tar.gz;
+    sha256 = "1a3gdhdnmk592jc652szxgfz8rjd8dax5jwxfsypiqx5lgkj3m21";
   };
 
   buildInputs = [ perl makeWrapper ];
diff --git a/pkgs/os-specific/linux/bluez/bluez5.nix b/pkgs/os-specific/linux/bluez/bluez5.nix
index 2a87611a680..61d3667f165 100644
--- a/pkgs/os-specific/linux/bluez/bluez5.nix
+++ b/pkgs/os-specific/linux/bluez/bluez5.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib, python,
   pythonPackages, pythonDBus, readline, libsndfile, udev, libical,
-  systemd }:
+  systemd, enableWiimote ? false }:
 
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.22";
+  name = "bluez-5.29";
    
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "10h8p89jnhxhjw4x53j4r53i999qjaz82l5591q6q48qb98ndf78";
+    sha256 = "1r7h8qr52n372r73fdyk804r92hqg9g6pvflwmak64y6brnnl8fz";
   };
 
   pythonPath = with pythonPackages;
@@ -38,7 +38,8 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     "--with-systemduserunitdir=$(out)/etc/systemd/user"
     "--with-udevdir=$(out)/lib/udev"
-    ];
+    ] ++
+    stdenv.lib.optional enableWiimote [ "--enable-wiimote" ];
 
   # Work around `make install' trying to create /var/lib/bluetooth.
   installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth";
diff --git a/pkgs/os-specific/linux/bluez/bluez5_28.nix b/pkgs/os-specific/linux/bluez/bluez5_28.nix
new file mode 100644
index 00000000000..7f5a30144c8
--- /dev/null
+++ b/pkgs/os-specific/linux/bluez/bluez5_28.nix
@@ -0,0 +1,79 @@
+{ stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib, python,
+  pythonPackages, pythonDBus, readline, libsndfile, udev, libical,
+  systemd, enableWiimote ? false }:
+
+assert stdenv.isLinux;
+
+stdenv.mkDerivation rec {
+  name = "bluez-5.28";
+   
+  src = fetchurl {
+    url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
+    sha256 = "1a8qzh38wpq5c0rydpx9isf0jc6g14g2qs18j1rmi8a79f7v9fl5";
+  };
+
+  pythonPath = with pythonPackages;
+    [ pythonDBus pygobject pygobject3 recursivePthLoader ];
+
+  buildInputs =
+    [ pkgconfig dbus.libs glib alsaLib python pythonPackages.wrapPython
+      readline libsndfile udev libical
+      # Disables GStreamer; not clear what it gains us other than a
+      # zillion extra dependencies.
+      # gstreamer gst_plugins_base 
+    ];
+
+  preConfigure = ''
+      substituteInPlace tools/hid2hci.rules --replace /sbin/udevadm ${systemd}/bin/udevadm
+      substituteInPlace tools/hid2hci.rules --replace "hid2hci " "$out/lib/udev/hid2hci "
+    '';
+
+  configureFlags = [
+    "--localstatedir=/var"
+    "--enable-library"
+    "--enable-cups"
+    "--with-dbusconfdir=$(out)/etc"
+    "--with-dbussystembusdir=$(out)/share/dbus-1/system-services"
+    "--with-dbussessionbusdir=$(out)/share/dbus-1/services"
+    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
+    "--with-systemduserunitdir=$(out)/etc/systemd/user"
+    "--with-udevdir=$(out)/lib/udev"
+    ] ++
+    stdenv.lib.optional enableWiimote [ "--enable-wiimote" ];
+
+  # Work around `make install' trying to create /var/lib/bluetooth.
+  installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth";
+
+  makeFlags = "rulesdir=$(out)/lib/udev/rules.d";
+
+  # FIXME: Move these into a separate package to prevent Bluez from
+  # depending on Python etc.
+  postInstall = ''
+    mkdir $out/test
+    cp -a test $out
+    pushd $out/test
+    for a in \
+            simple-agent \
+            test-adapter \
+            test-device \
+            test-thermometer \
+            list-devices \
+            monitor-bluetooth \
+            ; do
+      ln -s ../test/$a $out/bin/bluez-$a
+    done
+    popd
+    wrapPythonProgramsIn $out/test "$out/test $pythonPath"
+
+    # for bluez4 compatibility for NixOS
+    mkdir $out/sbin
+    ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = http://www.bluez.org/;
+    repositories.git = https://git.kernel.org/pub/scm/bluetooth/bluez.git;
+    description = "Bluetooth support for Linux";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 3b876322f1f..23e5171d178 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -24,7 +24,11 @@ stdenv.mkDerivation rec {
       # gstreamer gst_plugins_base 
     ];
 
-  configureFlags = "--localstatedir=/var --enable-cups";
+  configureFlags = [
+    "--localstatedir=/var"
+    "--enable-cups"
+    "--with-systemdunitdir=$(out)/etc/systemd/system"
+    ];
 
   # Work around `make install' trying to create /var/lib/bluetooth.
   installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth";
diff --git a/pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch b/pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch
new file mode 100644
index 00000000000..c9149bfec38
--- /dev/null
+++ b/pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch
@@ -0,0 +1,11 @@
+diff --git a/libbridge/libbridge.h b/libbridge/libbridge.h
+index 39964f2..dd14bae 100644
+--- a/libbridge/libbridge.h
++++ b/libbridge/libbridge.h
+@@ -20,6 +20,7 @@
+ #define _LIBBRIDGE_H
+
+ #include <sys/socket.h>
++#include <netinet/in.h>
+ #include <linux/if.h>
+ #include <linux/if_bridge.h>
diff --git a/pkgs/os-specific/linux/bridge-utils/default.nix b/pkgs/os-specific/linux/bridge-utils/default.nix
index 029f7ed6e29..2fdf728ef4e 100644
--- a/pkgs/os-specific/linux/bridge-utils/default.nix
+++ b/pkgs/os-specific/linux/bridge-utils/default.nix
@@ -1,19 +1,24 @@
-{ stdenv, fetchurl, autoconf, automake }:
+{ stdenv, fetchurl, autoreconfHook }:
 
-let
+stdenv.mkDerivation rec {
   name = "bridge-utils-1.5";
-in
-stdenv.mkDerivation {
-  inherit name;
 
   src = fetchurl {
     url = "mirror://sourceforge/bridge/${name}.tar.gz";
     sha256 = "42f9e5fb8f6c52e63a98a43b81bd281c227c529f194913e1c51ec48a393b6688";
   };
 
-  buildInputs = [ autoconf automake ];
+  # Remove patch once the kernel headers are updated
+  patches = [ ./add-ip6-header.patch ];
 
-  preConfigure = "autoreconf";
+  buildInputs = [ autoreconfHook ];
+
+  postInstall = ''
+    # The bridge utils build does not fail even if the brctl binary
+    # is not build. This test ensures that we fail if we don't produce a brctl
+    # binary.
+    test -f $out/sbin/brctl
+  '';
 
   meta = {
     description = "http://sourceforge.net/projects/bridge/";
diff --git a/pkgs/os-specific/linux/broadcom-sta/cfg80211_inform_bss-3.18.patch b/pkgs/os-specific/linux/broadcom-sta/cfg80211_inform_bss-3.18.patch
new file mode 100644
index 00000000000..100ac9161a6
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/cfg80211_inform_bss-3.18.patch
@@ -0,0 +1,21 @@
+Found on a random place http://web.archiveorange.com/archive/v/CcRuxYExfvTxfKcBFLah
+Nicolas Viéville, Oct 27 2014
+diff -Naur hybrid-v35_64-nodebug-pcoem-6_30_223_248.orig/src/wl/sys/wl_cfg80211_hybrid.c hybrid-v35_64-nodebug-pcoem-6_30_223_248/src/wl/sys/wl_cfg80211_hybrid.c
+--- hybrid-v35_64-nodebug-pcoem-6_30_223_248.orig/src/wl/sys/wl_cfg80211_hybrid.c	2014-09-10 19:27:13.301316000 +0200
++++ hybrid-v35_64-nodebug-pcoem-6_30_223_248/src/wl/sys/wl_cfg80211_hybrid.c	2014-10-27 11:21:58.213536239 +0100
+@@ -2025,7 +2025,15 @@
+ 	notify_ie = (u8 *)bi + le16_to_cpu(bi->ie_offset);
+ 	notify_ielen = le32_to_cpu(bi->ie_length);
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 18, 0)
++	cbss = cfg80211_inform_bss(wiphy, channel,
++		(mgmt_type == IEEE80211_STYPE_PROBE_RESP) ? CFG80211_BSS_FTYPE_PRESP : CFG80211_BSS_FTYPE_BEACON,
++		(const u8 *)(bi->BSSID.octet),
++		0, beacon_proberesp->capab_info, beacon_proberesp->beacon_int,
++		(const u8 *)notify_ie, notify_ielen, signal, GFP_KERNEL);
++#else
+ 	cbss = cfg80211_inform_bss(wiphy, channel, (const u8 *)(bi->BSSID.octet),
+ 		0, beacon_proberesp->capab_info, beacon_proberesp->beacon_int,
+ 		(const u8 *)notify_ie, notify_ielen, signal, GFP_KERNEL);
++#endif
+ 	if (unlikely(!cbss))
+ 		return -ENOMEM;
diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
index 1ed13c2e450..94f51911295 100644
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -1,25 +1,26 @@
 { stdenv, fetchurl, kernel }:
 let
-  version = "6_30_223_141";
+  version = "6.30.223.248";
 in
 stdenv.mkDerivation {
   name = "broadcom-sta-${version}-${kernel.version}";
 
   src = if stdenv.system == "i686-linux" then (
     fetchurl {
-      url = "http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-${version}.tar.gz";
-      sha256 = "19wra62dpm0x0byksh871yxr128b4v13kzkzqv56igjfpzv36z6m";
+      url = http://www.broadcom.com/docs/linux_sta/hybrid-v35-nodebug-pcoem-6_30_223_248.tar.gz;
+      sha256 = "1bd13pq5hj4yzp32rx71sg1i5wkzdsg1s32xsywb48lw88x595mi";
     } ) else (
     fetchurl {
-      url = "http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-${version}.tar.gz";
-      sha256 = "0jlvch7d3khmmg5kp80x4ka33hidj8yykqjcqq6j56z2g6wb4dsz";
+      url = http://www.broadcom.com/docs/linux_sta/hybrid-v35_64-nodebug-pcoem-6_30_223_248.tar.gz;
+      sha256 = "08ihbhwnqpnazskw9rlrk0alanp4x70kl8bsy2vg962iq334r69x";
     }
   );
 
   patches = [
-    ./linux-recent.patch
     ./license.patch
     ./cfg80211_ibss_joined-channel-parameter.patch
+    ./netdev-3.17.patch
+    ./cfg80211_inform_bss-3.18.patch
   ];
 
   makeFlags = "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}";
@@ -42,7 +43,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Kernel module driver for some Broadcom's wireless cards";
     homepage = http://www.broadcom.com/support/802.11/linux_sta.php;
-    license = "unfree-redistributable";
+    license = stdenv.lib.licenses.unfreeRedistributable;
     maintainers = with stdenv.lib.maintainers; [ phreedom vcunat ];
     platforms = stdenv.lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch b/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch
deleted file mode 100644
index 97a331a2bd7..00000000000
--- a/pkgs/os-specific/linux/broadcom-sta/linux-recent.patch
+++ /dev/null
@@ -1,126 +0,0 @@
---- a/src/wl/sys/wl_linux.c	2013-08-01 08:52:22.000000000 +0200
-+++ b/src/wl/sys/wl_linux.c	2013-09-13 14:25:36.463020788 +0200
-@@ -910,7 +910,11 @@
- 	pci_set_drvdata(pdev, NULL);
- }
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
- static struct pci_driver wl_pci_driver = {
-+#else
-+static struct pci_driver wl_pci_driver __refdata = {
-+#endif
- 	name:		"wl",
- 	probe:		wl_pci_probe,
- 	suspend:	wl_suspend,
-@@ -3235,7 +3239,7 @@
- void
- wl_tkip_printstats(wl_info_t *wl, bool group_key)
- {
--#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14)
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 14) && LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
- 	char debug_buf[512];
- 	int idx;
- 	if (wl->tkipmodops) {
-@@ -3408,6 +3412,7 @@
- 	return 0;
- }
- 
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
- static int
- wl_proc_read(char *buffer, char **start, off_t offset, int length, int *eof, void *data)
- {
-@@ -3462,19 +3467,90 @@
- 	return length;
- }
- 
-+#else
-+
-+static int
-+wl_proc_read(struct seq_file *seq, void *offset)
-+{
-+	wl_info_t * wl = (wl_info_t *)seq->private;
-+	int bcmerror, to_user;
-+
-+	WL_LOCK(wl);
-+	bcmerror = wlc_ioctl(wl->wlc, WLC_GET_MONITOR, &to_user, sizeof(int), NULL);
-+	WL_UNLOCK(wl);
-+
-+	seq_printf(seq, "%d\n", to_user);
-+	return bcmerror;
-+}
-+
-+static ssize_t wl_proc_write(struct file *file, const char __user *buff,
-+			     size_t length, loff_t *ppos)
-+{
-+	struct seq_file *seq = file->private_data;
-+	wl_info_t * wl = (wl_info_t *)seq->private;
-+	int bcmerror, from_user = 0;
-+
-+	if (length != 1) {
-+		WL_ERROR(("%s: Invalid data length\n", __FUNCTION__));
-+		return -EIO;
-+	}
-+
-+	if (copy_from_user(&from_user, buff, 1)) {
-+		WL_ERROR(("%s: copy from user failed\n", __FUNCTION__));
-+		return -EFAULT;
-+	}
-+
-+	if (from_user >= 0x30)
-+		from_user -= 0x30;
-+
-+	WL_LOCK(wl);
-+	bcmerror = wlc_ioctl(wl->wlc, WLC_SET_MONITOR, &from_user, sizeof(int), NULL);
-+	WL_UNLOCK(wl);
-+
-+	if (bcmerror < 0) {
-+		WL_ERROR(("%s: SET_MONITOR failed with %d\n", __FUNCTION__, bcmerror));
-+		return -EIO;
-+	}
-+	*ppos += length;
-+	return length;
-+}
-+
-+static int wl_proc_open(struct inode *inode, struct file *file)
-+{
-+	return single_open(file, wl_proc_read, PDE_DATA(inode));
-+}
-+
-+static const struct file_operations wl_proc_fops = {
-+	.owner = THIS_MODULE,
-+	.open = wl_proc_open,
-+	.read = seq_read,
-+	.write = wl_proc_write,
-+	.llseek = seq_lseek,
-+	.release = single_release,
-+};
-+#endif
-+
- static int
- wl_reg_proc_entry(wl_info_t *wl)
- {
- 	char tmp[32];
- 	sprintf(tmp, "%s%d", HYBRID_PROC, wl->pub->unit);
--	if ((wl->proc_entry = create_proc_entry(tmp, 0644, NULL)) == NULL) {
-+
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
-+	wl->proc_entry = create_proc_entry(tmp, 0644, NULL);
-+	if (wl->proc_entry) {
-+		wl->proc_entry->read_proc = wl_proc_read;
-+		wl->proc_entry->write_proc = wl_proc_write;
-+		wl->proc_entry->data = wl;
-+	} 
-+#else
-+	wl->proc_entry = proc_create_data(tmp, 0644, NULL, &wl_proc_fops, wl);
-+#endif
-+	if (!wl->proc_entry) {
- 		WL_ERROR(("%s: create_proc_entry %s failed\n", __FUNCTION__, tmp));
- 		ASSERT(0);
- 		return -1;
- 	}
--	wl->proc_entry->read_proc = wl_proc_read;
--	wl->proc_entry->write_proc = wl_proc_write;
--	wl->proc_entry->data = wl;
- 	return 0;
- }
- #ifdef WLOFFLD
diff --git a/pkgs/os-specific/linux/broadcom-sta/netdev-3.17.patch b/pkgs/os-specific/linux/broadcom-sta/netdev-3.17.patch
new file mode 100644
index 00000000000..5a33cef7370
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/netdev-3.17.patch
@@ -0,0 +1,15 @@
+diff -Naur a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
+--- a/src/wl/sys/wl_linux.c	2014-06-26 06:42:08.000000000 -0400
++++ b/src/wl/sys/wl_linux.c	2014-10-13 12:00:04.446122588 -0400
+@@ -1307,7 +1307,11 @@
+ 	dev->priv = priv_link;
+ #else
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 17, 0)
++	dev = alloc_netdev(sizeof(priv_link_t), intf_name, NET_NAME_UNKNOWN, ether_setup);
++#else
+ 	dev = alloc_netdev(sizeof(priv_link_t), intf_name, ether_setup);
++#endif
+ 	if (!dev) {
+ 		WL_ERROR(("wl%d: %s: alloc_netdev failed\n",
+ 			(wl->pub)?wl->pub->unit:wlif->subunit, __FUNCTION__));
diff --git a/pkgs/os-specific/linux/busybox/busybox-in-store.patch b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
new file mode 100644
index 00000000000..ea245a49259
--- /dev/null
+++ b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
@@ -0,0 +1,16 @@
+Allow BusyBox to be invoked as "<something>-busybox". This is
+necessary when it's run from the Nix store as <hash>-busybox during
+stdenv bootstrap.
+
+diff -ru -x '*~' busybox-1.22.1-orig/libbb/appletlib.c busybox-1.22.1/libbb/appletlib.c
+--- busybox-1.22.1-orig/libbb/appletlib.c	2014-01-09 19:15:44.000000000 +0100
++++ busybox-1.22.1/libbb/appletlib.c	2014-10-29 09:53:01.232052068 +0100
+@@ -764,7 +764,7 @@
+ 	int applet = find_applet_by_name(name);
+ 	if (applet >= 0)
+ 		run_applet_no_and_exit(applet, argv);
+-	if (strncmp(name, "busybox", 7) == 0)
++	if (strstr(name, "busybox") != 0)
+ 		exit(busybox_main(argv));
+ }
+ 
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 98fedb2d3f4..47f9fb9a5a4 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, enableStatic ? false, extraConfig ? ""}:
+{ lib, stdenv, uclibc, fetchurl, enableStatic ? false, enableMinimal ? false, useUclibc ? false, extraConfig ? "" }:
 
 let
   configParser = ''
@@ -7,14 +7,7 @@ let
             NAME=`echo "$LINE" | cut -d \  -f 1`
             OPTION=`echo "$LINE" | cut -d \  -f 2`
 
-            if test -z "$NAME"; then
-                continue
-            fi
-
-            if test "$NAME" == "CLEAR"; then
-                echo "parseconfig: CLEAR"
-                echo > .config
-            fi
+            if ! [[ "$NAME" =~ ^CONFIG_ ]]; then continue; fi
 
             echo "parseconfig: removing $NAME"
             sed -i /$NAME'\(=\| \)'/d .config
@@ -25,19 +18,6 @@ let
     }
   '';
 
-  nixConfig = ''
-    CONFIG_PREFIX "$out"
-    CONFIG_INSTALL_NO_USR y
-
-    # Use the external mount.cifs program.
-    CONFIG_FEATURE_MOUNT_CIFS n
-    CONFIG_FEATURE_MOUNT_HELPERS y
-  '';
-
-  staticConfig = stdenv.lib.optionalString enableStatic ''
-    CONFIG_STATIC y
-  '';
-
 in
 
 stdenv.mkDerivation rec {
@@ -48,16 +28,34 @@ stdenv.mkDerivation rec {
     sha256 = "12v7nri79v8gns3inmz4k24q7pcnwi00hybs0wddfkcy1afh42xf";
   };
 
+  patches = [ ./busybox-in-store.patch ];
+
   configurePhase = ''
-    make defconfig
+    export KCONFIG_NOTIMESTAMP=1
+    make ${if enableMinimal then "allnoconfig" else "defconfig"}
+
     ${configParser}
+
     cat << EOF | parseconfig
-    ${staticConfig}
-    ${nixConfig}
+
+    CONFIG_PREFIX "$out"
+    CONFIG_INSTALL_NO_USR y
+
+    ${lib.optionalString enableStatic ''
+      CONFIG_STATIC y
+    ''}
+
+    # Use the external mount.cifs program.
+    CONFIG_FEATURE_MOUNT_CIFS n
+    CONFIG_FEATURE_MOUNT_HELPERS y
+
     ${extraConfig}
     $extraCrossConfig
     EOF
+
     make oldconfig
+  '' + lib.optionalString useUclibc ''
+    makeFlagsArray+=("CC=gcc -isystem ${uclibc}/include -B${uclibc}/lib -L${uclibc}/lib")
   '';
 
   crossAttrs = {
@@ -74,8 +72,8 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Tiny versions of common UNIX utilities in a single small executable";
     homepage = http://busybox.net/;
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    license = lib.licenses.gpl2;
+    maintainers = [ lib.maintainers.viric ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/busybox/include-missing-sys-resource-header.patch b/pkgs/os-specific/linux/busybox/include-missing-sys-resource-header.patch
deleted file mode 100644
index 8163a86e3cd..00000000000
--- a/pkgs/os-specific/linux/busybox/include-missing-sys-resource-header.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/include/libbb.h b/include/libbb.h
-index f12800f..e7806c2 100644
---- a/include/libbb.h
-+++ b/include/libbb.h
-@@ -40,6 +40,7 @@
- #include <sys/poll.h>
- #include <sys/ioctl.h>
- #include <sys/mman.h>
-+#include <sys/resource.h>
- #include <sys/socket.h>
- #include <sys/stat.h>
- #include <sys/time.h>
diff --git a/pkgs/os-specific/linux/cgmanager/default.nix b/pkgs/os-specific/linux/cgmanager/default.nix
new file mode 100644
index 00000000000..79be500a13d
--- /dev/null
+++ b/pkgs/os-specific/linux/cgmanager/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchurl, pkgconfig, libnih, dbus }:
+
+stdenv.mkDerivation rec {
+  name = "cgmanager-0.36";
+
+  src = fetchurl {
+    url = "https://linuxcontainers.org/downloads/cgmanager/${name}.tar.gz";
+    sha256 = "039azd4ghpmiccd95ki8fna321kccapff00rib6hrdgg600pyw7l";
+  };
+
+  buildInputs = [ pkgconfig libnih dbus ];
+
+  configureFlags = [
+    "--with-init-script=systemd"
+    "--sysconfdir=/etc/"
+    "--localstatedir=/var"
+  ];
+
+  installFlags = [ "DESTDIR=\${out}" ];
+
+  postInstall = ''
+    mv $out/$out/* $out
+    DIR=$out/$out
+    while rmdir $DIR 2>/dev/null; do
+      DIR="$(dirname "$DIR")"
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://linuxcontainers.org/cgmanager/introduction/;
+    description = "a central privileged daemon that manages all your cgroups";
+    license = licenses.lgpl21;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ wkennington ];
+  };
+}
diff --git a/pkgs/os-specific/linux/cifs-utils/default.nix b/pkgs/os-specific/linux/cifs-utils/default.nix
index ce609c5be47..46a927209a2 100644
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@@ -1,18 +1,21 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, kerberos, keyutils, pam }:
 
 stdenv.mkDerivation rec {
-  name = "cifs-utils-6.3";
+  name = "cifs-utils-6.4";
 
   src = fetchurl {
-    url = "ftp://ftp.samba.org/pub/linux-cifs/cifs-utils/${name}.tar.bz2";
-    sha256 = "0nrpd3ibzfhdxgq1pw0jhzx163z5jvq4qcjxl35qlqj74lm3pxzz";
+    url = "mirror://samba/pub/linux-cifs/cifs-utils/${name}.tar.bz2";
+    sha256 = "1qz6d2xg4z1if0hy7qwyzgcr59l0alkhci6gxgjdldglda967z1q";
   };
 
+  buildInputs = [ kerberos keyutils pam ];
+
   makeFlags = "root_sbindir=$(out)/sbin";
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.samba.org/linux-cifs/cifs-utils/;
     description = "Tools for managing Linux CIFS client filesystems";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
+    license = licenses.lgpl3;
   };
 }
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index 52e5d95346e..c54d4aa6319 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -1,31 +1,59 @@
 { stdenv, fetchurl, pkgconfig
 
 # dependencies
-, glib, ncurses
+, glib
 
 # optional features without extra dependencies
-, mpdSupport   ? true
+, mpdSupport          ? true
+, ibmSupport          ? true # IBM/Lenovo notebooks
+
+# This should be optional, but it is not due to a bug in conky
+# Please, try to make it optional again on update
+, ncurses
+#, ncursesSupport      ? true      , ncurses       ? null
 
 # optional features with extra dependencies
-, x11Support   ? false, x11           ? null
-, xdamage      ? false, libXdamage    ? null
-, wireless     ? false, wirelesstools ? null
-, luaSupport   ? false, lua5          ? null
-
-, rss          ? false
-, weatherMetar ? false
-, weatherXoap  ? false
-, curl ? null, libxml2 ? null
+, x11Support          ? true      , x11           ? null
+, xdamageSupport      ? x11Support, libXdamage    ? null
+, imlib2Support       ? x11Support, imlib2        ? null
+, luaSupport          ? true      , lua           ? null
+
+, luaImlib2Support    ? luaSupport && imlib2Support
+, luaCairoSupport     ? luaSupport && x11Support, cairo ? null
+, toluapp ? null
+
+, alsaSupport         ? true      , alsaLib       ? null
+
+, wirelessSupport     ? true      , wirelesstools ? null
+
+, curlSupport         ? true      , curl ? null
+, rssSupport          ? curlSupport
+, weatherMetarSupport ? curlSupport
+, weatherXoapSupport  ? curlSupport
+, libxml2 ? null
 }:
 
-assert luaSupport -> lua5          != null;
-assert wireless   -> wirelesstools != null;
-assert x11Support -> x11           != null;
-assert xdamage    -> x11Support && libXdamage != null;
+#assert ncursesSupport      -> ncurses != null;
+
+assert x11Support          -> x11 != null;
+assert xdamageSupport      -> x11Support && libXdamage != null;
+assert imlib2Support       -> x11Support && imlib2     != null;
+assert luaSupport          -> lua != null;
+assert luaImlib2Support    -> luaSupport && imlib2Support
+                                         && toluapp != null;
+assert luaCairoSupport     -> luaSupport && toluapp != null
+                                         && cairo   != null;
+assert luaCairoSupport || luaImlib2Support
+                           -> lua.luaversion == "5.1";
 
-assert rss          -> curl != null && libxml2 != null;
-assert weatherMetar -> curl != null;
-assert weatherXoap  -> curl != null && libxml2 != null;
+assert alsaSupport         -> alsaLib != null;
+
+assert wirelessSupport     -> wirelesstools != null;
+
+assert curlSupport         -> curl != null;
+assert rssSupport          -> curlSupport && libxml2 != null;
+assert weatherMetarSupport -> curlSupport;
+assert weatherXoapSupport  -> curlSupport && libxml2 != null;
 
 with stdenv.lib;
 
@@ -39,30 +67,47 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lgcc_s";
 
-  buildInputs = [ pkgconfig glib ncurses ]
-    ++ optional  luaSupport   lua5
-    ++ optional  wireless     wirelesstools
-    ++ optional  x11Support   x11
-    ++ optional  xdamage      libXdamage
+  buildInputs = [ pkgconfig glib ]
+    ++ [ ncurses ]
+    #++ optional  ncursesSupport     ncurses
+    ++ optional  x11Support         x11
+    ++ optional  xdamageSupport     libXdamage
+    ++ optional  imlib2Support      imlib2
+    ++ optional  luaSupport         lua
+    ++ optionals luaImlib2Support   [ toluapp imlib2 ]
+    ++ optionals luaCairoSupport    [ toluapp cairo ]
+
+    ++ optional  alsaSupport        alsaLib
 
-    ++ optionals rss          [ curl libxml2 ]
-    ++ optional  weatherMetar curl
-    ++ optionals weatherXoap  [ curl libxml2 ]
+    ++ optional  wirelessSupport    wirelesstools
+
+    ++ optional  curlSupport        curl
+    ++ optional  rssSupport         libxml2
+    ++ optional  weatherXoapSupport libxml2
     ;
 
   configureFlags =
     let flag = state: flags: if state then map (x: "--enable-${x}")  flags
                                       else map (x: "--disable-${x}") flags;
-     in flag mpdSupport   [ "mpd" ]
+     in flag mpdSupport          [ "mpd" ]
+     ++ flag ibmSupport          [ "ibm" ]
+
+     #++ flag ncursesSupport      [ "ncurses" ]
+     ++ flag x11Support          [ "x11" "xft" "argb" "double-buffer" "own-window" ] # conky won't compile without --enable-own-window
+     ++ flag xdamageSupport      [ "xdamage" ]
+     ++ flag imlib2Support       [ "imlib2" ]
+     ++ flag luaSupport          [ "lua" ]
+     ++ flag luaImlib2Support    [ "lua-imlib2" ]
+     ++ flag luaCairoSupport     [ "lua-cairo" ]
+
+     ++ flag alsaSupport         [ "alsa" ]
 
-     ++ flag luaSupport   [ "lua" ]
-     ++ flag wireless     [ "wlan" ]
-     ++ flag x11Support   [ "x11" "xft" "argb" "double-buffer" "own-window" ] # conky won't compile without --enable-own-window
-     ++ flag xdamage      [ "xdamage" ]
+     ++ flag wirelessSupport     [ "wlan" ]
 
-     ++ flag rss          [ "rss" ]
-     ++ flag weatherMetar [ "weather-metar" ]
-     ++ flag weatherXoap  [ "weather-xoap" ]
+     ++ flag curlSupport         [ "curl" ]
+     ++ flag rssSupport          [ "rss" ]
+     ++ flag weatherMetarSupport [ "weather-metar" ]
+     ++ flag weatherXoapSupport  [ "weather-xoap" ]
      ;
 
   meta = {
diff --git a/pkgs/os-specific/linux/conntrack-tools/default.nix b/pkgs/os-specific/linux/conntrack-tools/default.nix
new file mode 100644
index 00000000000..51358628ff1
--- /dev/null
+++ b/pkgs/os-specific/linux/conntrack-tools/default.nix
@@ -0,0 +1,24 @@
+{ fetchurl, stdenv, flex, bison, pkgconfig, libmnl, libnfnetlink
+, libnetfilter_conntrack, libnetfilter_queue, libnetfilter_cttimeout
+, libnetfilter_cthelper }:
+
+stdenv.mkDerivation rec {
+  name = "conntrack-tools-${version}";
+  version = "1.4.2";
+
+  src = fetchurl {
+    url = "http://www.netfilter.org/projects/conntrack-tools/files/${name}.tar.bz2";
+    sha256 = "e5c423dc077f9ca8767eaa6cf40446943905711c6a8fe27f9cc1977d4d6aa11e";
+  };
+
+  buildInputs = [ libmnl libnfnetlink libnetfilter_conntrack libnetfilter_queue
+    libnetfilter_cttimeout libnetfilter_cthelper ];
+  nativeBuildInputs = [ flex bison pkgconfig ];
+
+  meta = with stdenv.lib; {
+    homepage = http://conntrack-tools.netfilter.org/;
+    description = "Connection tracking userspace tools";
+    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/os-specific/linux/consoletools/default.nix b/pkgs/os-specific/linux/consoletools/default.nix
index f8be37edfe2..6961768e7d3 100644
--- a/pkgs/os-specific/linux/consoletools/default.nix
+++ b/pkgs/os-specific/linux/consoletools/default.nix
@@ -2,20 +2,22 @@
 
 stdenv.mkDerivation rec {
   name = "linuxconsoletools-${version}";
-  version = "1.4.6";
+  version = "1.4.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxconsole/${name}.tar.bz2";
-    sha256 = "0035yhjbjdis5wqmbdz67xq61065x7vrx5mb7kb1rhrx3ag43wcf";
+    sha256 = "0spf9hx48cqx2i46pkz0gbrn7xrk68cw8iyrfbs2b3k0bxcsri13";
   };
 
   buildInputs = [ SDL ];
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "DESTDIR=$(out)"];
 
-  meta = {
-    homepage = "https://sourceforge.net/projects/linuxconsole/";
+  meta = with stdenv.lib; {
+    homepage = https://sourceforge.net/projects/linuxconsole/;
     description = "A set of tools for joysticks and serial peripherals";
-    license = stdenv.lib.licenses.gpl2Plus;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ pSub ];
 
     longDescription = ''
       The included tools are:
diff --git a/pkgs/os-specific/linux/conspy/default.nix b/pkgs/os-specific/linux/conspy/default.nix
index d252d9ce162..78d403a3afc 100644
--- a/pkgs/os-specific/linux/conspy/default.nix
+++ b/pkgs/os-specific/linux/conspy/default.nix
@@ -3,11 +3,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="conspy";
-    version="1.9";
+    version="1.10";
     name="${baseName}-${version}";
-    hash="1ndwdx8x5lnjl6cddy1d8g8m7ndxyj3wrs100w2bp9gnvbxbb8vv";
-    url="http://ace-host.stuart.id.au/russell/files/conspy/conspy-1.9.tar.gz";
-    sha256="1ndwdx8x5lnjl6cddy1d8g8m7ndxyj3wrs100w2bp9gnvbxbb8vv";
+    hash="1vnph4xa1qp4sr52jc9zldmbdpkr6z5j7hk2vgyhfn7m1vc5g0qw";
+    url="mirror://sourceforge/project/conspy/conspy-1.10-1/conspy-1.10.tar.gz";
+    sha256="1vnph4xa1qp4sr52jc9zldmbdpkr6z5j7hk2vgyhfn7m1vc5g0qw";
   };
   buildInputs = [
     autoconf automake ncurses
diff --git a/pkgs/os-specific/linux/conspy/default.upstream b/pkgs/os-specific/linux/conspy/default.upstream
index db0c0fd9680..3eeacf34694 100644
--- a/pkgs/os-specific/linux/conspy/default.upstream
+++ b/pkgs/os-specific/linux/conspy/default.upstream
@@ -1 +1,5 @@
-url http://ace-host.stuart.id.au/russell/files/conspy/
+url http://sourceforge.net/projects/conspy/files/
+version_link 'conspy-[-0-9.]+/$'
+version_link '[-0-9.]+[.]tar[.][a-z0-9]+/download$'
+SF_redirect
+version '.*-([-0-9.]+)[.]tar[.].*' '\1'
diff --git a/pkgs/os-specific/linux/cpufrequtils/default.nix b/pkgs/os-specific/linux/cpufrequtils/default.nix
index d056e60f2da..b7822035c20 100644
--- a/pkgs/os-specific/linux/cpufrequtils/default.nix
+++ b/pkgs/os-specific/linux/cpufrequtils/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
       -i Makefile
   '';
 
-  buildInputs = [ stdenv.gcc.libc.kernelHeaders libtool gettext ];
+  buildInputs = [ stdenv.cc.libc.kernelHeaders libtool gettext ];
 
   meta = {
     description = "Tools to display or change the CPU governor settings";
diff --git a/pkgs/os-specific/linux/cpupower/default.nix b/pkgs/os-specific/linux/cpupower/default.nix
index bf6e8c36f3d..269729917dd 100644
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    description = "Tool to examine and tune power saving features.";
+    description = "Tool to examine and tune power saving features";
     homepage = https://www.kernel.org.org/;
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index d3a0b827ed1..50ea3f6a067 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -5,11 +5,11 @@
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
-  name = "cryptsetup-1.6.3";
+  name = "cryptsetup-1.6.7";
 
   src = fetchurl {
-    url = "http://cryptsetup.googlecode.com/files/${name}.tar.bz2";
-    sha256 = "1n1qk5chyjspbiianrdb55fhb4wl0vfyqz2br05vfb24v4qlgbx2";
+    url = "mirror://kernel/linux/utils/cryptsetup/v1.6/${name}.tar.xz";
+    sha256 = "0878vwblazms1dac2ds7vyz8pgi1aac8870ccnl2s0v2sv428g62";
   };
 
   configureFlags = [ "--enable-cryptsetup-reencrypt" ]
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index b60232a9b75..11c1e7ee8a2 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation {
 
   buildPhase = "make -f makefile";
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+
   installPhase = ''
     mkdir -p "$out/bin"
     cp ./disk_indicator "$out/bin/"
diff --git a/pkgs/os-specific/linux/dmraid/default.nix b/pkgs/os-specific/linux/dmraid/default.nix
index 35efa8533ab..9e7e2a6bb8e 100644
--- a/pkgs/os-specific/linux/dmraid/default.nix
+++ b/pkgs/os-specific/linux/dmraid/default.nix
@@ -1,13 +1,17 @@
 { stdenv, fetchurl, devicemapper }:
 
 stdenv.mkDerivation rec {
-  name = "dmraid-1.0.0.rc15";
+  name = "dmraid-1.0.0.rc16";
 
   src = fetchurl {
     url = "http://people.redhat.com/~heinzm/sw/dmraid/src/old/${name}.tar.bz2";
-    sha256 = "01bcaq0sc329ghgj7f182xws7jgjpdc41bvris8fsiprnxc7511h";
+    sha256 = "0m92971gyqp61darxbiri6a48jz3wq3gkp8r2k39320z0i6w8jgq";
   };
 
+  postPatch = ''
+    sed -i 's/\[\[[^]]*\]\]/[ "''$''${n##*.}" = "so" ]/' */lib/Makefile.in
+  '';
+
   preConfigure = "cd */";
 
   buildInputs = [ devicemapper ];
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index c863be14461..fea41affe2c 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -4,28 +4,30 @@
 stdenv.mkDerivation rec {
   name = "dmtcp-${version}";
 
-  version = "1.2.0";
+  version = "2.3.1";
 
   buildInputs = [ perl python ];
 
   src = fetchurl {
-    url = "mirror://sourceforge/dmtcp/dmtcp_${version}.tar.gz";
-    sha256 = "1pw3m4l1xf887xagd0yrrnb35s372j0kvjziyy3gmx9fxpga1jzb";
+    url = "mirror://sourceforge/dmtcp/dmtcp-${version}.tar.gz";
+    sha256 = "1f83ae112e102d4fbf69dded0dfaa6daeb60c4c0c569297553785a876e95ba15";
   };
 
   preConfigure = ''
-    substituteInPlace dmtcp/src/dmtcp_coordinator.cpp \
-      --replace /bin/bash /bin/sh
-    substituteInPlace utils/gdb-add-symbol-file \
-      --replace /bin/bash /bin/sh
+    substituteInPlace src/dmtcp_coordinator.cpp \
+      --replace /bin/bash ${stdenv.shell}
+    substituteInPlace util/gdb-add-symbol-file \
+      --replace /bin/bash ${stdenv.shell}
     substituteInPlace test/autotest.py \
       --replace /usr/bin/env $(type -p env) \
       --replace /bin/bash $(type -p bash) \
       --replace /usr/bin/perl $(type -p perl) \
-      --replace /usr/bin/python $(type -p python)
+      --replace /usr/bin/python $(type -p python) \
+      --replace "os.environ['USER']" "\"nixbld1\"" \
+      --replace "os.getenv('USER')" "\"nixbld1\""
   '';
 
-  doCheck = true;
+  doCheck = false;
 
   meta = {
     description = "Distributed MultiThreaded Checkpointing";
@@ -36,6 +38,6 @@ stdenv.mkDerivation rec {
       not modify the user's program or the operating system.
     '';
     homepage = http://dmtcp.sourceforge.net/;
-    license = "LGPL";
+    license = stdenv.lib.licenses.lgpl3Plus; # most files seem this or LGPL-2.1+
   };
 }
diff --git a/pkgs/os-specific/linux/e3cfsprogs/default.nix b/pkgs/os-specific/linux/e3cfsprogs/default.nix
index 89d5ad5158c..ef25d59a9df 100644
--- a/pkgs/os-specific/linux/e3cfsprogs/default.nix
+++ b/pkgs/os-specific/linux/e3cfsprogs/default.nix
@@ -11,20 +11,10 @@ stdenv.mkDerivation {
     sha256 = "8dd3de546aeb1ae42fb05409aeb724a145fe9aa1dbe1115441c2297c9d48cf31";
   };
 
-  configureFlags =
-    if stdenv ? isDietLibC
-    then ""
-    else "--enable-dynamic-e2fsck --enable-elf-shlibs";
+  configureFlags ="--enable-dynamic-e2fsck --enable-elf-shlibs";
   buildInputs = [gettext];
   preInstall = "installFlagsArray=('LN=ln -s')";
   postInstall = "make install-libs";
-
-  NIX_CFLAGS_COMPILE =
-    if stdenv ? isDietLibC then
-      "-UHAVE_SYS_PRCTL_H " +
-      (if stdenv.system == "x86_64-linux" then "-DHAVE_LSEEK64_PROTOTYPE=1 -Dstat64=stat" else "")
-    else "";
 }
 
-
 #note that ext3cow requires the ext3cow kernel patch !!!!
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
new file mode 100644
index 00000000000..e2bcf9837e7
--- /dev/null
+++ b/pkgs/os-specific/linux/eudev/default.nix
@@ -0,0 +1,49 @@
+{stdenv, fetchurl, pkgconfig, glib, gperf, utillinux}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="eudev";
+    version = "3.0";
+    name="${baseName}-${version}";
+    url="http://dev.gentoo.org/~blueness/eudev/eudev-${version}.tar.gz";
+    sha256 = "0afva1vh3lwhw9bryh41dxg82kfnxj1ifa91p3gjwffc2fpqmnvl";
+  };
+  buildInputs = [
+    glib pkgconfig gperf utillinux
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchurl {
+    inherit (s) url sha256;
+  };
+  configureFlags = [
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+  ];
+  makeFlags = [
+    "hwdb_bin=/var/lib/udev/hwdb.bin"
+    "udevrulesdir=/etc/udev/rules.d"
+    ];
+  installFlags =
+    [
+    "localstatedir=$(TMPDIR)/var"
+    "sysconfdir=$(out)/etc"
+    "udevconfdir=$(out)/etc/udev"
+    "udevhwdbbin=$(out)/var/lib/udev/hwdb.bin"
+    "udevhwdbdir=$(out)/var/lib/udev/hwdb.d"
+    "udevrulesdir=$(out)/var/lib/udev/rules.d"
+    ];
+  enableParallelBuilding = true;
+  meta = {
+    inherit (s) version;
+    description = ''An udev fork by Gentoo'';
+    license = stdenv.lib.licenses.gpl2Plus ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+    homepage = ''http://www.gentoo.org/proj/en/eudev/'';
+    downloadPage = ''http://dev.gentoo.org/~blueness/eudev/'';
+    updateWalker = true;
+  };
+}
diff --git a/pkgs/os-specific/linux/fatrace/default.nix b/pkgs/os-specific/linux/fatrace/default.nix
new file mode 100644
index 00000000000..c6e52934a77
--- /dev/null
+++ b/pkgs/os-specific/linux/fatrace/default.nix
@@ -0,0 +1,31 @@
+{stdenv, fetchurl, python3}:
+
+stdenv.mkDerivation rec {
+  version = "0.9";
+  name = "fatrace-${version}";
+
+  src = fetchurl {
+    url = "https://launchpad.net/fatrace/trunk/${version}/+download/${name}.tar.bz2";
+    sha256 = "c028d822ffde68805e5d1f62c4e2d0f4b3d4ae565802cc9468c82b25b92e68cd";
+  };
+
+  buildInputs = [ python3 ];
+
+  makeFlagsArray = "PREFIX=$(out)";
+
+  meta = with stdenv.lib; {
+    description = "Report system-wide file access events";
+    homepage = https://launchpad.net/fatrace/;
+    license = with licenses; gpl3Plus;
+    longDescription = ''
+      fatrace reports file access events from all running processes.
+      Its main purpose is to find processes which keep waking up the disk
+      unnecessarily and thus prevent some power saving.
+
+      Requires a Linux kernel with the FANOTIFY configuration option enabled.
+      Enabling X86_MSR is also recommended for power-usage-report on x86.
+    '';
+    maintainers = with maintainers; [ nckx ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
index c1fa2c26205..91c039c875b 100644
--- a/pkgs/os-specific/linux/firejail/default.nix
+++ b/pkgs/os-specific/linux/firejail/default.nix
@@ -3,11 +3,11 @@ let
   s = # Generated upstream information
   rec {
     baseName="firejail";
-    version="0.9.8.1";
+    version="0.9.24";
     name="${baseName}-${version}";
-    hash="0wjanz42k301zdwv06ylnzqrabxy424j0k9dh4i4aqhvihvxr83x";
-    url="mirror://sourceforge/project/firejail/firejail/firejail-0.9.8.1.tar.bz2";
-    sha256="0wjanz42k301zdwv06ylnzqrabxy424j0k9dh4i4aqhvihvxr83x";
+    hash="15fz6hjxakjnsn505w3wlc6bqvf5pjwn8zfhp5aw9zq6vxr7f317";
+    url="mirror://sourceforge/project/firejail/firejail/firejail-0.9.24-rc1.tar.bz2";
+    sha256="15fz6hjxakjnsn505w3wlc6bqvf5pjwn8zfhp5aw9zq6vxr7f317";
   };
   buildInputs = [
   ];
@@ -25,6 +25,10 @@ stdenv.mkDerivation {
     sed -e '/ \/run/iif(vrcs!=NULL){symlink(vrcs, "/var/run/current-system")\;free(vrcs)\;}' -i ./src/firejail/fs_var.c
   '';
 
+  preBuild = ''
+    sed -e "s@/etc/@$out/etc/@g" -i Makefile
+  '';
+
   meta = {
     inherit (s) version;
     description = ''Namespace-based sandboxing tool for Linux'';
diff --git a/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix b/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
index 9d31fde2f0f..701b9742b6a 100644
--- a/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
+++ b/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "b43-fwcutter-018";
+  name = "b43-fwcutter-019";
 
   src = fetchurl {
     url = "http://bues.ch/b43/fwcutter/${name}.tar.bz2";
-    sha256 = "13v34pa0y1jf4hkhsh3zagyb7s8b8ymplffaayscwsd3s7f6kc2p";
+    sha256 = "1ki1f5fy3yrw843r697f8mqqdz0pbsbqnvg4yzkhibpn1lqqbsnn";
   };
 
   patches = [ ./no-root-install.patch ];
@@ -15,7 +15,6 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Firmware extractor for cards supported by the b43 kernel module";
     homepage = http://wireless.kernel.org/en/users/Drivers/b43;
-    license = "free-non-copyleft";
+    license = stdenv.lib.licenses.free;
   };
 }
-
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 04823ffeda0..6ac468774ad 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -1,70 +1,28 @@
-# The firmware bundle as packaged by Debian. This should be "all" firmware that is not shipped
-# as part of the kernel itself.
-# You can either install the complete bundle, or write a separate package for individual
-# devices that copies the firmware from this package.
+{ stdenv, fetchgit }:
 
-{ stdenv, fetchurl, dpkg }:
-
-let
-  version = "0.43";
-
-  packages = [
-    { name = "adi"; sha256 = "13cwnbispivpd73k928l1i818ylhpahp6xh7d6pw59sswrsx6inw"; }
-    { name = "atheros"; sha256 = "0sw9d52k3ynx1cxg7cq49pmm8y6vlqyhb9843hbyf6nbmjqj72bx"; }
-    { name = "bnx2"; sha256 = "1r8scys27qj5shdbgl8ag9vi4hiidx4bp8yw4n4dcp288d9x7bbh"; }
-    { name = "bnx2x"; sha256 = "03jx4vnn8irlwswydf4h3ya1kf064jkaj67jry2hr6qwpd4l8pgq"; }
-    { name = "brcm80211"; sha256 = "01mkmjkg16kdd26pwlg4a1s1717fh0j602mwqhwh46k8zakg2lkh"; }
-    { name = "intelwimax"; sha256 = "1avls6sx0pbsffrcs267r2r2rqlx2xrv8j9znc7ix1bi8g4fx91v"; }
-    { name = "ipw2x00"; sha256 = "19zqc30hsz7snw020izm81qbap3xsygggnmbspxndw7jihz0amjs"; }
-    { name = "ivtv"; sha256 = "1f2004lpw5nr9rxj3cl4ba0jdm51wkvsrbiy4drakawpjwh5y4qw"; }
-    { name = "iwlwifi"; sha256 = "1538r751mx8nhg3xibnnrhnflvf3kl5y9rnm7rpl4wyrfgx61amd"; }
-    { name = "libertas"; sha256 = "0svkqlsiqgmh970r38nh0c1pjx41zdfql2k2k5djw99fscjklacd"; }
-    { name = "linux"; sha256 = "0j62v6vbh2287j3x5c9i0xspmhyh5k1z8dyajgix7k37xi4jvpy2"; }
-    { name = "linux-nonfree"; sha256 = "1f5x72rzicivwm0sn9l6wjkx7z9a0b8n6c9m60xrqg36ly7mizzp"; }
-    { name = "myricom"; sha256 = "17cdl885jlnja5m60l35xr2f84hv8z4cvg3d25vpp171s1vf1ks1"; }
-    { name = "netxen"; sha256 = "122nava9ld1v8gcnqbdpx0kffv0rxm9glp4xg09ssvldy4myfgl7"; }
-    { name = "qlogic"; sha256 = "02pgmprz1qwij7lw1lgmb8clgxj8v3mx0fyy1l4z7bffnpvip863"; }
-    { name = "ralink"; sha256 = "0yw9gf9gm3jxmsndr8kcsf6829smm88kshfb4c8jn0n6f4yy9l7x"; }
-    { name = "realtek"; sha256 = "0gay9x47pimdqj665sr1416l3bdyca9grsqpj0s9n6k1lmywrqx1"; }
-    { name = "ti-connectivity"; sha256 = "1m6yk0827991hs46l8pp8iiwh1ms0rwlmwn64k2wr725k5yzg29b"; }
-  ];
-
-  fetchPackage =
-    { name, sha256 }: fetchurl {
-      url = "mirror://debian/pool/non-free/f/firmware-nonfree/firmware-${name}_${version}_all.deb";
-      inherit sha256;
-    };
-
-  srcs = map fetchPackage packages;
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   name = "firmware-linux-nonfree-${version}";
-  inherit srcs;
+  version = "2015-03-20";
 
-  unpackPhase = ''
-    mkdir -p ./firmware
-  '';
+  src = fetchgit {
+    url = "git://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
+    rev = "f404336ba808cbd57547196e13367079a23b822c";
+    sha256 = "0avz5vxax2b3s4gafib47vih1lbq78agdmpjcjnnnykw2kschkwa";
+  };
 
-  buildPhase = ''
-    for src in $srcs; do
-      dpkg-deb -W $src
-      dpkg-deb -x $src .
-    done
+  preInstall = ''
+    mkdir -p $out
   '';
 
-  buildInputs = [ dpkg ];
+  installFlags = [ "DESTDIR=$(out)" ];
 
-  installPhase = ''
-    mkdir -p $out/share $out/lib/firmware
-    cp -r lib/firmware/* "$out/lib/firmware/"
-    cp -r usr/share/doc $out/share/
-    find $out/share -name changelog.gz | xargs rm
-  '';
-
-  meta = {
-    description = "Binary firmware collection packaged by Debian";
+  meta = with stdenv.lib; {
+    description = "Binary firmware collection packaged by kernel.org";
     homepage = http://packages.debian.org/sid/firmware-linux-nonfree;
-    license = stdenv.lib.licenses.unfreeRedistributableFirmware;
-    platforms = stdenv.lib.platforms.linux;
+    license = licenses.unfreeRedistributableFirmware;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ wkennington ];
   };
+
+  passthru = { inherit version; };
 }
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index c9893031495..690b7dcc40f 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -18,10 +18,10 @@ in stdenv.mkDerivation {
     cp -R hardfp/opt/vc/* $out
     cp opt/vc/LICENCE $out/share/raspberrypi
   '';
-  
+
   meta = {
     description = "Firmware for the Raspberry Pi board";
     homepage = https://github.com/raspberrypi;
-    license = "non-free";
+    license = stdenv.lib.licenses.unfree;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/zd1211/default.nix b/pkgs/os-specific/linux/firmware/zd1211/default.nix
index cb4466dc20f..96e534e3b80 100644
--- a/pkgs/os-specific/linux/firmware/zd1211/default.nix
+++ b/pkgs/os-specific/linux/firmware/zd1211/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zd1211-firmware";
-  version = "1.4";
+  version = "1.5";
 
   name = "${pname}-${version}";
   
   src = fetchurl {
     url = "mirror://sourceforge/zd1211/${name}.tar.bz2";
-    sha256 = "866308f6f59f7075f075d4959dff2ede47735c751251fecd1496df1ba4d338e1";
+    sha256 = "04ibs0qw8bh6h6zmm5iz6lddgknwhsjq8ib3gyck6a7psw83h7gi";
   };
   
   buildPhase = "true";
diff --git a/pkgs/os-specific/linux/flashbench/default.nix b/pkgs/os-specific/linux/flashbench/default.nix
new file mode 100644
index 00000000000..0a6364f07df
--- /dev/null
+++ b/pkgs/os-specific/linux/flashbench/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchgit }:
+
+stdenv.mkDerivation rec {
+  name = "flashbench-${version}";
+  version = "2012-06-06";
+
+  src = fetchgit {
+    url = "https://github.com/bradfa/flashbench.git";
+    rev = "2e30b1968a66147412f21002ea844122a0d5e2f0";
+    sha256 = "037rhd2alwfip9qk78cy8fwwnc2kdyzccsyc7v2zpmvl4vvpvnhg";
+  };
+
+  installPhase = ''
+    install -d -m755 $out/bin $out/share/doc/flashbench
+    install -v -m755 flashbench $out/bin
+    install -v -m755 erase $out/bin/flashbench-erase
+    install -v -m644 README $out/share/doc/flashbench
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Testing tool for flash based memory devices";
+    homepage = https://github.com/bradfa/flashbench;
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.rycee ];
+  };
+}
diff --git a/pkgs/os-specific/linux/freefall/default.nix b/pkgs/os-specific/linux/freefall/default.nix
new file mode 100644
index 00000000000..7d5ed0cd3ee
--- /dev/null
+++ b/pkgs/os-specific/linux/freefall/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, fetchurl }:
+
+let version = "3.19"; in
+stdenv.mkDerivation rec {
+  name = "freefall-${version}";
+
+  src = fetchurl {
+    sha256 = "0v40b5l6dcviqgl47bxlcbimz7kawmy1c2909axi441jwlgm2hmy";
+    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
+  };
+
+  buildPhase = ''
+    cd Documentation/laptops
+
+    # Default time-out is a little low, probably because the AC/lid status
+    # functions were never implemented. Because no-one still uses HDDs, right?
+    substituteInPlace freefall.c --replace "alarm(2)" "alarm(5)"
+
+    cc -o freefall freefall.c
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install freefall $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Free-fall protection for spinning HP/Dell laptop hard drives";
+    longDescription = ''
+      ATA/ATAPI-7 specifies the IDLE IMMEDIATE command with unload feature.
+      Issuing this command should cause the drive to switch to idle mode and
+      unload disk heads. This feature is being used in modern laptops in
+      conjunction with accelerometers and appropriate software to implement
+      a shock protection facility. The idea is to stop all I/O operations on
+      the internal hard drive and park its heads on the ramp when critical
+      situations are anticipated. This has no effect on SSD devices!
+    '';
+    license = with licenses; gpl2;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ nckx ];
+  };
+}
diff --git a/pkgs/os-specific/linux/ftop/default.nix b/pkgs/os-specific/linux/ftop/default.nix
new file mode 100644
index 00000000000..4733ce95bb2
--- /dev/null
+++ b/pkgs/os-specific/linux/ftop/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, fetchurl, ncurses }:
+
+stdenv.mkDerivation rec {
+  name = "ftop-1.0";
+
+  src = fetchurl {
+    url = "http://ftop.googlecode.com/files/${name}.tar.bz2";
+    sha256 = "3a705f4f291384344cd32c3dd5f5f6a7cd7cea7624c83cb7e923966dbcd47f82";
+  };
+
+  buildInputs = [ ncurses ];
+
+  patches = [
+    ./ftop-fix_buffer_overflow.patch
+    ./ftop-fix_printf_format.patch
+  ];
+  patchFlags = "-p0";
+
+  postPatch = ''
+    substituteInPlace configure --replace "curses" "ncurses"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Show progress of open files and file systems";
+    homepage = https://code.google.com/p/ftop/;
+    license = with licenses; gpl3Plus;
+    longDescription = ''
+      Ftop is to files what top is to processes. The progress of all open files
+      and file systems can be monitored. If run as a regular user, the set of
+      open files will be limited to those in that user's processes (which is
+      generally all that is of interest to the user).
+      As with top, the items are displayed in order from most to least active.
+    '';
+    maintainers = with maintainers; [ nckx ];
+    platforms = with platforms; linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/ftop/ftop-fix_buffer_overflow.patch b/pkgs/os-specific/linux/ftop/ftop-fix_buffer_overflow.patch
new file mode 100644
index 00000000000..f10fa6a33b8
--- /dev/null
+++ b/pkgs/os-specific/linux/ftop/ftop-fix_buffer_overflow.patch
@@ -0,0 +1,11 @@
+--- src/ftop.c.orig	2010-06-15 21:42:15.000000000 +0200
++++ src/ftop.c	2010-06-15 21:45:38.000000000 +0200
+@@ -935,7 +935,7 @@
+     {
+         if (bar_used > 0)
+         {
+-            snprintf(rate_buf, bar_used + 1, "%s", tmp_buf);
++            snprintf(rate_buf, bar_used >= sizeof(rate_buf) ? sizeof(rate_buf) : bar_used + 1, "%s", tmp_buf);
+             p_attron(p, A_REVERSE);
+             p_printf(p, "%s", rate_buf);
+             if (bar_used > bytes)
diff --git a/pkgs/os-specific/linux/ftop/ftop-fix_printf_format.patch b/pkgs/os-specific/linux/ftop/ftop-fix_printf_format.patch
new file mode 100644
index 00000000000..afb04306428
--- /dev/null
+++ b/pkgs/os-specific/linux/ftop/ftop-fix_printf_format.patch
@@ -0,0 +1,20 @@
+--- src/ftop.c.orig	2010-06-15 23:14:50.000000000 +0200
++++ src/ftop.c	2010-06-15 23:15:52.000000000 +0200
+@@ -222,7 +222,7 @@
+     p_eol(p, part);
+ 
+     cols = snprintf(tmp_buf, sizeof(tmp_buf),
+-                    "Processes:  %u total, %u unreadable",
++                    "Processes:  %zu total, %zu unreadable",
+                     s->num_processes + s->num_unreadable_processes,
+                     s->num_unreadable_processes);
+ 
+@@ -244,7 +244,7 @@
+     p_eol(p, part);
+ 
+     snprintf(tmp_buf, sizeof(tmp_buf),
+-             "Open Files: %u regular, %u dir, %u chr, %u blk, %u pipe, %u sock, %u misc",
++             "Open Files: %zu regular, %zu dir, %zu chr, %zu blk, %zu pipe, %zu sock, %zu misc",
+              s->num_reg, s->num_dir, s->num_chr, s->num_blk, s->num_pipe,
+              s->num_sock, s->num_misc);
+ 
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index d6513f7ebb5..036ece4627b 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
     homepage = http://fuse.sourceforge.net/;
     description = "Kernel module and library that allows filesystems to be implemented in user space";
     platforms = platforms.linux;
-    maintainers = maintainers.mornfall;
+    maintainers = [ maintainers.mornfall ];
   };
 }
diff --git a/pkgs/os-specific/linux/gradm/default.nix b/pkgs/os-specific/linux/gradm/default.nix
index 87e8fa5b074..d34a028220c 100644
--- a/pkgs/os-specific/linux/gradm/default.nix
+++ b/pkgs/os-specific/linux/gradm/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name    = "gradm-${version}";
-  version = "3.0-201405281853";
+  version = "3.1-201503211320";
 
   src  = fetchurl {
     url    = "http://grsecurity.net/stable/${name}.tar.gz";
-    sha256 = "0yjmbjhm71cik5j8h2prgk40wki3sflwbf2zqmc4pwaqlvis9s2f";
+    sha256 = "17yd307jqva8jqib2xr3i9kmp58f2cb4jd7an5rbk5zr1k48ap9j";
   };
 
   buildInputs = [ gcc coreutils findutils binutils pam flex bison bash ];
diff --git a/pkgs/os-specific/linux/hdparm/default.nix b/pkgs/os-specific/linux/hdparm/default.nix
index bc83738acc8..a0cd09fbf35 100644
--- a/pkgs/os-specific/linux/hdparm/default.nix
+++ b/pkgs/os-specific/linux/hdparm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "hdparm-9.43";
+  name = "hdparm-9.45";
 
   src = fetchurl {
     url = "mirror://sourceforge/hdparm/${name}.tar.gz";
-    sha256 = "0amm2s67vzfgs0jv59jgj9pqkr6j9glj1chsj292263i94kr5gib";
+    sha256 = "0sc6yf3k6sd7n6a2ig2my9fjlqpak3znlyw7jw4cz5d9asm1rc13";
   };
 
   preBuild = ''
@@ -16,5 +16,7 @@ stdenv.mkDerivation rec {
     description = "A tool to get/set ATA/SATA drive parameters under Linux";
     homepage = http://sourceforge.net/projects/hdparm/;
     platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.bsd2;
+    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
   };
 }
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index a8988f0a452..84535e8d25e 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, libnl, openssl, pkgconfig }:
-stdenv.mkDerivation rec {
 
+stdenv.mkDerivation rec {
   name = "hostapd-${version}";
-  version = "2.1";
+  version = "2.4";
 
   src = fetchurl {
     url = "http://hostap.epitest.fi/releases/${name}.tar.gz";
-    sha256 = "121gpcs1ws7m2v8jk091jhmz3pm2xmhwkv96gqkyb4k0bgsi0waw";
+    sha256 = "0zv5pnfrp6z7jjbskzgdb2rlmlbvdxmmis7ca94x5jy9s5mypq3g";
   };
 
   buildInputs = [ libnl openssl pkgconfig ];
@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
     echo CONFIG_IEEE80211N=y | tee -a .config
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config --cflags libnl-3.0)"
   '';
+
   preInstall = "mkdir -p $out/bin";
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 325a44f97aa..1987e914ad9 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -1,11 +1,11 @@
-{stdenv, fetchurl}:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation {
-  name = "hwdata-0.249";
+  name = "hwdata-0.276";
 
   src = fetchurl {
-    url = "https://git.fedorahosted.org/cgit/hwdata.git/snapshot/hwdata-0.249-1.tar.bz2";
-    sha256 = "1ak3h3psg3wk9yk0dqnzdzik3jadzja3ah22vjfmf71p3b5xc8ai";
+    url = "https://git.fedorahosted.org/cgit/hwdata.git/snapshot/hwdata-0.276.tar.xz";
+    sha256 = "0pg0ms6kb2mm25mdklsb0xn2spcwi2mhygzc7bkpji72qq8srzsh";
   };
 
   preConfigure = "patchShebangs ./configure";
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 2cfbc2a1df1..a5bf8ccc162 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -1,24 +1,28 @@
 { fetchurl, stdenv, flex, bison, db, iptables, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  name = "iproute2-3.12.0";
+  name = "iproute2-3.19.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "04gi11gh087bg2nlxhj0lxrk8l9qxkpr88nsiil23917bm3h1xj4";
+    sha256 = "1c6pgysxfqs5qkd4kpwkbdhw3xydhjnskrz1q2k2nvqndv1ziyg2";
   };
 
-  patch = [ "vpnc.patch" ];
+  patch = [ ./vpnc.patch ];
 
-  preConfigure =
-    ''
-      patchShebangs ./configure
-      sed -e '/ARPDDIR/d' -i Makefile
-    '';
+  preConfigure = ''
+    patchShebangs ./configure
+    sed -e '/ARPDDIR/d' -i Makefile
+  '';
 
-  makeFlags = "DESTDIR= LIBDIR=$(out)/lib SBINDIR=$(out)/sbin"
-    + " CONFDIR=$(out)/etc DOCDIR=$(out)/share/doc/${name}"
-    + " MANDIR=$(out)/share/man";
+  makeFlags = [
+    "DESTDIR="
+    "LIBDIR=$(out)/lib"
+    "SBINDIR=$(out)/sbin"
+    "CONFDIR=$(out)/etc"
+    "DOCDIR=$(out)/share/doc/${name}"
+    "MANDIR=$(out)/share/man"
+  ];
 
   buildInputs = [ db iptables ];
   nativeBuildInputs = [ bison flex pkgconfig ];
@@ -28,10 +32,11 @@ stdenv.mkDerivation rec {
   # Get rid of useless TeX/SGML docs.
   postInstall = "rm -rf $out/share/doc";
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2;
     description = "A collection of utilities for controlling TCP/IP networking and traffic control in Linux";
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.eelco ];
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ eelco wkennington ];
   };
 }
diff --git a/pkgs/os-specific/linux/ipsec-tools/default.nix b/pkgs/os-specific/linux/ipsec-tools/default.nix
index 6a42784d1f0..a6042b1e33b 100644
--- a/pkgs/os-specific/linux/ipsec-tools/default.nix
+++ b/pkgs/os-specific/linux/ipsec-tools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, linuxHeaders, readline, openssl, flex, krb5, pam }:
+{ stdenv, fetchurl, linuxHeaders, readline, openssl, flex, kerberos, pam }:
 
 # TODO: These tools are supposed to work under NetBSD and FreeBSD as
 # well, so I guess it's not appropriate to place this expression in
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
     sha256 = "0b9gfbz78k2nj0k7jdlm5kajig628ja9qm0z5yksiwz22s3v7dlf";
   };
 
-  buildInputs = [ readline openssl flex krb5 pam ];
+  buildInputs = [ readline openssl flex kerberos pam ];
 
   patches = [ ./dont-create-localstatedir-during-install.patch ];
 
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
new file mode 100644
index 00000000000..b76ce583b23
--- /dev/null
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, fetchurl, pkgconfig, libmnl }:
+
+stdenv.mkDerivation rec {
+  name = "ipset-6.24";
+
+  src = fetchurl {
+    url = "http://ipset.netfilter.org/${name}.tar.bz2";
+    sha256 = "1l4mx78473azf7cb19fxf37gmj95k1zzabimbcmlg9h07wlgqw9h";
+  };
+
+  buildInputs = [ pkgconfig libmnl ];
+
+  configureFlags = [ "--with-kmod=no" ];
+
+  meta = with stdenv.lib; {
+    homepage = http://ipset.netfilter.org/;
+    description = "Administration tool for IP sets";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ wkennington ];
+  };
+}
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 0e022e0c4a1..2221250d57c 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,7 +1,8 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "iptables-1.4.21";
+  name = "iptables-${version}";
+  version = "1.4.21";
 
   src = fetchurl {
     url = "http://www.netfilter.org/projects/iptables/files/${name}.tar.bz2";
@@ -17,5 +18,8 @@ stdenv.mkDerivation rec {
     description = "A program to configure the Linux IP packet filtering ruleset";
     homepage = http://www.netfilter.org/projects/iptables/index.html;
     platforms = stdenv.lib.platforms.linux;
+    downloadPage = "http://www.netfilter.org/projects/iptables/files/";
+    updateWalker = true;
+    inherit version;
   };
 }
diff --git a/pkgs/os-specific/linux/iw/default.nix b/pkgs/os-specific/linux/iw/default.nix
index ab01231f334..262b673822b 100644
--- a/pkgs/os-specific/linux/iw/default.nix
+++ b/pkgs/os-specific/linux/iw/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl, libnl, pkgconfig}:
 
 stdenv.mkDerivation rec {
-  name = "iw-3.14";
+  name = "iw-3.15";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/iw/${name}.tar.xz";
-    sha256 = "16fr13cl02702d9yjqlgvnxvpv0w0mqn0acba39iwn2lln5b4747";
+    sha256 = "12jby9nv5nypadgdksbqw0y2kfm3j47zw7a3rwmy56d7rs90lp5x";
   };
 
   buildInputs = [ libnl pkgconfig ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Tool to use nl80211";
     homepage = http://wireless.kernel.org/en/users/Documentation/iw;
-    license = "BSD";
+    license = stdenv.lib.licenses.isc;
     maintainers = with stdenv.lib.maintainers; [viric];
     platforms = with stdenv.lib.platforms; linux;
   };
diff --git a/pkgs/os-specific/linux/jfbview/default.nix b/pkgs/os-specific/linux/jfbview/default.nix
new file mode 100644
index 00000000000..b497784861f
--- /dev/null
+++ b/pkgs/os-specific/linux/jfbview/default.nix
@@ -0,0 +1,44 @@
+{ stdenv, fetchFromGitHub, freetype, imlib2, jbig2dec, libjpeg, libX11, mujs
+, mupdf, ncurses, openjpeg, openssl }:
+
+stdenv.mkDerivation rec {
+  version = "0.4.2"; # TODO: update to 0.5 or later when nixpkgs has caught up
+  name = "jfbview-${version}";
+
+  src = fetchFromGitHub {
+    repo = "JFBView";
+    owner = "jichu4n";
+    rev = version;
+    sha256 = "1hhlzvs0jhygd3mqpzg5zymrbay9c8ilc4wjnwg00lvxhv3rwswr";
+  };
+
+  buildInputs = [ freetype imlib2 jbig2dec libjpeg libX11 mujs mupdf ncurses
+    openjpeg openssl ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = "jfbpdf jfbview";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install jfbpdf jfbview $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "PDF and image viewer for the Linux framebuffer";
+    longDescription = ''
+      PDF and image viewer for the Linux framebuffer. Very fast with a number
+      of advanced and unique features including:
+      - Reads PDFs (MuPDF) and common image formats (Imlib2).
+      - Supports arbitrary zoom (10% - 1000%) and rotation.
+      - Table of Contents (TOC) viewer for PDF documents.
+      - Multi-threaded rendering on multi-core machines.
+      - Asynchronous background rendering of the next page.
+      - Customizable multi-threaded caching.
+    '';
+    homepage = http://seasonofcode.com/pages/jfbview.html;
+    license = with licenses; asl20;
+    platforms = with platforms; linux;
+    maintainers = with maintainers; [ nckx ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kbd/console-fix.patch b/pkgs/os-specific/linux/kbd/console-fix.patch
new file mode 100644
index 00000000000..aefc20ff914
--- /dev/null
+++ b/pkgs/os-specific/linux/kbd/console-fix.patch
@@ -0,0 +1,18 @@
+diff --git a/src/loadkeys.c b/src/loadkeys.c
+index 6b23f68..adf65a0 100644
+--- a/src/loadkeys.c
++++ b/src/loadkeys.c
+@@ -166,10 +166,10 @@ main(int argc, char *argv[])
+ 		exit(EXIT_FAILURE);
+ 	}
+ 
+-	/* get console */
+-	fd = getfd(console);
+-
+ 	if (!(options & OPT_M) && !(options & OPT_B)) {
++		/* get console */
++		fd = getfd(console);
++
+ 		/* check whether the keyboard is in Unicode mode */
+ 		if (ioctl(fd, KDGKBMODE, &kbd_mode) ||
+ 		    ioctl(fd, KDGETMODE, &kd_mode)) {
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index 4d04b75b3b0..fba63daf8e5 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -1,22 +1,47 @@
-{ stdenv, fetchurl, gzip, bzip2 }:
+{ stdenv, fetchurl, autoreconfHook, gzip, bzip2, pkgconfig, check, pam }:
 
 stdenv.mkDerivation rec {
-  name = "kbd-1.15.3";
+  name = "kbd-2.0.2";
 
   src = fetchurl {
-    url = "ftp://ftp.altlinux.org/pub/people/legion/kbd/${name}.tar.gz";
-    sha256 = "1vcl2791xshjdpi4w88iy87gkb7zv0dbvi83f98v30dvqc9mfl46";
+    url = "mirror://kernel/linux/utils/kbd/${name}.tar.xz";
+    sha256 = "04mrms12nm5sas0nxs94yrr3hz7gmqhnmfgb9ff34bh1jszxmzcx";
   };
 
-  configureFlags = "--disable-nls";  
+  /* Get the dvorak programmer keymap (present in X but not in kbd) */
+  dvpSrc = fetchurl {
+    url = "http://kaufmann.no/downloads/linux/dvp-1_2_1.map.gz";
+    sha256 = "0e859211cfe16a18a3b9cbf2ca3e280a23a79b4e40b60d8d01d0fde7336b6d50";
+  };
+
+  neoSrc = fetchurl {
+    name = "neo.map";
+    url = "https://svn.neo-layout.org/linux/console/neo.map?r=2455";
+    sha256 = "1wlgp09wq84hml60hi4ls6d4zna7vhycyg40iipyh1279i91hsx7";
+  };
+
+  configureFlags = [
+    "--enable-optional-progs"
+    "--enable-libkeymap"
+    "--disable-nls"
+  ];
+
+  patches = [ ./console-fix.patch ];
 
-  patchPhase =
+  postPatch =
     ''
+      mkdir -p data/keymaps/i386/neo
+      cat "$neoSrc" > data/keymaps/i386/neo/neo.map
+      sed -i -e 's,^KEYMAPSUBDIRS *= *,&i386/neo ,' data/Makefile.in
+
+      # Add the dvp keyboard in the dvorak folder
+      ${gzip}/bin/gzip -c -d ${dvpSrc} > data/keymaps/i386/dvorak/dvp.map
+
       # Fix the path to gzip/bzip2.
-      substituteInPlace src/findfile.c \
+      substituteInPlace src/libkeymap/findfile.c \
         --replace gzip ${gzip}/bin/gzip \
         --replace bzip2 ${bzip2}/bin/bzip2 \
-    
+
       # We get a warning in armv5tel-linux and the fuloong2f, so we
       # disable -Werror in it.
       ${stdenv.lib.optionalString (stdenv.isArm || stdenv.system == "mips64el-linux") ''
@@ -24,10 +49,13 @@ stdenv.mkDerivation rec {
       ''}
     '';
 
+  buildInputs = [ autoreconfHook pkgconfig check pam ];
+
   makeFlags = "setowner= ";
 
   meta = {
     homepage = ftp://ftp.altlinux.org/pub/people/legion/kbd/;
     description = "Linux keyboard utilities and keyboard maps";
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/kernel-headers/3.7.nix b/pkgs/os-specific/linux/kernel-headers/3.12.nix
index e6fbf9bb9bc..2fd34c68edc 100644
--- a/pkgs/os-specific/linux/kernel-headers/3.7.nix
+++ b/pkgs/os-specific/linux/kernel-headers/3.12.nix
@@ -4,7 +4,7 @@ assert cross == null -> stdenv.isLinux;
 
 let
 
-  version = "3.7.1";
+  version = "3.12.32";
 
   kernelHeadersBaseConfig =
     if cross == null
@@ -17,8 +17,8 @@ stdenv.mkDerivation {
   name = "linux-headers-${version}";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.bz2";
-    sha256 = "1bb1dxj1i6j7pj926kfy6pz58kw03swyyikl9f3fq3jnswispaj2";
+    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
+    sha256 = "1hzws2bf267hfk81ywqcxspkyi1lg56x63izdc0pv1338xcfas53";
   };
 
   targetConfig = if cross != null then cross.config else null;
diff --git a/pkgs/os-specific/linux/kernel/3.17-buildfix.patch b/pkgs/os-specific/linux/kernel/3.17-buildfix.patch
deleted file mode 100644
index 234f0ac749f..00000000000
--- a/pkgs/os-specific/linux/kernel/3.17-buildfix.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From	Shea Levy <>
-Subject	[PATCH 1/1] usb: gadget: Remove use of PWD in Makefiles
-Date	Thu, 28 Aug 2014 01:30:46 -0400
-
-Using PWD breaks out-of-tree builds in certain circumstances [1], and
-other kernel Makefiles use relative paths just fine.
-
-[1]: https://bugzilla.kernel.org/show_bug.cgi?id=83251
-
-Signed-off-by: Shea Levy <shea@shealevy.com>
----
- drivers/usb/gadget/Makefile          | 2 +-
- drivers/usb/gadget/function/Makefile | 4 ++--
- drivers/usb/gadget/legacy/Makefile   | 6 +++---
- 3 files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/drivers/usb/gadget/Makefile b/drivers/usb/gadget/Makefile
-index a186afe..9add915 100644
---- a/drivers/usb/gadget/Makefile
-+++ b/drivers/usb/gadget/Makefile
-@@ -3,7 +3,7 @@
- #
- subdir-ccflags-$(CONFIG_USB_GADGET_DEBUG)	:= -DDEBUG
- subdir-ccflags-$(CONFIG_USB_GADGET_VERBOSE)	+= -DVERBOSE_DEBUG
--ccflags-y				+= -I$(PWD)/drivers/usb/gadget/udc
-+ccflags-y				+= -Idrivers/usb/gadget/udc
- 
- obj-$(CONFIG_USB_LIBCOMPOSITE)	+= libcomposite.o
- libcomposite-y			:= usbstring.o config.o epautoconf.o
-diff --git a/drivers/usb/gadget/function/Makefile b/drivers/usb/gadget/function/Makefile
-index 6d91f21..83ae106 100644
---- a/drivers/usb/gadget/function/Makefile
-+++ b/drivers/usb/gadget/function/Makefile
-@@ -2,8 +2,8 @@
- # USB peripheral controller drivers
- #
- 
--ccflags-y			:= -I$(PWD)/drivers/usb/gadget/
--ccflags-y			+= -I$(PWD)/drivers/usb/gadget/udc/
-+ccflags-y			:= -Idrivers/usb/gadget/
-+ccflags-y			+= -Idrivers/usb/gadget/udc/
- 
- # USB Functions
- usb_f_acm-y			:= f_acm.o
-diff --git a/drivers/usb/gadget/legacy/Makefile b/drivers/usb/gadget/legacy/Makefile
-index a11aad5..edba2d1 100644
---- a/drivers/usb/gadget/legacy/Makefile
-+++ b/drivers/usb/gadget/legacy/Makefile
-@@ -2,9 +2,9 @@
- # USB gadget drivers
- #
- 
--ccflags-y			:= -I$(PWD)/drivers/usb/gadget/
--ccflags-y			+= -I$(PWD)/drivers/usb/gadget/udc/
--ccflags-y			+= -I$(PWD)/drivers/usb/gadget/function/
-+ccflags-y			:= -Idrivers/usb/gadget/
-+ccflags-y			+= -Idrivers/usb/gadget/udc/
-+ccflags-y			+= -Idrivers/usb/gadget/function/
- 
- g_zero-y			:= zero.o
- g_audio-y			:= audio.o
--- 
-2.1.0
\ No newline at end of file
diff --git a/pkgs/os-specific/linux/kernel/bridge-stp-helper.patch b/pkgs/os-specific/linux/kernel/bridge-stp-helper.patch
new file mode 100644
index 00000000000..70d0f944c2a
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/bridge-stp-helper.patch
@@ -0,0 +1,13 @@
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index aea3d13..8fcbf81 100644
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -39,7 +39,7 @@
+ #define BR_GROUPFWD_8021AD	0xB801u
+ 
+ /* Path to usermode spanning tree program */
+-#define BR_STP_PROG	"/sbin/bridge-stp"
++#define BR_STP_PROG	"/run/current-system/sw/bin/bridge-stp"
+ 
+ typedef struct bridge_id bridge_id;
+ typedef struct mac_addr mac_addr;
diff --git a/pkgs/os-specific/linux/kernel/btrfs-fix-deadlock.patch b/pkgs/os-specific/linux/kernel/btrfs-fix-deadlock.patch
new file mode 100644
index 00000000000..9430d583387
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/btrfs-fix-deadlock.patch
@@ -0,0 +1,43 @@
+From 9c4f61f01d269815bb7c37be3ede59c5587747c6 Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.cz>
+Date: Fri, 2 Jan 2015 19:12:57 +0100
+Subject: btrfs: simplify insert_orphan_item
+
+We can search and add the orphan item in one go,
+btrfs_insert_orphan_item will find out if the item already exists.
+
+Signed-off-by: David Sterba <dsterba@suse.cz>
+
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 5be45c1..25a1c36 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -1254,21 +1254,13 @@ out:
+ }
+ 
+ static int insert_orphan_item(struct btrfs_trans_handle *trans,
+-			      struct btrfs_root *root, u64 offset)
++			      struct btrfs_root *root, u64 ino)
+ {
+ 	int ret;
+-	struct btrfs_path *path;
+-
+-	path = btrfs_alloc_path();
+-	if (!path)
+-		return -ENOMEM;
+ 
+-	ret = btrfs_find_item(root, path, BTRFS_ORPHAN_OBJECTID,
+-			offset, BTRFS_ORPHAN_ITEM_KEY, NULL);
+-	if (ret > 0)
+-		ret = btrfs_insert_orphan_item(trans, root, offset);
+-
+-	btrfs_free_path(path);
++	ret = btrfs_insert_orphan_item(trans, root, ino);
++	if (ret == -EEXIST)
++		ret = 0;
+ 
+ 	return ret;
+ }
+-- 
+cgit v0.10.2
+
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index d5c754eebc7..5fdfdb3b6a1 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1,28 +1,55 @@
+/*
+
+  WARNING/NOTE: whenever you want to add an option here you need to
+  either
+
+  * mark it as an optional one with `?` suffix,
+  * or make sure it works for all the versions in nixpkgs,
+  * or check for which kernel versions it will work (using kernel
+    changelog, google or whatever) and mark it with `versionOlder` or
+    `versionAtLeast`.
+
+  Then do test your change by building all the kernels (or at least
+  their configs) in nixpkgs or else you will guarantee lots and lots
+  of pain to users trying to switch to an older kernel because of some
+  hardware problems with a new one.
+
+*/
+
 { stdenv, version, kernelPlatform, extraConfig, features }:
 
 with stdenv.lib;
 
 ''
-  # Power management and debugging.
+  # Debugging.
   DEBUG_KERNEL y
-  PM_ADVANCED_DEBUG y
-  PM_RUNTIME y
   TIMER_STATS y
-  ${optionalString (versionOlder version "3.10") ''
-    USB_SUSPEND y
-  ''}
   BACKTRACE_SELF_TEST n
   CPU_NOTIFIER_ERROR_INJECT? n
   DEBUG_DEVRES n
   DEBUG_NX_TEST n
   DEBUG_STACK_USAGE n
-  ${optionalString (!(features.grsecurity or true)) ''
+  ${optionalString (!(features.grsecurity or false)) ''
     DEBUG_STACKOVERFLOW n
   ''}
   RCU_TORTURE_TEST n
   SCHEDSTATS n
   DETECT_HUNG_TASK y
 
+  # Power management.
+  ${optionalString (versionOlder version "3.19") ''
+    PM_RUNTIME y
+  ''}
+  PM_ADVANCED_DEBUG y
+  ${optionalString (versionAtLeast version "3.10") ''
+    X86_INTEL_PSTATE y
+  ''}
+  INTEL_IDLE y
+  CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
+  ${optionalString (versionOlder version "3.10") ''
+    USB_SUSPEND y
+  ''}
+
   # Support drivers that need external firmware.
   STANDALONE n
 
@@ -44,8 +71,6 @@ with stdenv.lib;
   NUMA? y
 
   # Disable some expensive (?) features.
-  FTRACE n
-  KPROBES n
   PM_TRACE_RTC n
 
   # Enable various subsystems.
@@ -59,6 +84,7 @@ with stdenv.lib;
   ''}
   SCSI_LOWLEVEL y # enable lots of SCSI devices
   SCSI_LOWLEVEL_PCMCIA y
+  SCSI_SAS_ATA y  # added to enable detection of hard drive
   SPI y # needed for many devices
   SPI_MASTER y
   WAN y
@@ -66,7 +92,7 @@ with stdenv.lib;
   # Networking options.
   IP_PNP n
   ${optionalString (versionOlder version "3.13") ''
-  IPV6_PRIVACY y
+    IPV6_PRIVACY y
   ''}
   NETFILTER_ADVANCED y
   IP_VS_PROTO_TCP y
@@ -76,6 +102,9 @@ with stdenv.lib;
   IP_DCCP_CCID3 n # experimental
   CLS_U32_PERF y
   CLS_U32_MARK y
+  ${optionalString (stdenv.system == "x86_64-linux") ''
+    BPF_JIT y
+  ''}
 
   # Wireless networking.
   CFG80211_WEXT? y # Without it, ipw2200 drivers don't build
@@ -139,10 +168,13 @@ with stdenv.lib;
 
   # Filesystem options - in particular, enable extended attributes and
   # ACLs for all filesystems that support them.
+  FANOTIFY y
   EXT2_FS_XATTR y
   EXT2_FS_POSIX_ACL y
   EXT2_FS_SECURITY y
-  EXT2_FS_XIP y # Ext2 execute in place support
+  ${optionalString (versionOlder version "4.0") ''
+    EXT2_FS_XIP y # Ext2 execute in place support
+  ''}
   EXT3_FS_POSIX_ACL y
   EXT3_FS_SECURITY y
   EXT4_FS_POSIX_ACL y
@@ -157,7 +189,6 @@ with stdenv.lib;
   XFS_RT? y # XFS Realtime subvolume support
   OCFS2_DEBUG_MASKLOG? n
   BTRFS_FS_POSIX_ACL y
-  UBIFS_FS_XATTR? y
   UBIFS_FS_ADVANCED_COMPR? y
   ${optionalString (versionAtLeast version "3.6") ''
     NFS_SWAP y
@@ -174,6 +205,23 @@ with stdenv.lib;
   CIFS_XATTR y
   CIFS_POSIX y
   CIFS_FSCACHE y
+  ${optionalString (versionAtLeast version "3.12") ''
+    CEPH_FSCACHE y
+  ''}
+  ${optionalString (versionAtLeast version "3.14") ''
+    CEPH_FS_POSIX_ACL y
+  ''}
+  ${optionalString (versionAtLeast version "3.13") ''
+    SQUASHFS_FILE_DIRECT y
+    SQUASHFS_DECOMP_MULTI_PERCPU y
+  ''}
+  SQUASHFS_XATTR y
+  SQUASHFS_ZLIB y
+  SQUASHFS_LZO y
+  SQUASHFS_XZ y
+  ${optionalString (versionAtLeast version "3.19") ''
+    SQUASHFS_LZ4 y
+  ''}
 
   # Security related features.
   STRICT_DEVMEM y # Filter access to /dev/mem
@@ -192,6 +240,16 @@ with stdenv.lib;
   SECURITY_APPARMOR y
   DEFAULT_SECURITY_APPARMOR y
 
+  # Microcode loading support
+  MICROCODE y
+  MICROCODE_INTEL y
+  MICROCODE_AMD y
+  ${optionalString (versionAtLeast version "3.11") ''
+    MICROCODE_EARLY y
+    MICROCODE_INTEL_EARLY y
+    MICROCODE_AMD_EARLY y
+  ''}
+
   # Misc. options.
   8139TOO_8129 y
   8139TOO_PIO n # PIO is slower
@@ -209,7 +267,9 @@ with stdenv.lib;
   BT_HCIUART_BCSP? y
   BT_HCIUART_H4? y # UART (H4) protocol support
   BT_HCIUART_LL? y
-  BT_RFCOMM_TTY? y # RFCOMM TTY support
+  ${optionalString (versionAtLeast version "3.4") ''
+    BT_RFCOMM_TTY? y # RFCOMM TTY support
+  ''}
   CRASH_DUMP? n
   ${optionalString (versionOlder version "3.1") ''
     DMAR? n # experimental
@@ -232,22 +292,30 @@ with stdenv.lib;
   LOGO n # not needed
   MEDIA_ATTACH y
   MEGARAID_NEWGEN y
-  MICROCODE_AMD y
   MODVERSIONS y
   MOUSE_PS2_ELANTECH y # Elantech PS/2 protocol extension
   MTRR_SANITIZER y
   NET_FC y # Fibre Channel driver support
   PPP_MULTILINK y # PPP multilink support
+  PPP_FILTER y
   REGULATOR y # Voltage and Current Regulator Support
   ${optionalString (versionAtLeast version "3.6") ''
     RC_DEVICES? y # Enable IR devices
   ''}
+  ${optionalString (versionAtLeast version "3.10") ''
+    RT2800USB_RT55XX y
+  ''}
   SCSI_LOGGING y # SCSI logging facility
   SERIAL_8250 y # 8250/16550 and compatible serial support
   SLIP_COMPRESSED y # CSLIP compressed headers
   SLIP_SMART y
   THERMAL_HWMON y # Hardware monitoring support
-  USB_DEBUG? n
+  ${optionalString (versionAtLeast version "3.15") ''
+    UEVENT_HELPER n
+  ''}
+  ${optionalString (versionOlder version "3.15") ''
+    USB_DEBUG? n
+  ''}
   USB_EHCI_ROOT_HUB_TT y # Root Hub Transaction Translators
   USB_EHCI_TT_NEWSCHED y # Improved transaction translator scheduling
   X86_CHECK_BIOS_CORRUPTION y
@@ -278,9 +346,16 @@ with stdenv.lib;
 
   # Tracing.
   FTRACE y
+  KPROBES y
   FUNCTION_TRACER y
   FTRACE_SYSCALLS y
   SCHED_TRACER y
+  STACK_TRACER y
+  ${optionalString (versionAtLeast version "3.10") ''
+    UPROBE_EVENT y
+  ''}
+  FUNCTION_PROFILER y
+  RING_BUFFER_BENCHMARK n
 
   # Devtmpfs support.
   DEVTMPFS y
@@ -303,10 +378,34 @@ with stdenv.lib;
   ''}
   XEN? y
   XEN_DOM0? y
+  ${optionalString ((versionAtLeast version "3.18") && (features.xen_dom0 or false))  ''
+    PCI_XEN? y
+    HVC_XEN? y
+    HVC_XEN_FRONTEND? y
+    XEN_SYS_HYPERVISOR? y
+    SWIOTLB_XEN? y
+    XEN_BACKEND? y
+    XEN_BALLOON? y
+    XEN_BALLOON_MEMORY_HOTPLUG? y
+    XEN_EFI? y
+    XEN_HAVE_PVMMU? y
+    XEN_MCE_LOG? y
+    XEN_PVH? y
+    XEN_PVHVM? y
+    XEN_SAVE_RESTORE? y
+    XEN_SCRUB_PAGES? y
+    XEN_SELFBALLOONING? y
+    XEN_STUB? y
+    XEN_TMEM? y
+  ''}
   KSM y
   ${optionalString (!stdenv.is64bit) ''
     HIGHMEM64G? y # We need 64 GB (PAE) support for Xen guest support.
   ''}
+  ${optionalString (versionAtLeast version "3.9" && stdenv.is64bit) ''
+    VFIO_PCI_VGA y
+  ''}
+  VIRT_DRIVERS y
 
   # Media support.
   ${optionalString (versionAtLeast version "3.6") ''
@@ -332,14 +431,20 @@ with stdenv.lib;
   TRANSPARENT_HUGEPAGE_ALWAYS? n
   TRANSPARENT_HUGEPAGE_MADVISE? y
 
-  # zram support (e.g for in-memory compressed swap)
+  # zram support (e.g for in-memory compressed swap).
   ${optionalString (versionAtLeast version "3.4") ''
     ZSMALLOC y
   ''}
   ZRAM m
-  
+
   ${optionalString (versionAtLeast version "3.17") "NFC? n"}
 
+  # Enable firmware loading via udev. Only needed for non-declarative
+  # firmware in /root/test-firmware.
+  ${optionalString (versionAtLeast version "3.17") ''
+    FW_LOADER_USER_HELPER_FALLBACK y
+  ''}
+
   ${kernelPlatform.kernelExtraConfig or ""}
   ${extraConfig}
 ''
diff --git a/pkgs/os-specific/linux/kernel/crc-regression.patch b/pkgs/os-specific/linux/kernel/crc-regression.patch
new file mode 100644
index 00000000000..623713d16a6
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/crc-regression.patch
@@ -0,0 +1,24 @@
+See https://github.com/NixOS/nixpkgs/issues/6231
+
+v3.14.31:crypto/crc32c.c is missing the MODULE_ALIAS_CRYPTO("crc32c").
+That's probably because crypto/crc32c.c was renamed to
+crypto/crc32c_generic.c in commit
+06e5a1f29819759392239669beb2cad27059c8ec and therefore fell through
+the cracks when backporting commit
+5d26a105b5a73e5635eae0629b42fa0a90e07b7b.
+
+So the affected kernels (all that backported the "crypto-" prefix
+patches) need this additional patch:
+
+diff --git a/crypto/crc32c.c b/crypto/crc32c.c
+index 06f7018c9d95..aae5829eb681 100644
+--- a/crypto/crc32c.c
++++ b/crypto/crc32c.c
+@@ -167,6 +167,7 @@ static void __exit crc32c_mod_fini(void)
+ module_init(crc32c_mod_init);
+ module_exit(crc32c_mod_fini);
+
++MODULE_ALIAS_CRYPTO("crc32c");
+ MODULE_AUTHOR("Clay Haapala <chaapala@cisco.com>");
+ MODULE_DESCRIPTION("CRC32c (Castagnoli) calculations wrapper for lib/crc32c");
+ MODULE_LICENSE("GPL");
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 13250e45494..b42892f9f2d 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -57,6 +57,10 @@ let
     autoModules = stdenv.platform.kernelAutoModules;
     arch = stdenv.platform.kernelArch;
 
+    preConfigure = ''
+        buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=Thu Jan 1 00:00:01 UTC 1970")
+    '';
+
     crossAttrs = let
         cp = stdenv.cross.platform;
       in {
diff --git a/pkgs/os-specific/linux/kernel/grsec-path.patch b/pkgs/os-specific/linux/kernel/grsec-path.patch
index 6f59cf8d80b..aaf7d80dc91 100644
--- a/pkgs/os-specific/linux/kernel/grsec-path.patch
+++ b/pkgs/os-specific/linux/kernel/grsec-path.patch
@@ -1,17 +1,18 @@
 diff --git a/kernel/kmod.c b/kernel/kmod.c
-index 67f7981..03f127d 100644
+index a26e825..29baec1 100644
 --- a/kernel/kmod.c
 +++ b/kernel/kmod.c
-@@ -246,9 +246,9 @@ static int ____call_usermodehelper(void *data)
+@@ -294,10 +294,9 @@ static int ____call_usermodehelper(void *data)
  	   out the path to be used prior to this point and are now operating
  	   on that copy
  	*/
 -	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
 -	     strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
+-	     strncmp(sub_info->path, "/usr/libexec/", 13) &&
 -	     strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
-+	     strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) ||
-+	     strstr(sub_info->path, "..")) {
++        if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/nix/store/", 11) &&
++             strncmp(sub_info->path, "/run/current-system/systemd/lib/", 32)) ||
++             strstr(sub_info->path, "..")) {
  		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
  		retval = -EPERM;
- 		goto fail;
+ 		goto out;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
index 8fa684e407c..853b784a335 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.10.53";
+  version = "3.10.73";
   extraMeta.branch = "3.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1sxa6ppgpy9fgj4lyj8d53y309v6r5nmifbrcf5pqs6l944frhq6";
+    sha256 = "0xy8738sdbw7lbqwkmbhr2zghva5nyfqq163r6jmjr6cfw116kin";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
index c67c531667a..951b55c2f35 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.12.27";
+  version = "3.12.39";
   extraMeta.branch = "3.12";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0c8psz9k6k413b48dphclqs6wkh9wiwf5nslykg27afdqd6v4ycc";
+    sha256 = "0svd2rnkrzpmnrv5qd5vfz4wkff6973s68zg5a1blmjs4p5asvl6";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.14.nix b/pkgs/os-specific/linux/kernel/linux-3.14.nix
index 74d83345ec1..8289235cd6e 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.14.nix
@@ -1,14 +1,22 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.14.17";
+  version = "3.14.37";
+  # Remember to update grsecurity!
   extraMeta.branch = "3.14";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1dl9skwd1xvkdm9gblidcawkck6x5slb41gbx0i8jxby2k6w6i5n";
+    sha256 = "1pq4i97vys38rl8ylx4s08qgh9yz3cl840j1f70yzakmc2017byc";
   };
 
+  # FIXME: remove with the next point release.
+  kernelPatches = args.kernelPatches ++
+    [ { name = "btrfs-fix-deadlock";
+        patch = ./btrfs-fix-deadlock.patch;
+      }
+    ];
+
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.15.nix b/pkgs/os-specific/linux/kernel/linux-3.18.nix
index cb2463ebfdc..8f1d9bd2765 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@@ -1,14 +1,21 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.15.10";
-  extraMeta.branch = "3.15";
+  version = "3.18.11";
+  extraMeta.branch = "3.18";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1x057a1pfr4rqzmjdb3x1bwwl6gzr6im8dg8f6anwz9fnps6vv5d";
+    sha256 = "19di7k38adnwimxddd1v6flgdsvxhgf8iswjwfyqi2p2bdcb0p5d";
   };
 
+  # FIXME: remove with the next point release.
+  kernelPatches = args.kernelPatches ++
+    [ { name = "btrfs-fix-deadlock";
+        patch = ./btrfs-fix-deadlock.patch;
+      }
+    ];
+
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.16.nix b/pkgs/os-specific/linux/kernel/linux-3.19.nix
index be2e68ab81e..e42775f0356 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.16.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.19.nix
@@ -1,14 +1,22 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.16.1";
-  extraMeta.branch = "3.16";
+  version = "3.19.3";
+  # Remember to update grsecurity!
+  extraMeta.branch = "3.19";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0wbxqlmk7w9047ir51dsz6vi7ww0hpycgrb43mk2a189xaldsdxy";
+    sha256 = "0nis1r9fg562ysirzlyvfxvirpcfhxhhpfv3s13ccz20qiqiy46f";
   };
 
+  # FIXME: remove with the next point release.
+  kernelPatches = args.kernelPatches ++
+    [ { name = "btrfs-fix-deadlock";
+        patch = ./btrfs-fix-deadlock.patch;
+      }
+    ];
+
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.2.nix b/pkgs/os-specific/linux/kernel/linux-3.2.nix
index 13205e048ca..54cf9bc9324 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.2.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.2.62";
+  version = "3.2.68";
   extraMeta.branch = "3.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1yrmar14p5y9xaj9df388xwjmwz8fnsxnid6rkxxk7dni5di8nqf";
+    sha256 = "0yz3k3qqr13r6fa2f8i83rryiawy4rrd7qk2zx6jxq6byfd31ba2";
   };
 
   # We don't provide these patches if grsecurity is enabled, because
diff --git a/pkgs/os-specific/linux/kernel/linux-3.4.nix b/pkgs/os-specific/linux/kernel/linux-3.4.nix
index 30bb873501b..2d053023721 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.4.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.4.103";
+  version = "3.4.106";
   extraMeta.branch = "3.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1ldga9l7dydwv5zvl3xgk8833cjv73yasyy2qmgimkbs03s8q4ig";
+    sha256 = "1l1k2kmlz0j12ly63w3mhvdzp5fpc22ajda4kw66fyjx96npm8sc";
   };
 
   kernelPatches = args.kernelPatches ++
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi-3.6.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 6d28c376078..67a51dc767d 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi-3.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -2,15 +2,17 @@
 
 let
 
-  rev = "7849605f5a";
+  rev = "fe4a83540ec73dfc298f16f027277355470ea9a0";
 
 in import ./generic.nix (args // rec {
-  version = "3.6.y-${rev}";
+  version = "3.18.y-${rev}";
+
+  modDirVersion = "3.18.7-v7";
 
   src = fetchurl {
     url = "https://api.github.com/repos/raspberrypi/linux/tarball/${rev}";
     name = "linux-raspberrypi-${version}.tar.gz";
-    sha256 = "1diwc5p6az6ipcldwmkq7hb5f15nvdgwzmypixc2vmzmc4ylarxl";
+    sha256 = "05gq40f038hxjqd3sdb1914g2bzw533dyxy59sgdpybs8801x2vb";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index ebbdd79ba16..769381355d4 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,17 +1,15 @@
 { stdenv, fetchurl, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.17-rc2";
-  modDirVersion = "3.17.0-rc2";
-  extraMeta.branch = "3.17";
+  version = "4.0-rc7";
+  modDirVersion = "4.0.0-rc7";
+  extraMeta.branch = "4.0";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v3.x/testing/linux-${version}.tar.xz";
-    sha256 = "094r4kqp7bj1wcdfsgdmv73law4zb7d0sd8lw82v3rz944mlm9y3";
+    url = "mirror://kernel/linux/kernel/v4.x/testing/linux-${version}.tar.xz";
+    sha256 = "1261p44zmsaq7gf08b8sd9xng2y46d4v7jyfipjlgrrmlkyfgqki";
   };
 
-  kernelPatches = args.kernelPatches ++ [ { name = "3.17-buildfix.patch"; patch = ./3.17-buildfix.patch; } ];
-
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 6d9baed7f2d..ea29c7f9e0c 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -118,9 +118,12 @@ let
       # Some image types need special install targets (e.g. uImage is installed with make uinstall)
       installTargets = [ (if platform.kernelTarget == "uImage" then "uinstall" else "install") ];
 
-      postInstall = optionalString installsFirmware ''
+      postInstall = (optionalString installsFirmware ''
         mkdir -p $out/lib/firmware
-      '' + (if isModular then ''
+      '') + (if (platform ? kernelDTB && platform.kernelDTB) then ''
+ 	make $makeFlags "''${makeFlagsArray[@]}" dtbs
+        cp $buildRoot/arch/$karch/boot/dts/*dtb $out
+      '' else "") + (if isModular then ''
         make modules_install $makeFlags "''${makeFlagsArray[@]}" \
           $installFlags "''${installFlagsArray[@]}"
         unlink $out/lib/modules/${modDirVersion}/build
@@ -222,6 +225,8 @@ stdenv.mkDerivation ((drvAttrs config stdenv.platform (kernelPatches ++ nativeKe
     "ARCH=${stdenv.platform.kernelArch}"
   ];
 
+  karch = stdenv.platform.kernelArch;
+
   crossAttrs = let cp = stdenv.cross.platform; in
     (drvAttrs crossConfig cp (kernelPatches ++ crossKernelPatches) crossConfigfile) // {
       makeFlags = commonMakeFlags ++ [
@@ -229,6 +234,8 @@ stdenv.mkDerivation ((drvAttrs config stdenv.platform (kernelPatches ++ nativeKe
         "CROSS_COMPILE=$(crossConfig)-"
       ];
 
+      karch = cp.kernelArch;
+
       # !!! uboot has messed up cross-compiling, nativeDrv builds arm tools on x86,
       # crossDrv builds x86 tools on x86 (but arm uboot). If this is fixed, uboot
       # can just go into buildInputs (but not nativeBuildInputs since cp.uboot
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index c91b8ddfb44..0b17c44be98 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, fetchgit, apparmor }:
+{ stdenv, fetchurl }:
 
 let
 
@@ -18,7 +18,7 @@ let
       };
     };
 
-  grsecPatch = { grversion ? "3.0", kversion, revision, branch, sha256 }:
+  grsecPatch = { grversion ? "3.1", kversion, revision, branch, sha256 }:
     { name = "grsecurity-${grversion}-${kversion}";
       inherit grversion kversion revision;
       patch = fetchurl {
@@ -32,6 +32,11 @@ in
 
 rec {
 
+  bridge_stp_helper =
+    { name = "bridge-stp-helper";
+      patch = ./bridge-stp-helper.patch;
+    };
+
   no_xsave =
     { name = "no-xsave";
       patch = ./no-xsave.patch;
@@ -60,21 +65,27 @@ rec {
   };
 
   grsecurity_stable = grsecPatch
-    { kversion  = "3.14.17";
-      revision  = "201408260041";
+    { kversion  = "3.14.37";
+      revision  = "201504051405";
       branch    = "stable";
-      sha256    = "1brcfxbdd5f29vci3bj2dk3878z24ncrjw268j4i1n8ms65jqda0";
+      sha256    = "0w1rz5g4wwd22ivii7m7qjgakdynzjwpqxiydx51kiw5j0avkzs3";
     };
 
   grsecurity_unstable = grsecPatch
-    { kversion  = "3.15.10";
-      revision  = "201408212335";
+    { kversion  = "3.19.3";
+      revision  = "201504021826";
       branch    = "test";
-      sha256    = "0ynnci7jms5a1acn8cpdw4w2j4jz5xai1da5w1l5r65909kwmx0k";
+      sha256    = "0r3gsha4x9bkzg9n4rcwzi9f3hkbqrf8yga1dd83kyd10fns4lzm";
     };
 
   grsec_fix_path =
     { name = "grsec-fix-path";
       patch = ./grsec-path.patch;
     };
+
+  crc_regression =
+    { name = "crc-backport-regression";
+      patch = ./crc-regression.patch;
+    };
+
 }
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 8b8f7e1e78d..efd3515ff24 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto
-, docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig
+, docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
 , withGtk ? false, gtk ? null }:
 
 with lib;
@@ -21,10 +21,13 @@ stdenv.mkDerivation {
   '';
 
   # perf refers both to newt and slang
+  # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt flex bison ];
-  buildInputs = [ elfutils python perl newt slang pkgconfig] ++
+  buildInputs = [ elfutils python perl newt slang pkgconfig libunwind binutils ] ++
     stdenv.lib.optional withGtk gtk;
 
+  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+
   installFlags = "install install-man ASCIIDOC8=1";
 
   inherit elfutils;
diff --git a/pkgs/os-specific/linux/kernel/update.sh b/pkgs/os-specific/linux/kernel/update.sh
new file mode 100755
index 00000000000..d9db7f9f916
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/update.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+set -e
+
+# Get the latest versions from kernel.org
+LINUXSED='s/.*linux-\([0-9]\+\(.[0-9]\+\)*\).*/\1/p'
+KDATA="$(curl -s https://www.kernel.org | sed -n -e '/Download complete/p')"
+VERSIONS=($(sed -n -e $LINUXSED <<< "$KDATA" | sort -Vr))
+
+# Remove mainline version if there is a stable update
+# Note due to sorting these two will always exist at the bottom
+if grep -q "^${VERSIONS[1]}" <<< "${VERSIONS[0]}"; then
+  VERSIONS=(${VERSIONS[@]:0:1} ${VERSIONS[@]:2})
+fi
+
+# Inspect each file and see if it has the latest version
+NIXPKGS="$(git rev-parse --show-toplevel)"
+ls $NIXPKGS/pkgs/os-specific/linux/kernel | while read FILE; do
+  KERNEL="$(sed -n $LINUXSED <<< "$FILE")"
+  [ -z "$KERNEL" ] && continue
+
+  # Find the matching new kernel version
+  MATCHING=""
+  for V in "${VERSIONS[@]}"; do
+    if grep -q "^$KERNEL" <<< "$V"; then
+      MATCHING="$V"
+      break
+    fi
+  done
+  if [ -z "$MATCHING" ]; then
+    echo "Out-of-support $KERNEL"
+    continue
+  fi
+
+  # Inspect the nix expression to check for changes
+  DATA="$(<$NIXPKGS/pkgs/os-specific/linux/kernel/$FILE)"
+  URL="$(sed -n -e 's/.*url = "\(.*\)";.*/\1/p' <<< "$DATA" | sed -e "s/\${version}/$MATCHING/g")"
+  OLDVER=$(sed -n -e 's/.*version = "\(.*\)".*/\1/p' <<< "$DATA")
+  if [ "$OLDVER" = "$V" ]; then
+    echo "No updates for $KERNEL"
+    continue
+  fi
+
+  # Download the new file for the hash
+  if ! HASH="$(nix-prefetch-url $URL 2>/dev/null)"; then
+    echo "Failed to get hash of $URL"
+    continue
+  fi
+  sed -i "s/sha256 = \".*\"/sha256 = \"$HASH\"/g" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
+
+  # Rewrite the expression
+  sed -i -e '/version = /d' -e '/modDirVersion = /d' $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
+  if grep -q '^[0-9]\+.[0-9]\+$' <<< "$V"; then
+    sed -i "\#import ./generic.nix (args // rec {#a \  modDirVersion = \"${V}.0\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
+  fi
+  sed -i "\#import ./generic.nix (args // rec {#a \  version = \"$V\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
+
+  # Commit the changes
+  git add -u $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
+  git commit -m "kernel: $OLDVER -> $V" >/dev/null 2>&1
+  
+  echo "Updated $OLDVER -> $V"
+done
diff --git a/pkgs/os-specific/linux/klibc/default.nix b/pkgs/os-specific/linux/klibc/default.nix
index df44cb68d8b..b948dbff2c1 100644
--- a/pkgs/os-specific/linux/klibc/default.nix
+++ b/pkgs/os-specific/linux/klibc/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, kernelHeaders, kernel, perl }:
 
 let
-  version = "2.0.3";
+  version = "2.0.4";
 
   commonMakeFlags = [
     "prefix=$(out)"
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/klibc/2.0/klibc-${version}.tar.xz";
-    sha256 = "02035f2b230020de569d40605485121e0fe481ed33a93bdb8bf8c6ee2695fffa";
+    sha256 = "7f9a0850586def7cf4faeeb75e5d0f66e613674c524f6e77b0f4d93a26c801cb";
   };
 
   patches = [ ./no-reinstall-kernel-headers.patch ];
diff --git a/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix b/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
index 682c36401de..686f63720fc 100644
--- a/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
+++ b/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
@@ -19,8 +19,8 @@ stdenv.mkDerivation {
 
     substituteInPlace "$out"/modprobe.conf \
       --replace /sbin/lsmod /run/booted-system/sw/bin/lsmod \
-      --replace /sbin/rmmod /run/booted-system/sw/sbin/rmmod \
-      --replace /sbin/modprobe /run/booted-system/sw/sbin/modprobe \
+      --replace /sbin/rmmod /run/booted-system/sw/bin/rmmod \
+      --replace /sbin/modprobe /run/booted-system/sw/bin/modprobe \
       --replace " grep " " ${gnugrep}/bin/grep " \
       --replace " xargs " " ${findutils}/bin/xargs "
   '';
diff --git a/pkgs/os-specific/linux/kmod/default.nix b/pkgs/os-specific/linux/kmod/default.nix
index 380b4a35f1c..1d190be71b8 100644
--- a/pkgs/os-specific/linux/kmod/default.nix
+++ b/pkgs/os-specific/linux/kmod/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, xz, zlib, pkgconfig, libxslt }:
 
 stdenv.mkDerivation rec {
-  name = "kmod-17";
+  name = "kmod-20";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/kernel/kmod/${name}.tar.xz";
-    sha256 = "1yid3a9b64a60ybj66fk2ysrq5klnl0ijl4g624cl16y8404g9rv";
+    sha256 = "186sz8b82n02yykza6a1q8fk80fl5gx0nr42wpmzjc9w36ia3hc9";
   };
 
   # Disable xz/zlib support to prevent needing them in the initrd.
diff --git a/pkgs/os-specific/linux/ktap/default.nix b/pkgs/os-specific/linux/ktap/default.nix
index a82804cb837..2cb4f60f75b 100644
--- a/pkgs/os-specific/linux/ktap/default.nix
+++ b/pkgs/os-specific/linux/ktap/default.nix
@@ -1,5 +1,7 @@
 { stdenv, fetchgit, kernel, useFFI ? false }:
 
+assert builtins.substring 0 4 kernel.version != "3.18";
+
 let
   ffiArgs = stdenv.lib.optionalString useFFI "FFI=1";
 in
@@ -23,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    description = "A lightweight script-based dynamic tracing tool for Linux.";
+    description = "A lightweight script-based dynamic tracing tool for Linux";
     homepage    = "http://www.ktap.org";
     license     = stdenv.lib.licenses.gpl2;
     platforms   = stdenv.lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/libaio/default.nix b/pkgs/os-specific/linux/libaio/default.nix
index bf30530e9ad..b3df129912e 100644
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchgit }:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "libaio-0.3.109";
+  version = "0.3.110";
+  name = "libaio-${version}";
 
-  src = fetchgit {
-    url = https://git.fedorahosted.org/git/libaio.git;
-    rev = "refs/tags/${name}";
-    sha256 = "1wbziq0hqvnbckpxrz1cgr8dlw3mifs4xpy3qhnagbrrsmrq2rhi";
+  src = fetchurl {
+    url = "https://fedorahosted.org/releases/l/i/libaio/${name}.tar.gz";
+    sha256 = "0zjzfkwd1kdvq6zpawhzisv7qbq1ffs343i5fs9p498pcf7046g0";
   };
 
   makeFlags = "prefix=$(out)";
@@ -15,5 +15,7 @@ stdenv.mkDerivation rec {
     description = "Library for asynchronous I/O in Linux";
     homepage = http://lse.sourceforge.net/io/aio.html;
     platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.lgpl21;
+    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
   };
 }
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 34d855da6f5..dfcbe61611c 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -4,11 +4,11 @@ assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
   name = "libcap-${version}";
-  version = "2.22";
+  version = "2.24";
 
   src = fetchurl {
-    url = "mirror://gentoo/distfiles/${name}.tar.bz2";
-    sha256 = "03q50j6bg65cc501q87qh328ncav1i8qw2bjig99vxmmfx4bvsvk";
+    url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${name}.tar.xz";
+    sha256 = "0rbc9qbqs5bp9am9s9g83wxj5k4ixps2agy9dxr1v1fwg27mdr6f";
   };
 
   outputs = [ "dev" "out" ];
diff --git a/pkgs/os-specific/linux/libcap/progs.nix b/pkgs/os-specific/linux/libcap/progs.nix
index 1902b4acb1a..ae4446c82e6 100644
--- a/pkgs/os-specific/linux/libcap/progs.nix
+++ b/pkgs/os-specific/linux/libcap/progs.nix
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libcap ];
 
+  prePatch = ''
+    # use relative bash path
+    substituteInPlace progs/capsh.c --replace "/bin/bash" "bash"
+
+    # ensure capsh can find bash in $PATH
+    substituteInPlace progs/capsh.c --replace execve execvpe
+  '';
+
   preConfigure = "cd progs";
 
   installFlags = "RAISE_SETFCAP=no";
diff --git a/pkgs/os-specific/linux/libnl/3.2.19.nix b/pkgs/os-specific/linux/libnl/3.2.19.nix
deleted file mode 100644
index ea508c088e7..00000000000
--- a/pkgs/os-specific/linux/libnl/3.2.19.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-
-{stdenv, fetchurl, bison, flex}:
-
-stdenv.mkDerivation rec {
-  name = "libnl-3.2.19";
-
-  src = fetchurl {
-    url = "${meta.homepage}files/${name}.tar.gz";
-    sha256 = "12q97cw680hg4rylyd8j3d7azwwia4ndsv3kybd1ajp8hjni39ip";
-  };
-
-  buildInputs = [ bison flex ];
-
-  meta = {
-    homepage = "http://www.infradead.org/~tgr/libnl/";
-    description = "Linux NetLink interface library";
-    maintainers = [ stdenv.lib.maintainers.urkud ];
-    platforms = stdenv.lib.platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index 093a00ed9a5..fe844226a64 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl, bison, flex}:
 
 stdenv.mkDerivation rec {
-  name = "libnl-3.2.23";
+  name = "libnl-3.2.25";
 
   src = fetchurl {
     url = "${meta.homepage}files/${name}.tar.gz";
-    sha256 = "1czj2bpb799bih6ighqwbvv9pvbpcw7vmccv9cwavfwcmalwvhlc";
+    sha256 = "1icfrv8yihcb74as1gcgmp0wfpdq632q2zvbvqqvjms9cy87bswb";
   };
 
   buildInputs = [ bison flex ];
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index c469fe93493..29b6d80445a 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "libsepol-${version}";
   version = "2.3";
   se_release = "20140506";
-  se_url = "${meta.homepage}/releases";
+  se_url = "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases";
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
diff --git a/pkgs/os-specific/linux/light/default.nix b/pkgs/os-specific/linux/light/default.nix
new file mode 100644
index 00000000000..5ca9f69f879
--- /dev/null
+++ b/pkgs/os-specific/linux/light/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  version = "0.9";
+  name = "light-${version}";
+  src = fetchurl {
+    url = "https://github.com/haikarainen/light/archive/v${version}.tar.gz";
+    sha256 = "1dnzkkg307izvw76gvzsl2vpxd2a1grxg5h82ix505rb9nnmn0d6";
+  };
+
+  installPhase = "mkdir -p $out/bin; cp light $out/bin/";
+
+  meta = {
+    description = "GNU/Linux application to control backlights";
+    homepage = https://haikarainen.github.io/light/;
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = with stdenv.lib.maintainers; [ puffnfresh ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/lightum/default.nix b/pkgs/os-specific/linux/lightum/default.nix
new file mode 100644
index 00000000000..fea188f8949
--- /dev/null
+++ b/pkgs/os-specific/linux/lightum/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchgit, libX11, libXScrnSaver, libXext, glib, dbus, pkgconfig, systemd }:
+
+stdenv.mkDerivation {
+  name = "lightum";
+  src = fetchgit {
+    url = https://github.com/poliva/lightum;
+    rev = "123e6babe0669b23d4c1dfa5511088608ff2baa8";
+    sha256 = "1r8c9mb82qgs8i7dczqx8fc7xrbn413b59xkqgjh4z1pfy75sl79";
+  };
+
+  buildInputs = [
+    dbus
+    glib
+    libX11
+    libXScrnSaver
+    libXext
+    pkgconfig
+    systemd
+  ];
+
+  installPhase = ''
+    make install prefix=$out bindir=$out/bin docdir=$out/share/doc \
+      mandir=$out/share/man INSTALL="install -c" INSTALLDATA="install -c -m 644"
+  '';
+
+  meta = {
+    description = "MacBook automatic light sensor daemon";
+    homepage = https://github.com/poliva/lightum;
+    license = stdenv.lib.licenses.gpl2;
+    maintainers = with stdenv.lib.maintainers; [ puffnfresh ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/lockdep/default.nix b/pkgs/os-specific/linux/lockdep/default.nix
index 1554715a613..612291e62e4 100644
--- a/pkgs/os-specific/linux/lockdep/default.nix
+++ b/pkgs/os-specific/linux/lockdep/default.nix
@@ -2,11 +2,12 @@
 
 stdenv.mkDerivation rec {
   name    = "lockdep-${version}";
-  version = "3.16.1";
+  version = "3.19.1";
+  fullver = "3.19.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0wbxqlmk7w9047ir51dsz6vi7ww0hpycgrb43mk2a189xaldsdxy";
+    sha256 = "0qx7vxmlcwr4nvzf4wq0da7xwzqw4b67h9a5rfpxgg9mayk3czvi";
   };
 
   preConfigure = "cd tools/lib/lockdep";
@@ -16,7 +17,7 @@ stdenv.mkDerivation rec {
     cp -R include/liblockdep $out/include
     make install DESTDIR=$out prefix=""
 
-    substituteInPlace $out/bin/lockdep --replace "./liblockdep.so" "$out/lib/liblockdep.so.$version"
+    substituteInPlace $out/bin/lockdep --replace "./liblockdep.so" "$out/lib/liblockdep.so.$fullver"
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 8e20bf1e3d3..5fe065d3cc6 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -1,16 +1,18 @@
-{ stdenv, fetchurl, kernel }:
+{ stdenv, fetchgit, kernel }:
+
+assert stdenv.lib.versionAtLeast kernel.version "3.4";  # fails on 3.2
 
 stdenv.mkDerivation rec {
-  pname = "lttng-modules-2.4.1";
+  pname = "lttng-modules-${version}";
   name = "${pname}-${kernel.version}";
+  version = "2.6.0-5-g1b2a542";
 
-  src = fetchurl {
-    url = "https://lttng.org/files/lttng-modules/${pname}.tar.bz2";
-    sha256 = "1qn1qm8lwqw9ri9wfkf6k3d58gl9rwffmpbpkwx21v1fw95zi92k";
+  src = fetchgit {
+    url = "https://github.com/lttng/lttng-modules.git";
+    rev = "1b2a5429de815c95643df2eadf91253909708728";
+    sha256 = "0zccaiadnk0xl6xrqaqlg9rpkwjgbq2fiyc3psylzqimnx0ydxc2";
   };
 
-  patches = [ ./lttng-fix-build-error-on-linux-3.2.patch ];
-
   preConfigure = ''
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     export INSTALL_MOD_PATH="$out"
@@ -23,7 +25,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Linux kernel modules for LTTng tracing";
     homepage = http://lttng.org/;
-    # TODO license = with licenses; [ lgpl21 gpl2 mit ];
+    license = with licenses; [ lgpl21 gpl2 mit ];
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
   };
diff --git a/pkgs/os-specific/linux/lttng-modules/lttng-fix-build-error-on-linux-3.2.patch b/pkgs/os-specific/linux/lttng-modules/lttng-fix-build-error-on-linux-3.2.patch
deleted file mode 100644
index dfe6d21be84..00000000000
--- a/pkgs/os-specific/linux/lttng-modules/lttng-fix-build-error-on-linux-3.2.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-When building against linux 3.2, we get this build error:
-
-  building /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/lttng-probe-ext3.o
-    CC [M]  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/lttng-probe-ext3.o
-  In file included from /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/lttng-events.h:759:0,
-                   from /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/define_trace.h:148,
-                   from /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/ext3.h:868,
-                   from /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/lttng-probe-ext3.c:48:
-  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/../instrumentation/events/lttng-module/ext3.h: In function '__event_probe__ext3__page_op':
-  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/../instrumentation/events/lttng-module/ext3.h:240:1: error: dereferencing pointer to incomplete type
-  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/../instrumentation/events/lttng-module/ext3.h:240:1: error: dereferencing pointer to incomplete type
-  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/../instrumentation/events/lttng-module/ext3.h:240:1: error: dereferencing pointer to incomplete type
-  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/../instrumentation/events/lttng-module/ext3.h: In function '__event_probe__ext3_invalidatepage':
-  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/../instrumentation/events/lttng-module/ext3.h:298:1: error: dereferencing pointer to incomplete type
-  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/../instrumentation/events/lttng-module/ext3.h:298:1: error: dereferencing pointer to incomplete type
-  /tmp/nix-build-lttng-modules-2.2.0.drv-0/lttng-modules-2.2.0/probes/../instrumentation/events/lttng-module/../../../probes/../instrumentation/events/lttng-module/ext3.h:298:1: error: dereferencing pointer to incomplete type
-
-because a check for existing ext3/*h files in the kernel build tree is skipped
-for linux < 3.4. Fix it by extending the ext3_dep_check thing to also be run
-when building against linux >= 3.2 (not only linux >= 3.4).
-
-diff -uNr lttng-modules-2.2.0.orig/probes/Makefile lttng-modules-2.2.0/probes/Makefile
---- lttng-modules-2.2.0.orig/probes/Makefile	2013-06-19 03:22:44.000000000 +0200
-+++ lttng-modules-2.2.0/probes/Makefile	2013-07-06 13:22:15.902957717 +0200
-@@ -59,7 +59,7 @@
- ext3_dep_check = $(wildcard $(ext3_dep))
- ext3 = $(shell \
- 	if [ $(VERSION) -ge 3 -a $(PATCHLEVEL) -ge 1 ] ; then \
--		if [ $(VERSION) -ge 3 -a $(PATCHLEVEL) -ge 4 -a \
-+		if [ $(VERSION) -ge 3 -a $(PATCHLEVEL) -ge 2 -a \
- 			-z "$(ext3_dep_check)" ] ; then \
- 			echo "warn" ; \
- 			exit ; \
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index 9e2b0c90079..228f7b34be0 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -1,19 +1,21 @@
-{ stdenv, fetchurl, pkgconfig, udev, utillinux, coreutils }:
+{ stdenv, fetchurl, pkgconfig, udev, utillinux, coreutils, enable_dmeventd ? false }:
 
 let
-  v = "2.02.106";
+  version = "2.02.118";
 in
 
 stdenv.mkDerivation {
-  name = "lvm2-${v}";
+  name = "lvm2-${version}";
 
   src = fetchurl {
-    url = "ftp://sources.redhat.com/pub/lvm2/releases/LVM2.${v}.tgz";
-    sha256 = "0nr833bl0q4zq52drjxmmpf7bs6kqxwa5kahwwxm9411khkxz0vc";
+    url = "ftp://sources.redhat.com/pub/lvm2/releases/LVM2.${version}.tgz";
+    sha256 = "1ishsibxn1l5fymrrc5fd3z05x1z2zh0y8939wpvwz0qp9rwxazn";
   };
 
   configureFlags =
-    "--disable-readline --enable-udev_rules --enable-udev_sync --enable-pkgconfig --enable-applib";
+    "--disable-readline --enable-udev_rules --enable-udev_sync --enable-pkgconfig --enable-applib --enable-cmdlib"
+      + (stdenv.lib.optionalString enable_dmeventd " --enable-dmeventd")
+      ;
 
   buildInputs = [ pkgconfig udev ];
 
@@ -54,5 +56,8 @@ stdenv.mkDerivation {
     homepage = http://sourceware.org/lvm2/;
     descriptions = "Tools to support Logical Volume Management (LVM) on Linux";
     platforms = stdenv.lib.platforms.linux;
+    maintainers = with stdenv.lib.maintainers; [raskin];
+    inherit version;
+    downloadPage = "ftp://sources.redhat.com/pub/lvm2/";
   };
 }
diff --git a/pkgs/os-specific/linux/lvm2/default.upstream b/pkgs/os-specific/linux/lvm2/default.upstream
new file mode 100644
index 00000000000..1e5aaf5ab5c
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/default.upstream
@@ -0,0 +1,4 @@
+url ftp://sources.redhat.com/pub/lvm2/
+version_link '[.]tgz$'
+version '.*[^0-9.][^.]*[.]([0-9.]+)[.].*' '\1'
+do_overwrite () { do_overwrite_just_version; }
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 12305687c29..9939a552574 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -1,36 +1,63 @@
-{ stdenv, autoreconfHook, fetchurl, libcap, apparmor, perl, docbook2x
-, docbook_xml_dtd_45, gnutls, pkgconfig
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, perl, docbook2x
+, docbook_xml_dtd_45, systemd
+, libapparmor ? null, gnutls ? null, libseccomp ? null, cgmanager ? null
+, libnih ? null, dbus ? null, libcap ? null
 }:
 
+let
+  enableCgmanager = cgmanager != null && libnih != null && dbus != null;
+in
+with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "lxc-1.0.3";
+  name = "lxc-1.1.1";
 
-  src = fetchurl {
-    url = "http://github.com/lxc/lxc/archive/${name}.tar.gz";
-    sha256 = "04k45jgj2i501yhm467s1a1yk7h7q0fjhspys158w1a2m1hari4z";
+  src = fetchFromGitHub {
+    owner = "lxc";
+    repo = "lxc";
+    rev = name;
+    sha256 = "04zpznd364862y3dwn97klvwfw9i2b6n1lh4fkci0z74c6z9svql";
   };
 
-  buildInputs = [ libcap apparmor perl docbook2x gnutls autoreconfHook pkgconfig ];
+  buildInputs = [
+    autoreconfHook pkgconfig perl docbook2x systemd
+    libapparmor gnutls libseccomp cgmanager libnih dbus libcap
+  ];
 
-  patches = [ ./install-localstatedir-in-store.patch ./support-db2x.patch ];
+  patches = [ ./support-db2x.patch ];
 
-  preConfigure = ''
-    export XML_CATALOG_FILES=${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml
-    substituteInPlace doc/rootfs/Makefile.am --replace '@LXCROOTFSMOUNT@' '$out/lib/lxc/rootfs'
-  '';
+  XML_CATALOG_FILES = "${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml";
 
   configureFlags = [
     "--localstatedir=/var"
+    "--sysconfdir=/etc"
     "--with-rootfs-path=/var/lib/lxc/rootfs"
+  ] ++ optional (libapparmor != null) "--enable-apparmor"
+    ++ optional (gnutls != null) "--enable-gnutls"
+    ++ optional (libseccomp != null) "--enable-seccomp"
+    ++ optional (enableCgmanager) "--enable-cgmanager"
+    ++ optional (libcap != null) "--enable-capabilities"
+    ++ [
     "--enable-doc"
     "--enable-tests"
-    "--enable-apparmor"
   ];
 
+  installFlags = [ "DESTDIR=\${out}" ];
+
+  postInstall = ''
+    mv $out/$out/* $out
+    DIR=$out/$out
+    while rmdir $DIR 2>/dev/null; do
+      DIR="$(dirname "$DIR")"
+    done
+
+    # Remove the unneeded var/lib directories
+    rm -rf $out/var
+  '';
+
   meta = {
     homepage = "http://lxc.sourceforge.net";
     description = "userspace tools for Linux Containers, a lightweight virtualization system";
-    license = stdenv.lib.licenses.lgpl21Plus;
+    license = licenses.lgpl21Plus;
 
     longDescription = ''
       LXC is the userspace control package for Linux Containers, a
@@ -40,7 +67,7 @@ stdenv.mkDerivation rec {
       mechanisms to Linux’s existing process management infrastructure.
     '';
 
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.simons ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ simons wkennington ];
   };
 }
diff --git a/pkgs/os-specific/linux/lxc/install-localstatedir-in-store.patch b/pkgs/os-specific/linux/lxc/install-localstatedir-in-store.patch
deleted file mode 100644
index d45335a0232..00000000000
--- a/pkgs/os-specific/linux/lxc/install-localstatedir-in-store.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index eac2bfd..8f040d3 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -25,8 +25,8 @@ pcdatadir = $(libdir)/pkgconfig
- pcdata_DATA = lxc.pc
- 
- install-data-local:
--	$(MKDIR_P) $(DESTDIR)$(LXCPATH)
--	$(MKDIR_P) $(DESTDIR)$(localstatedir)/cache/lxc
-+	$(MKDIR_P) $(out)$(LXCPATH)
-+	$(MKDIR_P) $(out)$(localstatedir)/cache/lxc
- 
- ChangeLog::
- 	@touch ChangeLog
diff --git a/pkgs/os-specific/linux/macchanger/default.nix b/pkgs/os-specific/linux/macchanger/default.nix
new file mode 100644
index 00000000000..b6ae89afbaf
--- /dev/null
+++ b/pkgs/os-specific/linux/macchanger/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, texinfo }:
+
+let
+  pname = "macchanger";
+  version = "1.7.0";
+in
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+
+  src = fetchFromGitHub {
+    owner = "alobbs";
+    repo = "macchanger";
+    rev = version;
+    sha256 = "1hypx6sxhd2b1nsxj314hpkhj7q4x9p2kfaaf20rjkkkig0nck9r";
+  };
+
+  buildInputs = [ autoreconfHook texinfo ];
+
+  meta = {
+    description = "A utility for viewing/manipulating the MAC address of network interfaces";
+    maintainers = [ stdenv.lib.maintainers.joachifm ];
+    license = stdenv.lib.licenses.gpl2Plus;
+    homepage = "https://www.gnu.org/software/macchanger";
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index 48e1c178490..a7965a70b1c 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -3,6 +3,15 @@
 stdenv.mkDerivation rec {
   name = "mdadm-3.3";
 
+  # WARNING -- WARNING -- WARNING -- WARNING -- WARNING -- WARNING -- WARNING
+  #  Do NOT update this if you're not ABSOLUTELY certain that it will work.
+  #  Please check the update using the NixOS VM test, BEFORE pushing:
+  #    nix-build nixos/release.nix -A tests.installer.swraid.x86_64-linux
+  # Discussion:
+  #   https://github.com/NixOS/nixpkgs/commit/7719f7f
+  #   https://github.com/NixOS/nixpkgs/commit/666cf99
+  #   https://github.com/NixOS/nixpkgs/pull/6006
+  # WARNING -- WARNING -- WARNING -- WARNING -- WARNING -- WARNING -- WARNING
   src = fetchurl {
     url = "mirror://kernel/linux/utils/raid/mdadm/${name}.tar.bz2";
     sha256 = "0igdqflihiq1dp5qlypzw0xfl44f4n3bckl7r2x2wfgkplcfa1ww";
diff --git a/pkgs/os-specific/linux/microcode/amd.nix b/pkgs/os-specific/linux/microcode/amd.nix
index 0ca33fa31f0..76a34052991 100644
--- a/pkgs/os-specific/linux/microcode/amd.nix
+++ b/pkgs/os-specific/linux/microcode/amd.nix
@@ -1,25 +1,30 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, firmwareLinuxNonfree, libarchive }:
 
 stdenv.mkDerivation rec {
-  name = "amd-ucode-2012-09-10";
+  name = "amd-ucode-${firmwareLinuxNonfree.version}";
 
-  src = fetchurl {
-    urls =
-      [ "http://pkgs.fedoraproject.org/repo/pkgs/microcode_ctl/${name}.tar/559bc355d3799538584add80df2996f0/${name}.tar"
-        "http://www.amd64.org/pub/microcode/${name}.tar"
-      ];
-    sha256 = "065phvhx5hx5ssdd1x2p5m1yv26ak7l5aaw6yk6h95x9mxn5r111";
-  };
+  src = firmwareLinuxNonfree;
+
+  sourceRoot = ".";
+
+  buildInputs = [ libarchive ];
+
+  buildPhase = ''
+    mkdir -p kernel/x86/microcode
+    find ${firmwareLinuxNonfree}/lib/firmware/amd-ucode -name \*.bin \
+      -exec sh -c 'cat {} >> kernel/x86/microcode/AuthenticAMD.bin' \;
+  '';
 
   installPhase = ''
-    mkdir -p $out/lib/firmware/amd-ucode $out/share/doc/amd-ucode
-    mv microcode_amd_fam15h.bin microcode_amd.bin $out/lib/firmware/amd-ucode/
-    mv LICENSE $out/share/doc/amd-ucode
+    mkdir -p $out
+    echo kernel/x86/microcode/AuthenticAMD.bin | bsdcpio -o -H newc -R 0:0 > $out/amd-ucode.img
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "AMD Processor microcode patch";
     homepage = http://www.amd64.org/support/microcode.html;
-    license = stdenv.lib.licenses.unfreeRedistributableFirmware;
+    license = licenses.unfreeRedistributableFirmware;
+    maintainers = with maintainers; [ wkennington ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/microcode/converter.nix b/pkgs/os-specific/linux/microcode/converter.nix
deleted file mode 100644
index da4d9677217..00000000000
--- a/pkgs/os-specific/linux/microcode/converter.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ stdenv, fetchurl }:
-
-stdenv.mkDerivation {
-  name = "microcode2ucode-20120205";
-  src = fetchurl {
-    url = "http://pkgs.fedoraproject.org/repo/pkgs/microcode_ctl/intel-microcode2ucode.c/0efc5f6c74a4d7e61ca22683c93c98cf/intel-microcode2ucode.c";
-    sha256 = "c51b1b1d8b4b28e7d5d007917c1e444af1a2ff04a9408aa9067c0e57d70164de";
-  };
-
-  sourceRoot = ".";
-
-  unpackPhase = ''
-    # nothing to unpack
-  '';
-
-  buildPhase = ''
-    gcc -Wall -O2 $src -o intel-microcode2ucode
-  '';
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    cp intel-microcode2ucode "$out/bin/"
-  '';
-
-  meta = {
-    homepage = http://www.intel.com;
-    description = "Microcode converter for Intel .dat files";
-  };
-}
diff --git a/pkgs/os-specific/linux/microcode/intel-microcode2ucode.c b/pkgs/os-specific/linux/microcode/intel-microcode2ucode.c
new file mode 100644
index 00000000000..c1660fae38a
--- /dev/null
+++ b/pkgs/os-specific/linux/microcode/intel-microcode2ucode.c
@@ -0,0 +1,154 @@
+/*
+ * Convert Intel microcode.dat into a single binary microcode.bin file
+ *
+ * Based on code by Kay Sievers <kay.sievers@vrfy.org>
+ * Changed to create a single file by Thomas Bächler <thomas@archlinux.org>
+ */
+
+
+#ifndef _GNU_SOURCE
+# define _GNU_SOURCE 1
+#endif
+
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include <limits.h>
+#include <stdbool.h>
+#include <inttypes.h>
+#include <fcntl.h>
+#include <errno.h>
+#include <sys/stat.h>
+
+struct microcode_header_intel {
+	unsigned int hdrver;
+	unsigned int rev;
+	unsigned int date;
+	unsigned int sig;
+	unsigned int cksum;
+	unsigned int ldrver;
+	unsigned int pf;
+	unsigned int datasize;
+	unsigned int totalsize;
+	unsigned int reserved[3];
+};
+
+union mcbuf {
+	struct microcode_header_intel hdr;
+	unsigned int i[0];
+	char c[0];
+};
+
+int main(int argc, char *argv[])
+{
+	const char *filename = "/lib/firmware/microcode.dat";
+	FILE *f;
+	char line[LINE_MAX];
+	char buf[4000000];
+	union mcbuf *mc;
+	size_t bufsize, count, start;
+	int rc = EXIT_SUCCESS;
+
+	if (argv[1] != NULL)
+		filename = argv[1];
+
+	count = 0;
+	mc = (union mcbuf *) buf;
+	f = fopen(filename, "re");
+	if (f == NULL) {
+		printf("open %s: %m\n", filename);
+		rc = EXIT_FAILURE;
+		goto out;
+	}
+
+	while (fgets(line, sizeof(line), f) != NULL) {
+		if (sscanf(line, "%x, %x, %x, %x",
+		    &mc->i[count],
+		    &mc->i[count + 1],
+		    &mc->i[count + 2],
+		    &mc->i[count + 3]) != 4)
+			continue;
+		count += 4;
+	}
+	fclose(f);
+
+	bufsize = count * sizeof(int);
+	printf("%s: %lu(%luk) bytes, %zu integers\n",
+	       filename,
+	       bufsize,
+	       bufsize / 1024,
+	       count);
+
+	if (bufsize < sizeof(struct microcode_header_intel))
+		goto out;
+
+	f = fopen("microcode.bin", "we");
+	if (f == NULL) {
+		printf("open microcode.bin: %m\n");
+		rc = EXIT_FAILURE;
+		goto out;
+	}
+
+	start = 0;
+	for (;;) {
+		size_t size;
+		unsigned int family, model, stepping;
+		unsigned int year, month, day;
+
+		mc = (union mcbuf *) &buf[start];
+
+		if (mc->hdr.totalsize)
+			size = mc->hdr.totalsize;
+		else
+			size = 2000 + sizeof(struct microcode_header_intel);
+
+		if (mc->hdr.ldrver != 1 || mc->hdr.hdrver != 1) {
+			printf("unknown version/format:\n");
+			rc = EXIT_FAILURE;
+			break;
+		}
+
+		/*
+		 *  0- 3 stepping
+		 *  4- 7 model
+		 *  8-11 family
+		 * 12-13 type
+		 * 16-19 extended model
+		 * 20-27 extended family
+		 */
+		family = (mc->hdr.sig >> 8) & 0xf;
+		if (family == 0xf)
+			family += (mc->hdr.sig >> 20) & 0xff;
+		model = (mc->hdr.sig >> 4) & 0x0f;
+		if (family == 0x06)
+			model += ((mc->hdr.sig >> 16) & 0x0f) << 4;
+		stepping = mc->hdr.sig & 0x0f;
+
+		year = mc->hdr.date & 0xffff;
+		month = mc->hdr.date >> 24;
+		day = (mc->hdr.date >> 16) & 0xff;
+
+		printf("\n");
+		printf("signature: 0x%02x\n", mc->hdr.sig);
+		printf("flags:     0x%02x\n", mc->hdr.pf);
+		printf("revision:  0x%02x\n", mc->hdr.rev);
+		printf("date:      %04x-%02x-%02x\n", year, month, day);
+		printf("size:      %zu\n", size);
+
+		if (fwrite(mc, size, 1, f) != 1) {
+			printf("write microcode.bin: %m\n");
+			rc = EXIT_FAILURE;
+			goto out;
+		}
+
+		start += size;
+		if (start >= bufsize)
+			break;
+	}
+	fclose(f);
+	printf("\n");
+out:
+	return rc;
+}
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index b72194548e0..ea9ff1d58d1 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -1,31 +1,34 @@
-{ stdenv, fetchurl, microcode2ucode }:
+{ stdenv, fetchurl, libarchive }:
 
-let version = "20140624"; in
-
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   name = "microcode-intel-${version}";
+  version = "20150121";
 
   src = fetchurl {
-    url = "http://downloadmirror.intel.com/23984/eng/microcode-${version}.tgz";
-    sha256 = "0dza0bdlx7q88yhnynvfgkrhgf7ycrq6mlp6hwnpp2j3h33jlrml";
+    url = "http://downloadmirror.intel.com/24661/eng/microcode-${version}.tgz";
+    sha256 = "1cznv3f25cxkwxdc930ab0ifvq0c76fryppadi4p26a2pf9knd93";
   };
 
-  buildInputs = [ microcode2ucode ];
+  buildInputs = [ libarchive ];
 
   sourceRoot = ".";
 
   buildPhase = ''
-    intel-microcode2ucode microcode.dat
+    gcc -O2 -Wall -o intel-microcode2ucode ${./intel-microcode2ucode.c}
+    ./intel-microcode2ucode microcode.dat
   '';
 
   installPhase = ''
-    mkdir -p $out/lib/firmware
-    cp -r intel-ucode "$out/lib/firmware/"
+    mkdir -p $out kernel/x86/microcode
+    mv microcode.bin kernel/x86/microcode/GenuineIntel.bin
+    echo kernel/x86/microcode/GenuineIntel.bin | bsdcpio -o -H newc -R 0:0 > $out/intel-ucode.img
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://www.intel.com/;
     description = "Microcode for Intel processors";
-    license = stdenv.lib.licenses.unfree;
+    license = licenses.unfreeRedistributableFirmware;
+    maintainers = with maintainers; [ wkennington ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/mingetty/default.nix b/pkgs/os-specific/linux/mingetty/default.nix
index 192e2c7ac5f..4e2888fa942 100644
--- a/pkgs/os-specific/linux/mingetty/default.nix
+++ b/pkgs/os-specific/linux/mingetty/default.nix
@@ -1,8 +1,8 @@
-{stdenv, fetchurl}:
+{ stdenv, fetchurl }:
 
 stdenv.mkDerivation {
   name = "mingetty-1.08";
-  
+
   src = fetchurl {
     url = mirror://sourceforge/mingetty/mingetty-1.08.tar.gz;
     sha256 = "05yxrp44ky2kg6qknk1ih0kvwkgbn9fbz77r3vci7agslh5wjm8g";
@@ -19,5 +19,6 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = http://sourceforge.net/projects/mingetty;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/module-init-tools/default.nix b/pkgs/os-specific/linux/module-init-tools/default.nix
index 66bd2dc30aa..2d6875d506a 100644
--- a/pkgs/os-specific/linux/module-init-tools/default.nix
+++ b/pkgs/os-specific/linux/module-init-tools/default.nix
@@ -12,7 +12,10 @@ stdenv.mkDerivation {
     # Upstream forgot to include the generated manpages.  Thankfully
     # the Gentoo people fixed this for us :-)
     (fetchurl {
-      url = mirror://gentoo/distfiles/module-init-tools-3.16-man.tar.bz2;
+      urls = [
+        mirror://gentoo/distfiles/module-init-tools-3.16-man.tar.bz2
+        http://mirror.meleeweb.net/pub/linux/gentoo/distfiles/module-init-tools-3.16-man.tar.bz2
+      ];
       sha256 = "1j1nzi87kgsh4scl645fhwhjvljxj83cmdasa4n4p5krhasgw358";
     })
   ];
@@ -25,10 +28,6 @@ stdenv.mkDerivation {
 
   postInstall = "rm $out/sbin/insmod.static"; # don't need it
 
-  # We don't want bash (and therefore glibc) in the closure of the
-  # output, since we want to put this in a initrd.
-  dontPatchShebangs = stdenv ? isDietLibC;
-
   meta = {
     homepage = http://www.kernel.org/pub/linux/utils/kernel/module-init-tools/;
     description = "Tools for loading and managing Linux kernel modules";
diff --git a/pkgs/os-specific/linux/mstpd/default.nix b/pkgs/os-specific/linux/mstpd/default.nix
new file mode 100644
index 00000000000..374300db460
--- /dev/null
+++ b/pkgs/os-specific/linux/mstpd/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchsvn }:
+
+stdenv.mkDerivation rec {
+  name = "mstpd-svn-${toString version}";
+  version = 61;
+
+  src = fetchsvn {
+    url = "svn://svn.code.sf.net/p/mstpd/code/trunk";
+    rev = version;
+    sha256 = "0n5vqqqq8hk6iqdz100j9ps4zkz71vyl5qgz5bzjhayab2dyq1fd";
+  };
+
+  patches = [ ./fixes.patch ];
+
+  installFlags = [ "DESTDIR=\${out}" ];
+
+  meta = with stdenv.lib; {
+    description = "Multiple Spanning Tree Protocol daemon";
+    homepage = http://sourceforge.net/projects/mstpd/;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ wkennington ];
+  };
+}
diff --git a/pkgs/os-specific/linux/mstpd/fixes.patch b/pkgs/os-specific/linux/mstpd/fixes.patch
new file mode 100644
index 00000000000..7303e1d7b4d
--- /dev/null
+++ b/pkgs/os-specific/linux/mstpd/fixes.patch
@@ -0,0 +1,72 @@
+diff --git a/Makefile b/Makefile
+index dde9f81..5af7cab 100644
+--- a/Makefile
++++ b/Makefile
+@@ -34,7 +34,6 @@ install: all
+ 	-mkdir -pv $(DESTDIR)/sbin
+ 	install -m 755 mstpd $(DESTDIR)/sbin/mstpd
+ 	install -m 755 mstpctl $(DESTDIR)/sbin/mstpctl
+-	install -m 755 bridge-stp /sbin/bridge-stp
+ 	-mkdir -pv $(DESTDIR)/lib/mstpctl-utils/
+ 	cp -rv lib/* $(DESTDIR)/lib/mstpctl-utils/
+ 	gzip -f $(DESTDIR)/lib/mstpctl-utils/mstpctl.8
+@@ -42,8 +41,9 @@ install: all
+ 	if [ -d $(DESTDIR)/etc/network/if-pre-up.d ] ; then ln -sf /lib/mstpctl-utils/ifupdown.sh $(DESTDIR)/etc/network/if-pre-up.d/mstpctl ; fi
+ 	if [ -d $(DESTDIR)/etc/network/if-pre-up.d ] ; then ln -sf /lib/mstpctl-utils/ifupdown.sh $(DESTDIR)/etc/network/if-post-down.d/mstpctl ; fi
+ 	if [ -d $(DESTDIR)/etc/bash_completion.d ] ; then ln -sf /lib/mstpctl-utils/bash_completion $(DESTDIR)/etc/bash_completion.d/mstpctl ; fi
+-	ln -sf /lib/mstpctl-utils/mstpctl.8.gz $(DESTDIR)/usr/share/man/man8/mstpctl.8.gz
+-	ln -sf /lib/mstpctl-utils/mstpctl-utils-interfaces.5.gz $(DESTDIR)/usr/share/man/man5/mstpctl-utils-interfaces.5.gz
++	mkdir -p $(DESTDIR)/share/man/man8 $(DESTDIR)/share/man/man5
++	ln -sf /lib/mstpctl-utils/mstpctl.8.gz $(DESTDIR)/share/man/man8/mstpctl.8.gz
++	ln -sf /lib/mstpctl-utils/mstpctl-utils-interfaces.5.gz $(DESTDIR)/share/man/man5/mstpctl-utils-interfaces.5.gz
+ 
+ romfs: all
+ 	$(ROMFSINST) /sbin/mstpd
+diff --git a/bridge_track.c b/bridge_track.c
+index c92fdf6..0c01aec 100644
+--- a/bridge_track.c
++++ b/bridge_track.c
+@@ -28,6 +28,7 @@
+ #include <unistd.h>
+ #include <fcntl.h>
+ #include <linux/param.h>
++#include <linux/in6.h>
+ #include <linux/if_bridge.h>
+ #include <asm/byteorder.h>
+ 
+diff --git a/broadcom_xstrata/driver_deps.c b/broadcom_xstrata/driver_deps.c
+index e72e9e3..5194253 100644
+--- a/broadcom_xstrata/driver_deps.c
++++ b/broadcom_xstrata/driver_deps.c
+@@ -14,6 +14,7 @@
+ #include <unistd.h>
+ #include <fcntl.h>
+ #include <asm/byteorder.h>
++#include <linux/in6.h>
+ #include <linux/if_bridge.h>
+ 
+ #include "log.h"
+diff --git a/ctl_functions.h b/ctl_functions.h
+index 9c3b914..df464de 100644
+--- a/ctl_functions.h
++++ b/ctl_functions.h
+@@ -27,6 +27,7 @@
+ #ifndef CTL_SOCKET_H
+ #define CTL_SOCKET_H
+ 
++#include <linux/in6.h>
+ #include <linux/if_bridge.h>
+ #include <asm/byteorder.h>
+ 
+diff --git a/mstp.c b/mstp.c
+index 1c6a2df..b2a1acd 100644
+--- a/mstp.c
++++ b/mstp.c
+@@ -37,6 +37,7 @@
+ 
+ #include <string.h>
+ #include <sys/time.h>
++#include <linux/in6.h>
+ #include <linux/if_bridge.h>
+ #include <asm/byteorder.h>
+ 
diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix
index 90722d74ace..3da37a89923 100644
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   preBuild =
     ''
-      makeFlagsArray=(GZIP="${gzip}/bin/gzip -9 -c" prefix=$out mandir=$out/share/man/man8 man5dir=$out/share/man/man5 LIB=lib)
+      makeFlagsArray=(GZIP="${gzip}/bin/gzip -9n -c" prefix=$out mandir=$out/share/man/man8 man5dir=$out/share/man/man5 LIB=lib)
       
       substituteInPlace multipath/Makefile --replace /etc $out/etc
       substituteInPlace kpartx/Makefile --replace /etc $out/etc
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 97407c887ce..1dae1d215ec 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -2,17 +2,21 @@
 
 stdenv.mkDerivation rec {
   name    = "musl-${version}";
-  version = "1.1.4";
+  version = "1.1.8";
 
   src = fetchurl {
     url    = "http://www.musl-libc.org/releases/${name}.tar.gz";
-    sha256 = "1kgmi17zpzgjhywmmqxazj8qsx8cf9siwa65jqd2i6rs7jnnb335";
+    sha256 = "04vq4a1hm81kbxfcqa30s6xpzbqf3568gbysfxcmb72v8438b4ps";
   };
 
   enableParallelBuilding = true;
-  configurePhase = ''
-    ./configure --enable-shared --enable-static --prefix=$out --syslibdir=$out/lib
-  '';
+
+  configureFlags = [
+    "--enable-shared"
+    "--enable-static"
+  ];
+
+  dontDisableStatic = true;
 
   meta = {
     description = "An efficient, small, quality libc implementation";
diff --git a/pkgs/os-specific/linux/netatop/default.nix b/pkgs/os-specific/linux/netatop/default.nix
index c77faa6a9e7..3d6b6faccca 100644
--- a/pkgs/os-specific/linux/netatop/default.nix
+++ b/pkgs/os-specific/linux/netatop/default.nix
@@ -1,5 +1,7 @@
 { stdenv, fetchurl, kernel, zlib }:
 
+assert stdenv.lib.versionOlder kernel.version "3.17";
+
 stdenv.mkDerivation {
   name = "netatop-${kernel.version}-0.3";
 
diff --git a/pkgs/os-specific/linux/nfs-utils/default.nix b/pkgs/os-specific/linux/nfs-utils/default.nix
index bb85acf4dcb..6b30104b083 100644
--- a/pkgs/os-specific/linux/nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/nfs-utils/default.nix
@@ -1,5 +1,6 @@
 { fetchurl, stdenv, tcp_wrappers, utillinux, libcap, libtirpc, libevent, libnfsidmap
-, lvm2, e2fsprogs }:
+, lvm2, e2fsprogs, python
+}:
 
 stdenv.mkDerivation rec {
   name = "nfs-utils-1.2.5";
@@ -11,7 +12,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [ tcp_wrappers utillinux libcap libtirpc libevent libnfsidmap
-      lvm2 e2fsprogs
+      lvm2 e2fsprogs python
     ];
 
   # FIXME: Add the dependencies needed for NFSv4 and TI-RPC.
@@ -57,6 +58,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
 
     platforms = stdenv.lib.platforms.linux;
-    maintainers = [ stdenv.lib.maintainers.ludo ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index e8dd56ab9e2..9834443a74d 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -1,12 +1,12 @@
-{ stdenv, fetchurl, docbook2x, docbook_xml_dtd_45
+{ stdenv, fetchurl, pkgconfig, docbook2x, docbook_xml_dtd_45
 , flex, bison, libmnl, libnftnl, gmp, readline }:
 
 stdenv.mkDerivation rec {
-  name = "nftables-0.3";
+  name = "nftables-0.4";
 
   src = fetchurl {
     url = "http://netfilter.org/projects/nftables/files/${name}.tar.bz2";
-    sha256 = "0bww48hc424svxfx3fpqxmbmp0n42ahs1f28f5f6g29d8i2jcdsd";
+    sha256 = "0g0x6mf5580kr1azrff0ryxxym43qr72fwir7agmz4b8bjvnkjpn";
   };
 
   configureFlags = [
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   XML_CATALOG_FILES = "${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml";
 
-  buildInputs = [ docbook2x flex bison libmnl libnftnl gmp readline ];
+  buildInputs = [ pkgconfig docbook2x flex bison libmnl libnftnl gmp readline ];
 
   meta = with stdenv.lib; {
     description = "the project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
diff --git a/pkgs/os-specific/linux/nvidia-x11/beta.nix b/pkgs/os-specific/linux/nvidia-x11/beta.nix
new file mode 100644
index 00000000000..fb57e194c80
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/beta.nix
@@ -0,0 +1,64 @@
+{ stdenv, fetchurl, kernel ? null, xlibs, zlib, perl
+, gtk, atk, pango, glib, gdk_pixbuf, cairo
+, # Whether to build the libraries only (i.e. not the kernel module or
+  # nvidia-settings).  Used to support 32-bit binaries on 64-bit
+  # Linux.
+  libsOnly ? false
+}:
+
+with stdenv.lib;
+
+assert (!libsOnly) -> kernel != null;
+
+let
+
+  versionNumber = "349.12";
+
+  # Policy: use the highest stable version as the default (on our master).
+  inherit (stdenv.lib) makeLibraryPath;
+
+in
+
+stdenv.mkDerivation {
+  name = "nvidia-x11-${versionNumber}${optionalString (!libsOnly) "-${kernel.version}"}";
+
+  builder = ./builder.sh;
+
+  src =
+    if stdenv.system == "i686-linux" then
+      fetchurl {
+        url = "http://us.download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
+        sha256 = "0x9zfw66nxv98zpkdkymlyqzspksk850bhfmza7g7pba4yba085h";
+      }
+    else if stdenv.system == "x86_64-linux" then
+      fetchurl {
+        url = "http://us.download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
+        sha256 = "19mfkigzffxsik3h4bsjsl481q410h804fz3rdc7chs86q4bg9h3";
+      }
+    else throw "nvidia-x11 does not support platform ${stdenv.system}";
+
+  inherit versionNumber libsOnly;
+
+  kernel = if libsOnly then null else kernel.dev;
+
+  dontStrip = true;
+
+  glPath      = makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr];
+  cudaPath    = makeLibraryPath [zlib stdenv.cc.cc];
+  openclPath  = makeLibraryPath [zlib];
+  allLibPath  = makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr zlib stdenv.cc.cc];
+
+  gtkPath = optionalString (!libsOnly) (makeLibraryPath
+    [ gtk atk pango glib gdk_pixbuf cairo ] );
+  programPath = makeLibraryPath [ xlibs.libXv ];
+
+  buildInputs = [ perl ];
+
+  meta = with stdenv.lib.meta; {
+    homepage = http://www.nvidia.com/object/unix.html;
+    description = "X.org driver and kernel module for NVIDIA graphics cards";
+    license = licenses.unfreeRedistributable;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.vcunat ];
+  };
+}
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder-legacy.sh b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
index 7d39dd31189..5d47df9a87a 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder-legacy.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
@@ -81,7 +81,7 @@ installPhase() {
 
         for i in nvidia-settings nvidia-xconfig; do
 	    cp usr/bin/$i $out/bin/$i
-	    patchelf --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
+	    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
 	        --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
         done
     
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder-legacy304.sh b/pkgs/os-specific/linux/nvidia-x11/builder-legacy304.sh
index 7771fb988f5..20666fdb061 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder-legacy304.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder-legacy304.sh
@@ -72,7 +72,7 @@ installPhase() {
 
         for i in nvidia-settings nvidia-xconfig; do
 	    cp $i $out/bin/$i
-	    patchelf --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
+	    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
 	        --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
         done
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder-legacy340.sh b/pkgs/os-specific/linux/nvidia-x11/builder-legacy340.sh
new file mode 100755
index 00000000000..5d6647d1ee0
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/builder-legacy340.sh
@@ -0,0 +1,107 @@
+source $stdenv/setup
+
+dontPatchELF=1 # must keep libXv, $out in RPATH
+
+
+unpackFile() {
+    skip=$(sed 's/^skip=//; t; d' $src)
+    tail -n +$skip $src | xz -d | tar xvf -
+    sourceRoot=.
+}
+
+
+buildPhase() {
+    if test -z "$libsOnly"; then
+        # Create the module.
+        echo "Building linux driver against kernel: $kernel";
+        cd kernel
+        kernelVersion=$(cd $kernel/lib/modules && ls)
+        sysSrc=$(echo $kernel/lib/modules/$kernelVersion/source)
+        sysOut=$(echo $kernel/lib/modules/$kernelVersion/build)
+        unset src # used by the nv makefile
+        make SYSSRC=$sysSrc SYSOUT=$sysOut module
+        cd uvm
+        make SYSSRC=$sysSrc SYSOUT=$sysOut module
+        cd ..
+        cd ..
+    fi
+}
+
+
+installPhase() {
+
+    if test -z "$libsOnly"; then
+        # Install the kernel module.
+        mkdir -p $out/lib/modules/$kernelVersion/misc
+        cp kernel/nvidia.ko $out/lib/modules/$kernelVersion/misc
+        cp kernel/uvm/nvidia-uvm.ko $out/lib/modules/$kernelVersion/misc
+
+        # Install the X driver.
+        mkdir -p $out/lib/xorg/modules
+        cp -p libnvidia-wfb.* $out/lib/xorg/modules/
+        mkdir -p $out/lib/xorg/modules/drivers
+        cp -p nvidia_drv.so $out/lib/xorg/modules/drivers
+        mkdir -p $out/lib/xorg/modules/extensions
+        cp -p libglx.so.* $out/lib/xorg/modules/extensions
+
+        #patchelf --set-rpath $out/lib $out/lib/xorg/modules/extensions/libglx.so.*.*
+
+        # Install the programs.
+        mkdir -p $out/bin
+
+        for i in nvidia-settings nvidia-smi; do
+            cp $i $out/bin/$i
+            patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+                --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
+        done
+
+        # Header files etc.
+        mkdir -p $out/include/nvidia
+        cp -p *.h $out/include/nvidia
+
+        mkdir -p $out/share/man/man1
+        cp -p *.1.gz $out/share/man/man1
+        rm $out/share/man/man1/nvidia-xconfig.1.gz
+
+        mkdir -p $out/share/applications
+        cp -p *.desktop $out/share/applications
+
+        mkdir -p $out/share/pixmaps
+        cp -p nvidia-settings.png $out/share/pixmaps
+
+        # Patch the `nvidia-settings.desktop' file.
+        substituteInPlace $out/share/applications/nvidia-settings.desktop \
+            --replace '__UTILS_PATH__' $out/bin \
+            --replace '__PIXMAP_PATH__' $out/share/pixmaps
+
+        # Test a bit.
+        $out/bin/nvidia-settings --version
+    fi
+
+
+    # Install libGL and friends.
+    mkdir -p "$out/lib/vendors"
+    cp -p nvidia.icd $out/lib/vendors/
+
+    cp -prd *.so.* tls "$out/lib/"
+    rm "$out"/lib/lib{glx,nvidia-wfb}.so.* # handled separately
+
+    for libname in `find "$out/lib/" -name '*.so.*'`
+    do
+      # I'm lazy to differentiate needed libs per-library, as the closure is the same.
+      # Unfortunately --shrink-rpath would strip too much.
+      patchelf --set-rpath "$out/lib:$allLibPath" "$libname"
+
+      libname_short=`echo -n "$libname" | sed 's/so\..*/so/'`
+      ln -srnf "$libname" "$libname_short"
+      ln -srnf "$libname" "$libname_short.1"
+    done
+
+    #patchelf --set-rpath $out/lib:$glPath $out/lib/libGL.so.*.*
+    #patchelf --set-rpath $out/lib:$glPath $out/lib/libvdpau_nvidia.so.*.*
+    #patchelf --set-rpath $cudaPath $out/lib/libcuda.so.*.*
+    #patchelf --set-rpath $openclPath $out/lib/libnvidia-opencl.so.*.*
+}
+
+
+genericBuild
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 4291116f4ef..5edadeda81b 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -29,14 +29,15 @@ buildPhase() {
 
 
 installPhase() {
+    # Install libGL and friends.
+    mkdir -p "$out/lib/vendors"
+    cp -p nvidia.icd $out/lib/vendors/
 
-    if test -z "$libsOnly"; then
-        # Install the kernel module.
-        mkdir -p $out/lib/modules/$kernelVersion/misc
-        cp kernel/nvidia.ko $out/lib/modules/$kernelVersion/misc
-        cp kernel/uvm/nvidia-uvm.ko $out/lib/modules/$kernelVersion/misc
+    cp -prd *.so.* tls "$out/lib/"
+    rm "$out"/lib/lib{glx,nvidia-wfb}.so.* # handled separately
 
-        # Install the X driver.
+    if test -z "$libsOnly"; then
+        # Install the X drivers.
         mkdir -p $out/lib/xorg/modules
         cp -p libnvidia-wfb.* $out/lib/xorg/modules/
         mkdir -p $out/lib/xorg/modules/drivers
@@ -44,18 +45,31 @@ installPhase() {
         mkdir -p $out/lib/xorg/modules/extensions
         cp -p libglx.so.* $out/lib/xorg/modules/extensions
 
-        #patchelf --set-rpath $out/lib $out/lib/xorg/modules/extensions/libglx.so.*.*
+        # Install the kernel module.
+        mkdir -p $out/lib/modules/$kernelVersion/misc
+        cp kernel/nvidia.ko $out/lib/modules/$kernelVersion/misc
+        cp kernel/uvm/nvidia-uvm.ko $out/lib/modules/$kernelVersion/misc
+    fi
 
-        # Install the programs.
-        mkdir -p $out/bin
+    # All libs except GUI-only are in $out now, so fixup them.
+    for libname in `find "$out/lib/" -name '*.so.*'`
+    do
+      # I'm lazy to differentiate needed libs per-library, as the closure is the same.
+      # Unfortunately --shrink-rpath would strip too much.
+      patchelf --set-rpath "$out/lib:$allLibPath" "$libname"
 
-        for i in nvidia-settings nvidia-smi; do
-            cp $i $out/bin/$i
-            patchelf --interpreter "$(cat $NIX_GCC/nix-support/dynamic-linker)" \
-                --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
-        done
+      libname_short=`echo -n "$libname" | sed 's/so\..*/so/'`
+      ln -srnf "$libname" "$libname_short"
+      ln -srnf "$libname" "$libname_short.1"
+    done
+
+    #patchelf --set-rpath $out/lib:$glPath $out/lib/libGL.so.*.*
+    #patchelf --set-rpath $out/lib:$glPath $out/lib/libvdpau_nvidia.so.*.*
+    #patchelf --set-rpath $cudaPath $out/lib/libcuda.so.*.*
+    #patchelf --set-rpath $openclPath $out/lib/libnvidia-opencl.so.*.*
 
-        # Header files etc.
+    if test -z "$libsOnly"; then
+        # Install headers and /share files etc.
         mkdir -p $out/include/nvidia
         cp -p *.h $out/include/nvidia
 
@@ -74,33 +88,26 @@ installPhase() {
             --replace '__UTILS_PATH__' $out/bin \
             --replace '__PIXMAP_PATH__' $out/share/pixmaps
 
-        # Test a bit.
-        $out/bin/nvidia-settings --version
-    fi
-
 
-    # Install libGL and friends.
-    mkdir -p "$out/lib/vendors"
-    cp -p nvidia.icd $out/lib/vendors/
+        # Install the programs.
+        mkdir -p $out/bin
 
-    cp -prd *.so.* tls "$out/lib/"
-    rm "$out"/lib/lib{glx,nvidia-wfb}.so.* # handled separately
+        for i in nvidia-settings nvidia-smi; do
+            cp $i $out/bin/$i
+            patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+                --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
+        done
 
-    for libname in `find "$out/lib/" -name '*.so.*'`
-    do
-      # I'm lazy to differentiate needed libs per-library, as the closure is the same.
-      # Unfortunately --shrink-rpath would strip too much.
-      patchelf --set-rpath "$out/lib:$allLibPath" "$libname"
+        patchelf --set-rpath $glPath:$gtkPath $out/lib/libnvidia-gtk2.so.*.*
 
-      libname_short=`echo -n "$libname" | sed 's/so\..*/so/'`
-      ln -srnf "$libname" "$libname_short"
-      ln -srnf "$libname" "$libname_short.1"
-    done
+        # Test a bit.
+        $out/bin/nvidia-settings --version
+    else
+        rm $out/lib/libnvidia-gtk2.*
+    fi
 
-    #patchelf --set-rpath $out/lib:$glPath $out/lib/libGL.so.*.*
-    #patchelf --set-rpath $out/lib:$glPath $out/lib/libvdpau_nvidia.so.*.*
-    #patchelf --set-rpath $cudaPath $out/lib/libcuda.so.*.*
-    #patchelf --set-rpath $openclPath $out/lib/libnvidia-opencl.so.*.*
+    # For simplicity and dependency reduction, don't support the gtk3 interface.
+    rm $out/lib/libnvidia-gtk3.*
 }
 
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index c89846db72c..e660004d172 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, kernel ? null, xlibs, zlib, perl
-, gtk, atk, pango, glib, gdk_pixbuf
+, gtk, atk, pango, glib, gdk_pixbuf, cairo
 , # Whether to build the libraries only (i.e. not the kernel module or
   # nvidia-settings).  Used to support 32-bit binaries on 64-bit
   # Linux.
@@ -12,9 +12,11 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "340.32";
+  versionNumber = "346.59";
 
+  # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
+
 in
 
 stdenv.mkDerivation {
@@ -26,12 +28,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://us.download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "1xcm8czz4bmnlzkl3al58flw6jmbrg1y77cxjjdjqcsvbk1qj10x";
+        sha256 = "0a91mmv9846chyx6rbf3hx39gr344cffmgic45a9sf82rky87kv5";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://us.download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "1nfrpx73817y1z0wkqqh02xjg65r0f05h9801mqm8ki2gxqv9vq0";
+        sha256 = "0rz7pdzdviz1086w8ks6qiv83ah84y13h3051xr1p4wa4kll2yac";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
@@ -42,12 +44,13 @@ stdenv.mkDerivation {
   dontStrip = true;
 
   glPath      = makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr];
-  cudaPath    = makeLibraryPath [zlib stdenv.gcc.gcc];
+  cudaPath    = makeLibraryPath [zlib stdenv.cc.cc];
   openclPath  = makeLibraryPath [zlib];
-  allLibPath  = makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr zlib stdenv.gcc.gcc];
+  allLibPath  = makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr zlib stdenv.cc.cc];
 
-  programPath = optionalString (!libsOnly) (makeLibraryPath
-    [ gtk atk pango glib gdk_pixbuf xlibs.libXv ] );
+  gtkPath = optionalString (!libsOnly) (makeLibraryPath
+    [ gtk atk pango glib gdk_pixbuf cairo ] );
+  programPath = makeLibraryPath [ xlibs.libXv ];
 
   buildInputs = [ perl ];
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy173.nix b/pkgs/os-specific/linux/nvidia-x11/legacy173.nix
index 0014a5d2ee5..432a756b6f6 100644
--- a/pkgs/os-specific/linux/nvidia-x11/legacy173.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/legacy173.nix
@@ -1,6 +1,6 @@
 {stdenv, fetchurl, kernel, xlibs, zlib, gtk, atk, pango, glib, gdk_pixbuf}:
 
-let 
+let
 
   versionNumber = "173.14.39";
 
@@ -8,9 +8,9 @@ in
 
 stdenv.mkDerivation {
   name = "nvidia-x11-${versionNumber}-${kernel.version}";
-  
-  builder = ./builder-legacy.sh;
-  
+
+  builder = ./builder-legacy173.sh;
+
   src =
     if stdenv.system == "i686-linux" then
       fetchurl {
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
 
   glPath = stdenv.lib.makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr];
 
-  cudaPath = stdenv.lib.makeLibraryPath [zlib stdenv.gcc.gcc];
+  cudaPath = stdenv.lib.makeLibraryPath [zlib stdenv.cc.cc];
 
   programPath = stdenv.lib.makeLibraryPath [ gtk atk pango glib gdk_pixbuf xlibs.libXv ];
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy304.nix b/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
index 9acaee797f0..d5e350a0302 100644
--- a/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
@@ -8,7 +8,7 @@
 
 with stdenv.lib;
 
-let versionNumber = "304.123"; in
+let versionNumber = "304.125"; in
 
 stdenv.mkDerivation {
   name = "nvidia-x11-${versionNumber}${optionalString (!libsOnly) "-${kernel.version}"}";
@@ -19,12 +19,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://us.download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "09gljwxw14img7hw0xdxd24cvpvlymdxssmxa9gikdrw2w04j0ym";
+        sha256 = "1xy4g3yc73mb932cfr25as648k12sxpyymppb8nia3lijakv7idf";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://us.download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "0vxw4gp78g06h5inwkhl989p9mq0m8rqipz9a67rdc4s364r243s";
+        sha256 = "08p6hikn7pbfg0apnsbaqyyh2s9m5r0ckqzgjvxirn5qcyll0g5a";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
 
   glPath = stdenv.lib.makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr];
 
-  cudaPath = stdenv.lib.makeLibraryPath [zlib stdenv.gcc.gcc];
+  cudaPath = stdenv.lib.makeLibraryPath [zlib stdenv.cc.cc];
 
   programPath = optionalString (!libsOnly) (stdenv.lib.makeLibraryPath
     [ gtk atk pango glib gdk_pixbuf xlibs.libXv ] );
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy340.nix b/pkgs/os-specific/linux/nvidia-x11/legacy340.nix
new file mode 100644
index 00000000000..7fcdb40de03
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/legacy340.nix
@@ -0,0 +1,64 @@
+{ stdenv, fetchurl, kernel ? null, xlibs, zlib, perl
+, gtk, atk, pango, glib, gdk_pixbuf
+, # Whether to build the libraries only (i.e. not the kernel module or
+  # nvidia-settings).  Used to support 32-bit binaries on 64-bit
+  # Linux.
+  libsOnly ? false
+}:
+
+with stdenv.lib;
+
+assert (!libsOnly) -> kernel != null;
+
+let
+
+  versionNumber = "340.76";
+  /* This branch is needed for G8x, G9x, and GT2xx GPUs, and motherboard chipsets based on them.
+    Ongoing support for new Linux kernels and X servers, as well as fixes for critical bugs,
+    will be included in 340.* legacy releases through the end of 2019.
+  */
+  inherit (stdenv.lib) makeLibraryPath;
+in
+
+stdenv.mkDerivation {
+  name = "nvidia-x11-${versionNumber}${optionalString (!libsOnly) "-${kernel.version}"}";
+
+  builder = ./builder-legacy340.sh;
+
+  src =
+    if stdenv.system == "i686-linux" then
+      fetchurl {
+        url = "http://us.download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
+        sha256 = "1l1nn340hc8iwlzb16gcm2xvnvkw7rf84ll89bcax70094xxjacv";
+      }
+    else if stdenv.system == "x86_64-linux" then
+      fetchurl {
+        url = "http://us.download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
+        sha256 = "016hnsgrcm4ly0mnkcd6c1qkciy3qmbwdwy4rlwq3m6dh4ixw7jc";
+      }
+    else throw "nvidia-x11 does not support platform ${stdenv.system}";
+
+  inherit versionNumber libsOnly;
+
+  kernel = if libsOnly then null else kernel.dev;
+
+  dontStrip = true;
+
+  glPath      = makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr];
+  cudaPath    = makeLibraryPath [zlib stdenv.cc.cc];
+  openclPath  = makeLibraryPath [zlib];
+  allLibPath  = makeLibraryPath [xlibs.libXext xlibs.libX11 xlibs.libXrandr zlib stdenv.cc.cc];
+
+  programPath = optionalString (!libsOnly) (makeLibraryPath
+    [ gtk atk pango glib gdk_pixbuf xlibs.libXv ] );
+
+  buildInputs = [ perl ];
+
+  meta = with stdenv.lib.meta; {
+    homepage = http://www.nvidia.com/object/unix.html;
+    description = "X.org driver and kernel module for NVIDIA graphics cards";
+    license = licenses.unfreeRedistributable;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.vcunat ];
+  };
+}
diff --git a/pkgs/os-specific/linux/nvidiabl/default.nix b/pkgs/os-specific/linux/nvidiabl/default.nix
index 6260134bf11..a5a43926e04 100644
--- a/pkgs/os-specific/linux/nvidiabl/default.nix
+++ b/pkgs/os-specific/linux/nvidiabl/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation {
   makeFlags = [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "DESTDIR=$(out)"
+    "KVER=${kernel.modDirVersion}"
   ];
 
   meta = {
diff --git a/pkgs/os-specific/linux/opengl/xorg-sys/default.nix b/pkgs/os-specific/linux/opengl/xorg-sys/default.nix
index 5c1cf1a90d3..2cebb8d9dcc 100644
--- a/pkgs/os-specific/linux/opengl/xorg-sys/default.nix
+++ b/pkgs/os-specific/linux/opengl/xorg-sys/default.nix
@@ -11,6 +11,6 @@
 stdenv.mkDerivation {
   name = "xorg-sys-opengl-3";
   builder = ./builder.sh;
-  neededLibs = [xlibs.libXxf86vm xlibs.libXext expat libdrm stdenv.gcc.gcc];
+  neededLibs = [xlibs.libXxf86vm xlibs.libXext expat libdrm stdenv.cc.cc];
 }
 
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
new file mode 100644
index 00000000000..2e25c0383b7
--- /dev/null
+++ b/pkgs/os-specific/linux/openvswitch/default.nix
@@ -0,0 +1,50 @@
+{ stdenv, fetchurl, openssl, python27, iproute, perl, kernel ? null}:
+let
+
+  version = "2.1.2";
+
+  skipKernelMod = kernel == null;
+
+in
+stdenv.mkDerivation {
+  version = "2.1.2";
+  name = "openvswitch-${version}";
+  src = fetchurl {
+    url = "http://openvswitch.org/releases/openvswitch-2.1.2.tar.gz";
+    sha256 = "16q7faqrj2pfchhn0x5s9ggi5ckcg9n62f6bnqaih064aaq2jm47";
+  };
+  kernel = if skipKernelMod then null else kernel.dev;
+  buildInputs = [
+    openssl
+    python27
+    perl
+  ];
+  configureFlags = [
+    "--localstatedir=/var"
+    "--sharedstatedir=/var"
+    "--sbindir=$(out)/bin"
+  ] ++ (if skipKernelMod then [] else ["--with-linux"]);
+  # Leave /var out of this!
+  installFlags = [
+    "LOGDIR=$(TMPDIR)/dummy"
+    "RUNDIR=$(TMPDIR)/dummy"
+    "PKIDIR=$(TMPDIR)/dummy"
+  ];
+  meta = {
+    platforms = stdenv.lib.platforms.linux;
+    description = "A multilayer virtual switch";
+    longDescription = 
+      ''
+      Open vSwitch is a production quality, multilayer virtual switch 
+      licensed under the open source Apache 2.0 license. It is 
+      designed to enable massive network automation through 
+      programmatic extension, while still supporting standard 
+      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN, 
+      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to 
+      support distribution across multiple physical servers similar 
+      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
+      '';
+    homepage = "http://openvswitch.org/";
+    licence = "Apache 2.0";
+  };
+}
diff --git a/pkgs/os-specific/linux/pam_console/configure.ac b/pkgs/os-specific/linux/pam_console/configure.ac
deleted file mode 100644
index 0d2d0288acf..00000000000
--- a/pkgs/os-specific/linux/pam_console/configure.ac
+++ /dev/null
@@ -1,27 +0,0 @@
-AC_PREREQ([2.59])
-AC_INIT([pam_console], [@PV@])
-AM_INIT_AUTOMAKE([pam_console], [@PV@])
-
-AC_CONFIG_HEADER([config.h])
-
-AC_GNU_SOURCE
-
-AM_CONDITIONAL([HAVE_VERSIONING], [test "x" = "y"])
-
-PKG_CHECK_MODULES([GLIB], [glib-2.0])
-
-m4_undefine([AC_PROG_CXX])
-m4_defun([AC_PROG_CXX],[])
-m4_undefine([AC_PROG_F77])
-m4_defun([AC_PROG_F77],[])
-AC_PROG_LIBTOOL
-
-AC_PROG_YACC
-
-SECUREDIR=${libdir}/security
-SCONFIGDIR=${sysconfdir}/security
-
-AC_SUBST([SECUREDIR])
-AC_SUBST([SCONFIGDIR])
-
-AC_OUTPUT([Makefile])
diff --git a/pkgs/os-specific/linux/pam_console/default.nix b/pkgs/os-specific/linux/pam_console/default.nix
deleted file mode 100644
index 7c1e83c0ed6..00000000000
--- a/pkgs/os-specific/linux/pam_console/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{stdenv, fetchurl, pam, autoconf, automake, libtool, pkgconfig, glib, bison, flex}:
-
-let
-
-  # Configure script borrowed from the good folks at Gentoo 
-  # (http://sources.gentoo.org/viewcvs.py/*checkout*/gentoo-x86/sys-auth/pam_console/files/pam_console-configure.ac).
-  configure = ./configure.ac;
-
-in
-   
-stdenv.mkDerivation {
-  name = "pam_console-0.99.5-1";
-   
-  src = fetchurl {
-    url = http://cvs.fedora.redhat.com/repo/dist/pam/pam-redhat-0.99.5-1.tar.bz2/e2edde7861c48195728bc531e5a277e0/pam-redhat-0.99.5-1.tar.bz2;
-    sha256 = "077xdhwspc785fas4yfw50mpy92rdfh35kq9awlrpbzq1fnapsfs";
-  };
-
-  buildInputs = [pam autoconf automake libtool pkgconfig glib bison flex];
-
-  makeFlags = "LEX=flex";
-
-  preConfigure = "
-    cd pam_console
-    cp ${configure} configure.ac
-    touch NEWS AUTHORS ChangeLog
-    # Don't try to create /var/run/console.
-    substituteInPlace Makefile.am --replace 'mkdir -m $(LOCKMODE) -p -p $(DESTDIR)$(LOCKDIR)' ''
-    autoreconf --install
-  ";
-}
diff --git a/pkgs/os-specific/linux/pam_krb5/default.nix b/pkgs/os-specific/linux/pam_krb5/default.nix
index ad60e63c263..40e7e1216a6 100644
--- a/pkgs/os-specific/linux/pam_krb5/default.nix
+++ b/pkgs/os-specific/linux/pam_krb5/default.nix
@@ -1,24 +1,24 @@
-{stdenv, fetchurl, pam, kerberos}:
+{ stdenv, fetchurl, pam, kerberos }:
 
-stdenv.mkDerivation {
-  name = "pam_krb5-2.3.11-1";
+stdenv.mkDerivation rec {
+  name = "pam-krb5-4.7";
 
   src = fetchurl {
-    url = https://fedorahosted.org/releases/p/a/pam_krb5/pam_krb5-2.3.11-1.tar.gz;
-    sha256 = "1x6wgjzkfkx0h9a7wdgx0jwrdm15npbs79i510lk1n3fyx9lk4mq";
-#    url = http://archives.eyrie.org/software/kerberos/pam-krb5-4.2.tar.gz;
-#    sha256 = "0a0zyd4ddln8yf827qxbfqi1pryxnj0fykfz8lx6nxn2f9pqj1gv";
+    url = "http://archives.eyrie.org/software/kerberos/${name}.tar.gz";
+    sha256 = "04klg9a2rhdz0a2dw4f0ybcm28vcbab6lrynwq7rm4sn0hnzakwv";
   };
 
-  buildInputs = [pam kerberos];
-  meta = {
-#    homepage = "http://www.eyrie.org/~eagle/software/pam-krb5";
-    homepage = "https://fedorahosted.org/pam_krb5/";
+  buildInputs = [ pam kerberos ];
+
+  meta = with stdenv.lib; {
+    homepage = http://www.eyrie.org/~eagle/software/pam-krb5/;
     description = "PAM module allowing PAM-aware applications to authenticate users by performing an AS exchange with a Kerberos KDC";
     longDescription = ''
       pam_krb5 can optionally convert Kerberos 5 credentials to Kerberos IV
       credentials and/or use them to set up AFS tokens for a user's session.
     '';
-    maintainers = stdenv.lib.maintainers.mornfall;
+    platforms = platforms.linux;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ wkennington mornfall ];
   };
 }
diff --git a/pkgs/os-specific/linux/pam_ldap/default.nix b/pkgs/os-specific/linux/pam_ldap/default.nix
index 2be869e73e3..1eee7dbdac2 100644
--- a/pkgs/os-specific/linux/pam_ldap/default.nix
+++ b/pkgs/os-specific/linux/pam_ldap/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
    
   src = fetchurl {
     url = "http://www.padl.com/download/${name}.tar.gz";
-    md5 = "c0ad81e9d9712ddc6599a6e7a1688778";
+    sha256 = "1l0mlwvas9dnsfcgbszbzq3bzhdkibn1c3x15fczq3i82faf5g5a";
   };
 
   preInstall = "
diff --git a/pkgs/os-specific/linux/pam_login/default.nix b/pkgs/os-specific/linux/pam_login/default.nix
deleted file mode 100644
index 46da3053d20..00000000000
--- a/pkgs/os-specific/linux/pam_login/default.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{stdenv, fetchurl, pam}:
-   
-stdenv.mkDerivation {
-  name = "pam_login-3.35";
-   
-  src = fetchurl {
-    url = ftp://ftp.suse.com/pub/people/kukuk/pam/pam_login/pam_login-3.35.tar.bz2;
-    sha256 = "1w2hpwjhmwjhf8rg789xpl0hibahqlr3ccivfy3m4kgrm5gf04kv";
-  };
-
-  patches = [ ./sys-stat-h.patch ];
-
-  # To overcome a gcc 4.4 warning:
-  # "#ident is a deprecated GCC extension"
-  postPatch = ''
-    sed -i s/-Werror// configure
-  '';
-
-  buildInputs = [pam];
-}
diff --git a/pkgs/os-specific/linux/pam_login/sys-stat-h.patch b/pkgs/os-specific/linux/pam_login/sys-stat-h.patch
deleted file mode 100644
index 163fd7ce8e2..00000000000
--- a/pkgs/os-specific/linux/pam_login/sys-stat-h.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-Include the needed <sys/stat.h> since recent glibc is stricter about that.
-
---- pam_login-3.35/src/login.c~	2007-05-04 14:07:49.000000000 +0200
-+++ pam_login-3.35/src/login.c	2010-04-27 11:38:13.000000000 +0200
-@@ -47,6 +47,7 @@
- #include <signal.h>
- #include <stdio.h>
- #include <string.h>
-+#include <sys/stat.h>
- #include <sys/ioctl.h>
- #include <sys/param.h>
- #include <sys/resource.h>
diff --git a/pkgs/os-specific/linux/pam_mount/default.nix b/pkgs/os-specific/linux/pam_mount/default.nix
new file mode 100644
index 00000000000..05438c6945c
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_mount/default.nix
@@ -0,0 +1,29 @@
+{ stdenv, fetchurl, autoconf, automake, pkgconfig, libtool, pam, libHX, utillinux, libxml2, pcre, perl, openssl, cryptsetup }:
+
+stdenv.mkDerivation rec {
+  name = "pam_mount-2.14";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/pam-mount/pam_mount/2.14/${name}.tar.xz";
+    sha256 = "1yfwg8i4n7af8yi3w3pkqzqz75wgjjlg5lslv1r5g1v88nrwnrkg";
+  };
+
+  buildInputs = [ autoconf automake pkgconfig libtool pam libHX utillinux libxml2 pcre perl openssl cryptsetup ];
+
+  preConfigure = "sh autogen.sh --prefix=$out";
+
+  makeFlags = "DESTDIR=$(out)";
+
+  # Probably a hack, but using DESTDIR and PREFIX makes everything work!
+  postInstall = ''
+    cp -r $out/$out/* $out
+    rm -r $out/nix
+    '';
+
+  meta = {
+    homepage = http://pam-mount.sourceforge.net/;
+    description = "PAM module to mount volumes for a user session";
+    maintainers = [ stdenv.lib.maintainers.tstrobel ];
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/pax-utils/default.nix b/pkgs/os-specific/linux/pax-utils/default.nix
index 83f0dc1e82d..266fee9e493 100644
--- a/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/pkgs/os-specific/linux/pax-utils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "pax-utils-${version}";
-  version = "0.8.1";
+  version = "1.0.3";
 
   src = fetchurl {
     url = "http://dev.gentoo.org/~vapier/dist/${name}.tar.xz";
-    sha256 = "1fgm70s52x48dxjihs0rcwmpfsi2dxbjzcilxy9fzg0i39dz4kw4";
+    sha256 = "0w2nddgany3s0znyj6zizlvn8y5vba9x49jm5nliv13p3x7ajdc5";
   };
 
   makeFlags = [
diff --git a/pkgs/os-specific/linux/paxctl/default.nix b/pkgs/os-specific/linux/paxctl/default.nix
index 795ffa38ac4..8402b952ff7 100644
--- a/pkgs/os-specific/linux/paxctl/default.nix
+++ b/pkgs/os-specific/linux/paxctl/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "paxctl-${version}";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchurl {
     url = "http://pax.grsecurity.net/${name}.tar.gz";
-    sha256 = "107gmriq5icsk9yni5q949rnjapjkcs0823pw6zra6h1xml2f0mm";
+    sha256 = "0biw882fp1lmgs6kpxznp1v6758r7dg9x8iv5a06k0b82bcdsc53";
   };
 
   preBuild = ''
diff --git a/pkgs/os-specific/linux/pcmciautils/default.nix b/pkgs/os-specific/linux/pcmciautils/default.nix
index 787b72fde48..ce5814965ef 100644
--- a/pkgs/os-specific/linux/pcmciautils/default.nix
+++ b/pkgs/os-specific/linux/pcmciautils/default.nix
@@ -8,11 +8,11 @@
 
 # FIXME: should add an option to choose between hotplug and udev.
 stdenv.mkDerivation rec {
-  name = "pcmciautils-015";
+  name = "pcmciautils-017";
 
   src = fetchurl {
-    url = "http://kernel.org/pub/linux/utils/kernel/pcmcia/${name}.tar.bz2";
-    sha256 = "4847485c412b47e3d88fa83ef811229e0e7941217303bc8449c30a3dc2128b6e";
+    url = "https://kernel.org/pub/linux/utils/kernel/pcmcia/${name}.tar.gz";
+    sha256 = "5d8e2efad8a7f692129610603da232f2144851753d8d49a70eeb8eb1be6f6bc3";
   };
 
   buildInputs = [udev yacc sysfsutils module_init_tools flex];
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     '') firmware;
 
   meta = {
-    homepage = http://kernel.org/pub/linux/utils/kernel/pcmcia/pcmcia.html;
+    homepage = https://www.kernel.org/pub/linux/utils/kernel/pcmcia/;
     longDescription = "
       PCMCIAutils contains the initialization tools necessary to allow
       the PCMCIA subsystem to behave (almost) as every other
diff --git a/pkgs/os-specific/linux/perf-tools/default.nix b/pkgs/os-specific/linux/perf-tools/default.nix
new file mode 100644
index 00000000000..0273fed3ec4
--- /dev/null
+++ b/pkgs/os-specific/linux/perf-tools/default.nix
@@ -0,0 +1,43 @@
+{ lib, stdenv, fetchFromGitHub, perl }:
+
+stdenv.mkDerivation {
+  name = "perf-tools-20150130";
+
+  src = fetchFromGitHub {
+    owner = "brendangregg";
+    repo = "perf-tools";
+    rev = "85414b01247666c9fefad25a1406c8078011c936";
+    sha256 = "1g15nnndcmxd1k9radcvfpn223pp627vs9wh90yiy73v03g7b8cs";
+  };
+
+  buildInputs = [ perl ];
+
+  patchPhase =
+    ''
+      for i in execsnoop iolatency iosnoop kernel/funcslower killsnoop opensnoop; do
+        substituteInPlace $i \
+          --replace /usr/bin/gawk "$(type -p gawk)" \
+          --replace /usr/bin/mawk /no-such-path \
+          --replace /usr/bin/getconf "$(type -p getconf)" \
+          --replace awk=awk "awk=$(type -p gawk)"
+      done
+
+      rm -rf examples deprecated
+    '';
+
+  installPhase =
+    ''
+      d=$out/libexec/perf-tools
+      mkdir -p $d $out/share
+      cp -prvd . $d/
+      ln -s $d/bin $out/bin
+      mv $d/man $out/share/
+    '';
+
+  meta = {
+    platforms = lib.platforms.linux;
+    homepage = https://github.com/brendangregg/perf-tools;
+    description = "Performance analysis tools based on Linux perf_events (aka perf) and ftrace";
+    maintainers = [ lib.maintainers.eelco ];
+  };
+}
diff --git a/pkgs/os-specific/linux/plymouth/default.nix b/pkgs/os-specific/linux/plymouth/default.nix
index a04407ba5c2..00d330ca955 100644
--- a/pkgs/os-specific/linux/plymouth/default.nix
+++ b/pkgs/os-specific/linux/plymouth/default.nix
@@ -1,6 +1,5 @@
-{ stdenv, fetchurl, autoconf, automake, cairo, docbook_xsl, gtk
-, libdrm, libpng , libtool, libxslt, makeWrapper, pango, pkgconfig
-, udev
+{ stdenv, fetchurl, autoreconfHook, cairo, docbook_xsl, gtk
+, libdrm, libpng, libxslt, makeWrapper, pango, pkgconfig, udev
 }:
 
 stdenv.mkDerivation rec {
@@ -13,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
-    autoconf automake cairo docbook_xsl gtk libdrm libpng libtool
+    autoreconfHook cairo docbook_xsl gtk libdrm libpng
     libxslt makeWrapper pango pkgconfig udev
   ];
 
@@ -22,23 +21,23 @@ stdenv.mkDerivation rec {
       -i configure.ac
   '';
 
-  configurePhase = ''
-    ./configure \
-      --prefix=$out \
-      -bindir=$out/bin \
-      -sbindir=$out/sbin \
-      --exec-prefix=$out \
-      --libdir=$out/lib \
-      --libexecdir=$out/lib \
-      --sysconfdir=$out/etc \
-      --localstatedir=/var \
-      --with-log-viewer \
-      --without-system-root-install \
-      --without-rhgb-compat-link \
-      --enable-tracing \
-      --enable-systemd-integration \
-      --enable-pango \
-      --enable-gtk
+  postPatch = ''
+    configureFlags="
+      --prefix=$out
+      --bindir=$out/bin
+      --sbindir=$out/sbin
+      --exec-prefix=$out
+      --libdir=$out/lib
+      --libexecdir=$out/lib
+      --sysconfdir=$out/etc
+      --localstatedir=/var
+      --with-log-viewer
+      --without-system-root-install
+      --without-rhgb-compat-link
+      --enable-tracing
+      --enable-systemd-integration
+      --enable-pango
+      --enable-gtk"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 630fe04e226..befe16f72f2 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, libnl, ncurses, pciutils, pkgconfig, zlib }:
 
 stdenv.mkDerivation rec {
-  name = "powertop-2.6.1";
+  name = "powertop-2.7";
 
   src = fetchurl {
     url = "https://01.org/sites/default/files/downloads/powertop/${name}.tar.gz";
-    sha256 = "1r103crmkdk617qrxqjzy2mlhaacbpg5q795546zwcxlbdnxwk03";
+    sha256 = "1jkqqr3l1x98m7rgin1dgfzxqwj4vciw9lyyq1kl9bdswa818jwd";
   };
 
   buildInputs = [ gettext libnl ncurses pciutils pkgconfig zlib ];
diff --git a/pkgs/os-specific/linux/prl-tools/autostart.desktop b/pkgs/os-specific/linux/prl-tools/autostart.desktop
new file mode 100644
index 00000000000..b8eb27fdd99
--- /dev/null
+++ b/pkgs/os-specific/linux/prl-tools/autostart.desktop
@@ -0,0 +1,8 @@
+[Desktop Entry]
+Version=@version@
+Encoding=UTF-8
+Name=@description@
+Type=Application
+Exec=@exec@
+X-KDE-autostart-phase=1
+GenericName[en_US]=
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
new file mode 100644
index 00000000000..0dac7c4358d
--- /dev/null
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -0,0 +1,197 @@
+{ stdenv, lib, requireFile, makeWrapper, substituteAll, p7zip
+, gawk, utillinux, xorg, glib, dbus_glib, zlib
+, kernel ? null, libsOnly ? false
+}:
+
+assert (!libsOnly) -> kernel != null;
+
+let xorgFullVer = (builtins.parseDrvName xorg.xorgserver.name).version;
+    xorgVer = lib.concatStringsSep "." (lib.take 2 (lib.splitString "." xorgFullVer));
+    x64 = if stdenv.system == "x86_64-linux" then true
+          else if stdenv.system == "i686-linux" then false
+          else abort "Parallels Tools for Linux only support {x86-64,i686}-linux targets";
+    # We autostart user services by ourselves, because prlcc uses hardcoded paths.
+    autostart = [ { exec = "prlcc";
+                    description = "Parallels Control Center";
+                  }
+                  { exec = "prldhd";
+                    description = "Parallels Control Center"; # not a mistake
+                  }
+                  { exec = "prl_wmouse_d";
+                    description = "Parallels Walking Mouse Daemon";
+                  }
+                  { exec = "prlcp";
+                    description = "Parallels CopyPaste Tool";
+                  }
+                  { exec = "prlsga";
+                    description = "Parallels Shared Guest Applications Tool";
+                  }
+                  { exec = "prlshprof";
+                    description = "Parallels Shared Profile Tool";
+                  }
+                ];
+in
+stdenv.mkDerivation rec {
+  version = "10.0.2.27712";
+  name = "prl-tools-${version}";
+
+  src = requireFile rec {
+    name = "prl-tools-lin.iso";
+    sha256 = "07960jvyv7gihjlg922znjm6db6l6bd23x9mg6ympwibzf2mylmx";
+    message = ''
+      Please, place Parallel Tools for Linux image into Nix store
+      using either
+        nix-store --add-fixed sha256 ${name}
+      or
+        nix-prefetch-url file://path/to/${name}
+    '';
+  };
+
+  # also maybe python2 to generate xorg.conf
+  nativeBuildInputs = [ p7zip ] ++ lib.optionals (!libsOnly) [ makeWrapper ];
+
+  inherit libsOnly;
+
+  unpackPhase = ''
+    7z x $src
+    export sourceRoot=.
+    if test -z "$libsOnly"; then
+      ( cd kmods; tar -xaf prl_mod.tar.gz )
+    fi
+    ( cd tools; tar -xaf prltools${if x64 then ".x64" else ""}.tar.gz )
+  '';
+
+  kernelVersion = if libsOnly then "" else (builtins.parseDrvName kernel.name).version;
+  kernelDir = if libsOnly then "" else "${kernel.dev}/lib/modules/${kernelVersion}";
+  scriptPath = lib.concatStringsSep ":" (lib.optionals (!libsOnly) [ "${utillinux}/bin" "${gawk}/bin" ]);
+
+  buildPhase = ''
+    if test -z "$libsOnly"; then
+      ( # kernel modules
+        cd kmods
+        make -f Makefile.kmods \
+          KSRC=$kernelDir/source \
+          HEADERS_CHECK_DIR=$kernelDir/source \
+          KERNEL_DIR=$kernelDir/build \
+          SRC=$kernelDir/build \
+          KVER=$kernelVersion
+      )
+
+      # Xorg config (maybe would be useful for other versions)
+      #python2 installer/xserver-config.py xorg ${xorgVer} /dev/null parallels.conf
+    fi
+  '';
+
+  libPath = with xorg;
+            stdenv.lib.makeLibraryPath ([ stdenv.cc.cc libXrandr libXext libX11 libXcomposite libXinerama ]
+            ++ lib.optionals (!libsOnly) [ libXi glib dbus_glib zlib ]);
+
+  desktops = map (x: substituteAll ({
+               src = ./autostart.desktop;
+               name = x.exec + ".desktop";
+               version = version;
+             } // x)) autostart;
+
+  installPhase = ''
+    if test -z "$libsOnly"; then
+      ( # kernel modules
+        cd kmods
+        mkdir -p $out/lib/modules/${kernelVersion}/extra
+        cp prl_eth/pvmnet/prl_eth.ko $out/lib/modules/${kernelVersion}/extra
+        cp prl_tg/Toolgate/Guest/Linux/prl_tg/prl_tg.ko $out/lib/modules/${kernelVersion}/extra
+        cp prl_fs/SharedFolders/Guest/Linux/prl_fs/prl_fs.ko $out/lib/modules/${kernelVersion}/extra
+        cp prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.ko $out/lib/modules/${kernelVersion}/extra
+      )
+    fi
+
+    ( # tools
+      cd tools
+      mkdir -p $out/lib
+
+      if test -z "$libsOnly"; then
+        # install binaries
+        for i in bin/* sbin/prl_nettool sbin/prl_snapshot; do
+          install -Dm755 $i $out/$i
+        done
+        # other binaries
+        for i in xorg.7.1/usr/bin/*; do
+          cp $i $out/bin
+        done
+
+        for i in $out/bin/* $out/sbin/*; do
+          patchelf \
+            --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+            --set-rpath "$out/lib:$libPath" \
+            $i
+        done
+
+        mkdir -p $out/bin
+        install -Dm755 ../installer/prlfsmountd.sh $out/sbin/prlfsmountd
+        wrapProgram $out/sbin/prlfsmountd \
+          --prefix PATH ':' "$scriptPath"
+
+        for i in lib/*.a; do
+          cp $i $out/lib
+        done
+
+        for i in xorg.7.1/usr/lib/libprl_wmouse_watcher.*; do
+          cp $i $out/lib
+        done
+
+        mkdir -p $out/lib/udev/rules.d
+        for i in *.rules; do
+          sed 's,/bin/bash,${stdenv.shell},g' $i > $out/lib/udev/rules.d/$i
+        done
+
+        mkdir -p $out/share/autostart
+        for i in $desktops; do
+          cat $i | sed "s,^Exec=,Exec=$out/bin/," > $out/share/autostart/$(basename $i)
+        done
+
+        (
+          cd xorg.${xorgVer}
+          # Install the X modules.
+          (
+            cd x-server/modules
+            for i in */*; do
+              install -Dm755 $i $out/lib/xorg/modules/$i
+            done
+          )
+          (
+            cd usr/lib
+            libGLXname=$(echo libglx.so*)
+            install -Dm755 $libGLXname $out/lib/xorg/modules/extensions/$libGLXname
+            ln -s $libGLXname $out/lib/xorg/modules/extensions/libglx.so
+            ln -s $libGLXname $out/lib/xorg/modules/extensions/libglx.so.1
+          )
+        )
+      fi
+
+      for i in xorg.7.1/usr/lib/libGL.*; do
+        cp $i $out/lib
+      done
+
+      cd $out
+      find -name \*.so\* -type f -exec \
+        patchelf --set-rpath "$out/lib:$libPath" {} \;
+
+      cd lib
+      libGLname=$(echo libGL.so*)
+      ln -s $libGLname libGL.so
+      ln -s $libGLname libGL.so.1
+    )
+  '';
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = with stdenv.lib; {
+    description = "Parallels Tools for Linux guests";
+    homepage = http://parallels.com;
+    platforms = platforms.linux;
+    license = licenses.unfree;
+    # I was making this package blindly and requesting testing from the real user,
+    # so I can't even test it by myself and won't provide future updates.
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index cd8a8eaec13..9ecc0c5bcb5 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -1,14 +1,14 @@
-{ stdenv, fetchurl, ncurses }:
+{ stdenv, fetchurl, pkgconfig, ncurses, systemd }:
 
-stdenv.mkDerivation {
-  name = "procps-3.3.9";
+stdenv.mkDerivation rec {
+  name = "procps-ng-3.3.10";
 
   src = fetchurl {
-    url = mirror://sourceforge/procps-ng/procps-ng-3.3.9.tar.xz;
-    sha256 = "0qw69v7wx8hilwylyk9455k3h1xg8sc13vxh0pvdss7rml7wpw00";
+    url = "mirror://sourceforge/procps-ng/${name}.tar.xz";
+    sha256 = "013z4rzy3p5m1zp6mmynpblv0c6zlcn91pw4k2vymz2djyc6ybm0";
   };
 
-  buildInputs = [ ncurses ];
+  buildInputs = [ pkgconfig ncurses systemd ];
 
   makeFlags = "usrbin_execdir=$(out)/bin";
 
@@ -18,9 +18,22 @@ stdenv.mkDerivation {
     CC = stdenv.cross.config + "-gcc";
   };
 
-  meta = {
+  # Too red
+  configureFlags = [
+    "--disable-modern-top"
+    "--enable-watch8bit"
+    "--with-systemd"
+    "--enable-skill"
+    "--enable-oomem"
+    "--enable-sigwinch"
+  ];
+
+  meta = with stdenv.lib; {
     homepage = http://sourceforge.net/projects/procps-ng/;
     description = "Utilities that give information about processes using the /proc filesystem";
     priority = 10; # less than coreutils, which also provides "kill" and "uptime"
+    maintainers = with maintainers; [ wkennington ];
+    license = licenses.gpl2;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/radeontop/default.nix b/pkgs/os-specific/linux/radeontop/default.nix
new file mode 100644
index 00000000000..7ec74c895c6
--- /dev/null
+++ b/pkgs/os-specific/linux/radeontop/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub, pkgconfig, gettext, ncurses, libdrm, libpciaccess }:
+
+let version = "v0.8-8-g2499679"; in
+stdenv.mkDerivation {
+  name = "radeontop-${version}";
+
+  src = fetchFromGitHub {
+    sha256 = "112zf6ms0qpmr9h3l4lg5wik5j206mgij0nypba5lnqzksxh2f88";
+    rev = "2499679fda60c3f6239886296fd2a74155f45f77";
+    repo = "radeontop";
+    owner = "clbr";
+  };
+
+  buildInputs = [ pkgconfig gettext ncurses libdrm libpciaccess ];
+
+  enableParallelBuilding = true;
+
+  patchPhase = ''
+    substituteInPlace getver.sh --replace ver=unknown ver=${version}
+  '';
+
+  makeFlags = "PREFIX=$(out)";
+
+  meta = with stdenv.lib; {
+    description = "Top-like tool for viewing AMD Radeon GPU utilization";
+    longDescription = ''
+      View GPU utilization, both for the total activity percent and individual
+      blocks. Supports R600 and later cards: even Southern Islands should work.
+      Works with both the open drivers and AMD Catalyst. Total GPU utilization
+      is also valid for OpenCL loads; the other blocks are only useful for GL
+      loads. Requires root rights or other permissions to read /dev/mem.
+    '';
+    homepage = https://github.com/clbr/radeontop;
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ rycee nckx ];
+  };
+}
diff --git a/pkgs/os-specific/linux/s6-linux-utils/default.nix b/pkgs/os-specific/linux/s6-linux-utils/default.nix
new file mode 100644
index 00000000000..9bccedb0120
--- /dev/null
+++ b/pkgs/os-specific/linux/s6-linux-utils/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl, skalibs }:
+
+let
+
+  version = "2.0.2.0";
+
+in stdenv.mkDerivation rec {
+
+  name = "s6-linux-utils-${version}";
+
+  src = fetchurl {
+    url = "http://www.skarnet.org/software/s6-linux-utils/${name}.tar.gz";
+    sha256 = "0y6dq4wb5v1c6ps6a7jyq08r2pjksrvz6n3dnfa9c91gzm4m1dxb";
+  };
+
+  dontDisableStatic = true;
+
+  configureFlags = [
+    "--includedir=\${prefix}/include"
+    "--with-sysdeps=${skalibs}/lib/skalibs/sysdeps"
+    "--with-include=${skalibs}/include"
+    "--with-lib=${skalibs}/lib"
+    "--with-dynlib=${skalibs}/lib"
+  ];
+
+  meta = {
+    homepage = http://www.skarnet.org/software/s6-linux-utils/;
+    description = "A set of minimalistic Linux-specific system utilities";
+    platforms = stdenv.lib.platforms.linux;
+    license = stdenv.lib.licenses.isc;
+  };
+
+}
diff --git a/pkgs/os-specific/linux/sdparm/default.nix b/pkgs/os-specific/linux/sdparm/default.nix
index 2a796c1b3a9..3b0f7c694ac 100644
--- a/pkgs/os-specific/linux/sdparm/default.nix
+++ b/pkgs/os-specific/linux/sdparm/default.nix
@@ -1,16 +1,17 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation {
-  name = "sdparm-1.08";
+  name = "sdparm-1.09";
 
   src = fetchurl {
-    url = http://sg.danny.cz/sg/p/sdparm-1.08.tgz;
-    sha256 = "0msy8anggdand1yr50vg2azcfgks7sbfpnqk7xzw9adi2jj7hsrp";
+    url = http://sg.danny.cz/sg/p/sdparm-1.09.tar.xz;
+    sha256 = "0jakqyjwi72zqjzss04bally0xl0lc4710mx8da08vpmir1hfphg";
   };
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = http://sg.danny.cz/sg/sdparm.html;
     description = "A utility to access SCSI device parameters";
-    license = "free";
+    license = with licenses; bsd3;
+    maintainers = with maintainers; [ nckx ];
   };
 }
diff --git a/pkgs/os-specific/linux/seturgent/default.nix b/pkgs/os-specific/linux/seturgent/default.nix
new file mode 100644
index 00000000000..ad77a7a1031
--- /dev/null
+++ b/pkgs/os-specific/linux/seturgent/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, libX11, xproto, xdotool, unzip }:
+
+stdenv.mkDerivation {
+  name = "seturgent";
+
+  src = fetchurl {
+    url = "https://github.com/hiltjo/seturgent/archive/ada70dcb15865391e5cdcab27a0739a304a17e03.zip";
+    sha256 = "0q1sr6aljkw2jr9b4xxzbc01qvnd5vk3pxrypif9yd8xjw4wqwri";
+  };
+
+  buildInputs = [
+    libX11 xproto unzip
+  ];
+
+  installPhase = ''
+    mkdir -pv $out/bin
+    mv seturgent $out/bin
+  '';
+
+  meta = {
+      platforms = stdenv.lib.platforms.linux;
+      description = "Set an application's urgency hint (or not)";
+      maintainers = [ stdenv.lib.maintainers.yarr ];
+      homepage = https://github.com/hiltjo/seturgent;
+      license = stdenv.lib.licenses.mit;
+  };
+}
\ No newline at end of file
diff --git a/pkgs/os-specific/linux/sinit/default.nix b/pkgs/os-specific/linux/sinit/default.nix
new file mode 100644
index 00000000000..783e5fa2063
--- /dev/null
+++ b/pkgs/os-specific/linux/sinit/default.nix
@@ -0,0 +1,36 @@
+{stdenv, fetchgit, rcinit ? null, rcshutdown ? null, rcreboot ? null}:
+let
+  s = # Generated upstream information
+  rec {
+    baseName="sinit";
+    version="0.9.2";
+    name="${baseName}-${version}";
+    url="http://git.suckless.org/sinit/";
+    sha256="0nncyzwnszwlqcvx1jf42rn1n2dd5vcxkndqb1b546pgpifniivp";
+    rev = "refs/tags/v${version}";
+  };
+  buildInputs = [
+  ];
+in
+stdenv.mkDerivation {
+  inherit (s) name version;
+  inherit buildInputs;
+  src = fetchgit {
+    inherit (s) url sha256 rev;
+  };
+  makeFlags = ["PREFIX=$(out)"];
+  preConfigure = ""
+    + (stdenv.lib.optionalString (rcinit != null) ''sed -re 's@(rcinitcmd[^"]*")[^"]*"@\1${rcinit}"@' -i config.def.h; '')
+    + (stdenv.lib.optionalString (rcshutdown != null) ''sed -re 's@(rc(reboot|poweroff)cmd[^"]*")[^"]*"@\1${rcshutdown}"@' -i config.def.h; '')
+    + (stdenv.lib.optionalString (rcreboot != null) ''sed -re 's@(rc(reboot)cmd[^"]*")[^"]*"@\1${rcreboot}"@' -i config.def.h; '')
+    ;
+  meta = {
+    inherit (s) version;
+    description = ''A very minimal Linux init implementation from suckless.org'';
+    license = stdenv.lib.licenses.mit ;
+    maintainers = [stdenv.lib.maintainers.raskin];
+    platforms = stdenv.lib.platforms.linux;
+    homepage = "http://tools.suckless.org/sinit";
+    downloadPage = "http://git.suckless.org/sinit";
+  };
+}
diff --git a/pkgs/os-specific/linux/smem/default.nix b/pkgs/os-specific/linux/smem/default.nix
new file mode 100644
index 00000000000..a61a54afc38
--- /dev/null
+++ b/pkgs/os-specific/linux/smem/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchurl, python }:
+
+stdenv.mkDerivation rec {
+  name = "smem-1.4";
+
+  src = fetchurl {
+    url = "http://www.selenic.com/smem/download/${name}.tar.gz";
+    sha256 = "1v31vy23s7szl6vdrllq9zbg58bp36jf5xy3fikjfg6gyiwgia9f";
+  };
+
+  buildInputs = [ python ];
+
+  buildPhase =
+    ''
+      gcc -O2 smemcap.c -o smemcap
+    '';
+
+  installPhase =
+    ''
+      mkdir -p $out/bin
+      cp smem smemcap $out/bin/
+
+      mkdir -p $out/share/man/man8
+      cp smem.8 $out/share/man/man8/
+    '';
+
+  meta = {
+    homepage = http://www.selenic.com/smem/;
+    description = "A memory usage reporting tool that takes shared memory into account";
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.eelco ];
+  };
+}
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 944fb6ff554..1367be74c63 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -1,45 +1,14 @@
-{ stdenv, fetchurl, kernel, perl, autoconf, automake, libtool, coreutils, gawk }:
+{ callPackage, fetchFromGitHub, ... } @ args:
 
-stdenv.mkDerivation {
-  name = "spl-0.6.3-${kernel.version}";
-  src = fetchurl {
-    url = http://archive.zfsonlinux.org/downloads/zfsonlinux/spl/spl-0.6.3.tar.gz;
-    sha256 = "1qqzyj2if5wai4jiwml4i8s6v8k7hbi7jmiph800lhkk5j8s72l9";
-  };
-
-  patches = [ ./install_prefix.patch ./const.patch ];
-
-  buildInputs = [ perl autoconf automake libtool ];
-
-  preConfigure = ''
-    ./autogen.sh
-
-    substituteInPlace ./module/spl/spl-generic.c --replace /usr/bin/hostid hostid
-    substituteInPlace ./module/spl/spl-module.c  --replace /bin/mknod mknod
-
-    substituteInPlace ./module/spl/spl-generic.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:${gawk}:/bin"
-    substituteInPlace ./module/splat/splat-vnode.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
-    substituteInPlace ./module/splat/splat-linux.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
-  '';
+callPackage ./generic.nix (args // rec {
+  version = "0.6.4";
 
-  configureFlags = ''
-     --with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source
-     --with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Kernel module driver for solaris porting layer (needed by in-kernel zfs)";
-
-    longDescription = ''
-      This kernel module is a porting layer for ZFS to work inside the linux
-      kernel.
-    '';
-
-    homepage = http://zfsonlinux.org/;
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [ jcumming wizeman ];
+  src = fetchFromGitHub {
+    owner = "zfsonlinux";
+    repo = "spl";
+    rev = "spl-${version}";
+    sha256 = "1jja3aqkm2whb4rcw5k5dr9c4gx6hax1w3f82fb9ks2sy731as6r";
   };
-}
+
+  patches = [ ./const.patch ./install_prefix.patch ];
+})
diff --git a/pkgs/os-specific/linux/spl/generic.nix b/pkgs/os-specific/linux/spl/generic.nix
new file mode 100644
index 00000000000..c25ff6608e2
--- /dev/null
+++ b/pkgs/os-specific/linux/spl/generic.nix
@@ -0,0 +1,61 @@
+{ stdenv, autoconf, automake, libtool, coreutils, gawk
+, configFile ? "all"
+
+# Kernel dependencies
+, kernel ? null
+
+# Version specific parameters
+, version, src, patches
+, ...
+}:
+
+with stdenv.lib;
+let
+  buildKernel = any (n: n == configFile) [ "kernel" "all" ];
+  buildUser = any (n: n == configFile) [ "user" "all" ];
+in
+
+assert any (n: n == configFile) [ "kernel" "user" "all" ];
+assert buildKernel -> kernel != null;
+
+stdenv.mkDerivation rec {
+  name = "spl-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
+
+  inherit version src patches;
+
+  buildInputs = [ autoconf automake libtool ];
+
+  preConfigure = ''
+    ./autogen.sh
+
+    substituteInPlace ./module/spl/spl-generic.c --replace /usr/bin/hostid hostid
+    substituteInPlace ./module/spl/spl-module.c  --replace /bin/mknod mknod
+
+    substituteInPlace ./module/spl/spl-generic.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:${gawk}:/bin"
+    substituteInPlace ./module/splat/splat-vnode.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
+    substituteInPlace ./module/splat/splat-linux.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
+  '';
+
+  configureFlags = [
+    "--with-config=${configFile}"
+  ] ++ optionals buildKernel [
+    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Kernel module driver for solaris porting layer (needed by in-kernel zfs)";
+
+    longDescription = ''
+      This kernel module is a porting layer for ZFS to work inside the linux
+      kernel.
+    '';
+
+    homepage = http://zfsonlinux.org/;
+    platforms = platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ jcumming wizeman wkennington ];
+  };
+}
diff --git a/pkgs/os-specific/linux/spl/git.nix b/pkgs/os-specific/linux/spl/git.nix
index d3ed285ccfe..7559562965d 100644
--- a/pkgs/os-specific/linux/spl/git.nix
+++ b/pkgs/os-specific/linux/spl/git.nix
@@ -1,46 +1,13 @@
-{ stdenv, fetchgit, kernel, perl, autoconf, automake, libtool, coreutils, gawk }:
+{ callPackage, fetchgit, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  version = "2015-04-08";
 
-stdenv.mkDerivation {
-  name = "spl-0.6.3-${kernel.version}";
   src = fetchgit {
     url = git://github.com/zfsonlinux/spl.git;
-    rev = "31cb5383bff0fddc5058973e32a6f2c446d45e59";
-    sha256 = "0mcivbddms8kbapbs9x6achqyvh5i6h1rd2b3jm8g5yjn0flc5gl";
+    rev = "cd69f020e4b0f9c416dd07a264e48c9488a7633f";
+    sha256 = "1fy5zlh8cs65s52vixkp00ihrlrhs2frd6vwxwjqmpzyb7fnh3m8";
   };
 
-  patches = [ ./install_prefix.patch ./const.patch ];
-
-  buildInputs = [ perl autoconf automake libtool ];
-
-  preConfigure = ''
-    ./autogen.sh
-
-    substituteInPlace ./module/spl/spl-generic.c --replace /usr/bin/hostid hostid
-    substituteInPlace ./module/spl/spl-module.c  --replace /bin/mknod mknod
-
-    substituteInPlace ./module/spl/spl-generic.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:${gawk}:/bin"
-    substituteInPlace ./module/splat/splat-vnode.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
-    substituteInPlace ./module/splat/splat-linux.c --replace "PATH=/sbin:/usr/sbin:/bin:/usr/bin" "PATH=${coreutils}:/bin"
-  '';
-
-  configureFlags = ''
-     --with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source
-     --with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build
-  '';
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "Kernel module driver for solaris porting layer (needed by in-kernel zfs)";
-
-    longDescription = ''
-      This kernel module is a porting layer for ZFS to work inside the linux
-      kernel.
-    '';
-
-    homepage = http://zfsonlinux.org/;
-    platforms = stdenv.lib.platforms.linux;
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [ wizeman ];
-  };
-}
+  patches = [ ./const.patch ./install_prefix.patch ];
+})
diff --git a/pkgs/os-specific/linux/spl/install_prefix.patch b/pkgs/os-specific/linux/spl/install_prefix.patch
index 6b3bd515bd0..0f12f531f7a 100644
--- a/pkgs/os-specific/linux/spl/install_prefix.patch
+++ b/pkgs/os-specific/linux/spl/install_prefix.patch
@@ -1,274 +1,173 @@
-diff -rc spl-0.6.1.orig/include/fs/Makefile.am spl-0.6.1/include/fs/Makefile.am
-*** spl-0.6.1.orig/include/fs/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/fs/Makefile.am	2013-04-05 22:10:41.436764000 -0700
-***************
-*** 8,13 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/fs
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 8,13 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/fs
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/linux/Makefile.am spl-0.6.1/include/linux/Makefile.am
-*** spl-0.6.1.orig/include/linux/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/linux/Makefile.am	2013-04-05 22:10:27.789139000 -0700
-***************
-*** 23,28 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/linux
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 23,28 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/linux
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/Makefile.am spl-0.6.1/include/Makefile.am
-*** spl-0.6.1.orig/include/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/Makefile.am	2013-04-05 22:10:45.108623000 -0700
-***************
-*** 16,21 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 16,21 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/rpc/Makefile.am spl-0.6.1/include/rpc/Makefile.am
-*** spl-0.6.1.orig/include/rpc/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/rpc/Makefile.am	2013-04-05 22:11:08.724410000 -0700
-***************
-*** 9,14 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/rpc
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 9,14 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/rpc
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/sharefs/Makefile.am spl-0.6.1/include/sharefs/Makefile.am
-*** spl-0.6.1.orig/include/sharefs/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/sharefs/Makefile.am	2013-04-05 22:10:38.852722000 -0700
-***************
-*** 8,13 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/sharefs
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 8,13 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/sharefs
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/sys/fm/Makefile.am spl-0.6.1/include/sys/fm/Makefile.am
-*** spl-0.6.1.orig/include/sys/fm/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/sys/fm/Makefile.am	2013-04-05 22:10:59.964334000 -0700
-***************
-*** 9,14 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/sys/fm
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 9,14 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/sys/fm
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/sys/fs/Makefile.am spl-0.6.1/include/sys/fs/Makefile.am
-*** spl-0.6.1.orig/include/sys/fs/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/sys/fs/Makefile.am	2013-04-05 22:10:57.860366000 -0700
-***************
-*** 8,13 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/sys/fs
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 8,13 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/sys/fs
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/sys/Makefile.am spl-0.6.1/include/sys/Makefile.am
-*** spl-0.6.1.orig/include/sys/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/sys/Makefile.am	2013-04-05 22:11:05.788303000 -0700
-***************
-*** 104,110 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/sys
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-  
---- 104,110 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/sys
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-  
-diff -rc spl-0.6.1.orig/include/sys/sysevent/Makefile.am spl-0.6.1/include/sys/sysevent/Makefile.am
-*** spl-0.6.1.orig/include/sys/sysevent/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/sys/sysevent/Makefile.am	2013-04-05 22:10:54.364458000 -0700
-***************
-*** 8,13 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/sys/sysevent
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 8,13 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/sys/sysevent
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/util/Makefile.am spl-0.6.1/include/util/Makefile.am
-*** spl-0.6.1.orig/include/util/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/util/Makefile.am	2013-04-05 22:10:49.452569000 -0700
-***************
-*** 9,14 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/util
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 9,14 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/util
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/include/vm/Makefile.am spl-0.6.1/include/vm/Makefile.am
-*** spl-0.6.1.orig/include/vm/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/include/vm/Makefile.am	2013-04-05 22:10:47.444535000 -0700
-***************
-*** 10,15 ****
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/spl-$(VERSION)/include/vm
-  kernel_HEADERS = $(KERNEL_H)
-  endif
---- 10,15 ----
-  EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/libexec/spl/include/vm
-  kernel_HEADERS = $(KERNEL_H)
-  endif
-diff -rc spl-0.6.1.orig/Makefile.am spl-0.6.1/Makefile.am
-*** spl-0.6.1.orig/Makefile.am	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/Makefile.am	2013-04-05 22:09:52.429676000 -0700
-***************
-*** 9,18 ****
-  if CONFIG_KERNEL
-  SUBDIRS += module
-  
-! extradir = /usr/src/spl-$(VERSION)
-  extra_HEADERS = spl.release.in spl_config.h.in
-  
-! kerneldir = /usr/src/spl-$(VERSION)/$(LINUX_VERSION)
-  nodist_kernel_HEADERS = spl.release spl_config.h module/$(LINUX_SYMBOLS)
-  endif
-  
---- 9,18 ----
-  if CONFIG_KERNEL
-  SUBDIRS += module
-  
-! extradir = @prefix@/libexec/spl
-  extra_HEADERS = spl.release.in spl_config.h.in
-  
-! kerneldir = @prefix@/libexec/spl/$(LINUX_VERSION)
-  nodist_kernel_HEADERS = spl.release spl_config.h module/$(LINUX_SYMBOLS)
-  endif
-  
-diff -rc spl-0.6.1.orig/module/Makefile.in spl-0.6.1/module/Makefile.in
-*** spl-0.6.1.orig/module/Makefile.in	2013-03-26 09:37:39.000000000 -0700
---- spl-0.6.1/module/Makefile.in	2013-03-28 10:21:59.093481000 -0700
-***************
-*** 21,41 ****
-  modules_install:
-  	@# Install the kernel modules
-  	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` $@ \
-! 		INSTALL_MOD_PATH=$(DESTDIR)$(INSTALL_MOD_PATH) \
-  		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR)
-  	@# Remove extraneous build products when packaging
-! 	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
-  	if [ -n $$kmoddir ]; then \
-  		find $$kmoddir -name 'modules.*' | xargs $(RM); \
-  	fi
-! 	sysmap=$(DESTDIR)$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
-  	if [ -f $$sysmap ]; then \
-  		depmod -ae -F $$sysmap @LINUX_VERSION@; \
-  	fi
-  
-  modules_uninstall:
-  	@# Uninstall the kernel modules
-! 	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@
-  	list='$(subdir-m)'; for subdir in $$list; do \
-  		$(RM) -R $$kmoddir/$(INSTALL_MOD_DIR)/$$subdir; \
-  	done
---- 21,41 ----
-  modules_install:
-  	@# Install the kernel modules
-  	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` $@ \
-! 		INSTALL_MOD_PATH=@prefix@/$(INSTALL_MOD_PATH) \
-  		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR)
-  	@# Remove extraneous build products when packaging
-! 	kmoddir=@prefix@/$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
-  	if [ -n $$kmoddir ]; then \
-  		find $$kmoddir -name 'modules.*' | xargs $(RM); \
-  	fi
-! 	sysmap=@prefix@/$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
-  	if [ -f $$sysmap ]; then \
-  		depmod -ae -F $$sysmap @LINUX_VERSION@; \
-  	fi
-  
-  modules_uninstall:
-  	@# Uninstall the kernel modules
-! 	kmoddir=@prefix@/$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@
-  	list='$(subdir-m)'; for subdir in $$list; do \
-  		$(RM) -R $$kmoddir/$(INSTALL_MOD_DIR)/$$subdir; \
-  	done
+diff --git a/Makefile.am b/Makefile.am
+index 89af931..674420c 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -12,10 +12,10 @@ endif
+ if CONFIG_KERNEL
+ SUBDIRS += module
+ 
+-extradir = @prefix@/src/spl-$(VERSION)
++extradir = @prefix@/libexec/spl
+ extra_HEADERS = spl.release.in spl_config.h.in
+ 
+-kerneldir = @prefix@/src/spl-$(VERSION)/$(LINUX_VERSION)
++kerneldir = @prefix@/libexec/spl/$(LINUX_VERSION)
+ nodist_kernel_HEADERS = spl.release spl_config.h module/$(LINUX_SYMBOLS)
+ endif
+ 
+diff --git a/include/Makefile.am b/include/Makefile.am
+index 3200222..4a47aaa 100644
+--- a/include/Makefile.am
++++ b/include/Makefile.am
+@@ -13,6 +13,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include
++kerneldir = @prefix@/libexec/spl/include
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/fs/Makefile.am b/include/fs/Makefile.am
+index e0da4b3..d6d7af0 100644
+--- a/include/fs/Makefile.am
++++ b/include/fs/Makefile.am
+@@ -8,6 +8,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/fs
++kerneldir = @prefix@/libexec/spl/include/fs
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/linux/Makefile.am b/include/linux/Makefile.am
+index 1cca44a..e0d843b 100644
+--- a/include/linux/Makefile.am
++++ b/include/linux/Makefile.am
+@@ -19,6 +19,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/linux
++kerneldir = @prefix@/libexec/spl/include/linux
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/rpc/Makefile.am b/include/rpc/Makefile.am
+index cfc8246..4fbd33d 100644
+--- a/include/rpc/Makefile.am
++++ b/include/rpc/Makefile.am
+@@ -9,6 +9,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/rpc
++kerneldir = @prefix@/libexec/spl/include/rpc
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/sharefs/Makefile.am b/include/sharefs/Makefile.am
+index 10e7093..febecdf 100644
+--- a/include/sharefs/Makefile.am
++++ b/include/sharefs/Makefile.am
+@@ -8,6 +8,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sharefs
++kerneldir = @prefix@/libexec/spl/include/sharefs
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/sys/Makefile.am b/include/sys/Makefile.am
+index 2d21c57..3958cfd 100644
+--- a/include/sys/Makefile.am
++++ b/include/sys/Makefile.am
+@@ -104,7 +104,7 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sys
++kerneldir = @prefix@/libexec/spl/include/sys
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+ 
+diff --git a/include/sys/fm/Makefile.am b/include/sys/fm/Makefile.am
+index 2821cbe..a84ce8e 100644
+--- a/include/sys/fm/Makefile.am
++++ b/include/sys/fm/Makefile.am
+@@ -9,6 +9,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sys/fm
++kerneldir = @prefix@/libexec/spl/include/sys/fm
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/sys/fs/Makefile.am b/include/sys/fs/Makefile.am
+index 581083e..0c35fb7 100644
+--- a/include/sys/fs/Makefile.am
++++ b/include/sys/fs/Makefile.am
+@@ -8,6 +8,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sys/fs
++kerneldir = @prefix@/libexec/spl/include/sys/fs
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/sys/sysevent/Makefile.am b/include/sys/sysevent/Makefile.am
+index 63d9af3..de1aa18 100644
+--- a/include/sys/sysevent/Makefile.am
++++ b/include/sys/sysevent/Makefile.am
+@@ -8,6 +8,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sys/sysevent
++kerneldir = @prefix@/libexec/spl/include/sys/sysevent
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/util/Makefile.am b/include/util/Makefile.am
+index b721b50..cbb9a05 100644
+--- a/include/util/Makefile.am
++++ b/include/util/Makefile.am
+@@ -9,6 +9,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/util
++kerneldir = @prefix@/libexec/spl/include/util
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/vm/Makefile.am b/include/vm/Makefile.am
+index 7faab0a..8148b3d 100644
+--- a/include/vm/Makefile.am
++++ b/include/vm/Makefile.am
+@@ -10,6 +10,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/vm
++kerneldir = @prefix@/libexec/spl/include/vm
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/module/Makefile.in b/module/Makefile.in
+index 41c1010..3141397 100644
+--- a/module/Makefile.in
++++ b/module/Makefile.in
+@@ -21,15 +21,15 @@ clean:
+ modules_install:
+ 	@# Install the kernel modules
+ 	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` $@ \
+-		INSTALL_MOD_PATH=$(DESTDIR)$(INSTALL_MOD_PATH) \
++		INSTALL_MOD_PATH=@prefix@/$(INSTALL_MOD_PATH) \
+ 		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR) \
+ 		KERNELRELEASE=@LINUX_VERSION@
+ 	@# Remove extraneous build products when packaging
+-	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
++	kmoddir=@prefix@/$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
+ 	if [ -n $$kmoddir ]; then \
+ 		find $$kmoddir -name 'modules.*' | xargs $(RM); \
+ 	fi
+-	sysmap=$(DESTDIR)$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
++	sysmap=@prefix@/$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
+ 	if [ -f $$sysmap ]; then \
+ 		depmod -ae -F $$sysmap @LINUX_VERSION@; \
+ 	fi
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index d5e2ed3ff94..5a7d0700004 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -3,14 +3,14 @@ let
   inherit (stdenv.lib) optional optionalString;
   s = rec {
     baseName="sysdig";
-    version="0.1.87";
+    version = "0.1.99";
     name="${baseName}-${version}";
     url="https://github.com/draios/sysdig/archive/${version}.tar.gz";
-    sha256="0xfildaj8kzbngpza47zqm363i6q87m97a18qlmdisrxmz11s32b";
+    sha256 = "02faw8s07i7jjydqzqfs0r9lc2qmny3sn26741bz0hmazs9h9w76";
   };
   buildInputs = [
     cmake zlib luajit
-  ] ++ optional (kernel != null) kernel;
+  ];
 in
 stdenv.mkDerivation {
   inherit (s) name version;
@@ -30,6 +30,10 @@ stdenv.mkDerivation {
   '';
   postInstall = optionalString (kernel != null) ''
     make install_driver
+    kernel_dev=${kernel.dev}
+    kernel_dev=''${kernel_dev#/nix/store/}
+    kernel_dev=''${kernel_dev%%-linux*dev*}
+    sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/sysfsutils/default.nix b/pkgs/os-specific/linux/sysfsutils/default.nix
index bf6dafae10a..99e6c4ff380 100644
--- a/pkgs/os-specific/linux/sysfsutils/default.nix
+++ b/pkgs/os-specific/linux/sysfsutils/default.nix
@@ -16,6 +16,6 @@ stdenv.mkDerivation rec {
         filesystem in Linux kernel versions 2.5+ that exposes a system's
         device tree.
       '';
-    license = "GPL-v2 / LGPL-v2.1";
+    license = with stdenv.lib.licenses; [ gpl2 lgpl21 ];
   };
 }
diff --git a/pkgs/os-specific/linux/sysklogd/default.nix b/pkgs/os-specific/linux/sysklogd/default.nix
index 979bfa1d0bf..fd1d932990e 100644
--- a/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/pkgs/os-specific/linux/sysklogd/default.nix
@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation {
-  name = "sysklogd-1.5";
+  name = "sysklogd-1.5.1";
 
   src = fetchurl {
-    url = http://www.infodrom.org/projects/sysklogd/download/sysklogd-1.5.tar.gz;
-    sha256 = "0wxpkrznqwz4dy11k90s2sqszwp7d4mlc0ag8288wa193plvhsb1";
+    url = http://www.infodrom.org/projects/sysklogd/download/sysklogd-1.5.1.tar.gz;
+    sha256 = "00f2wy6f0qng7qzga4iicyzl9j8b7mp6mrpfky5jxj93ms2w2rji";
   };
 
   patches = [ ./systemd.patch ];
@@ -21,5 +21,6 @@ stdenv.mkDerivation {
 
   meta = {
     description = "A system logging daemon";
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 734613c44ac..93e5d591a9d 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, nasm, perl, libuuid }:
 
 stdenv.mkDerivation rec {
-  name = "syslinux-6.02";
+  name = "syslinux-6.03";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/boot/syslinux/${name}.tar.xz";
-    sha256 = "0y2ld2s64s6vc5pf8rj36w71rq2cfax3c1iafp0w1qbjpxy1p8xg";
+    sha256 = "03l5iifwlg1wyb4yh98i0b7pd4j55a1c9y74q1frs47a5dnrilr6";
   };
 
   patches = [ ./perl-deps.patch ];
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index ec504bd9235..28d6f0b21a8 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,10 @@
-{ stdenv, fetchurl, gettext }:
-   
+{ stdenv, fetchurl, gettext, bzip2 }:
 stdenv.mkDerivation rec {
-  name = "sysstat-10.1.1";
-   
+  name = "sysstat-11.0.2";
+
   src = fetchurl {
-    url = "http://perso.orange.fr/sebastien.godard/${name}.tar.bz2";
-    sha256 = "1ig6k4yjkkazddjr90hykiapl30s9r9c1gy1h8hqzn2c3xgkm7p3";
+    url = "http://perso.orange.fr/sebastien.godard/${name}.tar.xz";
+    sha256 = "15hv3ylr5i6nrrdhyjnp4xld51gpv0cn3hjgy6068ybwpvgpzn5c";
   };
 
   buildInputs = [ gettext ];
@@ -13,10 +12,14 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     export PATH_CP=$(type -tp cp)
     export PATH_CHKCONFIG=/no-such-program
-    makeFlagsArray=(SA_DIR=/var/log/sa SYSCONFIG_DIR=$out/etc CHOWN=true IGNORE_MAN_GROUP=y)
+    export BZIP=${bzip2}/bin/bzip2
+    export SYSTEMCTL=systemctl
   '';
 
-  patches = [ ./no-install-statedir.patch ];
+  makeFlags = "SYSCONFIG_DIR=$(out)/etc IGNORE_MAN_GROUP=y CHOWN=true";
+  installTargets = "install_base install_nls install_man";
+
+  patches = [ ./install.patch ];
 
   meta = {
     homepage = http://sebastien.godard.pagesperso-orange.fr/;
diff --git a/pkgs/os-specific/linux/sysstat/install.patch b/pkgs/os-specific/linux/sysstat/install.patch
new file mode 100644
index 00000000000..473fa30b98b
--- /dev/null
+++ b/pkgs/os-specific/linux/sysstat/install.patch
@@ -0,0 +1,13 @@
+diff -rc sysstat-11.0.1/Makefile.in sysstat-11.0.1-new/Makefile.in
+*** sysstat-11.0.1/Makefile.in	2014-08-30 15:38:39.000000000 +0200
+--- sysstat-11.0.1-new/Makefile.in	2014-12-18 14:40:45.466349009 +0100
+***************
+*** 331,337 ****
+  install_base: all sa1 sa2 sysstat.sysconfig install_man install_nls \
+  	contrib/isag/isag
+  	mkdir -p $(DESTDIR)$(SA_LIB_DIR)
+- 	mkdir -p $(DESTDIR)$(SA_DIR)
+  ifeq ($(CLEAN_SA_DIR),y)
+  	find $(DESTDIR)$(SA_DIR) \( -name 'sar??' -o -name 'sa??' -o -name 'sar??.gz' -o -name 'sa??.gz' \) \
+  		-exec rm -f {} \;
+--- 331,336 ----
diff --git a/pkgs/os-specific/linux/sysstat/no-install-statedir.patch b/pkgs/os-specific/linux/sysstat/no-install-statedir.patch
deleted file mode 100644
index ef81f97217f..00000000000
--- a/pkgs/os-specific/linux/sysstat/no-install-statedir.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-diff -rc sysstat-10.1.1/Makefile.in sysstat-10.1.1-new/Makefile.in
-*** sysstat-10.1.1/Makefile.in	2012-01-02 14:36:00.000000000 +0100
---- sysstat-10.1.1-new/Makefile.in	2012-08-14 14:11:17.676124739 +0200
-***************
-*** 309,315 ****
-  install_base: all sa1 sa2 sysstat.sysconfig install_man install_nls \
-  	contrib/isag/isag
-  	mkdir -p $(DESTDIR)$(SA_LIB_DIR)
-! 	mkdir -p $(DESTDIR)$(SA_DIR)
-  ifeq ($(CLEAN_SA_DIR),y)
-  	find $(DESTDIR)$(SA_DIR) \( -name 'sar??' -o -name 'sa??' -o -name 'sar??.gz' -o -name 'sa??.gz' \) \
-  		-exec rm -f {} \;
---- 309,315 ----
-  install_base: all sa1 sa2 sysstat.sysconfig install_man install_nls \
-  	contrib/isag/isag
-  	mkdir -p $(DESTDIR)$(SA_LIB_DIR)
-! 	#mkdir -p $(DESTDIR)$(SA_DIR)
-  ifeq ($(CLEAN_SA_DIR),y)
-  	find $(DESTDIR)$(SA_DIR) \( -name 'sar??' -o -name 'sa??' -o -name 'sar??.gz' -o -name 'sa??.gz' \) \
-  		-exec rm -f {} \;
-***************
-*** 344,350 ****
-  
-  install_all: install_base cron/crontab sysstat \
-  	cron/sysstat.crond cron/sysstat.cron.daily cron/sysstat.cron.hourly
-! 	$(CHOWN) $(CRON_OWNER) $(DESTDIR)$(SA_DIR)
-  	if [ -d $(DESTDIR)/etc/cron.d ]; then \
-  	   $(INSTALL_DATA) cron/sysstat.crond $(DESTDIR)/etc/cron.d/sysstat; \
-  	elif [ -d $(DESTDIR)/etc/cron.hourly -a -d $(DESTDIR)/etc/cron.daily ]; then \
---- 344,350 ----
-  
-  install_all: install_base cron/crontab sysstat \
-  	cron/sysstat.crond cron/sysstat.cron.daily cron/sysstat.cron.hourly
-! 	#$(CHOWN) $(CRON_OWNER) $(DESTDIR)$(SA_DIR)
-  	if [ -d $(DESTDIR)/etc/cron.d ]; then \
-  	   $(INSTALL_DATA) cron/sysstat.crond $(DESTDIR)/etc/cron.d/sysstat; \
-  	elif [ -d $(DESTDIR)/etc/cron.hourly -a -d $(DESTDIR)/etc/cron.daily ]; then \
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 1c6a065a947..beee7ff3d5e 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,9 +1,8 @@
 { stdenv, fetchurl, pkgconfig, intltool, gperf, libcap, dbus, kmod
 , zlib, xz, pam, acl, cryptsetup, libuuid, m4, utillinux, libffi
-, glib, kbd, libxslt, coreutils, libgcrypt, sysvtools, docbook_xsl
+, glib, kbd, libxslt, coreutils, libgcrypt, sysvtools
 , kexectools, libmicrohttpd, linuxHeaders
 , pythonPackages ? null, pythonSupport ? false
-, autoreconfHook
 }:
 
 assert stdenv.isLinux;
@@ -11,27 +10,26 @@ assert stdenv.isLinux;
 assert pythonSupport -> pythonPackages != null;
 
 stdenv.mkDerivation rec {
-  version = "212";
+  version = "217";
   name = "systemd-${version}";
 
   src = fetchurl {
     url = "http://www.freedesktop.org/software/systemd/${name}.tar.xz";
-    sha256 = "1hpjcc42svrs06q3isjm3m5aphgkpfdylmvpnif71zh46ys0cab5";
+    sha256 = "163l1y4p2a564d4ynfq3k3xf53j2v5s81blb6cvpn1y7rpxyccd0";
   };
 
   outputs = [ "dev" "out" "libudev" "doc" ];
 
   patches =
     [ # These are all changes between upstream and
-      # https://github.com/edolstra/systemd/tree/nixos-v212.
+      # https://github.com/edolstra/systemd/tree/nixos-v217.
       ./fixes.patch
     ];
 
   buildInputs =
     [ pkgconfig intltool gperf libcap kmod xz pam acl
-      /* cryptsetup */ libuuid m4 glib libxslt libgcrypt docbook_xsl
+      /* cryptsetup */ libuuid m4 glib libxslt libgcrypt
       libmicrohttpd linuxHeaders libffi
-      autoreconfHook
     ] ++ stdenv.lib.optionals pythonSupport [pythonPackages.python pythonPackages.lxml];
 
 
@@ -48,9 +46,23 @@ stdenv.mkDerivation rec {
       "--with-dbussessionservicedir=$(out)/share/dbus-1/services"
       "--with-firmware-path=/root/test-firmware:/run/current-system/firmware"
       "--with-tty-gid=3" # tty in NixOS has gid 3
-      "--disable-networkd" # enable/use eventually
       "--enable-compat-libs" # get rid of this eventually
       "--disable-tests"
+
+      "--disable-hostnamed"
+      "--enable-networkd"
+      "--disable-sysusers"
+      "--disable-timedated"
+      "--enable-timesyncd"
+      "--disable-readahead"
+      "--disable-firstboot"
+      "--disable-localed"
+      "--enable-resolved"
+      "--disable-split-usr"
+
+      "--with-sysvinit-path="
+      "--with-sysvrcnd-path="
+      "--with-rc-local-script-path-stop=/etc/halt.local"
     ];
 
   preConfigure =
@@ -80,7 +92,7 @@ stdenv.mkDerivation rec {
 
   # This is needed because systemd uses the gold linker, which doesn't
   # yet have the wrapper script to add rpath flags automatically.
-  NIX_LDFLAGS = "-rpath ${pam}/lib -rpath ${libcap}/lib -rpath ${acl}/lib -rpath ${stdenv.gcc.gcc}/lib";
+  NIX_LDFLAGS = "-rpath ${pam}/lib -rpath ${libcap}/lib -rpath ${acl}/lib -rpath ${stdenv.cc.cc}/lib";
 
   PYTHON_BINARY = "${coreutils}/bin/env python"; # don't want a build time dependency on Python
 
@@ -94,6 +106,8 @@ stdenv.mkDerivation rec {
       # currently running systemd (/run/current-system/systemd) so
       # that we don't use an obsolete/garbage-collected release agent.
       "-USYSTEMD_CGROUP_AGENT_PATH" "-DSYSTEMD_CGROUP_AGENT_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
+
+      "-USYSTEMD_BINARY_PATH" "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
     ];
 
   # Use /var/lib/udev rather than /etc/udev for the generated hardware
@@ -112,12 +126,14 @@ stdenv.mkDerivation rec {
       "pamconfdir=$(out)/etc/pam.d"
     ];
 
-  # Get rid of configuration-specific data.
   postInstall =
     ''
-      mkdir -p $doc/example/systemd
-      mv $doc/lib/{modules-load.d,binfmt.d,sysctl.d,tmpfiles.d} $doc/example
-      mv $doc/lib/systemd/{system,user} $doc/example/systemd
+      # sysinit.target: Don't depend on
+      # systemd-tmpfiles-setup.service. This interferes with NixOps's
+      # send-keys feature (since sshd.service depends indirectly on
+      # sysinit.target).
+      mv $out/lib/systemd/system/sysinit.target.wants/systemd-tmpfiles-setup-dev.service $out/lib/systemd/system/multi-user.target.wants/
+
 
       rm -rf $out/etc/systemd/system
 
diff --git a/pkgs/os-specific/linux/systemd/fixes.patch b/pkgs/os-specific/linux/systemd/fixes.patch
index 72cf0e92bb8..c1c768dbacb 100644
--- a/pkgs/os-specific/linux/systemd/fixes.patch
+++ b/pkgs/os-specific/linux/systemd/fixes.patch
@@ -1,72 +1,5 @@
-diff --git a/Makefile.am b/Makefile.am
-index 3d9e5c1..46487f6 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -1095,7 +1095,7 @@ BUILT_SOURCES += \
- 
- src/shared/errno-list.txt:
- 	$(AM_V_at)$(MKDIR_P) $(dir $@)
--	$(AM_V_GEN)$(CPP) $(CFLAGS) $(AM_CPPFLAGS) $(CPPFLAGS) -dM -include errno.h - < /dev/null | $(AWK) '/^#define[ \t]+E[^ _]+[ \t]+[0-9]/ { print $$2; }'  > $@
-+	$(AM_V_GEN)$(CPP) $(CFLAGS) $(AM_CPPFLAGS) $(CPPFLAGS) -dM -include errno.h - < /dev/null | $(AWK) '/^#define[ \t]+E[^ _]+[ \t]+/ { print $$2; }'  > $@
- 
- src/shared/errno-from-name.gperf: src/shared/errno-list.txt
- 	$(AM_V_at)$(MKDIR_P) $(dir $@)
-@@ -1107,7 +1107,7 @@ src/shared/errno-from-name.h: src/shared/errno-from-name.gperf
- 
- src/shared/errno-to-name.h: src/shared/errno-list.txt
- 	$(AM_V_at)$(MKDIR_P) $(dir $@)
--	$(AM_V_GEN)$(AWK) 'BEGIN{ print "static const char* const errno_names[] = { "} { printf "[%s] = \"%s\",\n", $$1, $$1 } END{print "};"}' < $< > $@
-+	$(AM_V_GEN)$(AWK) 'BEGIN{ print "static const char* const errno_names[] = { "} !/EDEADLOCK/ && !/EWOULDBLOCK/ && !/ENOTSUP/ { printf "[%s] = \"%s\",\n", $$1, $$1 } END{print "};"}' < $< > $@
- 
- src/shared/af-list.txt:
- 	$(AM_V_at)$(MKDIR_P) $(dir $@)
-@@ -1707,7 +1707,9 @@ dist_tmpfiles_DATA += \
- endif
- 
- SYSINIT_TARGET_WANTS += \
--	systemd-tmpfiles-setup-dev.service \
-+	systemd-tmpfiles-setup-dev.service
-+
-+MULTI_USER_TARGET_WANTS += \
- 	systemd-tmpfiles-setup.service
- 
- dist_zshcompletion_DATA += \
-@@ -1961,6 +1963,7 @@ systemd_cgls_SOURCES = \
- 	src/cgls/cgls.c
- 
- systemd_cgls_LDADD = \
-+	libsystemd-internal.la \
- 	libsystemd-shared.la
- 
- # ------------------------------------------------------------------------------
-diff --git a/TODO b/TODO
-index e2ca1e6..d7efdd5 100644
---- a/TODO
-+++ b/TODO
-@@ -1,4 +1,6 @@
- Bugfixes:
-+* Should systemctl status \* work on all unit types, not just .service?
-+
- * enabling an instance unit creates a pointless link, and
-   the unit will be started with getty@getty.service:
-     $ systemctl enable getty@.service
-diff --git a/rules/42-usb-hid-pm.rules b/rules/42-usb-hid-pm.rules
-index c675b5b..4c300da 100644
---- a/rules/42-usb-hid-pm.rules
-+++ b/rules/42-usb-hid-pm.rules
-@@ -12,10 +12,6 @@ ACTION=="add", SUBSYSTEM=="usb", ATTR{product}=="QEMU USB Mouse", ATTR{serial}!=
- ACTION=="add", SUBSYSTEM=="usb", ATTR{product}=="QEMU USB Tablet", ATTR{serial}!="1", TEST=="power/control", ATTR{power/control}="auto"
- ACTION=="add", SUBSYSTEM=="usb", ATTR{product}=="QEMU USB Keyboard", ATTR{serial}!="1", TEST=="power/control", ATTR{power/control}="auto"
- 
--# Catch-all for Avocent HID devices. Keyed off interface in order to only
--# trigger on HID class devices.
--ACTION=="add", SUBSYSTEM=="usb", ATTRS{idVendor}=="0624", ATTR{bInterfaceClass}=="03", TEST=="../power/control", ATTR{../power/control}="auto"
--
- # Dell DRAC 4
- ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="413c", ATTR{idProduct}=="2500", TEST=="power/control", ATTR{power/control}="auto"
- 
 diff --git a/rules/99-systemd.rules.in b/rules/99-systemd.rules.in
-index db72373..2875958 100644
+index e30d9a8..a3d399b 100644
 --- a/rules/99-systemd.rules.in
 +++ b/rules/99-systemd.rules.in
 @@ -14,10 +14,6 @@ KERNEL=="vport*", TAG+="systemd"
@@ -80,583 +13,191 @@ index db72373..2875958 100644
  # Ignore raid devices that are not yet assembled and started
  SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", TEST!="md/array_state", ENV{SYSTEMD_READY}="0"
  SUBSYSTEM=="block", ENV{DEVTYPE}=="disk", KERNEL=="md*", ATTR{md/array_state}=="|clear|inactive", ENV{SYSTEMD_READY}="0"
-@@ -43,7 +39,7 @@ SUBSYSTEM=="net", KERNEL!="lo", TAG+="systemd", ENV{SYSTEMD_ALIAS}+="/sys/subsys
- SUBSYSTEM=="bluetooth", TAG+="systemd", ENV{SYSTEMD_ALIAS}+="/sys/subsystem/bluetooth/devices/%k"
- 
- SUBSYSTEM=="bluetooth", TAG+="systemd", ENV{SYSTEMD_WANTS}+="bluetooth.target"
--ENV{ID_SMARTCARD_READER}=="*?", TAG+="systemd", ENV{SYSTEMD_WANTS}+="smartcard.target"
-+ENV{ID_SMARTCARD_READER}=="?*", TAG+="systemd", ENV{SYSTEMD_WANTS}+="smartcard.target"
- SUBSYSTEM=="sound", KERNEL=="card*", TAG+="systemd", ENV{SYSTEMD_WANTS}+="sound.target"
- 
- SUBSYSTEM=="printer", TAG+="systemd", ENV{SYSTEMD_WANTS}+="printer.target"
-diff --git a/src/cgls/cgls.c b/src/cgls/cgls.c
-index b8e275d..1840594 100644
---- a/src/cgls/cgls.c
-+++ b/src/cgls/cgls.c
-@@ -35,6 +35,10 @@
- #include "build.h"
- #include "output-mode.h"
- #include "fileio.h"
-+#include "sd-bus.h"
-+#include "bus-util.h"
-+#include "bus-error.h"
-+#include "unit-name.h"
- 
- static bool arg_no_pager = false;
- static bool arg_kernel_threads = false;
-@@ -127,6 +131,7 @@ int main(int argc, char *argv[]) {
-         int r = 0, retval = EXIT_FAILURE;
-         int output_flags;
-         char _cleanup_free_ *root = NULL;
-+        _cleanup_bus_unref_ sd_bus *bus = NULL;
- 
-         log_parse_environment();
-         log_open();
-@@ -151,6 +156,12 @@ int main(int argc, char *argv[]) {
-                 arg_all * OUTPUT_SHOW_ALL |
-                 (arg_full > 0) * OUTPUT_FULL_WIDTH;
- 
-+        r = bus_open_transport(BUS_TRANSPORT_LOCAL, NULL, false, &bus);
-+        if (r < 0) {
-+                log_error("Failed to create bus connection: %s", strerror(-r));
-+                goto finish;
-+        }
-+
-         if (optind < argc) {
-                 int i;
- 
-@@ -189,8 +200,52 @@ int main(int argc, char *argv[]) {
-                 } else {
-                         if (arg_machine) {
-                                 char *m;
-+                                const char *cgroup;
-+                                _cleanup_free_ char *scope = NULL;
-+                                _cleanup_free_ char *path = NULL;
-+                                _cleanup_bus_message_unref_ sd_bus_message *reply = NULL;
-+                                _cleanup_bus_error_free_ sd_bus_error error = SD_BUS_ERROR_NULL;
-+
-                                 m = strappenda("/run/systemd/machines/", arg_machine);
--                                r = parse_env_file(m, NEWLINE, "CGROUP", &root, NULL);
-+                                r = parse_env_file(m, NEWLINE, "SCOPE", &scope, NULL);
-+                                if (r < 0) {
-+                                        log_error("Failed to get machine path: %s", strerror(-r));
-+                                        goto finish;
-+                                }
-+
-+                                path = unit_dbus_path_from_name(scope);
-+                                if (!path) {
-+                                        r = log_oom();
-+                                        goto finish;
-+                                }
-+
-+                                r = sd_bus_get_property(
-+                                                bus,
-+                                                "org.freedesktop.systemd1",
-+                                                path,
-+                                                "org.freedesktop.systemd1.Scope",
-+                                                "ControlGroup",
-+                                                &error,
-+                                                &reply,
-+                                                "s");
-+
-+                                if (r < 0) {
-+                                        log_error("Failed to query ControlGroup: %s", bus_error_message(&error, -r));
-+                                        goto finish;
-+                                }
-+
-+                                r = sd_bus_message_read(reply, "s", &cgroup);
-+                                if (r < 0) {
-+                                        bus_log_parse_error(r);
-+                                        goto finish;
-+                                }
-+
-+                                root = strdup(cgroup);
-+                                if (!root) {
-+                                        r = log_oom();
-+                                        goto finish;
-+                                }
-+
-                         } else
-                                 r = cg_get_root_path(&root);
-                         if (r < 0) {
-diff --git a/src/core/cgroup.c b/src/core/cgroup.c
-index 3dd4c91..4201e1e 100644
---- a/src/core/cgroup.c
-+++ b/src/core/cgroup.c
-@@ -871,7 +871,7 @@ int manager_setup_cgroup(Manager *m) {
-         safe_close(m->pin_cgroupfs_fd);
- 
-         m->pin_cgroupfs_fd = open(path, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOCTTY|O_NONBLOCK);
--        if (r < 0) {
-+        if (m->pin_cgroupfs_fd < 0) {
-                 log_error("Failed to open pin file: %m");
-                 return -errno;
-         }
-diff --git a/src/core/dbus-cgroup.c b/src/core/dbus-cgroup.c
-index 775825b..5b1c4e3 100644
---- a/src/core/dbus-cgroup.c
-+++ b/src/core/dbus-cgroup.c
-@@ -173,6 +173,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->cpu_accounting = b;
-+                        u->cgroup_realized_mask &= ~CGROUP_CPUACCT;
-                         unit_write_drop_in_private(u, mode, name, b ? "CPUAccounting=yes" : "CPUAccounting=no");
-                 }
- 
-@@ -192,6 +193,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->cpu_shares = ul;
-+                        u->cgroup_realized_mask &= ~CGROUP_CPU;
-                         unit_write_drop_in_private_format(u, mode, name, "CPUShares=%lu", ul);
-                 }
- 
-@@ -206,6 +208,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->blockio_accounting = b;
-+                        u->cgroup_realized_mask &= ~CGROUP_BLKIO;
-                         unit_write_drop_in_private(u, mode, name, b ? "BlockIOAccounting=yes" : "BlockIOAccounting=no");
-                 }
- 
-@@ -225,6 +228,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->blockio_weight = ul;
-+                        u->cgroup_realized_mask &= ~CGROUP_BLKIO;
-                         unit_write_drop_in_private_format(u, mode, name, "BlockIOWeight=%lu", ul);
-                 }
- 
-@@ -294,6 +298,8 @@ int bus_cgroup_set_property(
-                                                 cgroup_context_free_blockio_device_bandwidth(c, a);
-                         }
- 
-+                        u->cgroup_realized_mask &= ~CGROUP_BLKIO;
-+
-                         f = open_memstream(&buf, &size);
-                         if (!f)
-                                 return -ENOMEM;
-@@ -375,6 +381,8 @@ int bus_cgroup_set_property(
-                                         cgroup_context_free_blockio_device_weight(c, c->blockio_device_weights);
-                         }
- 
-+                        u->cgroup_realized_mask &= ~CGROUP_BLKIO;
-+
-                         f = open_memstream(&buf, &size);
-                         if (!f)
-                                 return -ENOMEM;
-@@ -398,6 +406,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->memory_accounting = b;
-+                        u->cgroup_realized_mask &= ~CGROUP_MEMORY;
-                         unit_write_drop_in_private(u, mode, name, b ? "MemoryAccounting=yes" : "MemoryAccounting=no");
-                 }
- 
-@@ -412,6 +421,7 @@ int bus_cgroup_set_property(
- 
-                 if (mode != UNIT_CHECK) {
-                         c->memory_limit = limit;
-+                        u->cgroup_realized_mask &= ~CGROUP_MEMORY;
-                         unit_write_drop_in_private_format(u, mode, name, "%s=%" PRIu64, name, limit);
-                 }
- 
-@@ -433,6 +443,7 @@ int bus_cgroup_set_property(
-                         char *buf;
- 
-                         c->device_policy = p;
-+                        u->cgroup_realized_mask &= ~CGROUP_DEVICE;
- 
-                         buf = strappenda("DevicePolicy=", policy);
-                         unit_write_drop_in_private(u, mode, name, buf);
-@@ -511,6 +522,8 @@ int bus_cgroup_set_property(
-                                         cgroup_context_free_device_allow(c, c->device_allow);
-                         }
- 
-+                        u->cgroup_realized_mask &= ~CGROUP_DEVICE;
-+
-                         f = open_memstream(&buf, &size);
-                         if (!f)
-                                 return -ENOMEM;
-diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
-index 13b3d0d..37d4154 100644
---- a/src/core/dbus-execute.c
-+++ b/src/core/dbus-execute.c
-@@ -842,7 +842,7 @@ int bus_exec_context_set_transient_property(
-                         strv_free(c->environment);
-                         c->environment = e;
- 
--                        joined = strv_join(c->environment, " ");
-+                        joined = strv_join_quoted(c->environment);
-                         if (!joined)
-                                 return -ENOMEM;
- 
 diff --git a/src/core/job.c b/src/core/job.c
-index 35a9de6..dc4f441 100644
+index eaa4bb1..db44fee 100644
 --- a/src/core/job.c
 +++ b/src/core/job.c
-@@ -1060,6 +1060,9 @@ int job_coldplug(Job *j) {
-         if (r < 0)
-                 return r;
+@@ -352,6 +352,9 @@ bool job_type_is_redundant(JobType a, UnitActiveState b) {
+                 return
+                         b == UNIT_ACTIVATING;
  
-+        if (j->state == JOB_WAITING)
-+                job_add_to_run_queue(j);
++        case JOB_NOP:
++                return true;
 +
-         if (j->begin_usec == 0 || j->unit->job_timeout == 0)
-                 return 0;
- 
-diff --git a/src/core/killall.c b/src/core/killall.c
-index 57ed41c..eab48f7 100644
---- a/src/core/killall.c
-+++ b/src/core/killall.c
-@@ -168,7 +168,7 @@ static int killall(int sig, Set *pids, bool send_sighup) {
-                         continue;
- 
-                 if (sig == SIGKILL) {
--                        _cleanup_free_ char *s;
-+                        _cleanup_free_ char *s = NULL;
- 
-                         get_process_comm(pid, &s);
-                         log_notice("Sending SIGKILL to PID "PID_FMT" (%s).", pid, strna(s));
-diff --git a/src/core/machine-id-setup.c b/src/core/machine-id-setup.c
-index d459afe..2a58e48 100644
---- a/src/core/machine-id-setup.c
-+++ b/src/core/machine-id-setup.c
-@@ -93,32 +93,9 @@ static int generate(char id[34], const char *root) {
-                 }
+         default:
+                 assert_not_reached("Invalid job type");
          }
+diff --git a/src/core/job.h b/src/core/job.h
+index 1e7c61b..ee8e54a 100644
+--- a/src/core/job.h
++++ b/src/core/job.h
+@@ -49,9 +49,11 @@ enum JobType {
+         _JOB_TYPE_MAX_MERGING,
+ 
+         /* JOB_NOP can enter into a transaction, but as it won't pull in
+-         * any dependencies, it won't have to merge with anything.
+-         * job_install() avoids the problem of merging JOB_NOP too (it's
+-         * special-cased, only merges with other JOB_NOPs). */
++         * any dependencies and it uses the special 'nop_job' slot in Unit,
++         * it won't have to merge with anything (except possibly into another
++         * JOB_NOP, previously installed). JOB_NOP is special-cased in
++         * job_type_is_*() functions so that the transaction can be
++         * activated. */
+         JOB_NOP = _JOB_TYPE_MAX_MERGING, /* do nothing */
+ 
+         _JOB_TYPE_MAX_IN_TRANSACTION,
+@@ -190,11 +192,15 @@ _pure_ static inline bool job_type_is_mergeable(JobType a, JobType b) {
+ }
  
--        /* If that didn't work, see if we are running in qemu/kvm and a
--         * machine ID was passed in via -uuid on the qemu/kvm command
--         * line */
--
--        r = detect_vm(&vm_id);
--        if (r > 0 && streq(vm_id, "kvm")) {
--                char uuid[37];
--
--                fd = open("/sys/class/dmi/id/product_uuid", O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
--                if (fd >= 0) {
--                        k = loop_read(fd, uuid, 36, false);
--                        safe_close(fd);
--
--                        if (k >= 36) {
--                                r = shorten_uuid(id, uuid);
--                                if (r >= 0) {
--                                        log_info("Initializing machine ID from KVM UUID.");
--                                        return 0;
--                                }
--                        }
--                }
--        }
--
--        /* If that didn't work either, see if we are running in a
--         * container, and a machine ID was passed in via
--         * $container_uuid the way libvirt/LXC does it */
-+        /* If that didn't work, see if we are running in a container,
-+         * and a machine ID was passed in via $container_uuid the way
-+         * libvirt/LXC does it */
-         r = detect_container(NULL);
-         if (r > 0) {
-                 _cleanup_free_ char *e = NULL;
-@@ -133,6 +110,30 @@ static int generate(char id[34], const char *root) {
-                                 }
-                         }
-                 }
-+
-+        } else {
-+                /* If we are not running in a container, see if we are
-+                 * running in qemu/kvm and a machine ID was passed in
-+                 * via -uuid on the qemu/kvm command line */
-+
-+                r = detect_vm(&vm_id);
-+                if (r > 0 && streq(vm_id, "kvm")) {
-+                        char uuid[37];
-+
-+                        fd = open("/sys/class/dmi/id/product_uuid", O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
-+                        if (fd >= 0) {
-+                                k = loop_read(fd, uuid, 36, false);
-+                                safe_close(fd);
-+
-+                                if (k >= 36) {
-+                                        r = shorten_uuid(id, uuid);
-+                                        if (r >= 0) {
-+                                                log_info("Initializing machine ID from KVM UUID.");
-+                                                return 0;
-+                                        }
-+                                }
-+                        }
-+                }
-         }
+ _pure_ static inline bool job_type_is_conflicting(JobType a, JobType b) {
+-        return !job_type_is_mergeable(a, b);
++        return a != JOB_NOP && b != JOB_NOP && !job_type_is_mergeable(a, b);
+ }
+ 
+ _pure_ static inline bool job_type_is_superset(JobType a, JobType b) {
+         /* Checks whether operation a is a "superset" of b in its actions */
++        if (b == JOB_NOP)
++                return true;
++        if (a == JOB_NOP)
++                return false;
+         return a == job_type_lookup_merge(a, b);
+ }
  
-         /* If that didn't work, generate a random machine id */
-diff --git a/src/core/main.c b/src/core/main.c
-index 41605ee..c65701d 100644
---- a/src/core/main.c
-+++ b/src/core/main.c
-@@ -1840,6 +1840,7 @@ finish:
-         if (reexecute) {
-                 const char **args;
-                 unsigned i, args_size;
-+                sigset_t ss;
- 
-                 /* Close and disarm the watchdog, so that the new
-                  * instance can reinitialize it, but doesn't get
-@@ -1883,7 +1884,7 @@ finish:
-                         char_array_0(sfd);
- 
-                         i = 0;
--                        args[i++] = SYSTEMD_BINARY_PATH;
-+                        args[i++] = "/run/current-system/systemd/lib/systemd/systemd";
-                         if (switch_root_dir)
-                                 args[i++] = "--switched-root";
-                         args[i++] = arg_running_as == SYSTEMD_SYSTEM ? "--system" : "--user";
-@@ -1923,6 +1924,13 @@ finish:
-                 args[i++] = NULL;
-                 assert(i <= args_size);
- 
-+                /* reenable any blocked signals, especially important
-+                 * if we switch from initial ramdisk to init=... */
-+                reset_all_signal_handlers();
-+
-+                assert_se(sigemptyset(&ss) == 0);
-+                assert_se(sigprocmask(SIG_SETMASK, &ss, NULL) == 0);
-+
-                 if (switch_root_init) {
-                         args[0] = switch_root_init;
-                         execv(args[0], (char* const*) args);
 diff --git a/src/core/manager.c b/src/core/manager.c
-index 224106c..7342095 100644
+index d427d88..256d6f7 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -422,7 +422,7 @@ int manager_new(SystemdRunningAs running_as, Manager **_m) {
-                 return -ENOMEM;
- 
- #ifdef ENABLE_EFI
--        if (detect_container(NULL) <= 0)
-+        if (running_as == SYSTEMD_SYSTEM && detect_container(NULL) <= 0)
-                 boot_timestamps(&m->userspace_timestamp, &m->firmware_timestamp, &m->loader_timestamp);
- #endif
- 
-@@ -2129,9 +2129,6 @@ int manager_serialize(Manager *m, FILE *f, FDSet *fds, bool switching_root) {
-                 if (u->id != t)
-                         continue;
- 
--                if (!unit_can_serialize(u))
--                        continue;
--
-                 /* Start marker */
-                 fputs(u->id, f);
-                 fputc('\n', f);
-diff --git a/src/core/namespace.c b/src/core/namespace.c
-index 9f15211..e41cf5b 100644
---- a/src/core/namespace.c
-+++ b/src/core/namespace.c
-@@ -42,6 +42,7 @@
- #include "mkdir.h"
- #include "dev-setup.h"
- #include "def.h"
-+#include "label.h"
- 
- typedef enum MountMode {
-         /* This is ordered by priority! */
-@@ -68,6 +69,7 @@ static int append_mounts(BindMount **p, char **strv, MountMode mode) {
-         STRV_FOREACH(i, strv) {
- 
-                 (*p)->ignore = false;
-+                (*p)->done = false;
- 
-                 if ((mode == INACCESSIBLE || mode == READONLY || mode == READWRITE) && (*i)[0] == '-') {
-                         (*p)->ignore = true;
-@@ -217,7 +219,10 @@ static int mount_dev(BindMount *m) {
-                         goto fail;
+@@ -662,9 +662,11 @@ static int manager_setup_notify(Manager *m) {
+                         return -errno;
                  }
  
-+                label_context_set(d, st.st_mode);
-                 r = mknod(dn, st.st_mode, st.st_rdev);
-+                label_context_clear();
+-                if (m->running_as == SYSTEMD_SYSTEM)
++                if (m->running_as == SYSTEMD_SYSTEM) {
+                         m->notify_socket = strdup("/run/systemd/notify");
+-                else {
++                        if (!m->notify_socket)
++                                return log_oom();
++                } else {
+                         const char *e;
+ 
+                         e = getenv("XDG_RUNTIME_DIR");
+@@ -674,9 +676,11 @@ static int manager_setup_notify(Manager *m) {
+                         }
+ 
+                         m->notify_socket = strappend(e, "/systemd/notify");
++                        if (!m->notify_socket)
++                                return log_oom();
 +
-                 if (r < 0) {
-                         r = -errno;
-                         goto fail;
-@@ -350,7 +355,7 @@ int setup_namespace(
-                 private_dev;
++                        mkdir_parents_label(m->notify_socket, 0755);
+                 }
+-                if (!m->notify_socket)
+-                        return log_oom();
+ 
+                 strncpy(sa.un.sun_path, m->notify_socket, sizeof(sa.un.sun_path)-1);
+                 r = bind(fd, &sa.sa, offsetof(struct sockaddr_un, sun_path) + strlen(sa.un.sun_path));
+diff --git a/src/core/shutdown.c b/src/core/shutdown.c
+index 20cf526..03cfddc 100644
+--- a/src/core/shutdown.c
++++ b/src/core/shutdown.c
+@@ -75,7 +75,9 @@ static int parse_argv(int argc, char *argv[]) {
+         assert(argc >= 1);
+         assert(argv);
+ 
+-        while ((c = getopt_long(argc, argv, "", options, NULL)) >= 0)
++        /* "-" prevents getopt from permuting argv[] and moving the verb away
++         * from argv[1]. Our interface to initrd promises it'll be there. */
++        while ((c = getopt_long(argc, argv, "-", options, NULL)) >= 0)
+                 switch (c) {
+ 
+                 case ARG_LOG_LEVEL:
+@@ -113,6 +115,13 @@ static int parse_argv(int argc, char *argv[]) {
+ 
+                         break;
+ 
++                case '\001':
++                        if (!arg_verb)
++                                arg_verb = optarg;
++                        else
++                                log_error("Excess arguments, ignoring");
++                        break;
++
+                 case '?':
+                         return -EINVAL;
+ 
+@@ -120,15 +129,11 @@ static int parse_argv(int argc, char *argv[]) {
+                         assert_not_reached("Unhandled option code.");
+                 }
  
-         if (n > 0) {
--                m = mounts = (BindMount *) alloca(n * sizeof(BindMount));
-+                m = mounts = (BindMount *) alloca0(n * sizeof(BindMount));
-                 r = append_mounts(&m, read_write_dirs, READWRITE);
-                 if (r < 0)
-                         return r;
-diff --git a/src/core/service.c b/src/core/service.c
-index ae3695a..6b3aa45 100644
---- a/src/core/service.c
-+++ b/src/core/service.c
-@@ -1096,11 +1096,6 @@ static int service_verify(Service *s) {
+-        if (optind >= argc) {
++        if (!arg_verb) {
+                 log_error("Verb argument missing.");
                  return -EINVAL;
          }
  
--        if (s->type == SERVICE_ONESHOT && s->restart != SERVICE_RESTART_NO) {
--                log_error_unit(UNIT(s)->id, "%s has Restart setting other than no, which isn't allowed for Type=oneshot services. Refusing.", UNIT(s)->id);
--                return -EINVAL;
--        }
--
-         if (s->type == SERVICE_DBUS && !s->bus_name) {
-                 log_error_unit(UNIT(s)->id, "%s is of type D-Bus but no D-Bus service name has been specified. Refusing.", UNIT(s)->id);
-                 return -EINVAL;
-diff --git a/src/core/socket.c b/src/core/socket.c
-index 7c18a2b..1a560a6 100644
---- a/src/core/socket.c
-+++ b/src/core/socket.c
-@@ -663,16 +663,25 @@ static int instance_from_socket(int fd, unsigned nr, char **instance) {
-                 int k;
- 
-                 k = getpeercred(fd, &ucred);
--                if (k < 0)
-+                if (k == -ENODATA) {
-+                        /* This handles the case where somebody is
-+                         * connecting from another pid/uid namespace
-+                         * (e.g. from outside of our container). */
-+                        if (asprintf(&r,
-+                                     "%u-unknown",
-+                                     nr) < 0)
-+                                return -ENOMEM;
-+                }
-+                else if (k < 0)
-                         return k;
--
--                if (asprintf(&r,
--                             "%u-%lu-%lu",
--                             nr,
--                             (unsigned long) ucred.pid,
--                             (unsigned long) ucred.uid) < 0)
--                        return -ENOMEM;
+-        arg_verb = argv[optind];
 -
-+                else {
-+                        if (asprintf(&r,
-+                                     "%u-%lu-%lu",
-+                                     nr,
-+                                     (unsigned long) ucred.pid,
-+                                     (unsigned long) ucred.uid) < 0)
-+                                return -ENOMEM;
-+                }
-                 break;
-         }
+-        if (optind + 1 < argc)
+-                log_error("Excess arguments, ignoring");
+         return 0;
+ }
  
-@@ -1242,6 +1251,8 @@ static int socket_spawn(Socket *s, ExecCommand *c, pid_t *_pid) {
-                        NULL,
-                        s->exec_runtime,
-                        &pid);
-+        if (r < 0)
-+                goto fail;
+diff --git a/src/core/snapshot.c b/src/core/snapshot.c
+index 5eed615..c2678cb 100644
+--- a/src/core/snapshot.c
++++ b/src/core/snapshot.c
+@@ -208,7 +208,7 @@ int snapshot_create(Manager *m, const char *name, bool cleanup, sd_bus_error *e,
+                         return sd_bus_error_setf(e, SD_BUS_ERROR_INVALID_ARGS, "Unit name %s lacks snapshot suffix.", name);
  
-         strv_free(argv);
-         if (r < 0)
-@@ -1497,6 +1508,12 @@ static void socket_enter_running(Socket *s, int cfd) {
-                         }
+                 if (manager_get_unit(m, name))
+-                        sd_bus_error_setf(e, BUS_ERROR_UNIT_EXISTS, "Snapshot %s exists already.", name);
++                        return sd_bus_error_setf(e, BUS_ERROR_UNIT_EXISTS, "Snapshot %s exists already.", name);
  
-                 if (!pending) {
-+                        if (!UNIT_ISSET(s->service)) {
-+                                log_error_unit(UNIT(s)->id, "%s: service to activate vanished, refusing activation.", UNIT(s)->id);
-+                                r = -ENOENT;
-+                                goto fail;
-+                        }
-+
-                         r = manager_add_job(UNIT(s)->manager, JOB_START, UNIT_DEREF(s->service), JOB_REPLACE, true, &error, NULL);
-                         if (r < 0)
-                                 goto fail;
+         } else {
+ 
+diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
+index d5b86bf..9c66e7b 100644
+--- a/src/core/systemd.pc.in
++++ b/src/core/systemd.pc.in
+@@ -14,8 +14,8 @@ systemduserunitdir=@userunitdir@
+ systemduserpresetdir=@userpresetdir@
+ systemdsystemconfdir=@pkgsysconfdir@/system
+ systemduserconfdir=@pkgsysconfdir@/user
+-systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:${systemdsystemunitdir}:/usr/lib/systemd/system:/lib/systemd/system
+-systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemduserunitdir}:/usr/lib/systemd/user:/usr/share/systemd/user
++systemdsystemunitpath=${systemdsystemconfdir}:/etc/systemd/system:/etc/systemd-mutable/system:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/system:${systemdsystemunitdir}
++systemduserunitpath=${systemduserconfdir}:/etc/systemd/user:/etc/systemd-mutable/user:/nix/var/nix/profiles/default/lib/systemd/system:/run/systemd/user:${systemduserunitdir}
+ systemdsystemgeneratordir=@systemgeneratordir@
+ systemdusergeneratordir=@usergeneratordir@
+ systemdsleepdir=@systemsleepdir@
 diff --git a/src/core/timer.c b/src/core/timer.c
-index 6c85304..720b8af 100644
+index a3713e2..5c4e9f9 100644
 --- a/src/core/timer.c
 +++ b/src/core/timer.c
-@@ -111,6 +111,23 @@ static int timer_add_default_dependencies(Timer *t) {
-         return unit_add_two_dependencies_by_name(UNIT(t), UNIT_BEFORE, UNIT_CONFLICTS, SPECIAL_SHUTDOWN_TARGET, NULL, true);
- }
+@@ -521,6 +521,7 @@ fail:
  
-+static void update_stampfile(Timer *t, usec_t timestamp) {
-+        _cleanup_close_ int fd = -1;
-+
-+        mkdir_parents_label(t->stamp_path, 0755);
-+
-+        /* Update the file atime + mtime, if we can */
-+        fd = open(t->stamp_path, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644);
-+        if (fd >= 0) {
-+                struct timespec ts[2];
-+
-+                timespec_store(&ts[0], timestamp);
-+                ts[1] = ts[0];
-+
-+                futimens(fd, ts);
-+        }
-+}
-+
- static int timer_setup_persistent(Timer *t) {
-         int r;
+ static int timer_start(Unit *u) {
+         Timer *t = TIMER(u);
++        TimerValue *v;
  
-@@ -131,7 +148,7 @@ static int timer_setup_persistent(Timer *t) {
+         assert(t);
+         assert(t->state == TIMER_DEAD || t->state == TIMER_FAILED);
+@@ -530,6 +531,11 @@ static int timer_start(Unit *u) {
  
-                 e = getenv("XDG_DATA_HOME");
-                 if (e)
--                        t->stamp_path = strjoin(e, "/systemd/timers/", UNIT(t)->id, NULL);
-+                        t->stamp_path = strjoin(e, "/systemd/timers/stamp-", UNIT(t)->id, NULL);
-                 else {
+         t->last_trigger = DUAL_TIMESTAMP_NULL;
  
-                         _cleanup_free_ char *h = NULL;
-@@ -496,22 +513,8 @@ static void timer_enter_running(Timer *t) {
- 
-         dual_timestamp_get(&t->last_trigger);
- 
--        if (t->stamp_path) {
--                _cleanup_close_ int fd = -1;
--
--                mkdir_parents_label(t->stamp_path, 0755);
--
--                /* Update the file atime + mtime, if we can */
--                fd = open(t->stamp_path, O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 0644);
--                if (fd >= 0) {
--                        struct timespec ts[2];
--
--                        timespec_store(&ts[0], t->last_trigger.realtime);
--                        ts[1] = ts[0];
--
--                        futimens(fd, ts);
--                }
--        }
-+        if (t->stamp_path)
-+                update_stampfile(t, t->last_trigger.realtime);
- 
-         timer_set_state(t, TIMER_RUNNING);
-         return;
-@@ -539,6 +542,11 @@ static int timer_start(Unit *u) {
- 
-                 if (stat(t->stamp_path, &st) >= 0)
-                         t->last_trigger.realtime = timespec_load(&st.st_atim);
-+                else if (errno == ENOENT)
-+                        /* The timer has never run before,
-+                         * make sure a stamp file exists.
-+                         */
-+                        update_stampfile(t, now(CLOCK_REALTIME));
-         }
++        /* Reenable all timers that depend on unit activation time */
++        LIST_FOREACH(value, v, t->values)
++                if (v->base == TIMER_ACTIVE)
++                        v->disabled = false;
++
+         if (t->stamp_path) {
+                 struct stat st;
  
-         t->result = TIMER_SUCCESS;
-diff --git a/src/core/transaction.c b/src/core/transaction.c
-index d00f427..2befc32 100644
---- a/src/core/transaction.c
-+++ b/src/core/transaction.c
-@@ -378,7 +378,7 @@ static int transaction_verify_order_one(Transaction *tr, Job *j, Job *from, unsi
-                                       "Found dependency on %s/%s",
-                                       k->unit->id, job_type_to_string(k->type));
- 
--                        if (!delete &&
-+                        if (!delete && hashmap_get(tr->jobs, k->unit) &&
-                             !unit_matters_to_anchor(k->unit, k)) {
-                                 /* Ok, we can drop this one, so let's
-                                  * do so. */
 diff --git a/src/core/umount.c b/src/core/umount.c
-index d1258f0..0311812 100644
+index cffa453..4d1a9ff 100644
 --- a/src/core/umount.c
 +++ b/src/core/umount.c
-@@ -404,6 +404,8 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
+@@ -385,6 +385,8 @@ static int mount_points_list_umount(MountPoint **head, bool *changed, bool log_e
                   * anyway, since we are running from it. They have
                   * already been remounted ro. */
                  if (path_equal(m->path, "/")
@@ -665,926 +206,405 @@ index d1258f0..0311812 100644
  #ifndef HAVE_SPLIT_USR
                      || path_equal(m->path, "/usr")
  #endif
-diff --git a/src/core/unit.c b/src/core/unit.c
-index 153b79b..ed52694 100644
---- a/src/core/unit.c
-+++ b/src/core/unit.c
-@@ -2287,25 +2287,25 @@ bool unit_can_serialize(Unit *u) {
- }
- 
- int unit_serialize(Unit *u, FILE *f, FDSet *fds, bool serialize_jobs) {
--        ExecRuntime *rt;
-         int r;
- 
-         assert(u);
-         assert(f);
-         assert(fds);
- 
--        if (!unit_can_serialize(u))
--                return 0;
--
--        r = UNIT_VTABLE(u)->serialize(u, f, fds);
--        if (r < 0)
--                return r;
-+        if (unit_can_serialize(u)) {
-+                ExecRuntime *rt;
- 
--        rt = unit_get_exec_runtime(u);
--        if (rt) {
--                r = exec_runtime_serialize(rt, u, f, fds);
-+                r = UNIT_VTABLE(u)->serialize(u, f, fds);
-                 if (r < 0)
-                         return r;
-+
-+                rt = unit_get_exec_runtime(u);
-+                if (rt) {
-+                        r = exec_runtime_serialize(rt, u, f, fds);
-+                        if (r < 0)
-+                                return r;
-+                }
-         }
- 
-         dual_timestamp_serialize(f, "inactive-exit-timestamp", &u->inactive_exit_timestamp);
-@@ -2367,17 +2367,14 @@ void unit_serialize_item(Unit *u, FILE *f, const char *key, const char *value) {
- }
- 
- int unit_deserialize(Unit *u, FILE *f, FDSet *fds) {
--        size_t offset;
-         ExecRuntime **rt = NULL;
-+        size_t offset;
-         int r;
- 
-         assert(u);
-         assert(f);
-         assert(fds);
- 
--        if (!unit_can_serialize(u))
--                return 0;
--
-         offset = UNIT_VTABLE(u)->exec_runtime_offset;
-         if (offset > 0)
-                 rt = (ExecRuntime**) ((uint8_t*) u + offset);
-@@ -2487,24 +2484,34 @@ int unit_deserialize(Unit *u, FILE *f, FDSet *fds) {
-                         if (!s)
-                                 return -ENOMEM;
- 
--                        free(u->cgroup_path);
--                        u->cgroup_path = s;
-+                        if (u->cgroup_path) {
-+                                void *p;
- 
-+                                p = hashmap_remove(u->manager->cgroup_unit, u->cgroup_path);
-+                                log_info("Removing cgroup_path %s from hashmap (%p)",
-+                                         u->cgroup_path, p);
-+                                free(u->cgroup_path);
-+                        }
-+
-+                        u->cgroup_path = s;
-                         assert(hashmap_put(u->manager->cgroup_unit, s, u) == 1);
-+
-                         continue;
-                 }
- 
--                if (rt) {
--                        r = exec_runtime_deserialize_item(rt, u, l, v, fds);
-+                if (unit_can_serialize(u)) {
-+                        if (rt) {
-+                                r = exec_runtime_deserialize_item(rt, u, l, v, fds);
-+                                if (r < 0)
-+                                        return r;
-+                                if (r > 0)
-+                                        continue;
-+                        }
-+
-+                        r = UNIT_VTABLE(u)->deserialize_item(u, l, v, fds);
-                         if (r < 0)
-                                 return r;
--                        if (r > 0)
--                                continue;
-                 }
--
--                r = UNIT_VTABLE(u)->deserialize_item(u, l, v, fds);
--                if (r < 0)
--                        return r;
-         }
- }
- 
-diff --git a/src/cryptsetup/cryptsetup-generator.c b/src/cryptsetup/cryptsetup-generator.c
-index 75d56dd..be8fb2f 100644
---- a/src/cryptsetup/cryptsetup-generator.c
-+++ b/src/cryptsetup/cryptsetup-generator.c
-@@ -29,6 +29,7 @@
- #include "mkdir.h"
- #include "strv.h"
- #include "fileio.h"
-+#include "path-util.h"
- 
- static const char *arg_dest = "/tmp";
- static bool arg_enabled = true;
-@@ -144,16 +145,19 @@ static int create_disk(
-                         if (!uu)
-                                 return log_oom();
- 
--                        if (is_device_path(uu)) {
--                                _cleanup_free_ char *dd;
-+                        if (!path_equal(uu, "/dev/null")) {
- 
--                                dd = unit_name_from_path(uu, ".device");
--                                if (!dd)
--                                        return log_oom();
-+                                if (is_device_path(uu)) {
-+                                        _cleanup_free_ char *dd;
- 
--                                fprintf(f, "After=%1$s\nRequires=%1$s\n", dd);
--                        } else
--                                fprintf(f, "RequiresMountsFor=%s\n", password);
-+                                        dd = unit_name_from_path(uu, ".device");
-+                                        if (!dd)
-+                                                return log_oom();
-+
-+                                        fprintf(f, "After=%1$s\nRequires=%1$s\n", dd);
-+                                } else
-+                                        fprintf(f, "RequiresMountsFor=%s\n", password);
-+                        }
-                 }
-         }
- 
-@@ -287,7 +291,7 @@ static int parse_proc_cmdline_item(const char *key, const char *value) {
-         } else if (STR_IN_SET(key, "luks.key", "rd.luks.key") && value) {
- 
-                 free(arg_keyfile);
--                arg_keyfile = strdup(key);
-+                arg_keyfile = strdup(value);
-                 if (!arg_keyfile)
-                         return log_oom();
- 
-diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
-index 9b9074c..ad6c76c 100644
---- a/src/cryptsetup/cryptsetup.c
-+++ b/src/cryptsetup/cryptsetup.c
-@@ -88,6 +88,13 @@ static int parse_one_option(const char *option) {
-                         return 0;
-                 }
+diff --git a/src/delta/delta.c b/src/delta/delta.c
+index 25c4a0b..e1f2d6d 100644
+--- a/src/delta/delta.c
++++ b/src/delta/delta.c
+@@ -487,7 +487,7 @@ static int parse_flags(const char *flag_str, int flags) {
+         const char *word, *state;
+         size_t l;
  
-+                if (arg_key_size % 8) {
-+                        log_error("size= not a multiple of 8, ignoring.");
-+                        return 0;
-+                }
-+
-+                arg_key_size /= 8;
-+
-         } else if (startswith(option, "key-slot=")) {
- 
-                 arg_type = CRYPT_LUKS1;
-@@ -404,7 +411,7 @@ static int attach_luks_or_plain(struct crypt_device *cd,
-                 /* for CRYPT_PLAIN limit reads
-                  * from keyfile to key length, and
-                  * ignore keyfile-size */
--                arg_keyfile_size = arg_key_size / 8;
-+                arg_keyfile_size = arg_key_size;
- 
-                 /* In contrast to what the name
-                  * crypt_setup() might suggest this
-@@ -567,7 +574,7 @@ int main(int argc, char *argv[]) {
-                 else
-                         until = 0;
- 
--                arg_key_size = (arg_key_size > 0 ? arg_key_size : 256);
-+                arg_key_size = (arg_key_size > 0 ? arg_key_size : (256 / 8));
- 
-                 if (key_file) {
-                         struct stat st;
+-        FOREACH_WORD(word, l, flag_str, state) {
++        FOREACH_WORD_SEPARATOR(word, l, flag_str, ",", state) {
+                 if (strneq("masked", word, l))
+                         flags |= SHOW_MASKED;
+                 else if (strneq ("equivalent", word, l))
 diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 18f2aca..2a2b1ea 100644
+index 70a5918..1926e52 100644
 --- a/src/fsck/fsck.c
 +++ b/src/fsck/fsck.c
-@@ -285,7 +285,7 @@ int main(int argc, char *argv[]) {
- 
-         type = udev_device_get_property_value(udev_device, "ID_FS_TYPE");
-         if (type) {
--                const char *checker = strappenda("/sbin/fsck.", type);
-+                const char *checker = strappenda("/run/current-system/sw/sbin/fsck.", type);
-                 r = access(checker, X_OK);
-                 if (r < 0) {
-                         if (errno == ENOENT) {
-@@ -302,7 +302,7 @@ int main(int argc, char *argv[]) {
+@@ -315,8 +315,7 @@ int main(int argc, char *argv[]) {
                          return EXIT_FAILURE;
                  }
  
 -        cmdline[i++] = "/sbin/fsck";
-+        cmdline[i++] = "/run/current-system/sw/sbin/fsck";
-         cmdline[i++] = "-a";
+-        cmdline[i++] =  arg_repair;
++        cmdline[i++] = "/run/current-system/sw/bin/fsck";
          cmdline[i++] = "-T";
-         cmdline[i++] = "-l";
-diff --git a/src/getty-generator/getty-generator.c b/src/getty-generator/getty-generator.c
-index 6a4aa2c..700e90a 100644
---- a/src/getty-generator/getty-generator.c
-+++ b/src/getty-generator/getty-generator.c
-@@ -72,7 +72,7 @@ static int add_serial_getty(const char *tty) {
- 
-         log_debug("Automatically adding serial getty for /dev/%s.", tty);
- 
--        n = unit_name_replace_instance("serial-getty@.service", tty);
-+        n = unit_name_from_path_instance("serial-getty", tty, ".service");
-         if (!n)
-                 return log_oom();
- 
-@@ -86,7 +86,7 @@ static int add_container_getty(const char *tty) {
- 
-         log_debug("Automatically adding container getty for /dev/pts/%s.", tty);
- 
--        n = unit_name_replace_instance("container-getty@.service", tty);
-+        n = unit_name_from_path_instance("container-getty", tty, ".service");
-         if (!n)
-                 return log_oom();
- 
-diff --git a/src/journal/catalog.c b/src/journal/catalog.c
-index 3ed0b7e..02dedc4 100644
---- a/src/journal/catalog.c
-+++ b/src/journal/catalog.c
-@@ -103,7 +103,7 @@ static int finish_item(
-                 const char *payload) {
- 
-         ssize_t offset;
--        CatalogItem *i;
-+        _cleanup_free_ CatalogItem *i = NULL;
-         int r;
  
-         assert(h);
-@@ -126,13 +126,14 @@ static int finish_item(
-         i->offset = htole64((uint64_t) offset);
+         /*
+diff --git a/src/fstab-generator/fstab-generator.c b/src/fstab-generator/fstab-generator.c
+index e257c12..1e04553 100644
+--- a/src/fstab-generator/fstab-generator.c
++++ b/src/fstab-generator/fstab-generator.c
+@@ -485,7 +485,7 @@ static int add_usr_mount(void) {
+                         return log_oom();
+         }
  
-         r = hashmap_put(h, i, i);
--        if (r == EEXIST) {
-+        if (r == -EEXIST) {
-                 log_warning("Duplicate entry for " SD_ID128_FORMAT_STR ".%s, ignoring.",
-                             SD_ID128_FORMAT_VAL(id), language ? language : "C");
--                free(i);
+-        if (!arg_usr_what || !arg_usr_options)
++        if (!arg_usr_what)
                  return 0;
--        }
-+        } else if (r < 0)
-+                return r;
- 
-+        i = NULL;
-         return 0;
- }
  
-@@ -383,8 +384,8 @@ error:
- int catalog_update(const char* database, const char* root, const char* const* dirs) {
-         _cleanup_strv_free_ char **files = NULL;
-         char **f;
--        Hashmap *h;
-         struct strbuf *sb = NULL;
-+        _cleanup_hashmap_free_free_ Hashmap *h = NULL;
-         _cleanup_free_ CatalogItem *items = NULL;
-         CatalogItem *i;
-         Iterator j;
-@@ -406,13 +407,17 @@ int catalog_update(const char* database, const char* root, const char* const* di
+         what = fstab_node_to_udev_node(arg_usr_what);
+@@ -494,7 +494,13 @@ static int add_usr_mount(void) {
+                 return -1;
          }
  
-         STRV_FOREACH(f, files) {
--                log_debug("reading file '%s'", *f);
--                catalog_import_file(h, sb, *f);
-+                log_debug("Reading file '%s'", *f);
-+                r = catalog_import_file(h, sb, *f);
-+                if (r < 0) {
-+                        log_error("Failed to import file '%s': %s.",
-+                                  *f, strerror(-r));
-+                        goto finish;
-+                }
-         }
+-        opts = arg_usr_options;
++        if (!arg_usr_options)
++                opts = arg_root_rw > 0 ? "rw" : "ro";
++        else if (!mount_test_option(arg_usr_options, "ro") &&
++                 !mount_test_option(arg_usr_options, "rw"))
++                opts = strappenda(arg_usr_options, ",", arg_root_rw > 0 ? "rw" : "ro");
++        else
++                opts = arg_usr_options;
+ 
+         log_debug("Found entry what=%s where=/sysroot/usr type=%s", what, strna(arg_usr_fstype));
+         return add_mount(what,
+diff --git a/src/hostname/hostnamectl.c b/src/hostname/hostnamectl.c
+index e487369..ff4e9c9 100644
+--- a/src/hostname/hostnamectl.c
++++ b/src/hostname/hostnamectl.c
+@@ -536,5 +536,5 @@ int main(int argc, char *argv[]) {
+         r = hostnamectl_main(bus, argc, argv);
  
-         if (hashmap_size(h) <= 0) {
-                 log_info("No items in catalog.");
--                r = 0;
-                 goto finish;
-         } else
-                 log_debug("Found %u items in catalog.", hashmap_size(h));
-@@ -443,11 +448,7 @@ int catalog_update(const char* database, const char* root, const char* const* di
-                 log_debug("%s: wrote %u items, with %zu bytes of strings, %ld total size.",
-                           database, n, sb->len, r);
- 
--        r = 0;
--
  finish:
--        if (h)
--                hashmap_free_free(h);
-         if (sb)
-                 strbuf_cleanup(sb);
- 
+-        return r < 0 ? EXIT_FAILURE : r;
++        return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
+ }
 diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
-index f2f1f35..fd9d2a8 100644
+index 8a2c0fc..9de3ddd 100644
 --- a/src/journal/journal-file.c
 +++ b/src/journal/journal-file.c
-@@ -274,12 +274,6 @@ static int journal_file_verify_header(JournalFile *f) {
-             !VALID64(le64toh(f->header->entry_array_offset)))
-                 return -ENODATA;
- 
--        if (le64toh(f->header->data_hash_table_offset) < le64toh(f->header->header_size) ||
--            le64toh(f->header->field_hash_table_offset) < le64toh(f->header->header_size) ||
--            le64toh(f->header->tail_object_offset) < le64toh(f->header->header_size) ||
--            le64toh(f->header->entry_array_offset) < le64toh(f->header->header_size))
--                return -ENODATA;
--
-         if (f->writable) {
-                 uint8_t state;
-                 sd_id128_t machine_id;
-diff --git a/src/journal/journal-remote-parse.c b/src/journal/journal-remote-parse.c
-index 142de0e..239ff38 100644
---- a/src/journal/journal-remote-parse.c
-+++ b/src/journal/journal-remote-parse.c
-@@ -40,7 +40,7 @@ void source_free(RemoteSource *source) {
- 
- static int get_line(RemoteSource *source, char **line, size_t *size) {
-         ssize_t n, remain;
--        char *c;
-+        char *c = NULL;
-         char *newbuf = NULL;
-         size_t newsize = 0;
- 
-@@ -49,7 +49,9 @@ static int get_line(RemoteSource *source, char **line, size_t *size) {
-         assert(source->filled <= source->size);
-         assert(source->buf == NULL || source->size > 0);
- 
--        c = memchr(source->buf, '\n', source->filled);
-+        if (source->buf)
-+                c = memchr(source->buf, '\n', source->filled);
-+
-         if (c != NULL)
-                 goto docopy;
- 
-diff --git a/src/journal/journald-kmsg.c b/src/journal/journald-kmsg.c
-index 35948ea..48725e4 100644
---- a/src/journal/journald-kmsg.c
-+++ b/src/journal/journald-kmsg.c
-@@ -152,7 +152,7 @@ static void dev_kmsg_record(Server *s, char *p, size_t l) {
-                 /* Did we lose any? */
-                 if (serial > *s->kernel_seqnum)
-                         server_driver_message(s, SD_MESSAGE_JOURNAL_MISSED, "Missed %"PRIu64" kernel messages",
--                                              serial - *s->kernel_seqnum - 1);
-+                                              serial - *s->kernel_seqnum);
- 
-                 /* Make sure we never read this one again. Note that
-                  * we always store the next message serial we expect
+@@ -1657,7 +1657,7 @@ static int generic_array_bisect(
+                         }
+                 }
+ 
+-                if (k > n) {
++                if (k >= n) {
+                         if (direction == DIRECTION_UP) {
+                                 i = n;
+                                 subtract_one = true;
+diff --git a/src/journal/journalctl.c b/src/journal/journalctl.c
+index f50faf4..03579fd 100644
+--- a/src/journal/journalctl.c
++++ b/src/journal/journalctl.c
+@@ -682,7 +682,7 @@ static int parse_argv(int argc, char *argv[]) {
+                         assert_not_reached("Unhandled option");
+                 }
+ 
+-        if (arg_follow && !arg_no_tail && arg_lines == ARG_LINES_DEFAULT)
++        if (arg_follow && !arg_no_tail && !arg_since && arg_lines == ARG_LINES_DEFAULT)
+                 arg_lines = 10;
+ 
+         if (!!arg_directory + !!arg_file + !!arg_machine > 1) {
 diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c
-index 6da81e7..b6f8e7e 100644
+index 12735c4..08b143b 100644
 --- a/src/journal/journald-server.c
 +++ b/src/journal/journald-server.c
-@@ -67,6 +67,7 @@
- #define DEFAULT_SYNC_INTERVAL_USEC (5*USEC_PER_MINUTE)
- #define DEFAULT_RATE_LIMIT_INTERVAL (30*USEC_PER_SEC)
- #define DEFAULT_RATE_LIMIT_BURST 1000
-+#define DEFAULT_MAX_FILE_USEC USEC_PER_MONTH
- 
- #define RECHECK_AVAILABLE_SPACE_USEC (30*USEC_PER_SEC)
- 
-@@ -1473,6 +1474,8 @@ int server_init(Server *s) {
-         s->forward_to_syslog = true;
-         s->forward_to_wall = true;
+@@ -1655,6 +1655,7 @@ void server_done(Server *s) {
+         free(s->buffer);
+         free(s->tty_path);
+         free(s->cgroup_root);
++        free(s->hostname_field);
+ 
+         if (s->mmap)
+                 mmap_cache_unref(s->mmap);
+diff --git a/src/libsystemd-network/network-internal.c b/src/libsystemd-network/network-internal.c
+index 372f3ed..d56ee51 100644
+--- a/src/libsystemd-network/network-internal.c
++++ b/src/libsystemd-network/network-internal.c
+@@ -392,10 +392,12 @@ void serialize_dhcp_routes(FILE *f, const char *key, struct sd_dhcp_route *route
+ 
+         fprintf(f, "%s=", key);
+ 
+-        for (i = 0; i < size; i++)
+-                fprintf(f, "%s/%" PRIu8 ",%s%s", inet_ntoa(routes[i].dst_addr),
+-                        routes[i].dst_prefixlen, inet_ntoa(routes[i].gw_addr),
++        for (i = 0; i < size; i++) {
++                fprintf(f, "%s/%" PRIu8, inet_ntoa(routes[i].dst_addr),
++                        routes[i].dst_prefixlen);
++                fprintf(f, ",%s%s", inet_ntoa(routes[i].gw_addr),
+                         (i < (size - 1)) ? " ": "");
++        }
  
-+        s->max_file_usec = DEFAULT_MAX_FILE_USEC;
-+
-         s->max_level_store = LOG_DEBUG;
-         s->max_level_syslog = LOG_DEBUG;
-         s->max_level_kmsg = LOG_NOTICE;
-diff --git a/src/journal/microhttpd-util.c b/src/journal/microhttpd-util.c
-index f693e0f..9a8d5c6 100644
---- a/src/journal/microhttpd-util.c
-+++ b/src/journal/microhttpd-util.c
-@@ -129,7 +129,7 @@ void log_func_gnutls(int level, const char *message) {
-         if (0 <= level && level < (int) ELEMENTSOF(log_level_map))
-                 ourlevel = log_level_map[level];
-         else
--                level = LOG_DEBUG;
-+                ourlevel = LOG_DEBUG;
- 
-         log_meta(ourlevel, NULL, 0, NULL, "gnutls: %s", message);
+         fputs("\n", f);
  }
-diff --git a/src/journal/test-catalog.c b/src/journal/test-catalog.c
-index b087a8b..967ab67 100644
---- a/src/journal/test-catalog.c
-+++ b/src/journal/test-catalog.c
-@@ -157,7 +157,8 @@ int main(int argc, char *argv[]) {
- 
-         setlocale(LC_ALL, "de_DE.UTF-8");
+diff --git a/src/libsystemd-network/sd-dhcp-client.c b/src/libsystemd-network/sd-dhcp-client.c
+index 0eba4c3..9986b52 100644
+--- a/src/libsystemd-network/sd-dhcp-client.c
++++ b/src/libsystemd-network/sd-dhcp-client.c
+@@ -68,7 +68,6 @@ struct sd_dhcp_client {
+         uint32_t mtu;
+         uint32_t xid;
+         usec_t start_time;
+-        uint16_t secs;
+         unsigned int attempt;
+         usec_t request_sent;
+         sd_event_source *timeout_t1;
+@@ -321,10 +320,12 @@ static int client_message_init(sd_dhcp_client *client, DHCPPacket **ret,
+         _cleanup_free_ DHCPPacket *packet;
+         size_t optlen, optoffset, size;
+         be16_t max_size;
++        usec_t time_now;
++        uint16_t secs;
+         int r;
  
--        log_set_max_level(LOG_DEBUG);
-+        log_parse_environment();
-+        log_open();
+         assert(client);
+-        assert(client->secs);
++        assert(client->start_time);
+         assert(ret);
+         assert(_optlen);
+         assert(_optoffset);
+@@ -344,7 +345,15 @@ static int client_message_init(sd_dhcp_client *client, DHCPPacket **ret,
+ 
+         /* Although 'secs' field is a SHOULD in RFC 2131, certain DHCP servers
+            refuse to issue an DHCP lease if 'secs' is set to zero */
+-        packet->dhcp.secs = htobe16(client->secs);
++        r = sd_event_now(client->event, clock_boottime_or_monotonic(), &time_now);
++        if (r < 0)
++                return r;
++        assert(time_now >= client->start_time);
++
++        /* seconds between sending first and last DISCOVER
++         * must always be strictly positive to deal with broken servers */
++        secs = ((time_now - client->start_time) / USEC_PER_SEC) ? : 1;
++        packet->dhcp.secs = htobe16(secs);
+ 
+         /* RFC2132 section 4.1
+            A client that cannot receive unicast IP datagrams until its protocol
+@@ -441,24 +450,12 @@ static int dhcp_client_send_raw(sd_dhcp_client *client, DHCPPacket *packet,
+ static int client_send_discover(sd_dhcp_client *client) {
+         _cleanup_free_ DHCPPacket *discover = NULL;
+         size_t optoffset, optlen;
+-        usec_t time_now;
+         int r;
  
-         test_catalog_file_lang();
+         assert(client);
+         assert(client->state == DHCP_STATE_INIT ||
+                client->state == DHCP_STATE_SELECTING);
  
-diff --git a/src/libsystemd/sd-rtnl/rtnl-message.c b/src/libsystemd/sd-rtnl/rtnl-message.c
-index 84a8ffa..e79b318 100644
---- a/src/libsystemd/sd-rtnl/rtnl-message.c
-+++ b/src/libsystemd/sd-rtnl/rtnl-message.c
-@@ -335,24 +335,28 @@ int sd_rtnl_message_link_get_flags(sd_rtnl_message *m, unsigned *flags) {
- /* If successful the updated message will be correctly aligned, if
-    unsuccessful the old message is untouched. */
- static int add_rtattr(sd_rtnl_message *m, unsigned short type, const void *data, size_t data_length) {
--        uint32_t rta_length, message_length;
-+        uint32_t rta_length;
-+        size_t message_length, padding_length;
-         struct nlmsghdr *new_hdr;
-         struct rtattr *rta;
-         char *padding;
-         unsigned i;
-+        int offset;
- 
-         assert(m);
-         assert(m->hdr);
-         assert(!m->sealed);
-         assert(NLMSG_ALIGN(m->hdr->nlmsg_len) == m->hdr->nlmsg_len);
--        assert(!data || data_length > 0);
--        assert(data || m->n_containers < RTNL_CONTAINER_DEPTH);
-+        assert(!data || data_length);
-+
-+        /* get offset of the new attribute */
-+        offset = m->hdr->nlmsg_len;
- 
-         /* get the size of the new rta attribute (with padding at the end) */
-         rta_length = RTA_LENGTH(data_length);
- 
-         /* get the new message size (with padding at the end) */
--        message_length = m->hdr->nlmsg_len + RTA_ALIGN(rta_length);
-+        message_length = offset + RTA_ALIGN(rta_length);
- 
-         /* realloc to fit the new attribute */
-         new_hdr = realloc(m->hdr, message_length);
-@@ -361,32 +365,35 @@ static int add_rtattr(sd_rtnl_message *m, unsigned short type, const void *data,
-         m->hdr = new_hdr;
- 
-         /* get pointer to the attribute we are about to add */
--        rta = (struct rtattr *) ((uint8_t *) m->hdr + m->hdr->nlmsg_len);
-+        rta = (struct rtattr *) ((uint8_t *) m->hdr + offset);
- 
-         /* if we are inside containers, extend them */
-         for (i = 0; i < m->n_containers; i++)
--                GET_CONTAINER(m, i)->rta_len += message_length - m->hdr->nlmsg_len;
-+                GET_CONTAINER(m, i)->rta_len += message_length - offset;
- 
-         /* fill in the attribute */
-         rta->rta_type = type;
-         rta->rta_len = rta_length;
--        if (!data) {
--                /* this is the start of a new container */
--                m->container_offsets[m->n_containers ++] = m->hdr->nlmsg_len;
--        } else {
-+        if (data)
-                 /* we don't deal with the case where the user lies about the type
-                  * and gives us too little data (so don't do that)
--                */
-+                 */
-                 padding = mempcpy(RTA_DATA(rta), data, data_length);
--                /* make sure also the padding at the end of the message is initialized */
--                memzero(padding,
--                        (uint8_t *) m->hdr + message_length - (uint8_t *) padding);
-+        else {
-+                /* if no data was passed, make sure we still initialize the padding
-+                   note that we can have data_length > 0 (used by some containers) */
-+                padding = RTA_DATA(rta);
-+                data_length = 0;
+-        /* See RFC2131 section 4.4.1 */
+-
+-        r = sd_event_now(client->event, clock_boottime_or_monotonic(), &time_now);
+-        if (r < 0)
+-                return r;
+-        assert(time_now >= client->start_time);
+-
+-        /* seconds between sending first and last DISCOVER
+-         * must always be strictly positive to deal with broken servers */
+-        client->secs = ((time_now - client->start_time) / USEC_PER_SEC) ? : 1;
+-
+         r = client_message_init(client, &discover, DHCP_DISCOVER,
+                                 &optlen, &optoffset);
+         if (r < 0)
+@@ -875,10 +872,8 @@ static int client_start(sd_dhcp_client *client) {
          }
+         client->fd = r;
  
-+        /* make sure also the padding at the end of the message is initialized */
-+        padding_length = (uint8_t*)m->hdr + message_length - (uint8_t*)padding;
-+        memzero(padding, padding_length);
-+
-         /* update message size */
-         m->hdr->nlmsg_len = message_length;
+-        if (client->state == DHCP_STATE_INIT) {
++        if (client->state == DHCP_STATE_INIT || client->state == DHCP_STATE_INIT_REBOOT)
+                 client->start_time = now(clock_boottime_or_monotonic());
+-                client->secs = 0;
+-        }
  
--        return 0;
-+        return offset;
+         return client_initialize_events(client, client_receive_message_raw);
  }
+@@ -1269,6 +1264,9 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message,
+                 if (r >= 0) {
+                         client->timeout_resend =
+                                 sd_event_source_unref(client->timeout_resend);
++                        client->receive_message =
++                                sd_event_source_unref(client->receive_message);
++                        client->fd = asynchronous_close(client->fd);
+ 
+                         if (IN_SET(client->state, DHCP_STATE_REQUESTING,
+                                    DHCP_STATE_REBOOTING))
+diff --git a/src/libsystemd-network/sd-dhcp-lease.c b/src/libsystemd-network/sd-dhcp-lease.c
+index 4fb01c0..b7c9a07 100644
+--- a/src/libsystemd-network/sd-dhcp-lease.c
++++ b/src/libsystemd-network/sd-dhcp-lease.c
+@@ -50,7 +50,7 @@ int sd_dhcp_lease_get_address(sd_dhcp_lease *lease, struct in_addr *addr) {
+ 
+ int sd_dhcp_lease_get_lifetime(sd_dhcp_lease *lease, uint32_t *lifetime) {
+         assert_return(lease, -EINVAL);
+-        assert_return(lease, -EINVAL);
++        assert_return(lifetime, -EINVAL);
+ 
+         *lifetime = lease->lifetime;
+ 
+diff --git a/src/libsystemd-network/sd-dhcp6-client.c b/src/libsystemd-network/sd-dhcp6-client.c
+index fa4f9b5..dbec1a2 100644
+--- a/src/libsystemd-network/sd-dhcp6-client.c
++++ b/src/libsystemd-network/sd-dhcp6-client.c
+@@ -200,19 +200,19 @@ int sd_dhcp6_client_set_duid(sd_dhcp6_client *client, uint16_t type, uint8_t *du
+ 
+         switch (type) {
+         case DHCP6_DUID_LLT:
+-                if (duid_len <= sizeof(client->duid.llt))
++                if (duid_len <= sizeof(client->duid.llt) - 2)
+                         return -EINVAL;
+                 break;
+         case DHCP6_DUID_EN:
+-                if (duid_len != sizeof(client->duid.en))
++                if (duid_len != sizeof(client->duid.en) - 2)
+                         return -EINVAL;
+                 break;
+         case DHCP6_DUID_LL:
+-                if (duid_len <= sizeof(client->duid.ll))
++                if (duid_len <= sizeof(client->duid.ll) - 2)
+                         return -EINVAL;
+                 break;
+         case DHCP6_DUID_UUID:
+-                if (duid_len != sizeof(client->duid.uuid))
++                if (duid_len != sizeof(client->duid.uuid) - 2)
+                         return -EINVAL;
+                 break;
+         default:
+@@ -222,7 +222,7 @@ int sd_dhcp6_client_set_duid(sd_dhcp6_client *client, uint16_t type, uint8_t *du
  
- int sd_rtnl_message_append_string(sd_rtnl_message *m, unsigned short type, const char *data) {
-@@ -761,22 +768,29 @@ int sd_rtnl_message_open_container(sd_rtnl_message *m, unsigned short type) {
- 
-         assert_return(m, -EINVAL);
-         assert_return(!m->sealed, -EPERM);
-+        assert_return(m->n_containers < RTNL_CONTAINER_DEPTH, -ERANGE);
- 
-         sd_rtnl_message_get_type(m, &rtm_type);
- 
-+        int r = -ENOTSUP;
-+
-         if (rtnl_message_type_is_link(rtm_type)) {
- 
-                 if ((type == IFLA_LINKINFO && m->n_containers == 0) ||
-                     (type == IFLA_INFO_DATA && m->n_containers == 1 &&
-                      GET_CONTAINER(m, 0)->rta_type == IFLA_LINKINFO))
--                        return add_rtattr(m, type, NULL, 0);
-+                        r = add_rtattr(m, type, NULL, 0);
-                 else if (type == VETH_INFO_PEER && m->n_containers == 2 &&
-                          GET_CONTAINER(m, 1)->rta_type == IFLA_INFO_DATA &&
-                          GET_CONTAINER(m, 0)->rta_type == IFLA_LINKINFO)
--                        return add_rtattr(m, type, NULL, sizeof(struct ifinfomsg));
-+                        r=  add_rtattr(m, type, NULL, sizeof(struct ifinfomsg));
-         }
+         client->duid.raw.type = htobe16(type);
+         memcpy(&client->duid.raw.data, duid, duid_len);
+-        client->duid_len = duid_len;
++        client->duid_len = duid_len + 2;  /* +2 for sizeof(type) */
  
--        return -ENOTSUP;
-+        if (r < 0) return r;
-+
-+        m->container_offsets[m->n_containers ++] = r;
-+
-+        return 0;
+         return 0;
  }
- 
- int sd_rtnl_message_close_container(sd_rtnl_message *m) {
-diff --git a/src/libudev/libudev-monitor.c b/src/libudev/libudev-monitor.c
-index ba1b04d..85b1e40 100644
---- a/src/libudev/libudev-monitor.c
-+++ b/src/libudev/libudev-monitor.c
-@@ -108,15 +108,13 @@ static struct udev_monitor *udev_monitor_new(struct udev *udev)
- 
- /* we consider udev running when /dev is on devtmpfs */
- static bool udev_has_devtmpfs(struct udev *udev) {
--        struct file_handle *h;
-+        union file_handle_union h = { .handle.handle_bytes = MAX_HANDLE_SZ, };
-         int mount_id;
-         _cleanup_fclose_ FILE *f = NULL;
-         char line[LINE_MAX], *e;
-         int r;
- 
--        h = alloca(MAX_HANDLE_SZ);
--        h->handle_bytes = MAX_HANDLE_SZ;
--        r = name_to_handle_at(AT_FDCWD, "/dev", h, &mount_id, 0);
-+        r = name_to_handle_at(AT_FDCWD, "/dev", &h.handle, &mount_id, 0);
-         if (r < 0)
-                 return false;
- 
-diff --git a/src/login/70-uaccess.rules b/src/login/70-uaccess.rules
-index e1cf897..57f619d 100644
---- a/src/login/70-uaccess.rules
-+++ b/src/login/70-uaccess.rules
-@@ -12,7 +12,7 @@ ENV{MAJOR}=="", GOTO="uaccess_end"
- SUBSYSTEM=="usb", ENV{ID_USB_INTERFACES}=="*:060101:*", TAG+="uaccess"
- 
- # Digicams with proprietary protocol
--ENV{ID_GPHOTO2}=="*?", TAG+="uaccess"
-+ENV{ID_GPHOTO2}=="?*", TAG+="uaccess"
- 
- # SCSI and USB scanners
- ENV{libsane_matched}=="yes", TAG+="uaccess"
-@@ -49,13 +49,13 @@ SUBSYSTEM=="drm", KERNEL=="card*|renderD*", TAG+="uaccess"
- SUBSYSTEM=="misc", KERNEL=="kvm", TAG+="uaccess"
- 
- # smart-card readers
--ENV{ID_SMARTCARD_READER}=="*?", TAG+="uaccess"
-+ENV{ID_SMARTCARD_READER}=="?*", TAG+="uaccess"
- 
- # (USB) authentication devices
--ENV{ID_SECURITY_TOKEN}=="*?", TAG+="uaccess"
-+ENV{ID_SECURITY_TOKEN}=="?*", TAG+="uaccess"
- 
- # PDA devices
--ENV{ID_PDA}=="*?", TAG+="uaccess"
-+ENV{ID_PDA}=="?*", TAG+="uaccess"
- 
- # Programmable remote control
- ENV{ID_REMOTE_CONTROL}=="1", TAG+="uaccess"
-@@ -64,10 +64,10 @@ ENV{ID_REMOTE_CONTROL}=="1", TAG+="uaccess"
- SUBSYSTEM=="input", ENV{ID_INPUT_JOYSTICK}=="?*", TAG+="uaccess"
- 
- # color measurement devices
--ENV{COLOR_MEASUREMENT_DEVICE}=="*?", TAG+="uaccess"
-+ENV{COLOR_MEASUREMENT_DEVICE}=="?*", TAG+="uaccess"
- 
- # DDC/CI device, usually high-end monitors such as the DreamColor
--ENV{DDC_DEVICE}=="*?", TAG+="uaccess"
-+ENV{DDC_DEVICE}=="?*", TAG+="uaccess"
- 
- # media player raw devices (for user-mode drivers, Android SDK, etc.)
- SUBSYSTEM=="usb", ENV{ID_MEDIA_PLAYER}=="?*", TAG+="uaccess"
-diff --git a/src/login/logind-acl.c b/src/login/logind-acl.c
-index dc86f0f..4bbeb64 100644
---- a/src/login/logind-acl.c
-+++ b/src/login/logind-acl.c
-@@ -279,7 +279,9 @@ int devnode_acl_all(struct udev *udev,
- 
-                 log_debug("Fixing up ACLs at %s for seat %s", n, seat);
-                 k = devnode_acl(n, flush, del, old_uid, add, new_uid);
--                if (k < 0)
-+                if (k == -ENOENT)
-+                        log_debug("Device %s disappeared while setting ACLs", n);
-+                else if (k < 0)
-                         r = k;
+diff --git a/src/libsystemd/sd-bus/bus-match.c b/src/libsystemd/sd-bus/bus-match.c
+index 18afe0f..5658c61 100644
+--- a/src/libsystemd/sd-bus/bus-match.c
++++ b/src/libsystemd/sd-bus/bus-match.c
+@@ -537,7 +537,7 @@ static int bus_match_find_compare_value(
+         else if (BUS_MATCH_CAN_HASH(t))
+                 n = hashmap_get(c->compare.children, value_str);
+         else {
+-                for (n = c->child; !value_node_same(n, t, value_u8, value_str); n = n->next)
++                for (n = c->child; n && !value_node_same(n, t, value_u8, value_str); n = n->next)
+                         ;
          }
  
-diff --git a/src/login/logind-action.c b/src/login/logind-action.c
-index 1928f43..d69c7ad 100644
---- a/src/login/logind-action.c
-+++ b/src/login/logind-action.c
-@@ -79,14 +79,12 @@ int manager_handle_action(
-                         return 0;
-                 }
- 
--                /* If we have more than one or no displays connected,
--                 * don't react to lid closing. The no display case we
--                 * treat like this under the assumption that there is
--                 * no modern drm driver available. */
-+                /* If we have more than one display connected,
-+                 * don't react to lid closing. */
-                 n = manager_count_displays(m);
-                 if (n < 0)
-                         log_warning("Display counting failed: %s", strerror(-n));
--                else if (n != 1) {
-+                else if (n > 1) {
-                         log_debug("Ignoring lid switch request, %i displays connected.", n);
-                         return 0;
-                 }
-diff --git a/src/login/logind-seat.c b/src/login/logind-seat.c
-index 3f5efdc..1ee6ced 100644
---- a/src/login/logind-seat.c
-+++ b/src/login/logind-seat.c
-@@ -275,8 +275,13 @@ int seat_switch_to(Seat *s, unsigned int num) {
-         if (!num)
-                 return -EINVAL;
+diff --git a/src/libsystemd/sd-bus/bus-objects.c b/src/libsystemd/sd-bus/bus-objects.c
+index 0ab1119..6c3230a 100644
+--- a/src/libsystemd/sd-bus/bus-objects.c
++++ b/src/libsystemd/sd-bus/bus-objects.c
+@@ -617,6 +617,9 @@ static int property_get_set_callbacks_run(
+                         return r;
  
--        if (num >= s->position_count || !s->positions[num])
-+        if (num >= s->position_count || !s->positions[num]) {
-+                /* allow switching to unused VTs to trigger auto-activate */
-+                if (seat_has_vts(s) && num < 64)
-+                        return chvt(num);
+         } else {
++                const char *signature = NULL;
++                char type = 0;
 +
-                 return -EINVAL;
-+        }
+                 if (c->vtable->type != _SD_BUS_VTABLE_WRITABLE_PROPERTY)
+                         return sd_bus_reply_method_errorf(m, SD_BUS_ERROR_PROPERTY_READ_ONLY, "Property '%s' is not writable.", c->member);
  
-         return session_activate(s->positions[num]);
- }
-diff --git a/src/login/logind-session.c b/src/login/logind-session.c
-index 4ca6b5d..02a780d 100644
---- a/src/login/logind-session.c
-+++ b/src/login/logind-session.c
-@@ -213,7 +213,6 @@ int session_save(Session *s) {
- 
-         if (s->scope)
-                 fprintf(f, "SCOPE=%s\n", s->scope);
--
-         if (s->scope_job)
-                 fprintf(f, "SCOPE_JOB=%s\n", s->scope_job);
+@@ -628,6 +631,13 @@ static int property_get_set_callbacks_run(
  
-@@ -229,17 +228,54 @@ int session_save(Session *s) {
-         if (s->display)
-                 fprintf(f, "DISPLAY=%s\n", s->display);
+                 c->last_iteration = bus->iteration_counter;
  
--        if (s->remote_host)
--                fprintf(f, "REMOTE_HOST=%s\n", s->remote_host);
-+        if (s->remote_host) {
-+                _cleanup_free_ char *escaped;
-+
-+                escaped = cescape(s->remote_host);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+
-+                fprintf(f, "REMOTE_HOST=%s\n", escaped);
-+        }
-+
-+        if (s->remote_user) {
-+                _cleanup_free_ char *escaped;
-+
-+                escaped = cescape(s->remote_user);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+
-+                fprintf(f, "REMOTE_USER=%s\n", escaped);
-+        }
++                r = sd_bus_message_peek_type(m, &type, &signature);
++                if (r < 0)
++                        return r;
 +
-+        if (s->service) {
-+                _cleanup_free_ char *escaped;
- 
--        if (s->remote_user)
--                fprintf(f, "REMOTE_USER=%s\n", s->remote_user);
-+                escaped = cescape(s->service);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
++                if (type != 'v' || !streq(strempty(signature), strempty(c->vtable->x.property.signature)))
++                        return sd_bus_reply_method_errorf(m, SD_BUS_ERROR_INVALID_ARGS, "Incorrect parameters for property '%s', expected '%s', got '%s'.", c->member, strempty(c->vtable->x.property.signature), strempty(signature));
 +
-+                fprintf(f, "SERVICE=%s\n", escaped);
-+        }
- 
--        if (s->service)
--                fprintf(f, "SERVICE=%s\n", s->service);
-+        if (s->desktop) {
-+                _cleanup_free_ char *escaped;
+                 r = sd_bus_message_enter_container(m, 'v', c->vtable->x.property.signature);
+                 if (r < 0)
+                         return r;
+diff --git a/src/libsystemd/sd-rtnl/rtnl-message.c b/src/libsystemd/sd-rtnl/rtnl-message.c
+index b501a52..740133a 100644
+--- a/src/libsystemd/sd-rtnl/rtnl-message.c
++++ b/src/libsystemd/sd-rtnl/rtnl-message.c
+@@ -36,6 +36,8 @@
+ #define GET_CONTAINER(m, i) ((i) < (m)->n_containers ? (struct rtattr*)((uint8_t*)(m)->hdr + (m)->container_offsets[i]) : NULL)
+ #define PUSH_CONTAINER(m, new) (m)->container_offsets[(m)->n_containers ++] = (uint8_t*)(new) - (uint8_t*)(m)->hdr;
  
--        if (s->desktop)
--                fprintf(f, "DESKTOP=%s\n", s->desktop);
-+
-+                escaped = cescape(s->desktop);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
++#define RTA_TYPE(rta) ((rta)->rta_type & NLA_TYPE_MASK)
 +
-+                fprintf(f, "DESKTOP=%s\n", escaped);
-+        }
+ static int message_new_empty(sd_rtnl *rtnl, sd_rtnl_message **ret) {
+         sd_rtnl_message *m;
  
-         if (s->seat && seat_has_vts(s->seat))
-                 fprintf(f, "VTNR=%u\n", s->vtnr);
-@@ -972,6 +1008,10 @@ void session_mute_vt(Session *s) {
-         if (vt < 0)
-                 return;
+@@ -566,8 +568,8 @@ int sd_rtnl_message_append_string(sd_rtnl_message *m, unsigned short type, const
+                 size = (size_t)r;
  
-+        r = fchown(vt, s->user->uid, -1);
-+        if (r < 0)
-+                goto error;
-+
-         r = ioctl(vt, KDSKBMODE, K_OFF);
-         if (r < 0)
-                 goto error;
-@@ -1026,6 +1066,8 @@ void session_restore_vt(Session *s) {
-         mode.mode = VT_AUTO;
-         ioctl(vt, VT_SETMODE, &mode);
+         if (size) {
+-                length = strnlen(data, size);
+-                if (length >= size)
++                length = strnlen(data, size+1);
++                if (length > size)
+                         return -EINVAL;
+         } else
+                 length = strlen(data);
+@@ -1066,7 +1068,7 @@ int rtnl_message_parse(sd_rtnl_message *m,
+         *rta_tb_size = max + 1;
  
-+        fchown(vt, 0, -1);
-+
-         s->vtfd = safe_close(s->vtfd);
- }
+         for (; RTA_OK(rta, rt_len); rta = RTA_NEXT(rta, rt_len)) {
+-                type = rta->rta_type;
++                type = RTA_TYPE(rta);
  
-diff --git a/src/login/org.freedesktop.login1.policy.in b/src/login/org.freedesktop.login1.policy.in
-index b96d32d..b8e90f1 100644
---- a/src/login/org.freedesktop.login1.policy.in
-+++ b/src/login/org.freedesktop.login1.policy.in
-@@ -254,7 +254,7 @@
-                 <defaults>
-                         <allow_any>auth_admin_keep</allow_any>
-                         <allow_inactive>auth_admin_keep</allow_inactive>
--                        <allow_active>auth_admin_keep</allow_active>
-+                        <allow_active>yes</allow_active>
-                 </defaults>
-                 <annotate key="org.freedesktop.policykit.imply">org.freedesktop.login1.hibernate</annotate>
-         </action>
-diff --git a/src/login/pam-module.c b/src/login/pam-module.c
-index 9873dd5..1259457 100644
---- a/src/login/pam-module.c
-+++ b/src/login/pam-module.c
-@@ -475,7 +475,7 @@ _public_ PAM_EXTERN int pam_sm_open_session(
+                 /* if the kernel is newer than the headers we used
+                    when building, we ignore out-of-range attributes
+@@ -1222,7 +1224,7 @@ int socket_read_message(sd_rtnl *rtnl) {
+                 }
          }
  
-         if (session_fd >= 0) {
--                session_fd = dup(session_fd);
-+                session_fd = fcntl(session_fd, F_DUPFD_CLOEXEC, 3);
-                 if (session_fd < 0) {
-                         pam_syslog(handle, LOG_ERR, "Failed to dup session fd: %m");
-                         return PAM_SESSION_ERR;
-diff --git a/src/machine/machine.c b/src/machine/machine.c
-index 9a5cc9a..de701ad 100644
---- a/src/machine/machine.c
-+++ b/src/machine/machine.c
-@@ -123,17 +123,42 @@ int machine_save(Machine *m) {
-                 "NAME=%s\n",
-                 m->name);
- 
--        if (m->unit)
--                fprintf(f, "SCOPE=%s\n", m->unit); /* We continue to call this "SCOPE=" because it is internal only, and we want to stay compatible with old files */
-+        if (m->unit) {
-+                _cleanup_free_ char *escaped;
-+
-+                escaped = cescape(m->unit);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+
-+                fprintf(f, "SCOPE=%s\n", escaped); /* We continue to call this "SCOPE=" because it is internal only, and we want to stay compatible with old files */
-+        }
- 
-         if (m->scope_job)
-                 fprintf(f, "SCOPE_JOB=%s\n", m->scope_job);
+-        for (new_msg = rtnl->rbuffer; NLMSG_OK(new_msg, len); new_msg = NLMSG_NEXT(new_msg, len)) {
++        for (new_msg = rtnl->rbuffer; NLMSG_OK(new_msg, len) && !done; new_msg = NLMSG_NEXT(new_msg, len)) {
+                 _cleanup_rtnl_message_unref_ sd_rtnl_message *m = NULL;
+                 const NLType *nl_type;
  
--        if (m->service)
--                fprintf(f, "SERVICE=%s\n", m->service);
-+        if (m->service) {
-+                _cleanup_free_ char *escaped;
- 
--        if (m->root_directory)
--                fprintf(f, "ROOT=%s\n", m->root_directory);
-+                escaped = cescape(m->service);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+                fprintf(f, "SERVICE=%s\n", escaped);
-+        }
-+
-+        if (m->root_directory) {
-+                _cleanup_free_ char *escaped;
+@@ -1237,7 +1239,8 @@ int socket_read_message(sd_rtnl *rtnl) {
+                 if (new_msg->nlmsg_type == NLMSG_DONE) {
+                         /* finished reading multi-part message */
+                         done = true;
+-                        break;
 +
-+                escaped = cescape(m->root_directory);
-+                if (!escaped) {
-+                        r = -ENOMEM;
-+                        goto finish;
-+                }
-+                fprintf(f, "ROOT=%s\n", escaped);
-+        }
- 
-         if (!sd_id128_equal(m->id, SD_ID128_NULL))
-                 fprintf(f, "ID=" SD_ID128_FORMAT_STR "\n", SD_ID128_FORMAT_VAL(m->id));
-@@ -330,16 +355,18 @@ static int machine_stop_scope(Machine *m) {
-         if (!m->unit)
-                 return 0;
++                        continue;
+                 }
  
--        r = manager_stop_unit(m->manager, m->unit, &error, &job);
--        if (r < 0) {
--                log_error("Failed to stop machine scope: %s", bus_error_message(&error, r));
--                return r;
-+        if (!m->registered) {
-+                r = manager_stop_unit(m->manager, m->unit, &error, &job);
-+                if (r < 0) {
-+                        log_error("Failed to stop machine scope: %s", bus_error_message(&error, r));
-+                        return r;
+                 /* check that we support this message type */
+diff --git a/src/libudev/libudev-device.c b/src/libudev/libudev-device.c
+index 2699374..e2afcb8 100644
+--- a/src/libudev/libudev-device.c
++++ b/src/libudev/libudev-device.c
+@@ -730,8 +730,13 @@ _public_ struct udev_device *udev_device_new_from_syspath(struct udev *udev, con
+                         return NULL;
+         } else {
+                 /* everything else just needs to be a directory */
+-                if (stat(path, &statbuf) != 0 || !S_ISDIR(statbuf.st_mode))
++                if (stat(path, &statbuf) != 0)
+                         return NULL;
++
++                if (!S_ISDIR(statbuf.st_mode)) {
++                        errno = EISDIR;
++                        return NULL;
 +                }
          }
  
-         free(m->scope_job);
-         m->scope_job = job;
- 
--        return r;
-+        return 0;
- }
- 
- int machine_stop(Machine *m) {
-@@ -415,6 +442,8 @@ int machine_kill(Machine *m, KillWho who, int signo) {
- 
-                 if (kill(m->leader, signo) < 0)
-                         return -errno;
-+
-+                return 0;
-         }
- 
-         /* Otherwise make PID 1 do it for us, for the entire cgroup */
-diff --git a/src/machine/machine.h b/src/machine/machine.h
-index f4aefc5..de3536d 100644
---- a/src/machine/machine.h
-+++ b/src/machine/machine.h
-@@ -72,6 +72,7 @@ struct Machine {
- 
-         bool in_gc_queue:1;
-         bool started:1;
-+        bool registered:1;
- 
-         sd_bus_message *create_message;
- 
-diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c
-index 9473105..154a335 100644
---- a/src/machine/machined-dbus.c
-+++ b/src/machine/machined-dbus.c
-@@ -241,6 +241,7 @@ static int method_create_or_register_machine(Manager *manager, sd_bus_message *m
-         m->leader = leader;
-         m->class = c;
-         m->id = id;
-+        m->registered = true;
- 
-         if (!isempty(service)) {
-                 m->service = strdup(service);
+         udev_device = udev_device_new(udev);
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 9a9ed9d..c3e6d23 100644
+index b6d9bc6..759794f 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -769,6 +769,15 @@ static int setup_resolv_conf(const char *dest) {
-         return 0;
- }
+@@ -758,7 +758,7 @@ static int mount_binds(const char *dest, char **l, bool ro) {
+                  * and char devices. */
+                 if (S_ISDIR(source_st.st_mode)) {
+                         r = mkdir_label(where, 0755);
+-                        if (r < 0) {
++                        if (r < 0 && errno != EEXIST) {
+                                 log_error("Failed to create mount point %s: %s", where, strerror(-r));
  
-+static char* id128_format_as_uuid(sd_id128_t id, char s[37]) {
-+
-+        snprintf(s, 37,
-+                 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
-+                 SD_ID128_FORMAT_VAL(id));
-+
-+        return s;
-+}
-+
- static int setup_boot_id(const char *dest) {
-         _cleanup_free_ char *from = NULL, *to = NULL;
-         sd_id128_t rnd = {};
-@@ -794,10 +803,7 @@ static int setup_boot_id(const char *dest) {
-                 return r;
-         }
+                                 return r;
+@@ -818,7 +818,7 @@ static int mount_tmpfs(const char *dest) {
+                         return log_oom();
  
--        snprintf(as_uuid, sizeof(as_uuid),
--                 "%02x%02x%02x%02x-%02x%02x-%02x%02x-%02x%02x-%02x%02x%02x%02x%02x%02x",
--                 SD_ID128_FORMAT_VAL(rnd));
--        char_array_0(as_uuid);
-+        id128_format_as_uuid(rnd, as_uuid);
+                 r = mkdir_label(where, 0755);
+-                if (r < 0) {
++                if (r < 0 && errno != EEXIST) {
+                         log_error("creating mount point for tmpfs %s failed: %s", where, strerror(-r));
  
-         r = write_string_file(from, as_uuid);
-         if (r < 0) {
-@@ -2378,7 +2384,7 @@ static int change_uid_gid(char **_home) {
-         _cleanup_fclose_ FILE *f = NULL;
-         _cleanup_close_ int fd = -1;
-         unsigned n_uids = 0;
--        size_t sz, l;
-+        size_t sz = 0, l;
-         uid_t uid;
-         gid_t gid;
-         pid_t pid;
-@@ -2667,6 +2673,7 @@ int main(int argc, char *argv[]) {
+                         return r;
+@@ -3073,6 +3073,7 @@ int main(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
@@ -1592,7 +612,7 @@ index 9a9ed9d..c3e6d23 100644
                          const char *p;
  
                          p = strappenda(arg_directory,
-@@ -2676,6 +2683,7 @@ int main(int argc, char *argv[]) {
+@@ -3082,6 +3083,7 @@ int main(int argc, char *argv[]) {
                                  goto finish;
  
                          }
@@ -1600,510 +620,237 @@ index 9a9ed9d..c3e6d23 100644
                  }
          } else {
                  char template[] = "/tmp/nspawn-root-XXXXXX";
-@@ -2748,8 +2756,6 @@ int main(int argc, char *argv[]) {
-                 goto finish;
-         }
+diff --git a/src/resolve/resolved-dns-packet.c b/src/resolve/resolved-dns-packet.c
+index 7375f77..ec8efcc 100644
+--- a/src/resolve/resolved-dns-packet.c
++++ b/src/resolve/resolved-dns-packet.c
+@@ -866,7 +866,7 @@ fail:
+ 
+ int dns_packet_read_name(DnsPacket *p, char **_ret,
+                          bool allow_compression, size_t *start) {
+-        size_t saved_rindex, after_rindex = 0;
++        size_t saved_rindex, after_rindex = 0, jump_barrier;
+         _cleanup_free_ char *ret = NULL;
+         size_t n = 0, allocated = 0;
+         bool first = true;
+@@ -876,6 +876,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
+         assert(_ret);
+ 
+         saved_rindex = p->rindex;
++        jump_barrier = p->rindex;
+ 
+         for (;;) {
+                 uint8_t c, d;
+@@ -922,7 +923,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
+                                 goto fail;
  
--        sd_notify(0, "READY=1");
--
-         assert_se(sigemptyset(&mask) == 0);
-         sigset_add_many(&mask, SIGCHLD, SIGWINCH, SIGTERM, SIGINT, -1);
-         assert_se(sigprocmask(SIG_BLOCK, &mask, NULL) == 0);
-@@ -2966,7 +2972,9 @@ int main(int argc, char *argv[]) {
+                         ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d;
+-                        if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= saved_rindex) {
++                        if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= jump_barrier) {
+                                 r = -EBADMSG;
+                                 goto fail;
                          }
+@@ -930,9 +931,13 @@ int dns_packet_read_name(DnsPacket *p, char **_ret,
+                         if (after_rindex == 0)
+                                 after_rindex = p->rindex;
  
-                         if (!sd_id128_equal(arg_uuid, SD_ID128_NULL)) {
--                                if (asprintf((char**)(envp + n_env++), "container_uuid=" SD_ID128_FORMAT_STR, SD_ID128_FORMAT_VAL(arg_uuid)) < 0) {
-+                                char as_uuid[37];
-+
-+                                if (asprintf((char**)(envp + n_env++), "container_uuid=%s", id128_format_as_uuid(arg_uuid, as_uuid)) < 0) {
-                                         log_oom();
-                                         goto child_fail;
-                                 }
-@@ -3086,6 +3094,8 @@ int main(int argc, char *argv[]) {
-                 if (r < 0)
-                         goto finish;
- 
-+                sd_notify(0, "READY=1");
-+
-                 /* Notify the child that the parent is ready with all
-                  * its setup, and thtat the child can now hand over
-                  * control to the code to run inside the container. */
-@@ -3136,6 +3146,10 @@ int main(int argc, char *argv[]) {
- 
-                         if (!arg_quiet)
-                                 log_info("Container %s is being rebooted.", arg_machine);
-+                        if (getenv("EXIT_ON_REBOOT") != 0) {
-+                                r = 10;
-+                                break;
-+                        }
-                         continue;
-                 } else if (status.si_code == CLD_KILLED ||
-                            status.si_code == CLD_DUMPED) {
-diff --git a/src/nss-myhostname/netlink.c b/src/nss-myhostname/netlink.c
-index d61ecdf..228a3a4 100644
---- a/src/nss-myhostname/netlink.c
-+++ b/src/nss-myhostname/netlink.c
-@@ -112,6 +112,10 @@ static int read_reply(int fd, struct address **list, unsigned *n_list) {
-                     ifaddrmsg->ifa_scope == RT_SCOPE_NOWHERE)
-                         continue;
- 
-+                if (ifaddrmsg->ifa_family == AF_INET6 &&
-+                    ifaddrmsg->ifa_scope == RT_SCOPE_LINK)
-+                        continue;
-+
-                 if (ifaddrmsg->ifa_flags & IFA_F_DEPRECATED)
-                         continue;
- 
-diff --git a/src/python-systemd/_reader.c b/src/python-systemd/_reader.c
-index 059b904..9a19a10 100644
---- a/src/python-systemd/_reader.c
-+++ b/src/python-systemd/_reader.c
-@@ -902,7 +902,6 @@ static PyObject* get_catalog(PyObject *self, PyObject *args) {
-         sd_id128_t id;
-         _cleanup_free_ char *msg = NULL;
- 
--        assert(!self);
-         assert(args);
- 
-         if (!PyArg_ParseTuple(args, "z:get_catalog", &id_))
-diff --git a/src/python-systemd/journal.py b/src/python-systemd/journal.py
-index 9c7e004..dd1f229 100644
---- a/src/python-systemd/journal.py
-+++ b/src/python-systemd/journal.py
-@@ -293,7 +293,7 @@ class Reader(_Reader):
-             monotonic = monotonic.totalseconds()
-         monotonic = int(monotonic * 1000000)
-         if isinstance(bootid, _uuid.UUID):
--            bootid = bootid.get_hex()
-+            bootid = bootid.hex
-         return super(Reader, self).seek_monotonic(monotonic, bootid)
- 
-     def log_level(self, level):
-@@ -314,7 +314,7 @@ class Reader(_Reader):
-         Equivalent to add_match(MESSAGE_ID=`messageid`).
-         """
-         if isinstance(messageid, _uuid.UUID):
--            messageid = messageid.get_hex()
-+            messageid = messageid.hex
-         self.add_match(MESSAGE_ID=messageid)
- 
-     def this_boot(self, bootid=None):
-@@ -346,7 +346,7 @@ class Reader(_Reader):
- 
- def get_catalog(mid):
-     if isinstance(mid, _uuid.UUID):
--        mid = mid.get_hex()
-+        mid = mid.hex
-     return _get_catalog(mid)
- 
- def _make_line(field, value):
-diff --git a/src/readahead/readahead-common.c b/src/readahead/readahead-common.c
-index 5ffa88b..49679fc 100644
---- a/src/readahead/readahead-common.c
-+++ b/src/readahead/readahead-common.c
-@@ -75,7 +75,7 @@ int fs_on_ssd(const char *p) {
-         if (major(st.st_dev) == 0) {
-                 _cleanup_fclose_ FILE *f = NULL;
-                 int mount_id;
--                struct file_handle *h;
-+                union file_handle_union h = { .handle.handle_bytes = MAX_HANDLE_SZ, };
- 
-                 /* Might be btrfs, which exposes "ssd" as mount flag if it is on ssd.
-                  *
-@@ -83,9 +83,7 @@ int fs_on_ssd(const char *p) {
-                  * and then lookup the mount ID in mountinfo to find
-                  * the mount options. */
- 
--                h = alloca(MAX_HANDLE_SZ);
--                h->handle_bytes = MAX_HANDLE_SZ;
--                r = name_to_handle_at(AT_FDCWD, p, h, &mount_id, AT_SYMLINK_FOLLOW);
-+                r = name_to_handle_at(AT_FDCWD, p, &h.handle, &mount_id, AT_SYMLINK_FOLLOW);
-                 if (r < 0)
-                         return false;
- 
-diff --git a/src/shared/conf-parser.c b/src/shared/conf-parser.c
-index d27b1b7..905a2e1 100644
---- a/src/shared/conf-parser.c
-+++ b/src/shared/conf-parser.c
-@@ -336,8 +336,8 @@ int config_parse(const char *unit,
-         if (!f) {
-                 f = ours = fopen(filename, "re");
-                 if (!f) {
--                        log_error("Failed to open configuration file '%s': %m", filename);
--                        return -errno;
-+                        log_full(errno == ENOENT ? LOG_DEBUG : LOG_ERR, "Failed to open configuration file '%s': %m", filename);
-+                        return errno == ENOENT ? 0 : -errno;
-                 }
-         }
- 
-diff --git a/src/shared/generator.c b/src/shared/generator.c
-index 6110303..e679cb1 100644
---- a/src/shared/generator.c
-+++ b/src/shared/generator.c
-@@ -48,7 +48,7 @@ int generator_write_fsck_deps(
-                 const char *checker;
-                 int r;
- 
--                checker = strappenda("/sbin/fsck.", fstype);
-+                checker = strappenda("/run/current-system/sw/sbin/fsck.", fstype);
-                 r = access(checker, X_OK);
-                 if (r < 0) {
-                         log_warning("Checking was requested for %s, but %s cannot be used: %m", what, checker);
-diff --git a/src/shared/install.c b/src/shared/install.c
-index 7409046..4517c9c 100644
---- a/src/shared/install.c
-+++ b/src/shared/install.c
-@@ -560,7 +560,7 @@ int unit_file_mask(
-                 unsigned *n_changes) {
- 
-         char **i;
--        _cleanup_free_ char *prefix;
-+        _cleanup_free_ char *prefix = NULL;
-         int r;
- 
-         assert(scope >= 0);
-diff --git a/src/shared/log.c b/src/shared/log.c
-index a4b3b68..890a9fa 100644
---- a/src/shared/log.c
-+++ b/src/shared/log.c
-@@ -878,6 +878,9 @@ void log_parse_environment(void) {
-                         if (l == 5 && startswith(w, "debug")) {
-                                 log_set_max_level(LOG_DEBUG);
-                                 break;
-+                        } else if (l == 5 && startswith(w, "quiet")) {
-+                                log_set_max_level(LOG_WARNING);
-+                                break;
-                         }
-                 }
-         }
-diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c
-index 9d14933..b0b66f6 100644
---- a/src/shared/logs-show.c
-+++ b/src/shared/logs-show.c
-@@ -547,7 +547,9 @@ static int output_export(
-                     startswith(data, "_BOOT_ID="))
-                         continue;
- 
--                if (!utf8_is_printable(data, length)) {
-+                if (utf8_is_printable_newline(data, length, false))
-+                        fwrite(data, length, 1, f);
-+                else {
-                         const char *c;
-                         uint64_t le64;
- 
-@@ -562,8 +564,7 @@ static int output_export(
-                         le64 = htole64(length - (c - (const char*) data) - 1);
-                         fwrite(&le64, sizeof(le64), 1, f);
-                         fwrite(c + 1, length - (c - (const char*) data) - 1, 1, f);
++                        /* Jumps are limited to a "prior occurence" (RFC-1035 4.1.4) */
++                        jump_barrier = ptr;
+                         p->rindex = ptr;
 -                } else
--                        fwrite(data, length, 1, f);
++                } else {
++                        r = -EBADMSG;
+                         goto fail;
 +                }
- 
-                 fputc('\n', f);
          }
-diff --git a/src/shared/unit-name.c b/src/shared/unit-name.c
-index 6c167b4..d0e71f2 100644
---- a/src/shared/unit-name.c
-+++ b/src/shared/unit-name.c
-@@ -332,7 +332,7 @@ char *unit_name_path_unescape(const char *f) {
- }
- 
- bool unit_name_is_template(const char *n) {
--        const char *p;
-+        const char *p, *e;
  
-         assert(n);
+         if (!GREEDY_REALLOC(ret, allocated, n + 1)) {
+diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
+index 7d258c9..6dd4cad 100644
+--- a/src/resolve/resolved.c
++++ b/src/resolve/resolved.c
+@@ -108,7 +108,7 @@ int main(int argc, char *argv[]) {
  
-@@ -340,11 +340,15 @@ bool unit_name_is_template(const char *n) {
-         if (!p)
-                 return false;
+ finish:
+         sd_notify(false,
+-                  "STOPPIN=1\n"
++                  "STOPPING=1\n"
+                   "STATUS=Shutting down...");
+ 
+         return r < 0 ? EXIT_FAILURE : EXIT_SUCCESS;
+diff --git a/src/run/run.c b/src/run/run.c
+index e3b6293..dcefb5c 100644
+--- a/src/run/run.c
++++ b/src/run/run.c
+@@ -573,9 +573,12 @@ int main(int argc, char* argv[]) {
+         if (r <= 0)
+                 goto finish;
  
--        return p[1] == '.';
-+        e = strrchr(p+1, '.');
-+        if (!e)
-+                return false;
-+
-+        return e == p + 1;
+-        r = find_binary(argv[optind], &command);
++        r = find_binary(argv[optind], arg_transport == BUS_TRANSPORT_LOCAL, &command);
+         if (r < 0) {
+-                log_error("Failed to find executable %s: %s", argv[optind], strerror(-r));
++                log_error("Failed to find executable %s%s: %s",
++                          argv[optind],
++                          arg_transport == BUS_TRANSPORT_LOCAL ? "" : " on local system",
++                          strerror(-r));
+                 goto finish;
+         }
+         argv[optind] = command;
+diff --git a/src/shared/install.c b/src/shared/install.c
+index 035b44c..cab93e8 100644
+--- a/src/shared/install.c
++++ b/src/shared/install.c
+@@ -1620,12 +1620,10 @@ int unit_file_enable(
+         STRV_FOREACH(i, files) {
+                 UnitFileState state;
+ 
++                /* We only want to know if this unit is masked, so we ignore
++                 * errors from unit_file_get_state, deferring other checks.
++                 * This allows templated units to be enabled on the fly. */
+                 state = unit_file_get_state(scope, root_dir, *i);
+-                if (state < 0) {
+-                        log_error("Failed to get unit file state for %s: %s", *i, strerror(-state));
+-                        return state;
+-                }
+-
+                 if (state == UNIT_FILE_MASKED || state == UNIT_FILE_MASKED_RUNTIME) {
+                         log_error("Failed to enable unit: Unit %s is masked", *i);
+                         return -ENOTSUP;
+diff --git a/src/shared/path-lookup.c b/src/shared/path-lookup.c
+index 8f75a8e..c800e01 100644
+--- a/src/shared/path-lookup.c
++++ b/src/shared/path-lookup.c
+@@ -86,17 +86,14 @@ static char** user_dirs(
+         const char * const config_unit_paths[] = {
+                 USER_CONFIG_UNIT_PATH,
+                 "/etc/systemd/user",
++                "/etc/systemd-mutable/user",
+                 NULL
+         };
+ 
+         const char * const runtime_unit_path = "/run/systemd/user";
+ 
+         const char * const data_unit_paths[] = {
+-                "/usr/local/lib/systemd/user",
+-                "/usr/local/share/systemd/user",
+                 USER_DATA_UNIT_PATH,
+-                "/usr/lib/systemd/user",
+-                "/usr/share/systemd/user",
+                 NULL
+         };
+ 
+@@ -260,13 +257,11 @@ int lookup_paths_init(
+                                         STRV_IFNOTNULL(generator_early),
+                                         USER_CONFIG_UNIT_PATH,
+                                         "/etc/systemd/user",
++                                        "/etc/systemd-mutable/user",
++                                        "/nix/var/nix/profiles/default/lib/systemd/user",
+                                         "/run/systemd/user",
+                                         STRV_IFNOTNULL(generator),
+-                                        "/usr/local/lib/systemd/user",
+-                                        "/usr/local/share/systemd/user",
+                                         USER_DATA_UNIT_PATH,
+-                                        "/usr/lib/systemd/user",
+-                                        "/usr/share/systemd/user",
+                                         STRV_IFNOTNULL(generator_late),
+                                         NULL);
+                 } else
+@@ -276,14 +271,11 @@ int lookup_paths_init(
+                                 STRV_IFNOTNULL(generator_early),
+                                 SYSTEM_CONFIG_UNIT_PATH,
+                                 "/etc/systemd/system",
++                                "/etc/systemd-mutable/system",
++                                "/nix/var/nix/profiles/default/lib/systemd/system",
+                                 "/run/systemd/system",
+                                 STRV_IFNOTNULL(generator),
+-                                "/usr/local/lib/systemd/system",
+                                 SYSTEM_DATA_UNIT_PATH,
+-                                "/usr/lib/systemd/system",
+-#ifdef HAVE_SPLIT_USR
+-                                "/lib/systemd/system",
+-#endif
+                                 STRV_IFNOTNULL(generator_late),
+                                 NULL);
+ 
+diff --git a/src/shared/path-util.c b/src/shared/path-util.c
+index 67566bc..be03695 100644
+--- a/src/shared/path-util.c
++++ b/src/shared/path-util.c
+@@ -563,11 +563,11 @@ int path_is_os_tree(const char *path) {
+         return r >= 0;
  }
  
- bool unit_name_is_instance(const char *n) {
--        const char *p;
-+        const char *p, *e;
- 
-         assert(n);
+-int find_binary(const char *name, char **filename) {
++int find_binary(const char *name, bool local, char **filename) {
+         assert(name);
  
-@@ -352,7 +356,11 @@ bool unit_name_is_instance(const char *n) {
-         if (!p)
-                 return false;
+         if (is_path(name)) {
+-                if (access(name, X_OK) < 0)
++                if (local && access(name, X_OK) < 0)
+                         return -errno;
  
--        return p[1] != '.';
-+        e = strrchr(p+1, '.');
-+        if (!e)
-+                return false;
-+
-+        return e > p + 1;
- }
+                 if (filename) {
+@@ -657,7 +657,7 @@ int fsck_exists(const char *fstype) {
  
- char *unit_name_replace_instance(const char *f, const char *i) {
-diff --git a/src/shared/utf8.c b/src/shared/utf8.c
-index 0b524d8..c559c13 100644
---- a/src/shared/utf8.c
-+++ b/src/shared/utf8.c
-@@ -136,7 +136,7 @@ int utf8_encoded_to_unichar(const char *str) {
-         return unichar;
- }
+         checker = strappenda("fsck.", fstype);
  
--bool utf8_is_printable(const char* str, size_t length) {
-+bool utf8_is_printable_newline(const char* str, size_t length, bool newline) {
-         const uint8_t *p;
- 
-         assert(str);
-@@ -145,7 +145,8 @@ bool utf8_is_printable(const char* str, size_t length) {
-                 int encoded_len = utf8_encoded_valid_unichar((const char *)p);
-                 int val = utf8_encoded_to_unichar((const char*)p);
- 
--                if (encoded_len < 0 || val < 0 || is_unicode_control(val))
-+                if (encoded_len < 0 || val < 0 || is_unicode_control(val) ||
-+                    (!newline && val == '\n'))
-                         return false;
- 
-                 length -= encoded_len;
-diff --git a/src/shared/utf8.h b/src/shared/utf8.h
-index c0eb73a..c087995 100644
---- a/src/shared/utf8.h
-+++ b/src/shared/utf8.h
-@@ -31,7 +31,10 @@ const char *utf8_is_valid(const char *s) _pure_;
- char *ascii_is_valid(const char *s) _pure_;
- char *utf8_escape_invalid(const char *s);
- 
--bool utf8_is_printable(const char* str, size_t length) _pure_;
-+bool utf8_is_printable_newline(const char* str, size_t length, bool newline) _pure_;
-+_pure_ static inline bool utf8_is_printable(const char* str, size_t length) {
-+        return utf8_is_printable_newline(str, length, true);
-+}
- 
- char *utf16_to_utf8(const void *s, size_t length);
- 
-diff --git a/src/shared/util.c b/src/shared/util.c
-index ffe6624..2a2b2b2 100644
---- a/src/shared/util.c
-+++ b/src/shared/util.c
-@@ -166,19 +166,19 @@ int close_nointr(int fd) {
- 
-         assert(fd >= 0);
-         r = close(fd);
--
--        /* Just ignore EINTR; a retry loop is the wrong
--         * thing to do on Linux.
--         *
--         * http://lkml.indiana.edu/hypermail/linux/kernel/0509.1/0877.html
--         * https://bugzilla.gnome.org/show_bug.cgi?id=682819
--         * http://utcc.utoronto.ca/~cks/space/blog/unix/CloseEINTR
--         * https://sites.google.com/site/michaelsafyan/software-engineering/checkforeintrwheninvokingclosethinkagain
--         */
--        if (_unlikely_(r < 0 && errno == EINTR))
--                return 0;
--        else if (r >= 0)
-+        if (r >= 0)
+-        r = find_binary(checker, &p);
++        r = find_binary(checker, true, &p);
+         if (r < 0)
                  return r;
-+        else if (errno == EINTR)
-+                /*
-+                 * Just ignore EINTR; a retry loop is the wrong
-+                 * thing to do on Linux.
-+                 *
-+                 * http://lkml.indiana.edu/hypermail/linux/kernel/0509.1/0877.html
-+                 * https://bugzilla.gnome.org/show_bug.cgi?id=682819
-+                 * http://utcc.utoronto.ca/~cks/space/blog/unix/CloseEINTR
-+                 * https://sites.google.com/site/michaelsafyan/software-engineering/checkforeintrwheninvokingclosethinkagain
-+                 */
-+                return 0;
-         else
-                 return -errno;
- }
-@@ -195,7 +195,13 @@ int safe_close(int fd) {
- 
-         if (fd >= 0) {
-                 PROTECT_ERRNO;
--                assert_se(close_nointr(fd) == 0);
-+
-+                /* The kernel might return pretty much any error code
-+                 * via close(), but the fd will be closed anyway. The
-+                 * only condition we want to check for here is whether
-+                 * the fd was invalid at all... */
-+
-+                assert_se(close_nointr(fd) != -EBADF);
-         }
  
-         return -1;
-@@ -1365,7 +1371,7 @@ bool ignore_file(const char *filename) {
-         assert(filename);
+diff --git a/src/shared/path-util.h b/src/shared/path-util.h
+index 8d171a5..bd0d324 100644
+--- a/src/shared/path-util.h
++++ b/src/shared/path-util.h
+@@ -55,7 +55,7 @@ int path_is_mount_point(const char *path, bool allow_symlink);
+ int path_is_read_only_fs(const char *path);
+ int path_is_os_tree(const char *path);
  
-         if (endswith(filename, "~"))
--                return false;
-+                return true;
+-int find_binary(const char *name, char **filename);
++int find_binary(const char *name, bool local, char **filename);
  
-         return ignore_file_allow_backup(filename);
- }
-@@ -1495,6 +1501,7 @@ bool fstype_is_network(const char *fstype) {
-         static const char table[] =
-                 "cifs\0"
-                 "smbfs\0"
-+                "sshfs\0"
-                 "ncpfs\0"
-                 "ncp\0"
-                 "nfs\0"
-@@ -1581,8 +1588,9 @@ int read_one_char(FILE *f, char *ret, usec_t t, bool *need_nl) {
-                 if (fd_wait_for_event(fileno(f), POLLIN, t) <= 0)
-                         return -ETIMEDOUT;
- 
-+        errno = 0;
-         if (!fgets(line, sizeof(line), f))
--                return -EIO;
-+                return errno ? -errno : -EIO;
- 
-         truncate_nl(line);
- 
-@@ -5327,6 +5335,9 @@ bool string_is_safe(const char *p) {
-                 if (*t > 0 && *t < ' ')
-                         return false;
- 
-+                if (*t == 127)
-+                        return false;
-+
-                 if (strchr("\\\"\'", *t))
-                         return false;
-         }
-@@ -5343,10 +5354,14 @@ bool string_has_cc(const char *p) {
- 
-         assert(p);
- 
--        for (t = p; *t; t++)
-+        for (t = p; *t; t++) {
-                 if (*t > 0 && *t < ' ' && *t != '\t')
-                         return true;
- 
-+                if (*t == 127)
-+                        return true;
-+        }
-+
-         return false;
- }
+ bool paths_check_timestamp(const char* const* paths, usec_t *paths_ts_usec, bool update);
  
-@@ -6391,3 +6406,19 @@ void hexdump(FILE *f, const void *p, size_t s) {
-                 s -= 16;
-         }
- }
-+
-+int update_reboot_param_file(const char *param)
-+{
-+        int r = 0;
-+
-+        if (param) {
-+
-+                r = write_string_file(REBOOT_PARAM_FILE, param);
-+                if (r < 0)
-+                        log_error("Failed to write reboot param to "
-+                                  REBOOT_PARAM_FILE": %s", strerror(-r));
-+        } else
-+                unlink(REBOOT_PARAM_FILE);
-+
-+        return r;
-+}
-diff --git a/src/shared/util.h b/src/shared/util.h
-index 90464c9..122ac91 100644
---- a/src/shared/util.h
-+++ b/src/shared/util.h
-@@ -22,6 +22,7 @@
- ***/
- 
- #include <alloca.h>
-+#include <fcntl.h>
- #include <inttypes.h>
- #include <time.h>
- #include <sys/time.h>
-@@ -922,3 +923,10 @@ uint64_t physical_memory(void);
- char* mount_test_option(const char *haystack, const char *needle);
- 
- void hexdump(FILE *f, const void *p, size_t s);
-+
-+union file_handle_union {
-+        struct file_handle handle;
-+        char padding[sizeof(struct file_handle) + MAX_HANDLE_SZ];
-+};
-+
-+int update_reboot_param_file(const char *param);
 diff --git a/src/shared/virt.c b/src/shared/virt.c
-index ec2ddcf..f03e790 100644
+index f9c4e67..f10baab 100644
 --- a/src/shared/virt.c
 +++ b/src/shared/virt.c
-@@ -149,7 +149,7 @@ static int detect_vm_dmi(const char **_id) {
- 
- /* Returns a short identifier for the various VM implementations */
- int detect_vm(const char **id) {
--        _cleanup_free_ char *hvtype = NULL, *cpuinfo_contents = NULL;
-+        _cleanup_free_ char *domcap = NULL, *cpuinfo_contents = NULL;
-         static thread_local int cached_found = -1;
-         static thread_local const char *cached_id = NULL;
-         const char *_id = NULL;
-@@ -163,17 +163,37 @@ int detect_vm(const char **id) {
-                 return cached_found;
-         }
+@@ -293,8 +293,26 @@ int detect_container(const char **id) {
  
--        /* Try high-level hypervisor sysfs file first:
-+        /* Try xen capabilities file first, if not found try high-level hypervisor sysfs file:
-          *
--         * https://bugs.freedesktop.org/show_bug.cgi?id=61491 */
--        r = read_one_line_file("/sys/hypervisor/type", &hvtype);
-+         * https://bugs.freedesktop.org/show_bug.cgi?id=77271 */
-+        r = read_one_line_file("/proc/xen/capabilities", &domcap);
-         if (r >= 0) {
--                if (streq(hvtype, "xen")) {
-+                char *cap, *i = domcap;
-+
-+                while ((cap = strsep(&i, ",")))
-+                        if (streq(cap, "control_d"))
-+                                break;
-+
-+                if (!i)  {
-                         _id = "xen";
-                         r = 1;
+                 r = read_one_line_file("/run/systemd/container", &m);
+                 if (r == -ENOENT) {
+-                        r = 0;
 -                        goto finish;
-                 }
--        } else if (r != -ENOENT)
 +
-+                goto finish;
++                        /* Fallback for cases where PID 1 was not
++                         * systemd (for example, cases where
++                         * init=/bin/sh is used. */
 +
-+        } else if (r == -ENOENT) {
-+                _cleanup_free_ char *hvtype = NULL;
++                        r = getenv_for_pid(1, "container", &m);
++                        if (r <= 0) {
 +
-+                r = read_one_line_file("/sys/hypervisor/type", &hvtype);
-+                if (r >= 0) {
-+                        if (streq(hvtype, "xen")) {
-+                                _id = "xen";
-+                                r = 1;
++                                /* If that didn't work, give up,
++                                 * assume no container manager.
++                                 *
++                                 * Note: This means we still cannot
++                                 * detect containers if init=/bin/sh
++                                 * is passed but privileges dropped,
++                                 * as /proc/1/environ is only readable
++                                 * with privileges. */
++
++                                r = 0;
 +                                goto finish;
 +                        }
-+                } else if (r != -ENOENT)
-+                        return r;
-+        } else
-                 return r;
- 
-         /* this will set _id to "other" and return 0 for unknown hypervisors */
+                 }
+                 if (r < 0)
+                         return r;
 diff --git a/src/systemctl/systemctl.c b/src/systemctl/systemctl.c
-index 0887bc3..d02ee2b 100644
+index 28eaa6a..3866308 100644
 --- a/src/systemctl/systemctl.c
 +++ b/src/systemctl/systemctl.c
-@@ -461,7 +461,7 @@ static int output_units_list(const UnitInfo *unit_infos, unsigned c) {
-                 }
- 
-                 if (circle_len > 0)
--                        printf("%s%s%s", on_circle, circle ? draw_special_char(DRAW_BLACK_CIRCLE) : "  ", off_circle);
-+                        printf("%s%s%s ", on_circle, circle ? draw_special_char(DRAW_BLACK_CIRCLE) : " ", off_circle);
- 
-                 printf("%s%-*s%s %s%-*s%s %s%-*s %-*s%s %-*s",
-                        on_active, id_len, id, off_active,
-@@ -2561,7 +2561,7 @@ static int start_unit_one(
+@@ -2651,7 +2651,7 @@ static int start_unit_one(
  
                  log_debug("Adding %s to the set", p);
                  r = set_consume(s, p);
@@ -2112,523 +859,89 @@ index 0887bc3..d02ee2b 100644
                          return log_oom();
          }
  
-@@ -4240,7 +4240,7 @@ static int show_all(
-         _cleanup_free_ UnitInfo *unit_infos = NULL;
-         const UnitInfo *u;
-         unsigned c;
--        int r;
-+        int r, ret = 0;
+@@ -6917,8 +6917,13 @@ done:
  
-         r = get_unit_list(bus, NULL, NULL, &unit_infos, 0, &reply);
-         if (r < 0)
-@@ -4262,9 +4262,11 @@ static int show_all(
-                 r = show_one(verb, bus, p, show_properties, new_line, ellipsized);
-                 if (r < 0)
-                         return r;
-+                else if (r > 0 && ret == 0)
-+                        ret = r;
-         }
- 
--        return 0;
-+        return ret;
- }
- 
- static int show_system_status(sd_bus *bus) {
-@@ -4386,7 +4388,12 @@ static int show(sd_bus *bus, char **args) {
-                                 }
-                         }
+ static int halt_now(enum action a) {
  
--                        show_one(args[0], bus, unit, show_properties, &new_line, &ellipsized);
-+                        r = show_one(args[0], bus, unit, show_properties,
-+                                     &new_line, &ellipsized);
-+                        if (r < 0)
-+                                return r;
-+                        else if (r > 0 && ret == 0)
-+                                ret = r;
-                 }
- 
-                 if (!strv_isempty(patterns)) {
-@@ -4403,7 +4410,12 @@ static int show(sd_bus *bus, char **args) {
-                                 if (!unit)
-                                         return log_oom();
- 
--                                show_one(args[0], bus, unit, show_properties, &new_line, &ellipsized);
-+                                r = show_one(args[0], bus, unit, show_properties,
-+                                             &new_line, &ellipsized);
-+                                if (r < 0)
-+                                        return r;
-+                                else if (r > 0 && ret == 0)
-+                                        ret = r;
-                         }
-                 }
-         }
-@@ -5403,15 +5415,15 @@ static int systemctl_help(void) {
-                "                                  otherwise restart if active\n"
-                "  isolate NAME                    Start one unit and stop all others\n"
-                "  kill NAME...                    Send signal to processes of a unit\n"
--               "  is-active NAME...               Check whether units are active\n"
--               "  is-failed NAME...               Check whether units are failed\n"
--               "  status [NAME...|PID...]         Show runtime status of one or more units\n"
--               "  show [NAME...|JOB...]           Show properties of one or more\n"
-+               "  is-active PATTERN...            Check whether units are active\n"
-+               "  is-failed PATTERN...            Check whether units are failed\n"
-+               "  status [PATTERN...|PID...]      Show runtime status of one or more units\n"
-+               "  show [PATTERN...|JOB...]        Show properties of one or more\n"
-                "                                  units/jobs or the manager\n"
--               "  cat NAME...                     Show files and drop-ins of one or more units\n"
-+               "  cat PATTERN...                  Show files and drop-ins of one or more units\n"
-                "  set-property NAME ASSIGNMENT... Sets one or more properties of a unit\n"
--               "  help NAME...|PID...             Show manual for one or more units\n"
--               "  reset-failed [NAME...]          Reset failed state for all, one, or more\n"
-+               "  help PATTERN...|PID...          Show manual for one or more units\n"
-+               "  reset-failed [PATTERN...]       Reset failed state for all, one, or more\n"
-                "                                  units\n"
-                "  list-dependencies [NAME]        Recursively show units which are required\n"
-                "                                  or wanted by this unit or by which this\n"
-@@ -5973,13 +5985,10 @@ static int halt_parse_argv(int argc, char *argv[]) {
-                 }
-         }
+-/* Make sure C-A-D is handled by the kernel from this
+-         * point on... */
++        /* The kernel will automaticall flush ATA disks and suchlike
++         * on reboot(), but the file systems need to be synce'd
++         * explicitly in advance. */
++        sync();
++
++        /* Make sure C-A-D is handled by the kernel from this point
++         * on... */
+         reboot(RB_ENABLE_CAD);
  
--        if (arg_action == ACTION_REBOOT && argc == optind + 1) {
--                r = write_string_file(REBOOT_PARAM_FILE, argv[optind]);
--                if (r < 0) {
--                        log_error("Failed to write reboot param to "
--                                  REBOOT_PARAM_FILE": %s", strerror(-r));
-+        if (arg_action == ACTION_REBOOT && (argc == optind || argc == optind + 1)) {
-+                r = update_reboot_param_file(argc == optind + 1 ? argv[optind] : NULL);
-+                if (r < 0)
-                         return r;
--                }
-         } else if (optind < argc) {
-                 log_error("Too many arguments.");
-                 return -EINVAL;
-diff --git a/src/test/test-udev.c b/src/test/test-udev.c
-index b064744..b057cc8 100644
---- a/src/test/test-udev.c
-+++ b/src/test/test-udev.c
-@@ -155,9 +155,8 @@ int main(int argc, char *argv[]) {
-                 }
+         switch (a) {
+diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c
+index 63d64b2..57264de 100644
+--- a/src/test/test-path-util.c
++++ b/src/test/test-path-util.c
+@@ -85,29 +85,30 @@ static void test_path(void) {
          }
- 
--        err = udev_event_execute_rules(event, rules, &sigmask_orig);
--        if (err == 0)
--                udev_event_execute_run(event, NULL);
-+        udev_event_execute_rules(event, rules, &sigmask_orig);
-+        udev_event_execute_run(event, NULL);
- out:
-         if (event != NULL && event->fd_signal >= 0)
-                 close(event->fd_signal);
-diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
-index 33e7cbc..04b472d 100644
---- a/src/tmpfiles/tmpfiles.c
-+++ b/src/tmpfiles/tmpfiles.c
-@@ -217,19 +217,16 @@ static bool unix_socket_alive(const char *fn) {
  }
  
- static int dir_is_mount_point(DIR *d, const char *subdir) {
--        struct file_handle *h;
-+        union file_handle_union h = { .handle.handle_bytes = MAX_HANDLE_SZ };
-         int mount_id_parent, mount_id;
-         int r_p, r;
- 
--        h = alloca(MAX_HANDLE_SZ);
--
--        h->handle_bytes = MAX_HANDLE_SZ;
--        r_p = name_to_handle_at(dirfd(d), ".", h, &mount_id_parent, 0);
-+        r_p = name_to_handle_at(dirfd(d), ".", &h.handle, &mount_id_parent, 0);
-         if (r_p < 0)
-                 r_p = -errno;
- 
--        h->handle_bytes = MAX_HANDLE_SZ;
--        r = name_to_handle_at(dirfd(d), subdir, h, &mount_id, 0);
-+        h.handle.handle_bytes = MAX_HANDLE_SZ;
-+        r = name_to_handle_at(dirfd(d), subdir, &h.handle, &mount_id, 0);
-         if (r < 0)
-                 r = -errno;
- 
-diff --git a/src/tty-ask-password-agent/tty-ask-password-agent.c b/src/tty-ask-password-agent/tty-ask-password-agent.c
-index 1d067af..3203474 100644
---- a/src/tty-ask-password-agent/tty-ask-password-agent.c
-+++ b/src/tty-ask-password-agent/tty-ask-password-agent.c
-@@ -432,7 +432,7 @@ static int wall_tty_block(void) {
- 
-         r = get_ctty_devnr(0, &devnr);
-         if (r < 0)
--                return -r;
-+                return r;
- 
-         if (asprintf(&p, "/run/systemd/ask-password-block/%u:%u", major(devnr), minor(devnr)) < 0)
-                 return -ENOMEM;
-diff --git a/src/udev/accelerometer/accelerometer.c b/src/udev/accelerometer/accelerometer.c
-index 925d38d..32adf27 100644
---- a/src/udev/accelerometer/accelerometer.c
-+++ b/src/udev/accelerometer/accelerometer.c
-@@ -180,7 +180,7 @@ get_prev_orientation(struct udev_device *dev)
-         return string_to_orientation(value);
+-static void test_find_binary(const char *self) {
++static void test_find_binary(const char *self, bool local) {
+         char *p;
+ 
+-        assert_se(find_binary("/bin/sh", &p) == 0);
++        assert_se(find_binary("/bin/sh", local, &p) == 0);
+         puts(p);
+         assert_se(streq(p, "/bin/sh"));
+         free(p);
+ 
+-        assert_se(find_binary(self, &p) == 0);
++        assert_se(find_binary(self, local, &p) == 0);
+         puts(p);
+         assert_se(endswith(p, "/test-path-util"));
+         assert_se(path_is_absolute(p));
+         free(p);
+ 
+-        assert_se(find_binary("sh", &p) == 0);
++        assert_se(find_binary("sh", local, &p) == 0);
+         puts(p);
+         assert_se(endswith(p, "/sh"));
+         assert_se(path_is_absolute(p));
+         free(p);
+ 
+-        assert_se(find_binary("xxxx-xxxx", &p) == -ENOENT);
++        assert_se(find_binary("xxxx-xxxx", local, &p) == -ENOENT);
+ 
+-        assert_se(find_binary("/some/dir/xxxx-xxxx", &p) == -ENOENT);
++        assert_se(find_binary("/some/dir/xxxx-xxxx", local, &p) ==
++                  (local ? -ENOENT : 0));
  }
  
--#define SET_AXIS(axis, code_) if (ev[i].code == code_) { if (got_##axis == 0) { axis = ev[i].value; got_##axis = true; } }
-+#define READ_AXIS(axis, var) { memzero(&abs_info, sizeof(abs_info)); r = ioctl(fd, EVIOCGABS(axis), &abs_info); if (r < 0) return; var = abs_info.value; }
- 
- /* accelerometers */
- static void test_orientation(struct udev *udev,
-@@ -189,10 +189,9 @@ static void test_orientation(struct udev *udev,
- {
-         OrientationUp old, new;
-         _cleanup_close_ int fd = -1;
--        struct input_event ev[64];
--        bool got_syn = false;
--        bool got_x = false, got_y = false, got_z = false;
-+        struct input_absinfo abs_info;
-         int x = 0, y = 0, z = 0;
-+        int r;
-         char text[64];
- 
-         old = get_prev_orientation(dev);
-@@ -201,30 +200,10 @@ static void test_orientation(struct udev *udev,
-         if (fd < 0)
-                 return;
- 
--        while (1) {
--                int i, r;
--
--                r = read(fd, ev, sizeof(struct input_event) * 64);
--
--                if (r < (int) sizeof(struct input_event))
--                        return;
--
--                for (i = 0; i < r / (int) sizeof(struct input_event); i++) {
--                        if (got_syn) {
--                                if (ev[i].type == EV_ABS) {
--                                        SET_AXIS(x, ABS_X);
--                                        SET_AXIS(y, ABS_Y);
--                                        SET_AXIS(z, ABS_Z);
--                                }
--                        }
--                        if (ev[i].type == EV_SYN && ev[i].code == SYN_REPORT)
--                                got_syn = true;
--                        if (got_x && got_y && got_z)
--                                goto read_dev;
--                }
--        }
-+        READ_AXIS(ABS_X, x);
-+        READ_AXIS(ABS_Y, y);
-+        READ_AXIS(ABS_Z, z);
- 
--read_dev:
-         new = orientation_calc(old, x, y, z);
-         snprintf(text, sizeof(text),
-                  "ID_INPUT_ACCELEROMETER_ORIENTATION=%s", orientation_to_string(new));
-diff --git a/src/udev/net/link-config.c b/src/udev/net/link-config.c
-index 5bb6b02..b31ad80 100644
---- a/src/udev/net/link-config.c
-+++ b/src/udev/net/link-config.c
-@@ -184,7 +184,7 @@ failure:
- }
+ static void test_prefixes(void) {
+@@ -244,7 +245,8 @@ static void test_strv_resolve(void) {
  
- static bool enable_name_policy(void) {
--        _cleanup_free_ char *line;
-+        _cleanup_free_ char *line = NULL;
-         char *w, *state;
-         int r;
-         size_t l;
-@@ -391,7 +391,9 @@ int link_config_apply(link_config_ctx *ctx, link_config *config, struct udev_dev
-                 case MACPOLICY_PERSISTENT:
-                         if (!mac_is_permanent(device)) {
-                                 r = get_mac(device, false, &generated_mac);
--                                if (r < 0)
-+                                if (r == -ENOENT)
-+                                        break;
-+                                else if (r < 0)
-                                         return r;
-                                 mac = &generated_mac;
-                         }
-@@ -399,7 +401,9 @@ int link_config_apply(link_config_ctx *ctx, link_config *config, struct udev_dev
-                 case MACPOLICY_RANDOM:
-                         if (!mac_is_random(device)) {
-                                 r = get_mac(device, true, &generated_mac);
--                                if (r < 0)
-+                                if (r == -ENOENT)
-+                                        break;
-+                                else if (r < 0)
-                                         return r;
-                                 mac = &generated_mac;
-                         }
-diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
-index 5998be2..5213a4a 100644
---- a/src/udev/udev-event.c
-+++ b/src/udev/udev-event.c
-@@ -771,18 +771,17 @@ static int rename_netif(struct udev_event *event)
-                 log_error("error changing net interface name %s to %s: %s",
-                           oldname, name, strerror(-r));
-         else
--                print_kmsg("renamed network interface %s to %s", oldname, name);
-+                print_kmsg("renamed network interface %s to %s\n", oldname, name);
- 
-         return r;
- }
- 
--int udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules, const sigset_t *sigmask)
-+void udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules, const sigset_t *sigmask)
- {
-         struct udev_device *dev = event->dev;
--        int err = 0;
- 
-         if (udev_device_get_subsystem(dev) == NULL)
--                return -1;
-+                return;
- 
-         if (streq(udev_device_get_action(dev), "remove")) {
-                 udev_device_read_db(dev, NULL);
-@@ -816,9 +815,10 @@ int udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules,
-                     event->name != NULL && !streq(event->name, udev_device_get_sysname(dev))) {
-                         char syspath[UTIL_PATH_SIZE];
-                         char *pos;
-+                        int r;
- 
--                        err = rename_netif(event);
--                        if (err == 0) {
-+                        r = rename_netif(event);
-+                        if (r >= 0) {
-                                 log_debug("renamed netif to '%s'", event->name);
- 
-                                 /* remember old name */
-@@ -881,7 +881,6 @@ int udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules,
-                 udev_device_unref(event->dev_db);
-                 event->dev_db = NULL;
-         }
--        return err;
- }
- 
- void udev_event_execute_run(struct udev_event *event, const sigset_t *sigmask)
-diff --git a/src/udev/udev-rules.c b/src/udev/udev-rules.c
-index 2630264..17f47f2 100644
---- a/src/udev/udev-rules.c
-+++ b/src/udev/udev-rules.c
-@@ -2555,10 +2555,15 @@ int udev_rules_apply_static_dev_perms(struct udev_rules *rules)
-                         struct stat stats;
- 
-                         /* we assure, that the permissions tokens are sorted before the static token */
-+
-                         if (mode == 0 && uid == 0 && gid == 0 && tags == NULL)
-                                 goto next;
- 
-                         strscpyl(device_node, sizeof(device_node), "/dev/", rules_str(rules, cur->key.value_off), NULL);
-+                        if (stat(device_node, &stats) != 0)
-+                                break;
-+                        if (!S_ISBLK(stats.st_mode) && !S_ISCHR(stats.st_mode))
-+                                break;
- 
-                         /* export the tags to a directory as symlinks, allowing otherwise dead nodes to be tagged */
-                         if (tags) {
-@@ -2588,11 +2593,6 @@ int udev_rules_apply_static_dev_perms(struct udev_rules *rules)
-                         if (mode == 0 && uid == 0 && gid == 0)
-                                 break;
- 
--                        if (stat(device_node, &stats) != 0)
--                                break;
--                        if (!S_ISBLK(stats.st_mode) && !S_ISCHR(stats.st_mode))
--                                break;
--
-                         if (mode == 0) {
-                                 if (gid > 0)
-                                         mode = 0660;
-diff --git a/src/udev/udev.h b/src/udev/udev.h
-index 936adfb..62538bc 100644
---- a/src/udev/udev.h
-+++ b/src/udev/udev.h
-@@ -84,7 +84,7 @@ int udev_event_apply_subsys_kernel(struct udev_event *event, const char *string,
- int udev_event_spawn(struct udev_event *event,
-                      const char *cmd, char **envp, const sigset_t *sigmask,
-                      char *result, size_t ressize);
--int udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules, const sigset_t *sigset);
-+void udev_event_execute_rules(struct udev_event *event, struct udev_rules *rules, const sigset_t *sigset);
- void udev_event_execute_run(struct udev_event *event, const sigset_t *sigset);
- int udev_build_argv(struct udev *udev, char *cmd, int *argc, char *argv[]);
- 
-diff --git a/src/udev/udevadm-test.c b/src/udev/udevadm-test.c
-index 6cd311b..6a2f548 100644
---- a/src/udev/udevadm-test.c
-+++ b/src/udev/udevadm-test.c
-@@ -43,7 +43,6 @@ static int adm_test(struct udev *udev, int argc, char *argv[])
-         _cleanup_udev_device_unref_ struct udev_device *dev = NULL;
-         _cleanup_udev_event_unref_ struct udev_event *event = NULL;
-         sigset_t mask, sigmask_orig;
--        int err;
-         int rc = 0, c;
- 
-         static const struct option options[] = {
-@@ -139,18 +138,16 @@ static int adm_test(struct udev *udev, int argc, char *argv[])
-                 goto out;
-         }
- 
--        err = udev_event_execute_rules(event, rules, &sigmask_orig);
-+        udev_event_execute_rules(event, rules, &sigmask_orig);
- 
-         udev_list_entry_foreach(entry, udev_device_get_properties_list_entry(dev))
-                 printf("%s=%s\n", udev_list_entry_get_name(entry), udev_list_entry_get_value(entry));
- 
--        if (err == 0) {
--                udev_list_entry_foreach(entry, udev_list_get_entry(&event->run_list)) {
--                        char program[UTIL_PATH_SIZE];
-+        udev_list_entry_foreach(entry, udev_list_get_entry(&event->run_list)) {
-+                char program[UTIL_PATH_SIZE];
- 
--                        udev_event_apply_format(event, udev_list_entry_get_name(entry), program, sizeof(program));
--                        printf("run: '%s'\n", program);
--                }
-+                udev_event_apply_format(event, udev_list_entry_get_name(entry), program, sizeof(program));
-+                printf("run: '%s'\n", program);
-         }
- out:
-         if (event != NULL && event->fd_signal >= 0)
+ int main(int argc, char **argv) {
+         test_path();
+-        test_find_binary(argv[0]);
++        test_find_binary(argv[0], true);
++        test_find_binary(argv[0], false);
+         test_prefixes();
+         test_path_join();
+         test_fsck_exists();
 diff --git a/src/udev/udevd.c b/src/udev/udevd.c
-index f21c227..93afca1 100644
+index 2e6c713..193702c 100644
 --- a/src/udev/udevd.c
 +++ b/src/udev/udevd.c
-@@ -288,10 +288,9 @@ static void worker_new(struct event *event)
-                                 udev_event->exec_delay = exec_delay;
- 
-                         /* apply rules, create node, symlinks */
--                        err = udev_event_execute_rules(udev_event, rules, &sigmask_orig);
-+                        udev_event_execute_rules(udev_event, rules, &sigmask_orig);
- 
--                        if (err == 0)
--                                udev_event_execute_run(udev_event, &sigmask_orig);
-+                        udev_event_execute_run(udev_event, &sigmask_orig);
- 
-                         /* apply/restore inotify watch */
-                         if (err == 0 && udev_event->inotify_watch) {
-diff --git a/src/vconsole/vconsole-setup.c b/src/vconsole/vconsole-setup.c
-index 0f2b706..645b1e6 100644
---- a/src/vconsole/vconsole-setup.c
-+++ b/src/vconsole/vconsole-setup.c
-@@ -180,6 +180,10 @@ static int font_load(const char *vc, const char *font, const char *map, const ch
-  */
- static void font_copy_to_all_vcs(int fd) {
-         struct vt_stat vcs = {};
-+        unsigned char map8[E_TABSZ];
-+        unsigned short map16[E_TABSZ];
-+        struct unimapdesc unimapd;
-+        struct unipair unipairs[USHRT_MAX];
-         int i, r;
- 
-         /* get active, and 16 bit mask of used VT numbers */
-@@ -209,17 +213,35 @@ static void font_copy_to_all_vcs(int fd) {
-                 cfo.op = KD_FONT_OP_COPY;
-                 cfo.height = vcs.v_active-1; /* tty1 == index 0 */
-                 ioctl(vcfd, KDFONTOP, &cfo);
-+
-+                /* copy map of 8bit chars */
-+                if (ioctl(fd, GIO_SCRNMAP, map8) >= 0)
-+                    ioctl(vcfd, PIO_SCRNMAP, map8);
-+
-+                /* copy map of 8bit chars -> 16bit Unicode values */
-+                if (ioctl(fd, GIO_UNISCRNMAP, map16) >= 0)
-+                    ioctl(vcfd, PIO_UNISCRNMAP, map16);
-+
-+                /* copy unicode translation table */
-+                /* unimapd is a ushort count and a pointer to an
-+                   array of struct unipair { ushort, ushort } */
-+                unimapd.entries  = unipairs;
-+                unimapd.entry_ct = USHRT_MAX;
-+                if (ioctl(fd, GIO_UNIMAP, &unimapd) >= 0) {
-+                        struct unimapinit adv = { 0, 0, 0 };
-+
-+                        ioctl(vcfd, PIO_UNIMAPCLR, &adv);
-+                        ioctl(vcfd, PIO_UNIMAP, &unimapd);
-+                }
-         }
- }
- 
- int main(int argc, char **argv) {
-         const char *vc;
--        char *vc_keymap = NULL;
--        char *vc_keymap_toggle = NULL;
--        char *vc_font = NULL;
--        char *vc_font_map = NULL;
--        char *vc_font_unimap = NULL;
--        int fd = -1;
-+        _cleanup_free_ char
-+                *vc_keymap = NULL, *vc_keymap_toggle = NULL,
-+                *vc_font = NULL, *vc_font_map = NULL, *vc_font_unimap = NULL;
-+        _cleanup_close_ int fd = -1;
-         bool utf8;
-         pid_t font_pid = 0, keymap_pid = 0;
-         bool font_copy = false;
-@@ -241,12 +263,12 @@ int main(int argc, char **argv) {
-         fd = open_terminal(vc, O_RDWR|O_CLOEXEC);
-         if (fd < 0) {
-                 log_error("Failed to open %s: %m", vc);
--                goto finish;
-+                return EXIT_FAILURE;
-         }
- 
-         if (!is_vconsole(fd)) {
-                 log_error("Device %s is not a virtual console.", vc);
--                goto finish;
-+                return EXIT_FAILURE;
-         }
- 
-         utf8 = is_locale_utf8();
-@@ -281,27 +303,27 @@ int main(int argc, char **argv) {
-         else
-                 disable_utf8(fd);
- 
--        r = EXIT_FAILURE;
--        if (keymap_load(vc, vc_keymap, vc_keymap_toggle, utf8, &keymap_pid) >= 0 &&
--            font_load(vc, vc_font, vc_font_map, vc_font_unimap, &font_pid) >= 0)
--                r = EXIT_SUCCESS;
--
--finish:
--        if (keymap_pid > 0)
--                wait_for_terminate_and_warn(KBD_LOADKEYS, keymap_pid);
-+        r = font_load(vc, vc_font, vc_font_map, vc_font_unimap, &font_pid);
-+        if (r < 0) {
-+                log_error("Failed to start " KBD_SETFONT ": %s", strerror(-r));
-+                return EXIT_FAILURE;
-+        }
- 
--        if (font_pid > 0) {
-+        if (font_pid > 0)
-                 wait_for_terminate_and_warn(KBD_SETFONT, font_pid);
--                if (font_copy)
--                        font_copy_to_all_vcs(fd);
-+
-+        r = keymap_load(vc, vc_keymap, vc_keymap_toggle, utf8, &keymap_pid);
-+        if (r < 0) {
-+                log_error("Failed to start " KBD_LOADKEYS ": %s", strerror(-r));
-+                return EXIT_FAILURE;
-         }
- 
--        free(vc_keymap);
--        free(vc_font);
--        free(vc_font_map);
--        free(vc_font_unimap);
-+        if (keymap_pid > 0)
-+                wait_for_terminate_and_warn(KBD_LOADKEYS, keymap_pid);
- 
--        safe_close(fd);
-+        /* Only copy the font when we started setfont successfully */
-+        if (font_copy && font_pid > 0)
-+                font_copy_to_all_vcs(fd);
- 
--        return r;
-+        return EXIT_SUCCESS;
- }
-diff --git a/tmpfiles.d/systemd.conf b/tmpfiles.d/systemd.conf
-index 7c6d6b9..c470045 100644
---- a/tmpfiles.d/systemd.conf
-+++ b/tmpfiles.d/systemd.conf
-@@ -23,6 +23,6 @@ d /run/systemd/machines 0755 root root -
- d /run/systemd/shutdown 0755 root root -
- 
- m /var/log/journal 2755 root systemd-journal - -
--m /var/log/journal/%m 2755 root systemd-journal - -
-+Z /var/log/journal/%m 2755 root systemd-journal - -
- m /run/log/journal 2755 root systemd-journal - -
--m /run/log/journal/%m 2755 root systemd-journal - -
-+Z /run/log/journal/%m 2755 root systemd-journal - -
+@@ -994,9 +994,9 @@ static void kernel_cmdline_options(struct udev *udev) {
+                         if (r < 0)
+                                 log_warning("Invalid udev.exec-delay ignored: %s", opt + 16);
+                 } else if (startswith(opt, "udev.event-timeout=")) {
+-                        r = safe_atou64(opt + 16, &arg_event_timeout_usec);
++                        r = safe_atou64(opt + 19, &arg_event_timeout_usec);
+                         if (r < 0) {
+-                                log_warning("Invalid udev.event-timeout ignored: %s", opt + 16);
++                                log_warning("Invalid udev.event-timeout ignored: %s", opt + 19);
+                                 break;
+                         }
+                         arg_event_timeout_usec *= USEC_PER_SEC;
 diff --git a/units/console-getty.service.m4.in b/units/console-getty.service.m4.in
 index 8ac51a4..cae9fb5 100644
 --- a/units/console-getty.service.m4.in
@@ -2642,11 +955,14 @@ index 8ac51a4..cae9fb5 100644
  Restart=always
  RestartSec=0
 diff --git a/units/container-getty@.service.m4.in b/units/container-getty@.service.m4.in
-index 4f7794b..bad2a9a 100644
+index 4f7794b..6dfc2e9 100644
 --- a/units/container-getty@.service.m4.in
 +++ b/units/container-getty@.service.m4.in
-@@ -16,7 +16,6 @@ Before=getty.target
+@@ -14,9 +14,9 @@ After=rc-local.service
+ )m4_dnl
+ Before=getty.target
  IgnoreOnIsolate=yes
++ConditionPathExists=/dev/pts/%I
  
  [Service]
 -ExecStart=-/sbin/agetty --noclear --keep-baud pts/%I 115200,38400,9600 $TERM
@@ -2654,19 +970,19 @@ index 4f7794b..bad2a9a 100644
  Restart=always
  RestartSec=0
 diff --git a/units/emergency.service.in b/units/emergency.service.in
-index 94c090f..0d20640 100644
+index 18973e7..3a99660 100644
 --- a/units/emergency.service.in
 +++ b/units/emergency.service.in
-@@ -15,7 +15,6 @@ Before=shutdown.target
+@@ -16,7 +16,6 @@ Before=shutdown.target
  [Service]
  Environment=HOME=/root
  WorkingDirectory=/root
 -ExecStartPre=-/bin/plymouth quit
- ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" to try again\\nto boot into default mode.'
- ExecStart=-/sbin/sulogin
- ExecStopPost=@SYSTEMCTL@ --fail --no-block default
+ ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" or ^D to\\ntry again to boot into default mode.'
+ ExecStart=-/bin/sh -c "/sbin/sulogin; @SYSTEMCTL@ --fail --no-block default"
+ Type=idle
 diff --git a/units/getty@.service.m4 b/units/getty@.service.m4
-index aa853b8..8bcc647 100644
+index 46164ab..f194a31 100644
 --- a/units/getty@.service.m4
 +++ b/units/getty@.service.m4
 @@ -23,11 +23,12 @@ IgnoreOnIsolate=yes
@@ -2685,23 +1001,23 @@ index aa853b8..8bcc647 100644
  Restart=always
  RestartSec=0
 diff --git a/units/kmod-static-nodes.service.in b/units/kmod-static-nodes.service.in
-index 368f980..d0c1bd2 100644
+index 0934a87..7e30c9e 100644
 --- a/units/kmod-static-nodes.service.in
 +++ b/units/kmod-static-nodes.service.in
 @@ -10,7 +10,6 @@ Description=Create list of required static device nodes for the current kernel
  DefaultDependencies=no
  Before=sysinit.target systemd-tmpfiles-setup-dev.service
- ConditionCapability=CAP_MKNOD
+ ConditionCapability=CAP_SYS_MODULE
 -ConditionPathExists=/lib/modules/%v/modules.devname
  
  [Service]
  Type=oneshot
 diff --git a/units/local-fs.target b/units/local-fs.target
-index ae3cedc..0e36840 100644
+index d2e5429..d26984b 100644
 --- a/units/local-fs.target
 +++ b/units/local-fs.target
-@@ -13,3 +13,5 @@ DefaultDependencies=no
- Conflicts=shutdown.target
+@@ -13,3 +13,5 @@ Conflicts=shutdown.target
+ After=local-fs-pre.target
  OnFailure=emergency.target
  OnFailureJobMode=replace-irreversibly
 +
@@ -2718,47 +1034,43 @@ index 43ffa5c..156a681 100644
 +
  [Install]
  WantedBy=multi-user.target
-diff --git a/units/rescue.service.m4.in b/units/rescue.service.m4.in
-index 552ef89..af3915f 100644
---- a/units/rescue.service.m4.in
-+++ b/units/rescue.service.m4.in
+diff --git a/units/rescue.service.in b/units/rescue.service.in
+index fc93f1e..3c87cf8 100644
+--- a/units/rescue.service.in
++++ b/units/rescue.service.in
 @@ -16,7 +16,6 @@ Before=shutdown.target
  [Service]
  Environment=HOME=/root
  WorkingDirectory=/root
 -ExecStartPre=-/bin/plymouth quit
- ExecStartPre=-/bin/echo -e 'Welcome to rescue mode! Type "systemctl default" or ^D to enter default mode.\\nType "journalctl -xb" to view system logs. Type "systemctl reboot" to reboot.'
- ExecStart=-/sbin/sulogin
- ExecStopPost=-@SYSTEMCTL@ --fail --no-block default
+ ExecStartPre=-/bin/echo -e 'Welcome to emergency mode! After logging in, type "journalctl -xb" to view\\nsystem logs, "systemctl reboot" to reboot, "systemctl default" or ^D to\\nboot into default mode.'
+ ExecStart=-/bin/sh -c "/sbin/sulogin; @SYSTEMCTL@ --fail --no-block default"
+ Type=idle
 diff --git a/units/serial-getty@.service.m4 b/units/serial-getty@.service.m4
-index 4ac51e7..96daa5c 100644
+index 4522d0d..96daa5c 100644
 --- a/units/serial-getty@.service.m4
 +++ b/units/serial-getty@.service.m4
-@@ -22,10 +22,8 @@ Before=getty.target
+@@ -22,7 +22,6 @@ Before=getty.target
  IgnoreOnIsolate=yes
  
  [Service]
 -ExecStart=-/sbin/agetty --keep-baud 115200,38400,9600 %I $TERM
  Type=idle
  Restart=always
--RestartSec=0
  UtmpIdentifier=%I
- TTYPath=/dev/%I
- TTYReset=yes
 diff --git a/units/sysinit.target b/units/sysinit.target
-index 8f4fb8f..e0f0147 100644
+index ec33503..4ac47b9 100644
 --- a/units/sysinit.target
 +++ b/units/sysinit.target
-@@ -9,6 +9,5 @@
+@@ -9,5 +9,4 @@
  Description=System Initialization
  Documentation=man:systemd.special(7)
  Conflicts=emergency.service emergency.target
 -Wants=local-fs.target swap.target
 -After=local-fs.target swap.target emergency.service emergency.target
 +After=emergency.service emergency.target
- RefuseManualStart=yes
 diff --git a/units/systemd-backlight@.service.in b/units/systemd-backlight@.service.in
-index e945d87..77728f2 100644
+index ecf3de4..7e83446 100644
 --- a/units/systemd-backlight@.service.in
 +++ b/units/systemd-backlight@.service.in
 @@ -19,3 +19,4 @@ Type=oneshot
@@ -2767,25 +1079,34 @@ index e945d87..77728f2 100644
  ExecStop=@rootlibexecdir@/systemd-backlight save %i
 +X-RestartIfChanged=false
 diff --git a/units/systemd-journal-flush.service.in b/units/systemd-journal-flush.service.in
-index 503e8a6..fe23b8b 100644
+index 699670b..ba22c6d 100644
 --- a/units/systemd-journal-flush.service.in
 +++ b/units/systemd-journal-flush.service.in
-@@ -10,8 +10,9 @@ Description=Trigger Flushing of Journal to Persistent Storage
+@@ -10,8 +10,10 @@ Description=Trigger Flushing of Journal to Persistent Storage
  Documentation=man:systemd-journald.service(8) man:journald.conf(5)
  DefaultDependencies=no
  Requires=systemd-journald.service
 -After=systemd-journald.service local-fs.target remote-fs.target
 +After=systemd-journald.service
- Before=systemd-user-sessions.service
++After=systemd-remount-fs.service
+ Before=systemd-user-sessions.service systemd-tmpfiles-setup.service
 +RequiresMountsFor=/var/log/journal
  
  [Service]
- ExecStart=@rootbindir@/systemctl kill --kill-who=main --signal=SIGUSR1 systemd-journald.service
+ ExecStart=@rootbindir@/journalctl --flush
 diff --git a/units/systemd-journald.service.in b/units/systemd-journald.service.in
-index de93879..c9a49f3 100644
+index 4de38fa..2f23c13 100644
 --- a/units/systemd-journald.service.in
 +++ b/units/systemd-journald.service.in
-@@ -25,3 +25,8 @@ WatchdogSec=1min
+@@ -14,6 +14,7 @@ After=systemd-journald.socket systemd-journald-dev-log.socket syslog.socket
+ Before=sysinit.target
+ 
+ [Service]
++Type=notify
+ Sockets=systemd-journald.socket systemd-journald-dev-log.socket
+ ExecStart=@rootlibexecdir@/systemd-journald
+ Restart=always
+@@ -26,3 +27,8 @@ WatchdogSec=1min
  # Increase the default a bit in order to allow many simultaneous
  # services being run since we keep one fd open per service.
  LimitNOFILE=16384
@@ -2794,20 +1115,8 @@ index de93879..c9a49f3 100644
 +# journald to stop logging (see
 +# https://bugs.freedesktop.org/show_bug.cgi?id=56043).
 +X-RestartIfChanged=no
-diff --git a/units/systemd-nspawn@.service.in b/units/systemd-nspawn@.service.in
-index ff36e90..e373628 100644
---- a/units/systemd-nspawn@.service.in
-+++ b/units/systemd-nspawn@.service.in
-@@ -11,6 +11,7 @@ Documentation=man:systemd-nspawn(1)
- 
- [Service]
- ExecStart=@bindir@/systemd-nspawn --quiet --keep-unit --boot --link-journal=guest --directory=/var/lib/container/%i
-+KillMode=mixed
- Type=notify
- 
- [Install]
 diff --git a/units/systemd-random-seed.service.in b/units/systemd-random-seed.service.in
-index 1879b2f..9b895b9 100644
+index b55844b..3ef9fc6 100644
 --- a/units/systemd-random-seed.service.in
 +++ b/units/systemd-random-seed.service.in
 @@ -19,3 +19,4 @@ Type=oneshot
@@ -2816,7 +1125,7 @@ index 1879b2f..9b895b9 100644
  ExecStop=@rootlibexecdir@/systemd-random-seed save
 +X-RestartIfChanged=false
 diff --git a/units/systemd-rfkill@.service.in b/units/systemd-rfkill@.service.in
-index 9d264a2..c505535 100644
+index 0e9851b..9f8fa0d 100644
 --- a/units/systemd-rfkill@.service.in
 +++ b/units/systemd-rfkill@.service.in
 @@ -19,3 +19,4 @@ Type=oneshot
@@ -2825,28 +1134,28 @@ index 9d264a2..c505535 100644
  ExecStop=@rootlibexecdir@/systemd-rfkill save %I
 +X-RestartIfChanged=false
 diff --git a/units/systemd-tmpfiles-setup.service.in b/units/systemd-tmpfiles-setup.service.in
-index 01043b7..507f820 100644
+index e895cda..194146f 100644
 --- a/units/systemd-tmpfiles-setup.service.in
 +++ b/units/systemd-tmpfiles-setup.service.in
-@@ -12,7 +12,7 @@ DefaultDependencies=no
- Wants=local-fs.target
+@@ -11,7 +11,7 @@ Documentation=man:tmpfiles.d(5) man:systemd-tmpfiles(8)
+ DefaultDependencies=no
  Conflicts=shutdown.target
- After=systemd-readahead-collect.service systemd-readahead-replay.service local-fs.target
+ After=local-fs.target systemd-sysusers.service
 -Before=sysinit.target shutdown.target
 +Before=shutdown.target
- ConditionDirectoryNotEmpty=|/usr/lib/tmpfiles.d
- ConditionDirectoryNotEmpty=|/lib/tmpfiles.d
- ConditionDirectoryNotEmpty=|/usr/local/lib/tmpfiles.d
+ RefuseManualStop=yes
+ 
+ [Service]
 diff --git a/units/systemd-update-utmp.service.in b/units/systemd-update-utmp.service.in
-index da7dda7..e638145 100644
+index 163eccd..7357c12 100644
 --- a/units/systemd-update-utmp.service.in
 +++ b/units/systemd-update-utmp.service.in
 @@ -11,7 +11,7 @@ Documentation=man:systemd-update-utmp.service(8) man:utmp(5)
  DefaultDependencies=no
  RequiresMountsFor=/var/log/wtmp
  Conflicts=shutdown.target
--After=systemd-readahead-collect.service systemd-readahead-replay.service systemd-remount-fs.service systemd-tmpfiles-setup.service auditd.service
-+After=systemd-readahead-collect.service systemd-readahead-replay.service systemd-remount-fs.service auditd.service
+-After=systemd-remount-fs.service systemd-tmpfiles-setup.service auditd.service
++After=systemd-remount-fs.service auditd.service
  Before=sysinit.target shutdown.target
  
  [Service]
diff --git a/pkgs/os-specific/linux/sysvinit/default.nix b/pkgs/os-specific/linux/sysvinit/default.nix
index 7b4ecbb027e..042e601ec14 100644
--- a/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/pkgs/os-specific/linux/sysvinit/default.nix
@@ -43,5 +43,6 @@ stdenv.mkDerivation {
   meta = {
     homepage = http://www.nongnu.org/sysvinit/;
     description = "Utilities related to booting and shutdown";
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/uclibc/default.nix b/pkgs/os-specific/linux/uclibc/default.nix
index a0df3d526f5..88cf59cf8b7 100644
--- a/pkgs/os-specific/linux/uclibc/default.nix
+++ b/pkgs/os-specific/linux/uclibc/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, linuxHeaders, libiconv, cross ? null, gccCross ? null,
+{stdenv, fetchurl, linuxHeaders, libiconvReal, cross ? null, gccCross ? null,
 extraConfig ? ""}:
 
 assert stdenv.isLinux;
@@ -16,18 +16,13 @@ let
                 continue
             fi
 
-            if test "$NAME" == "CLEAR"; then
-                echo "parseconfig: CLEAR"
-                echo > .config
-            fi
-
             echo "parseconfig: removing $NAME"
             sed -i /^$NAME=/d .config
 
-            if test "$OPTION" != n; then
+            #if test "$OPTION" != n; then
                 echo "parseconfig: setting $NAME=$OPTION"
                 echo "$NAME=$OPTION" >> .config
-            fi
+            #fi
         done
         set +x
     }
@@ -48,16 +43,24 @@ let
     UCLIBC_SUSV4_LEGACY y
     UCLIBC_HAS_THREADS_NATIVE y
     KERNEL_HEADERS "${linuxHeaders}/include"
+  '' + stdenv.lib.optionalString (stdenv.isArm && cross == null) ''
+    CONFIG_ARM_EABI y
+    ARCH_WANTS_BIG_ENDIAN n
+    ARCH_BIG_ENDIAN n
+    ARCH_WANTS_LITTLE_ENDIAN y
+    ARCH_LITTLE_ENDIAN y
+    UCLIBC_HAS_FPU n
   '';
 
 in
+
 stdenv.mkDerivation {
-  name = "uclibc-0.9.33.2" + stdenv.lib.optionalString (cross != null)
+  name = "uclibc-0.9.34-pre-20150131" + stdenv.lib.optionalString (cross != null)
     ("-" + cross.config);
 
   src = fetchurl {
-    url = http://www.uclibc.org/downloads/uClibc-0.9.33.2.tar.bz2;
-    sha256 = "0qhngsbzj2s6nz92b1s2p0dmvwk8xiqpy58j7ljzw186grvjr3cq";
+    url = http://www.uclibc.org/downloads/snapshots/uClibc-20150131.tar.bz2;
+    sha256 = "14svyxw4nizdcz4vqk9nizlgy32d8ngpvcca34jjbdjjg77xdvkc";
   };
 
   # 'ftw' needed to build acl, a coreutils dependency
@@ -80,6 +83,8 @@ stdenv.mkDerivation {
 
   buildInputs = stdenv.lib.optional (gccCross != null) gccCross;
 
+  enableParallelBuilding = true;
+
   installPhase = ''
     mkdir -p $out
     make PREFIX=$out VERBOSE=1 install ${crossMakeFlag}
@@ -90,9 +95,9 @@ stdenv.mkDerivation {
 
   passthru = {
     # Derivations may check for the existance of this attribute, to know what to link to.
-    inherit libiconv;
+    libiconv = libiconvReal;
   };
-  
+
   meta = {
     homepage = http://www.uclibc.org/;
     description = "A small implementation of the C library";
diff --git a/pkgs/os-specific/linux/udisks-glue/default.nix b/pkgs/os-specific/linux/udisks-glue/default.nix
index 9f99d5e9f20..2dfc8f1b520 100644
--- a/pkgs/os-specific/linux/udisks-glue/default.nix
+++ b/pkgs/os-specific/linux/udisks-glue/default.nix
@@ -17,6 +17,6 @@ stdenv.mkDerivation {
     description = "A tool to associate udisks events to user-defined actions";
     platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [pSub];
-    license = "free";
+    license = stdenv.lib.licenses.free;
   };
 }
diff --git a/pkgs/os-specific/linux/udisks/1-default.nix b/pkgs/os-specific/linux/udisks/1-default.nix
index 09731d54ab7..b3df300e519 100644
--- a/pkgs/os-specific/linux/udisks/1-default.nix
+++ b/pkgs/os-specific/linux/udisks/1-default.nix
@@ -3,14 +3,19 @@
 , libxslt, docbook_xsl, utillinux }:
 
 stdenv.mkDerivation rec {
-  name = "udisks-1.0.4";
+  name = "udisks-1.0.5";
 
   src = fetchurl {
     url = "http://hal.freedesktop.org/releases/${name}.tar.gz";
-    sha256 = "1xgqifddwaavmjc8c30i0mdffyirsld7c6qhfyjw7f9khwv8jjw5";
+    sha256 = "0wbg3jrv8limdgvcygf4dqin3y6d30y9pcmmk711vq571vmq5v7j";
   };
 
-  patches = [ ./purity.patch ./no-pci-db.patch ./cve-2014-0004.patch ];
+  patches = [ ./purity.patch ./no-pci-db.patch ];
+
+  preConfigure =
+    ''
+      configureFlagsArray+=(--with-systemdsystemunitdir=$out/lib/systemd/system)
+    '';
 
   postPatch =
     ''
@@ -18,7 +23,7 @@ stdenv.mkDerivation rec {
 
       substituteInPlace src/main.c --replace \
         "/sbin:/bin:/usr/sbin:/usr/bin" \
-        "${utillinux}/bin:${mdadm}/sbin:/var/run/current-system/sw/bin:/var/run/current-system/sw/sbin"
+        "${utillinux}/bin:${mdadm}/sbin:/var/run/current-system/sw/bin:/var/run/current-system/sw/bin"
     '';
 
   buildInputs =
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index 6c9b743fe17..2dc99504c58 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, intltool
-, expat, acl, udev, glib, libatasmart, polkit
+, expat, acl, systemd, glib, libatasmart, polkit
 , libxslt, docbook_xsl, utillinux, mdadm
 }:
 
 stdenv.mkDerivation rec {
-  name = "udisks-2.1.3";
+  name = "udisks-2.1.4";
 
   src = fetchurl {
     url = "http://udisks.freedesktop.org/releases/${name}.tar.bz2";
-    sha256 = "0bb3403pa23j317b7z9ikdigr6ll5cl93l4hiy4afjgfa7b2zjaw";
+    sha256 = "1fqrwmdyn5vc5r7wixh2f013ca1qf3kwy4ia8mh9282a7bfliqd4";
   };
 
   patches = [ ./force-path.patch ];
@@ -19,12 +19,12 @@ stdenv.mkDerivation rec {
     ''
       substituteInPlace src/main.c --replace \
         "@path@" \
-        "${utillinux}/bin:${mdadm}/sbin:/var/run/current-system/sw/bin:/var/run/current-system/sw/sbin"
+        "${utillinux}/bin:${mdadm}/sbin:/var/run/current-system/sw/bin:/var/run/current-system/sw/bin"
     '';
 
   nativeBuildInputs = [ pkgconfig intltool ];
 
-  propagatedBuildInputs = [ expat acl udev glib libatasmart polkit ]; # in closure anyway
+  propagatedBuildInputs = [ expat acl systemd glib libatasmart polkit ]; # in closure anyway
 
   buildInputs = [ libxslt docbook_xsl ];
 
diff --git a/pkgs/os-specific/linux/upower/0.99.nix b/pkgs/os-specific/linux/upower/0.99.nix
index c42fea16d35..58133db9023 100644
--- a/pkgs/os-specific/linux/upower/0.99.nix
+++ b/pkgs/os-specific/linux/upower/0.99.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, glib, dbus, dbus_glib, dbus_tools, polkit
+{ stdenv, fetchurl, pkgconfig, glib, dbus, dbus_glib, dbus_tools
 , intltool, libxslt, docbook_xsl, udev, libusb1, pmutils
 , useSystemd ? true, systemd, gobjectIntrospection
 }:
@@ -6,15 +6,15 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "upower-0.99.0";
+  name = "upower-0.99.2";
 
   src = fetchurl {
     url = "http://upower.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "189rd8j5czy4fs7imxvr38icjh9vlgdz6ki2h08v530h96clndaz";
+    sha256 = "0vwlh20jmaf01m38kfn8yx2869a3clmkzlycrj99rf4nvwx4bp79";
   };
 
   buildInputs =
-    [ dbus_glib polkit intltool libxslt docbook_xsl udev libusb1 gobjectIntrospection ]
+    [ dbus_glib intltool libxslt docbook_xsl udev libusb1 gobjectIntrospection ]
     ++ stdenv.lib.optional useSystemd systemd;
 
   nativeBuildInputs = [ pkgconfig ];
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional useSystemd
     [ "--enable-systemd"
       "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-      "--with-systemdutildir=$(out)/lib/systemd/system-sleep"
+      "--with-systemdutildir=$(out)/lib/systemd"
       "--with-udevrulesdir=$(out)/lib/udev/rules.d"
     ];
 
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 605d3d7adc5..90914284773 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional useSystemd
     [ "--enable-systemd"
       "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-      "--with-systemdutildir=$(out)/lib/systemd/system-sleep"
+      "--with-systemdutildir=$(out)/lib/systemd"
       "--with-udevrulesdir=$(out)/lib/udev/rules.d"
     ];
 
diff --git a/pkgs/os-specific/linux/upstart/default.nix b/pkgs/os-specific/linux/upstart/default.nix
index 6ad255caef4..1b3366f86f8 100644
--- a/pkgs/os-specific/linux/upstart/default.nix
+++ b/pkgs/os-specific/linux/upstart/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   
   src = fetchurl {
     url = "http://upstart.ubuntu.com/download/${version}/${name}.tar.gz";
-    md5 = "870920a75f8c13f3a3af4c35916805ac";
+    sha256 = "01w4ab6nlisz5blb0an1sxjkndwikr7sjp0cmz4lg00g3n7gahmx";
   };
 
   buildInputs = [ pkgconfig dbus libnih ];
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index aff730e387a..710a01ed03d 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -1,36 +1,25 @@
-{ stdenv, fetchurl, pkgconfig, libusb1 }:
-
-let
-
-  # Obtained from http://www.linux-usb.org/usb.ids.bz2.
-  usbids = fetchurl {
-    url = http://tarballs.nixos.org/usb.ids.20130821.bz2;
-    sha256 = "0x7mf4h5h5wjzhygfr4lc8yz0cwm7mahxrnp5nkxcmawmyxwsg53";
-  };
-
-in
+{ stdenv, fetchurl, pkgconfig, libusb1, hwdata }:
 
 stdenv.mkDerivation rec {
-  name = "usbutils-007";
+  name = "usbutils-008";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/usb/usbutils/${name}.tar.xz";
-    sha256 = "197gpbxnspy6ncqv5mziaikcfqgb3irbqqlfwjgzvh5v4hbs14vm";
+    sha256 = "132clk14j4nm8crln2jymdbbc2vhzar2j2hnxyh05m79pbq1lx24";
   };
 
   buildInputs = [ pkgconfig libusb1 ];
 
-  preBuild = "bunzip2 < ${usbids} > usb.ids";
-
   postInstall =
     ''
       rm $out/sbin/update-usbids.sh
       substituteInPlace $out/bin/lsusb.py \
-        --replace /usr/share/usb.ids $out/share/usb.ids
+        --replace /usr/share/usb.ids ${hwdata}/data/hwdata/usb.ids
     '';
 
   meta = {
     homepage = http://www.linux-usb.org/;
     description = "Tools for working with USB devices, such as lsusb";
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index 9bf8692d1ce..6f96445ef5e 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = https://github.com/tom5760/usermount;
-    description = "A simple tool to automatically mount removable drives using UDisks2 and D-Bus.";
+    description = "A simple tool to automatically mount removable drives using UDisks2 and D-Bus";
     license = stdenv.lib.licenses.mit;
     platforms = stdenv.lib.platforms.linux;
     maintainers = with stdenv.lib.maintainers; [ the-kenny ];
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 7b4ac6d04d4..c4ccd6d37f8 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,15 +1,26 @@
 { stdenv, fetchurl, zlib, ncurses ? null, perl ? null, pam }:
 
 stdenv.mkDerivation rec {
-  name = "util-linux-2.25";
+  name = "util-linux-2.26.1";
 
   src = fetchurl {
-    url = "http://www.kernel.org/pub/linux/utils/util-linux/v2.25/${name}.tar.xz";
-    sha256 = "02lqww6ck4p47wzc883zdjb1gnwm59hsay4hd5i55mfdv25mmfj7";
+    url = "mirror://kernel/linux/utils/util-linux/v2.26/${name}.tar.xz";
+    sha256 = "0vmvk5khfwf71xbsnplvmk9ikwnlbhysc96mnkgwpqk2faairp12";
   };
 
+  patches = [ ./rtcwake-search-PATH-for-shutdown.patch
+            ];
   outputs = [ "dev" "out" "bin" ]; # ToDo: problems with e2fsprogs
 
+
+  #FIXME: make it also work on non-nixos?
+  postPatch = ''
+    # Substituting store paths would create a circular dependency on systemd
+    substituteInPlace include/pathnames.h \
+      --replace "/bin/login" "/run/current-system/sw/bin/login" \
+      --replace "/sbin/shutdown" "/run/current-system/sw/bin/shutdown"
+  '';
+
   crossAttrs = {
     # Work around use of `AC_RUN_IFELSE'.
     preConfigure = "export scanf_cv_type_modifier=ms";
@@ -23,9 +34,8 @@ stdenv.mkDerivation rec {
     --enable-write
     --enable-last
     --enable-mesg
-    --enable-ddate
     --disable-use-tty-group
-    --enable-fs-paths-default=/var/setuid-wrappers:/var/run/current-system/sw/sbin:/sbin
+    --enable-fs-paths-default=/var/setuid-wrappers:/var/run/current-system/sw/bin:/sbin
     ${if ncurses == null then "--without-ncurses" else ""}
   '';
 
@@ -47,7 +57,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.kernel.org/pub/linux/utils/util-linux/;
     description = "A set of system utilities for Linux";
     license = licenses.gpl2; # also contains parts under more permissive licenses
-    platforms = platforms.all;
+    platforms = platforms.linux;
   };
 }
 
diff --git a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
new file mode 100644
index 00000000000..92cb07d4383
--- /dev/null
+++ b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
@@ -0,0 +1,30 @@
+Search $PATH for the shutdown binary instead of hard-coding /sbin/shutdown,
+which isn't valid on NixOS (and a compatibility link on most other modern
+distros anyway).
+
+  -- nckx <tobias.geerinckx.rice@gmail.com>
+
+diff -Naur a/include/pathnames.h b/include/pathnames.h
+--- a/include/pathnames.h	2014-09-16 14:37:06.138551680 +0200
++++ b/include/pathnames.h	2015-01-01 20:41:02.510948314 +0100
+@@ -43,7 +43,7 @@
+ #define _PATH_INITTAB		"/etc/inittab"
+ #define _PATH_RC		"/etc/rc"
+ #define _PATH_REBOOT		"/sbin/reboot"
+-#define _PATH_SHUTDOWN		"/sbin/shutdown"
++#define _PATH_SHUTDOWN		"shutdown"
+ #define _PATH_SINGLE		"/etc/singleboot"
+ #define _PATH_SHUTDOWN_CONF	"/etc/shutdown.conf"
+ 
+diff -Naur a/sys-utils/rtcwake.c b/sys-utils/rtcwake.c
+--- a/sys-utils/rtcwake.c	2014-10-24 11:21:20.447389309 +0200
++++ b/sys-utils/rtcwake.c	2015-01-01 20:57:59.398911209 +0100
+@@ -582,7 +582,7 @@
+ 		arg[i]   = NULL;
+ 
+ 		if (!dryrun) {
+-			execv(arg[0], arg);
++			execvp(arg[0], arg);
+ 
+ 			warn(_("failed to execute %s"), _PATH_SHUTDOWN);
+ 			rc = EXIT_FAILURE;
diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index c220d2d2dd0..1a27ae8f571 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -1,26 +1,57 @@
-{stdenv, fetchurl, which, libjpeg
-, withQt4 ? false, qt4 ? null}:
+{ stdenv, fetchurl, pkgconfig
+, libjpeg
+, alsaLib ? null
+, libX11 ? null
+, qt4 ? null # The default is set to qt4 in all-packages.nix
+, qt5 ? null
+}:
 
-assert withQt4 -> qt4 != null;
+# See libv4l in all-packages.nix for the libs only (overrides alsa, libX11 & QT)
+
+assert qt4 != null -> qt5 == null;
+assert qt5 != null -> qt4 == null;
+
+let
+  inherit (stdenv.lib) optional;
+in
 
 stdenv.mkDerivation rec {
-  name = "v4l-utils-1.0.0";
+  name = "v4l-utils-1.6.2";
 
   src = fetchurl {
     url = "http://linuxtv.org/downloads/v4l-utils/${name}.tar.bz2";
-    sha256 = "0c2z500ijxr1ldzb4snasfpwi2icp04f8pk7akiqjkp0k4h8iqqx";
+    sha256 = "0zdyjrja2mkqlijpdb4gz1vw0g7pslswmgqqsgri3yq408gypmnk";
   };
 
-  buildInputs = [ which ];
-  propagatedBuildInputs = [ libjpeg ] ++ stdenv.lib.optional withQt4 qt4;
+  configureFlags = [
+    "--enable-libv4l"
+  ] ++ (if (alsaLib != null && libX11 != null && (qt4 != null || qt5 != null)) then [
+    "--with-udevdir=\${out}/lib/udev"
+    "--enable-v4l-utils"
+    "--enable-qv4l2"
+  ] else [
+    "--without-libudev"
+    "--without-udevdir"
+    "--disable-v4l-utils"
+    "--disable-qv4l2"
+  ]);
+
+  postInstall = ''
+    # Create symlink for V4l1 compatibility
+    ln -s $out/include/libv4l1-videodev.h $out/include/videodev.h
+  '';
+
+  nativeBuildInputs = [ pkgconfig ];
 
-  preConfigure = ''configureFlags="--with-udevdir=$out/lib/udev"'';
+  buildInputs = [ alsaLib libX11 qt4 qt5 ];
+  
+  propagatedBuildInputs = [ libjpeg ];
 
-  meta = {
+  meta = with stdenv.lib; {
+    description = "V4L utils and libv4l, provide common image formats regardless of the v4l device";
     homepage = http://linuxtv.org/projects.php;
-    description = "V4L utils and libv4l, that provides common image formats regardless of the v4l device";
-    license = "free"; # The libs are of LGPLv2.1+, some other pieces are GPL.
-    maintainers = with stdenv.lib.maintainers; [viric];
-    platforms = with stdenv.lib.platforms; linux;
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ codyopel viric ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 5b88d4c7556..127341412ab 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation rec {
     sed -i '/depmod/d' Makefile
     export PATH=${kmod}/sbin:$PATH
   '';
+
+  patches = [ ./kernel-3.18-fix.patch ];
   
   buildInputs = [ kmod ];
   
diff --git a/pkgs/os-specific/linux/v4l2loopback/kernel-3.18-fix.patch b/pkgs/os-specific/linux/v4l2loopback/kernel-3.18-fix.patch
new file mode 100644
index 00000000000..9f6dc57f322
--- /dev/null
+++ b/pkgs/os-specific/linux/v4l2loopback/kernel-3.18-fix.patch
@@ -0,0 +1,31 @@
+From 21195cd6d1ff767a271359dfa7d201078f766611 Mon Sep 17 00:00:00 2001
+From: tatokis <tasos@tasossah.com>
+Date: Mon, 24 Nov 2014 16:28:33 +0200
+Subject: [PATCH] Updated v4l2loopback.c to compile on >= 3.18 kernel
+
+---
+ v4l2loopback.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/v4l2loopback.c b/v4l2loopback.c
+index bb228bb..67f6ed4 100644
+--- a/v4l2loopback.c
++++ b/v4l2loopback.c
+@@ -498,10 +498,15 @@ static ssize_t attr_store_maxopeners(struct device *cd,
+ {
+ 	struct v4l2_loopback_device *dev = NULL;
+ 	unsigned long curr = 0;
+-
++	
++	#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,18,0)
++	if (kstrtoul(buf, 0, &curr))
++		return -EINVAL;
++	#else
+ 	if (strict_strtoul(buf, 0, &curr))
+ 		return -EINVAL;
+-
++	#endif
++	
+ 	dev = v4l2loopback_cd2dev(cd);
+ 
+ 	if (dev->max_openers == curr)
diff --git a/pkgs/os-specific/linux/v86d/default.nix b/pkgs/os-specific/linux/v86d/default.nix
index 2ad3087d6a1..f7e0c5ca5e2 100644
--- a/pkgs/os-specific/linux/v86d/default.nix
+++ b/pkgs/os-specific/linux/v86d/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A userspace helper that runs x86 code in an emulated environment";
     homepage = http://dev.gentoo.org/~spock/projects/uvesafb/;
-    license = "BSD";
+    license = stdenv.lib.licenses.gpl2;
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 937f65089e9..988242e3c42 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -5,13 +5,13 @@
 assert readlineSupport -> readline != null;
 
 stdenv.mkDerivation rec {
-  version = "2.2";
+  version = "2.3";
 
   name = "wpa_supplicant-${version}";
 
   src = fetchurl {
     url = "http://hostap.epitest.fi/releases/${name}.tar.gz";
-    sha256 = "1vf8jc4yyksbxf86narvsli3vxfbm8nbnim2mdp66nd6d3yvin70";
+    sha256 = "0skvkl6c10ls4s48b2wmf47h9j1y40nlzxnzn8hyaw2j0prmpapa";
   };
 
   extraConfig =
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
     echo "$extraConfig" >> .config
     cat .config
     substituteInPlace Makefile --replace /usr/local $out
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I$(echo "${libnl}"/include/libnl*/)"
   '';
 
   buildInputs = [ openssl dbus_libs libnl ]
@@ -38,7 +39,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig ];
 
-  patches = [ ./libnl.patch ];
+  patches = [];
 
   postInstall = ''
     mkdir -p $out/share/man/man5 $out/share/man/man8
diff --git a/pkgs/os-specific/linux/wpa_supplicant/libnl.patch b/pkgs/os-specific/linux/wpa_supplicant/libnl.patch
deleted file mode 100644
index 477f8dd55f6..00000000000
--- a/pkgs/os-specific/linux/wpa_supplicant/libnl.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff -up wpa_supplicant-1.0-rc2/src/drivers/drivers.mak.foo wpa_supplicant-1.0-rc2/src/drivers/drivers.mak
---- wpa_supplicant-1.0-rc2/src/drivers/drivers.mak.foo	2012-03-02 16:11:43.176448714 -0600
-+++ wpa_supplicant-1.0-rc2/src/drivers/drivers.mak	2012-03-02 16:12:29.759866341 -0600
-@@ -48,7 +48,7 @@ NEED_RFKILL=y
- ifdef CONFIG_LIBNL32
-   DRV_LIBS += -lnl-3
-   DRV_LIBS += -lnl-genl-3
--  DRV_CFLAGS += -DCONFIG_LIBNL20 -I/usr/include/libnl3
-+  DRV_CFLAGS += -DCONFIG_LIBNL20 `pkg-config --cflags libnl-3.0`
- else
-   ifdef CONFIG_LIBNL_TINY
-     DRV_LIBS += -lnl-tiny
-
diff --git a/pkgs/os-specific/linux/x86info/default.nix b/pkgs/os-specific/linux/x86info/default.nix
index eaec63f98bf..54bd33cc92f 100644
--- a/pkgs/os-specific/linux/x86info/default.nix
+++ b/pkgs/os-specific/linux/x86info/default.nix
@@ -9,7 +9,12 @@ stdenv.mkDerivation rec {
     sha256 = "0a4lzka46nabpsrg3n7akwr46q38f96zfszd73xcback1s2hjc7y";
   };
 
-  preConfigure = "patchShebangs .";
+  preConfigure = ''
+    patchShebangs .
+
+    # ignore warnings
+    sed -i 's/-Werror -Wall//' Makefile
+  '';
 
   buildInputs = [ pciutils python ];
 
diff --git a/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index 962aca77753..5242aabe507 100644
--- a/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -3,11 +3,11 @@
 , ncurses, pkgconfig, randrproto, xorgserver, xproto, udev, libXinerama, pixman }:
 
 stdenv.mkDerivation rec {
-  name = "xf86-input-wacom-0.25.99.1";
+  name = "xf86-input-wacom-0.28.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxwacom/${name}.tar.bz2";
-    sha256 = "0vjl4m1w6j5j9yr2kw6f66n723ghq5jwxivbdjmacjw6r3ml4l9r";
+    sha256 = "0fr4ssdam8nxkahznqril8q2pbakb4r9ghhg61yl7997yy7006bw";
   };
 
   buildInputs = [ inputproto libX11 libXext libXi libXrandr libXrender
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 0242c586cea..06aca23369e 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -1,53 +1,14 @@
-{ stdenv, fetchurl, kernel, spl, perl, autoconf, automake, libtool, zlib, libuuid, coreutils, utillinux }:
+{ callPackage, fetchFromGitHub, ... } @ args:
 
-stdenv.mkDerivation {
-  name = "zfs-0.6.3-${kernel.version}";
+callPackage ./generic.nix (args // rec {
+  version = "0.6.4";
 
-  src = fetchurl {
-    url = http://archive.zfsonlinux.org/downloads/zfsonlinux/zfs/zfs-0.6.3.tar.gz;
-    sha256 = "06rrip9fxn13x6qnyp6br68r9pcygb95lld25hnnj88m2vagvg19";
+  src = fetchFromGitHub {
+    owner = "zfsonlinux";
+    repo = "zfs";
+    rev = "zfs-${version}";
+    sha256 = "0xlj2w6gadip3rr3f1lri1n93lkjpzyksnk01sbl5wsrbkry3xjq";
   };
 
-  patches = [ ./mount_zfs_prefix.patch ./nix-build.patch ];
-
-  buildInputs = [ spl perl autoconf automake libtool zlib libuuid coreutils ];
-
-  # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
-  NIX_CFLAGS_LINK = "-lgcc_s";
-
-  preConfigure = ''
-    ./autogen.sh
-
-    substituteInPlace ./module/zfs/zfs_ctldir.c    --replace "umount -t zfs"     "${utillinux}/bin/umount -t zfs"
-    substituteInPlace ./module/zfs/zfs_ctldir.c    --replace "mount -t zfs"      "${utillinux}/bin/mount -t zfs"
-    substituteInPlace ./lib/libzfs/libzfs_mount.c  --replace "/bin/umount"       "${utillinux}/bin/umount"
-    substituteInPlace ./lib/libzfs/libzfs_mount.c  --replace "/bin/mount"        "${utillinux}/bin/mount"
-    substituteInPlace ./udev/rules.d/*             --replace "/lib/udev/vdev_id" "$out/lib/udev/vdev_id"
-    substituteInPlace ./cmd/ztest/ztest.c          --replace "/usr/sbin/ztest"   "$out/sbin/ztest"
-    substituteInPlace ./cmd/ztest/ztest.c          --replace "/usr/sbin/zdb"     "$out/sbin/zdb"
-  '';
-
-  configureFlags = [
-    "--disable-systemd"
-    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    "--with-spl=${spl}/libexec/spl"
-    "--with-dracutdir=$(out)/lib/dracut"
-    "--with-udevdir=$(out)/lib/udev"
-  ];
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "ZFS Filesystem Linux Kernel module";
-    longDescription = ''
-      ZFS is a filesystem that combines a logical volume manager with a
-      Copy-On-Write filesystem with data integrity detection and repair,
-      snapshotting, cloning, block devices, deduplication, and more. 
-      '';
-    homepage = http://zfsonlinux.org/;
-    license = stdenv.lib.licenses.cddl;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ jcumming wizeman ];
-  };
-}
+  patches = [ ./nix-build.patch ];
+})
diff --git a/pkgs/os-specific/linux/zfs/generic.nix b/pkgs/os-specific/linux/zfs/generic.nix
new file mode 100644
index 00000000000..ba3884a5e9b
--- /dev/null
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@@ -0,0 +1,94 @@
+{ stdenv, fetchFromGitHub, autoconf, automake, libtool, utillinux
+, configFile ? "all"
+
+# Userspace dependencies
+, zlib, libuuid, python
+
+# Kernel dependencies
+, kernel ? null, spl ? null
+
+# Version specific settings
+, version, src, patches
+, ...
+}:
+
+with stdenv.lib;
+let
+  buildKernel = any (n: n == configFile) [ "kernel" "all" ];
+  buildUser = any (n: n == configFile) [ "user" "all" ];
+in
+
+assert any (n: n == configFile) [ "kernel" "user" "all" ];
+assert buildKernel -> kernel != null && spl != null;
+
+stdenv.mkDerivation rec {
+  name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
+
+  inherit version src patches;
+
+  buildInputs = [ autoconf automake libtool ]
+    ++ optionals buildKernel [ spl ]
+    ++ optionals buildUser [ zlib libuuid python ];
+
+  # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
+  NIX_CFLAGS_LINK = "-lgcc_s";
+
+  preConfigure = ''
+    substituteInPlace ./module/zfs/zfs_ctldir.c   --replace "umount -t zfs"           "${utillinux}/bin/umount -t zfs"
+    substituteInPlace ./module/zfs/zfs_ctldir.c   --replace "mount -t zfs"            "${utillinux}/bin/mount -t zfs"
+    substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/umount"             "${utillinux}/bin/umount"
+    substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/mount"              "${utillinux}/bin/mount"
+    substituteInPlace ./udev/rules.d/*            --replace "/lib/udev/vdev_id"       "$out/lib/udev/vdev_id"
+    substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/ztest"         "$out/sbin/ztest"
+    substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/zdb"           "$out/sbin/zdb"
+    substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
+    substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d"
+    substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
+    substituteInPlace ./cmd/zed/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
+    substituteInPlace ./module/Makefile.in        --replace "/bin/cp"                 "cp"
+
+    ./autogen.sh
+  '';
+
+  configureFlags = [
+    "--with-config=${configFile}"
+  ] ++ optionals buildUser [
+    "--with-dracutdir=$(out)/lib/dracut"
+    "--with-udevdir=$(out)/lib/udev"
+    "--with-systemdunitdir=$(out)/etc/systemd/system"
+    "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--enable-systemd"
+  ] ++ optionals buildKernel [
+    "--with-spl=${spl}/libexec/spl"
+    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  # Remove provided services as they are buggy
+  postInstall = optionalString buildUser ''
+    rm $out/etc/systemd/system/zfs-import-*.service
+
+    sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
+
+    for i in $out/etc/systemd/system/*; do
+      substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
+    done
+  '';
+
+  meta = {
+    description = "ZFS Filesystem Linux Kernel module";
+    longDescription = ''
+      ZFS is a filesystem that combines a logical volume manager with a
+      Copy-On-Write filesystem with data integrity detection and repair,
+      snapshotting, cloning, block devices, deduplication, and more.
+      '';
+    homepage = http://zfsonlinux.org/;
+    license = licenses.cddl;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ jcumming wizeman wkennington ];
+  };
+}
diff --git a/pkgs/os-specific/linux/zfs/git.nix b/pkgs/os-specific/linux/zfs/git.nix
index e88cb9d6130..a7d312c4041 100644
--- a/pkgs/os-specific/linux/zfs/git.nix
+++ b/pkgs/os-specific/linux/zfs/git.nix
@@ -1,54 +1,15 @@
-{ stdenv, fetchgit, kernel, spl_git, perl, autoconf, automake, libtool, zlib, libuuid, coreutils, utillinux }:
+{ callPackage, stdenv, fetchgit, spl_git, ... } @ args:
 
-stdenv.mkDerivation {
-  name = "zfs-0.6.3-${kernel.version}";
+callPackage ./generic.nix (args // rec {
+  version = "2015-04-08";
 
   src = fetchgit {
     url = git://github.com/zfsonlinux/zfs.git;
-    rev = "07dabd234dd51a1e5adc5bd21cddf5b5fdc70732";
-    sha256 = "1yqsfdhyzh33aisfvwqd692n5kfgnlz7yjixd2gqn8vx9bv0dz0b";
+    rev = "d07a16360c1ee219b8820f80d035e56a18c58b84";
+    sha256 = "0yyc0n960bzd4fmrg1mwp0xy1db7yn90g33ds44chh4g74mrfgdz";
   };
 
-  patches = [ ./mount_zfs_prefix.patch ./nix-build.patch ];
+  patches = [ ./nix-build.patch ];
 
-  buildInputs = [ spl_git perl autoconf automake libtool zlib libuuid coreutils ];
-
-  # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
-  NIX_CFLAGS_LINK = "-lgcc_s";
-
-  preConfigure = ''
-    ./autogen.sh
-
-    substituteInPlace ./module/zfs/zfs_ctldir.c    --replace "umount -t zfs"     "${utillinux}/bin/umount -t zfs"
-    substituteInPlace ./module/zfs/zfs_ctldir.c    --replace "mount -t zfs"      "${utillinux}/bin/mount -t zfs"
-    substituteInPlace ./lib/libzfs/libzfs_mount.c  --replace "/bin/umount"       "${utillinux}/bin/umount"
-    substituteInPlace ./lib/libzfs/libzfs_mount.c  --replace "/bin/mount"        "${utillinux}/bin/mount"
-    substituteInPlace ./udev/rules.d/*             --replace "/lib/udev/vdev_id" "$out/lib/udev/vdev_id"
-    substituteInPlace ./cmd/ztest/ztest.c          --replace "/usr/sbin/ztest"   "$out/sbin/ztest"
-    substituteInPlace ./cmd/ztest/ztest.c          --replace "/usr/sbin/zdb"     "$out/sbin/zdb"
-  '';
-
-  configureFlags = [
-    "--disable-systemd"
-    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    "--with-spl=${spl_git}/libexec/spl"
-    "--with-dracutdir=$(out)/lib/dracut"
-    "--with-udevdir=$(out)/lib/udev"
-  ];
-
-  enableParallelBuilding = true;
-
-  meta = {
-    description = "ZFS Filesystem Linux Kernel module";
-    longDescription = ''
-      ZFS is a filesystem that combines a logical volume manager with a
-      Copy-On-Write filesystem with data integrity detection and repair,
-      snapshotting, cloning, block devices, deduplication, and more.
-      '';
-    homepage = http://zfsonlinux.org/;
-    license = stdenv.lib.licenses.cddl;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [ wizeman ];
-  };
-}
+  spl = spl_git;
+})
diff --git a/pkgs/os-specific/linux/zfs/mount_zfs_prefix.patch b/pkgs/os-specific/linux/zfs/mount_zfs_prefix.patch
deleted file mode 100644
index 49ad88fc3a4..00000000000
--- a/pkgs/os-specific/linux/zfs/mount_zfs_prefix.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff -crN '--exclude=.git' zfs-0.60-rc11/cmd/mount_zfs/Makefile.am zfs/cmd/mount_zfs/Makefile.am
-*** zfs-0.60-rc11/cmd/mount_zfs/Makefile.am 2012-10-22 10:26:07.066205000 -0700
---- zfs/cmd/mount_zfs/Makefile.am 2012-10-22 11:16:21.859286000 -0700
-***************
-*** 7,14 ****
-  #
-  # Ignore the prefix for the mount helper.  It must be installed in /sbin/
-  # because this path is hardcoded in the mount(8) for security reasons.
-  #
-- sbindir=/sbin
-  sbin_PROGRAMS = mount.zfs
-
-  mount_zfs_SOURCES = \
---- 7,16 ----
-  #
-  # Ignore the prefix for the mount helper.  It must be installed in /sbin/
-  # because this path is hardcoded in the mount(8) for security reasons.
-+ #
-+ # ... except on nixos, where it really is /var/run/current-system/sw/sbin,
-+ # which is where this will end up if we put it in ${out}/sbin.
-  #
-  sbin_PROGRAMS = mount.zfs
-
-  mount_zfs_SOURCES = \
diff --git a/pkgs/os-specific/linux/zfs/nix-build.patch b/pkgs/os-specific/linux/zfs/nix-build.patch
index af4b94e355d..ae8e82f703a 100644
--- a/pkgs/os-specific/linux/zfs/nix-build.patch
+++ b/pkgs/os-specific/linux/zfs/nix-build.patch
@@ -1,214 +1,133 @@
-diff -rc zfs-0.6.1.orig/include/linux/Makefile.am zfs-0.6.1/include/linux/Makefile.am
-*** zfs-0.6.1.orig/include/linux/Makefile.am	2013-03-26 09:37:47.000000000 -0700
---- zfs-0.6.1/include/linux/Makefile.am	2013-03-28 11:07:10.099129000 -0700
-***************
-*** 16,21 ****
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/zfs-$(VERSION)/include/linux
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
---- 16,21 ----
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/include/linux
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
-diff -rc zfs-0.6.1.orig/include/Makefile.am zfs-0.6.1/include/Makefile.am
-*** zfs-0.6.1.orig/include/Makefile.am	2013-03-26 09:37:47.000000000 -0700
---- zfs-0.6.1/include/Makefile.am	2013-03-28 11:07:38.810870000 -0700
-***************
-*** 28,33 ****
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/zfs-$(VERSION)/include
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
---- 28,33 ----
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/include
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
-diff -rc zfs-0.6.1.orig/include/sys/fm/fs/Makefile.am zfs-0.6.1/include/sys/fm/fs/Makefile.am
-*** zfs-0.6.1.orig/include/sys/fm/fs/Makefile.am	2013-03-26 09:37:47.000000000 -0700
---- zfs-0.6.1/include/sys/fm/fs/Makefile.am	2013-03-28 11:07:36.074756000 -0700
-***************
-*** 13,18 ****
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/zfs-$(VERSION)/include/sys/fm/fs
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
---- 13,18 ----
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/include/sys/fm/fs
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
-diff -rc zfs-0.6.1.orig/include/sys/fm/Makefile.am zfs-0.6.1/include/sys/fm/Makefile.am
-*** zfs-0.6.1.orig/include/sys/fm/Makefile.am	2013-03-26 09:37:47.000000000 -0700
---- zfs-0.6.1/include/sys/fm/Makefile.am	2013-03-28 11:07:32.265896000 -0700
-***************
-*** 16,21 ****
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/zfs-$(VERSION)/include/sys/fm
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
---- 16,21 ----
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/include/sys/fm
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
-diff -rc zfs-0.6.1.orig/include/sys/fs/Makefile.am zfs-0.6.1/include/sys/fs/Makefile.am
-*** zfs-0.6.1.orig/include/sys/fs/Makefile.am	2013-03-26 09:37:47.000000000 -0700
---- zfs-0.6.1/include/sys/fs/Makefile.am	2013-03-28 11:07:27.592339000 -0700
-***************
-*** 13,18 ****
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/zfs-$(VERSION)/include/sys/fs
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
---- 13,18 ----
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/include/sys/fs
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
-diff -rc zfs-0.6.1.orig/include/sys/Makefile.am zfs-0.6.1/include/sys/Makefile.am
-*** zfs-0.6.1.orig/include/sys/Makefile.am	2013-03-26 09:37:47.000000000 -0700
---- zfs-0.6.1/include/sys/Makefile.am	2013-03-28 11:07:19.045717000 -0700
-***************
-*** 91,96 ****
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = /usr/src/zfs-$(VERSION)/include/sys
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
---- 91,96 ----
-  endif
-  
-  if CONFIG_KERNEL
-! kerneldir = @prefix@/include/sys
-  kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
-  endif
-diff -rc zfs-0.6.1.orig/Makefile.am zfs-0.6.1/Makefile.am
-*** zfs-0.6.1.orig/Makefile.am	2013-03-26 09:37:47.000000000 -0700
---- zfs-0.6.1/Makefile.am	2013-04-05 23:49:39.763623000 -0700
-***************
-*** 9,18 ****
-  if CONFIG_KERNEL
-  SUBDIRS += module
-  
-! extradir = /usr/src/zfs-$(VERSION)
-  extra_HEADERS = zfs.release.in zfs_config.h.in
-  
-! kerneldir = /usr/src/zfs-$(VERSION)/$(LINUX_VERSION)
-  nodist_kernel_HEADERS = zfs.release zfs_config.h module/$(LINUX_SYMBOLS)
-  endif
-  
---- 9,18 ----
-  if CONFIG_KERNEL
-  SUBDIRS += module
-  
-! extradir = @prefix@/libexec/zfs-$(VERSION)
-  extra_HEADERS = zfs.release.in zfs_config.h.in
-  
-! kerneldir = @prefix@/zfs-$(VERSION)/$(LINUX_VERSION)
-  nodist_kernel_HEADERS = zfs.release zfs_config.h module/$(LINUX_SYMBOLS)
-  endif
-  
-diff -rc zfs-0.6.1.orig/module/Makefile.in zfs-0.6.1/module/Makefile.in
-*** zfs-0.6.1.orig/module/Makefile.in	2013-03-26 09:37:47.000000000 -0700
---- zfs-0.6.1/module/Makefile.in	2013-04-05 23:50:41.497876000 -0700
-***************
-*** 18,26 ****
-  	@# installed devel headers, or they may be in the module
-  	@# subdirectory when building against the spl source tree.
-  	@if [ -f @SPL_OBJ@/@SPL_SYMBOLS@ ]; then \
-! 		/bin/cp @SPL_OBJ@/@SPL_SYMBOLS@ .; \
-  	elif [ -f @SPL_OBJ@/module/@SPL_SYMBOLS@ ]; then \
-! 		/bin/cp @SPL_OBJ@/module/@SPL_SYMBOLS@ .; \
-  	else \
-  		echo -e "\n" \
-  		"*** Missing spl symbols ensure you have built the spl:\n" \
---- 18,26 ----
-  	@# installed devel headers, or they may be in the module
-  	@# subdirectory when building against the spl source tree.
-  	@if [ -f @SPL_OBJ@/@SPL_SYMBOLS@ ]; then \
-! 		cp @SPL_OBJ@/@SPL_SYMBOLS@ .; \
-  	elif [ -f @SPL_OBJ@/module/@SPL_SYMBOLS@ ]; then \
-! 		cp @SPL_OBJ@/module/@SPL_SYMBOLS@ .; \
-  	else \
-  		echo -e "\n" \
-  		"*** Missing spl symbols ensure you have built the spl:\n" \
-***************
-*** 28,33 ****
---- 28,35 ----
-  		"*** - @SPL_OBJ@/module/@SPL_SYMBOLS@\n"; \
-  		exit 1; \
-  	fi
-+ 	@# when copying a file out of the nix store, we need to make it writable again. 
-+ 	chmod +w @SPL_SYMBOLS@
-  	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` @KERNELMAKE_PARAMS@ CONFIG_ZFS=m $@
-  
-  clean:
-***************
-*** 42,62 ****
-  modules_install:
-  	@# Install the kernel modules
-  	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` $@ \
-! 		INSTALL_MOD_PATH=$(DESTDIR)$(INSTALL_MOD_PATH) \
-  		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR)
-  	@# Remove extraneous build products when packaging
-! 	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
-  	if [ -n $$kmoddir ]; then \
-  		find $$kmoddir -name 'modules.*' | xargs $(RM); \
-  	fi
-! 	sysmap=$(DESTDIR)$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
-  	if [ -f $$sysmap ]; then \
-  		depmod -ae -F $$sysmap @LINUX_VERSION@; \
-  	fi
-  
-  modules_uninstall:
-  	@# Uninstall the kernel modules
-! 	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@
-  	list='$(subdir-m)'; for subdir in $$list; do \
-  		$(RM) -R $$kmoddir/$(INSTALL_MOD_DIR)/$$subdir; \
-  	done
---- 44,64 ----
-  modules_install:
-  	@# Install the kernel modules
-  	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` $@ \
-! 		INSTALL_MOD_PATH=@prefix@/$(INSTALL_MOD_PATH) \
-  		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR)
-  	@# Remove extraneous build products when packaging
-! 	kmoddir=@prefix@/$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
-  	if [ -n $$kmoddir ]; then \
-  		find $$kmoddir -name 'modules.*' | xargs $(RM); \
-  	fi
-! 	sysmap=@prefix@/$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
-  	if [ -f $$sysmap ]; then \
-  		depmod -ae -F $$sysmap @LINUX_VERSION@; \
-  	fi
-  
-  modules_uninstall:
-  	@# Uninstall the kernel modules
-! 	kmoddir=@prefix@/$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@
-  	list='$(subdir-m)'; for subdir in $$list; do \
-  		$(RM) -R $$kmoddir/$(INSTALL_MOD_DIR)/$$subdir; \
-  	done
+diff --git a/Makefile.am b/Makefile.am
+index 49b417a..f4af44d 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -12,10 +12,10 @@ endif
+ if CONFIG_KERNEL
+ SUBDIRS += module
+ 
+-extradir = @prefix@/src/zfs-$(VERSION)
++extradir = @prefix@/libexec/zfs-$(VERSION)
+ extra_HEADERS = zfs.release.in zfs_config.h.in
+ 
+-kerneldir = @prefix@/src/zfs-$(VERSION)/$(LINUX_VERSION)
++kerneldir = @prefix@/zfs-$(VERSION)/$(LINUX_VERSION)
+ nodist_kernel_HEADERS = zfs.release zfs_config.h module/$(LINUX_SYMBOLS)
+ endif
+ 
+diff --git a/include/Makefile.am b/include/Makefile.am
+index a94cad5..a160fe2 100644
+--- a/include/Makefile.am
++++ b/include/Makefile.am
+@@ -29,6 +29,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
+ endif
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/zfs-$(VERSION)/include
++kerneldir = @prefix@/include
+ kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
+ endif
+diff --git a/include/linux/Makefile.am b/include/linux/Makefile.am
+index d00b1c8..3242d2e 100644
+--- a/include/linux/Makefile.am
++++ b/include/linux/Makefile.am
+@@ -17,6 +17,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
+ endif
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/zfs-$(VERSION)/include/linux
++kerneldir = @prefix@/include/linux
+ kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
+ endif
+diff --git a/include/sys/Makefile.am b/include/sys/Makefile.am
+index 7ddace0..8da3870 100644
+--- a/include/sys/Makefile.am
++++ b/include/sys/Makefile.am
+@@ -102,6 +102,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
+ endif
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys
++kerneldir = @prefix@/include/sys
+ kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
+ endif
+diff --git a/include/sys/fm/Makefile.am b/include/sys/fm/Makefile.am
+index 8bca5d8..a5eafcd 100644
+--- a/include/sys/fm/Makefile.am
++++ b/include/sys/fm/Makefile.am
+@@ -16,6 +16,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
+ endif
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys/fm
++kerneldir = @prefix@/include/sys/fm
+ kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
+ endif
+diff --git a/include/sys/fm/fs/Makefile.am b/include/sys/fm/fs/Makefile.am
+index fdc9eb5..807c47c 100644
+--- a/include/sys/fm/fs/Makefile.am
++++ b/include/sys/fm/fs/Makefile.am
+@@ -13,6 +13,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
+ endif
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys/fm/fs
++kerneldir = @prefix@/include/sys/fm/fs
+ kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
+ endif
+diff --git a/include/sys/fs/Makefile.am b/include/sys/fs/Makefile.am
+index 0859b9f..b0c6eec 100644
+--- a/include/sys/fs/Makefile.am
++++ b/include/sys/fs/Makefile.am
+@@ -13,6 +13,6 @@ libzfs_HEADERS = $(COMMON_H) $(USER_H)
+ endif
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/zfs-$(VERSION)/include/sys/fs
++kerneldir = @prefix@/include/sys/fs
+ kernel_HEADERS = $(COMMON_H) $(KERNEL_H)
+ endif
+diff --git a/module/Makefile.in b/module/Makefile.in
+index 686402b..9cbf598 100644
+--- a/module/Makefile.in
++++ b/module/Makefile.in
+@@ -18,9 +18,9 @@ modules:
+ 	@# installed devel headers, or they may be in the module
+ 	@# subdirectory when building against the spl source tree.
+ 	@if [ -f @SPL_OBJ@/@SPL_SYMBOLS@ ]; then \
+-		/bin/cp @SPL_OBJ@/@SPL_SYMBOLS@ .; \
++		cp @SPL_OBJ@/@SPL_SYMBOLS@ .; \
+ 	elif [ -f @SPL_OBJ@/module/@SPL_SYMBOLS@ ]; then \
+-		/bin/cp @SPL_OBJ@/module/@SPL_SYMBOLS@ .; \
++		cp @SPL_OBJ@/module/@SPL_SYMBOLS@ .; \
+ 	else \
+ 		echo -e "\n" \
+ 		"*** Missing spl symbols ensure you have built the spl:\n" \
+@@ -28,6 +28,8 @@ modules:
+ 		"*** - @SPL_OBJ@/module/@SPL_SYMBOLS@\n"; \
+ 		exit 1; \
+ 	fi
++	@# when copying a file out of the nix store, we need to make it writable again. 
++	chmod +w @SPL_SYMBOLS@
+ 	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` @KERNELMAKE_PARAMS@ CONFIG_ZFS=m $@
+ 
+ clean:
+@@ -42,15 +44,15 @@ clean:
+ modules_install:
+ 	@# Install the kernel modules
+ 	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` $@ \
+-		INSTALL_MOD_PATH=$(DESTDIR)$(INSTALL_MOD_PATH) \
++		INSTALL_MOD_PATH=@prefix@/$(INSTALL_MOD_PATH) \
+ 		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR) \
+ 		KERNELRELEASE=@LINUX_VERSION@
+ 	@# Remove extraneous build products when packaging
+-	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
++	kmoddir=@prefix@/$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
+ 	if [ -n $$kmoddir ]; then \
+ 		find $$kmoddir -name 'modules.*' | xargs $(RM); \
+ 	fi
+-	sysmap=$(DESTDIR)$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
++	sysmap=@prefix@/$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
+ 	if [ -f $$sysmap ]; then \
+ 		depmod -ae -F $$sysmap @LINUX_VERSION@; \
+ 	fi