Merge commit '70963b382f3f820ba6d3bc3b3aaf50a2957ec1ff' into lib-platform-simplify

193 files changed, 3189 insertions, 1160 deletions

diff --git a/pkgs/os-specific/bsd/default.nix b/pkgs/os-specific/bsd/default.nix
new file mode 100644
index 000000000000..a75c132b55a2
--- /dev/null
+++ b/pkgs/os-specific/bsd/default.nix
@@ -0,0 +1,5 @@
+{ callPackages, recurseIntoAttrs }:
+
+rec {
+  netbsd = recurseIntoAttrs (callPackages ./netbsd {});
+}
diff --git a/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
new file mode 100644
index 000000000000..d47d602e2edb
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/compat-setup-hook.sh
@@ -0,0 +1,18 @@
+setupCompatFlags() {
+    # The `depHostOffset` describes how the host platform of the dependencies
+    # are slid relative to the depending package. It is brought into scope of
+    # the environment hook defined as the role of the dependency being applied.
+    case $depHostOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
+            return 1 ;;
+    esac
+
+    export NIX_${role}LDFLAGS+=" -lnbcompat"
+    export NIX_${role}CFLAGS_COMPILE+=" -DHAVE_NBTOOL_CONFIG_H"
+    export NIX_${role}CFLAGS_COMPILE+=" -include nbtool_config.h"
+}
+
+addEnvHooks "$hostOffset" setupCompatFlags
diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
new file mode 100644
index 000000000000..b4fb99504ef2
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -0,0 +1,589 @@
+{ stdenv, hostPlatform, fetchcvs, lib, groff, mandoc, zlib, coreutils
+, yacc, flex, libressl, bash, less, writeText }:
+
+let
+  fetchNetBSD = path: version: sha256: fetchcvs {
+    cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
+    module = "src/${path}";
+    inherit sha256;
+    tag = "netbsd-${builtins.replaceStrings ["."] ["-"] version}-RELEASE";
+  };
+
+  netBSDDerivation = attrs: stdenv.mkDerivation ((rec {
+    name = "bsd-${attrs.pname or (baseNameOf attrs.path)}-netbsd-${attrs.version}";
+    src = attrs.src or fetchNetBSD attrs.path attrs.version attrs.sha256;
+
+    extraPaths = [ ];
+    setOutputFlags = false;
+
+    nativeBuildInputs = [ makeMinimal mandoc groff install stat
+                          yacc flex tsort lorder ];
+    buildInputs = [ compat ];
+    installFlags = [ "includes" ];
+
+    # Definitions passed to share/mk/*.mk. Should be pretty simple -
+    # eventually maybe move it to a configure script.
+    DESTDIR = "$(out)";
+    TOOLDIR = "$(out)";
+    USETOOLS = "never";
+    NOCLANGERROR = "yes";
+    NOGCCERROR = "yes";
+    LEX = "flex";
+    MKUNPRIVED = "yes";
+    HOST_SH = "${bash}/bin/sh";
+    OBJCOPY = if stdenv.isDarwin then "true" else "objcopy";
+    MACHINE_ARCH = hostPlatform.parsed.cpu.name;
+    MACHINE_CPU = hostPlatform.parsed.cpu.name;
+
+    INSTALL_FILE = "install -U -c";
+    INSTALL_DIR = "xinstall -U -d";
+    INSTALL_LINK = "install -U -l h";
+    INSTALL_SYMLINK = "install -U -l s";
+
+    # libs will be provided by cc-wrapper
+    LIBCRT0 = "";
+    LIBCRTI = "";
+    LIBCRTEND = "";
+    LIBCRTBEGIN = "";
+    LIBC = "";
+    LIBUTIL = "";
+    LIBSSL = "";
+    LIBCRYPTO = "";
+    LIBCRYPT = "";
+    LIBCURSES = "";
+    LIBTERMINFO = "";
+    LIBM = "";
+    LIBL = "";
+    _GCC_CRTBEGIN = "";
+    _GCC_CRTBEGINS = "";
+    _GCC_CRTEND = "";
+    _GCC_CRTENDS = "";
+    _GCC_LIBGCCDIR = "";
+    _GCC_CRTI = "";
+    _GCC_CRTDIR = "";
+    _GCC_CRTN = "";
+
+    "LIBDO.terminfo" = "_external";
+    "LIBDO.curses" = "_external";
+
+    # all dirs will be prefixed with DESTDIR
+    BINDIR = "/bin";
+    LIBDIR = "/lib";
+    SHLIBDIR = "/lib";
+    INCSDIR = "/include";
+    MANDIR = "/share/man";
+    INFODIR = "/share/info";
+    DOCDIR = "/share/doc";
+    LOCALEDIR = "/share/locale";
+    X11BINDIR = "/bin";
+    X11USRLIBDIR = "/lib";
+    X11MANDIR = "/share/man";
+
+    # NetBSD makefiles should be able to detect this
+    # but without they end up using gcc on Darwin stdenv
+    preConfigure = ''
+      export HAVE_${if stdenv.cc.isGNU then "GCC" else "LLVM"}=${lib.head (lib.splitString "." (lib.getVersion stdenv.cc.cc))}
+
+      # Parallel building. Needs the space.
+      export makeFlags+=" -j $NIX_BUILD_CORES"
+    '';
+
+    postUnpack = ''
+      # merge together all extra paths
+      # there should be a better way to do this
+      sourceRoot=$PWD/$sourceRoot
+      export NETBSDSRCDIR=$sourceRoot
+      export BSDSRCDIR=$NETBSDSRCDIR
+      export _SRC_TOP_=$NETBSDSRCDIR
+      chmod -R u+w $sourceRoot
+      for path in $extraPaths; do
+        cd $path
+        find . -type d -exec mkdir -p $sourceRoot/\{} \;
+        find . -type f -exec cp -pr \{} $sourceRoot/\{} \;
+        chmod -R u+w $sourceRoot
+      done
+
+      cd $sourceRoot
+      if [ -d ${attrs.path} ]
+        then sourceRoot=$sourceRoot/${attrs.path}
+      fi
+    '';
+
+    preFixup = ''
+      # Remove lingering /usr references
+      if [ -d $out/usr ]; then
+        cd $out/usr
+        find . -type d -exec mkdir -p $out/\{} \;
+        find . -type f -exec mv \{} $out/\{} \;
+      fi
+
+      find $out -type d -empty -delete
+    '';
+
+    meta = with lib; {
+      maintainers = with maintainers; [matthewbauer];
+      platforms = platforms.unix;
+      license = licenses.bsd2;
+    };
+  }) // attrs);
+
+  ##
+  ## BOOTSTRAPPING
+  ##
+  makeMinimal = netBSDDerivation rec {
+    path = "tools/make";
+    sha256 = "0l4794zwj2haark3azf9xwcwqlkbrifhb2glaa9iba4dkg2mklsb";
+    version = "7.1.2";
+
+    buildInputs = [];
+    nativeBuildInputs = [];
+
+    postPatch = ''
+      patchShebangs configure
+      ${make.postPatch}
+    '';
+    buildPhase = ''
+      runHook preBuild
+
+      sh ./buildmake.sh
+
+      runHook postBuild
+    '';
+    installPhase = ''
+      runHook preInstall
+
+      install -D nbmake $out/bin/nbmake
+      ln -s $out/bin/nbmake $out/bin/make
+      mkdir -p $out/share
+      cp -r $NETBSDSRCDIR/share/mk $out/share/mk
+
+      runHook postInstall
+    '';
+    extraPaths = [ make.src ] ++ make.extraPaths;
+  };
+
+  compat = netBSDDerivation {
+    path = "tools/compat";
+    sha256 = "17phkfafybxwhzng44k5bhmag6i55br53ky1nwcmw583kg2fa86z";
+    version = "7.1.2";
+
+    setupHook = ./compat-setup-hook.sh;
+
+    # override defaults to prevent infinite recursion
+    nativeBuildInputs = [ makeMinimal ];
+    buildInputs = [ zlib ];
+
+    # temporarily use gnuinstall for bootstrapping
+    # bsdinstall will be built later
+    makeFlags = [ "INSTALL=${coreutils}/bin/install" ];
+    installFlags = [];
+    RENAME = "-D";
+
+    postInstall = ''
+      mv $out/include/compat/* $out/include
+      rmdir $out/include/compat
+
+      # why aren't these installed by netbsd?
+      install -D compat_defs.h $out/include/compat_defs.h
+      install -D $NETBSDSRCDIR/include/cdbw.h $out/include/cdbw.h
+      install -D $NETBSDSRCDIR/sys/sys/cdbr.h $out/include/cdbr.h
+      install -D $NETBSDSRCDIR/sys/sys/featuretest.h \
+                 $out/include/sys/featuretest.h
+      install -D $NETBSDSRCDIR/sys/sys/md5.h $out/include/md5.h
+      install -D $NETBSDSRCDIR/sys/sys/rmd160.h $out/include/rmd160.h
+      install -D $NETBSDSRCDIR/sys/sys/sha1.h $out/include/sha1.h
+      install -D $NETBSDSRCDIR/sys/sys/sha2.h $out/include/sha2.h
+      install -D $NETBSDSRCDIR/sys/sys/queue.h $out/include/sys/queue.h
+      install -D $NETBSDSRCDIR/include/vis.h $out/include/vis.h
+      install -D $NETBSDSRCDIR/include/db.h $out/include/db.h
+      install -D $NETBSDSRCDIR/include/netconfig.h $out/include/netconfig.h
+      install -D $NETBSDSRCDIR/include/rpc/types.h $out/include/rpc/types.h
+      install -D $NETBSDSRCDIR/include/utmpx.h $out/include/utmpx.h
+      install -D $NETBSDSRCDIR/include/tzfile.h $out/include/tzfile.h
+
+      # Remove lingering /usr references
+      if [ -d $out/usr ]; then
+        cd $out/usr
+        find . -type d -exec mkdir -p $out/\{} \;
+        find . -type f -exec mv \{} $out/\{} \;
+      fi
+
+      find $out -type d -empty -delete
+    '';
+    extraPaths = [ libc.src libutil.src
+      (fetchNetBSD "include" "7.1.2" "1vc58xrhrp202biiv1chhlh0jwnjr7k3qq91pm46k6v5j95j0qwp")
+      (fetchNetBSD "external/bsd/flex" "7.1.2" "0m0m72r3zzc9gi432h3xkqdzspr4n0hj4m8h7j74pwbvpfg9d9qq")
+      (fetchNetBSD "sys/sys" "7.1.2" "1vwnv5nk7rlgn5w9nkdqj9652hmwmfwqxj3ymcz0zk10abbaib93")
+    ] ++ libutil.extraPaths ++ libc.extraPaths;
+  };
+
+  # HACK to ensure parent directories exist. This emulates GNU
+  # install’s -D option. No alternative seems to exist in BSD install.
+  install = let binstall = writeText "binstall" ''
+    #!/usr/bin/env sh
+    for last in $@; do true; done
+    mkdir -p $(dirname $last)
+    xinstall "$@"
+  ''; in netBSDDerivation {
+    path = "usr.bin/xinstall";
+    version = "7.1.2";
+    sha256 = "0nzhyh714m19h61m45gzc5dszkbafp5iaphbp5mza6w020fzf2y8";
+    extraPaths = [ mtree.src make.src ];
+    nativeBuildInputs = [ makeMinimal mandoc groff ];
+    buildInputs = [ compat fts ];
+    installPhase = ''
+      runHook preInstall
+
+      install -D install.1 $out/share/man/man1/install.1
+      install -D xinstall $out/bin/xinstall
+      install -D -m 0550 ${binstall} $out/bin/binstall
+      ln -s $out/bin/binstall $out/bin/install
+
+      runHook postInstall
+    '';
+  };
+
+  fts = netBSDDerivation {
+    pname = "fts";
+    path = "include/fts.h";
+    sha256 = "01d4fpxvz1pgzfk5xznz5dcm0x0gdzwcsfm1h3d0xc9kc6hj2q77";
+    version = "7.1.2";
+    nativeBuildInputs = [ ];
+    propagatedBuildInputs = [ compat ];
+    extraPaths = [
+      (fetchNetBSD "lib/libc/gen/fts.c" "7.1.2" "1yfd2liypj6xky2h0mgxi5lgpflmkkg4zf3ii3apz5cf8jq9gmn9")
+      (fetchNetBSD "lib/libc/include/namespace.h" "7.1.2" "0kwd4v8y0mfjhmwplsk52pvzbcpvpp2qy2g8c0jmfraam63q6q1y")
+      (fetchNetBSD "lib/libc/gen/fts.3" "7.1.2" "1asxw0n3fhjdadwkkq3xplfgqgl3q32w1lyrvbakfa3gs0wz5zc1")
+    ];
+    buildPhase = ''
+      cc  -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
+          -o lib/libc/gen/fts.o
+      ar -rsc libfts.a lib/libc/gen/fts.o
+    '';
+    installPhase = ''
+      runHook preInstall
+
+      install -D lib/libc/gen/fts.3 $out/share/man/man3/fts.3
+      install -D include/fts.h $out/include/fts.h
+      install -D lib/libc/include/namespace.h $out/include/namespace.h
+      install -D libfts.a $out/lib/libfts.a
+
+      runHook postInstall
+    '';
+    setupHook = ./fts-setup-hook.sh;
+  };
+
+  stat = netBSDDerivation {
+    path = "usr.bin/stat";
+    version = "7.1.2";
+    sha256 = "0z4r96id2r4cfy443rw2s1n52n186xm0lqvs8s3qjf4314z7r7yh";
+    nativeBuildInputs = [ makeMinimal mandoc groff install ];
+  };
+
+  tsort = netBSDDerivation {
+    path = "usr.bin/tsort";
+    version = "7.1.2";
+    sha256 = "1dqvf9gin29nnq3c4byxc7lfd062pg7m84843zdy6n0z63hnnwiq";
+    nativeBuildInputs = [ makeMinimal mandoc groff install ];
+  };
+
+  lorder = netBSDDerivation {
+    path = "usr.bin/lorder";
+    version = "7.1.2";
+    sha256 = "0rjf9blihhm0n699vr2bg88m4yjhkbxh6fxliaay3wxkgnydjwn2";
+    nativeBuildInputs = [ makeMinimal mandoc groff install ];
+  };
+  ##
+  ## END BOOTSTRAPPING
+  ##
+
+  libutil = netBSDDerivation {
+    path = "lib/libutil";
+    version = "7.1.2";
+    sha256 = "12848ynizz13mvn2kndrkq482xhkw323b7c8fg0zli1nhfsmwsm8";
+    extraPaths = [
+      (fetchNetBSD "common/lib/libutil" "7.1.2" "0q3ixrf36lip1dx0gafs0a03qfs5cs7n0myqq7af4jpjd6kh1831")
+    ];
+  };
+
+  libc = netBSDDerivation {
+    path = "lib/libc";
+    version = "7.1.2";
+    sha256 = "13rcx3mbx2644z01zgk9gggdfr0hqdbsvd7zrsm2l13yf9aix6pg";
+    extraPaths = [
+      (fetchNetBSD "common/lib/libc" "7.1.2" "1va8zd4lqyrc1d0c9q04r8y88cfxpkhwcxasggxxvhksd3khkpha")
+    ];
+  };
+
+  make = netBSDDerivation {
+    path = "usr.bin/make";
+    sha256 = "0srkkg6qdzqlccfi4xh19gl766ks6hpss76bnfvwmd0zg4q4zdar";
+    version = "7.1.2";
+    postPatch = ''
+      # make needs this to pick up our sys make files
+      export NIX_CFLAGS_COMPILE+=" -D_PATH_DEFSYSPATH=\"$out/share/mk\""
+
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.prog.mk \
+        --replace '-Wl,-dynamic-linker=''${_SHLINKER}' "" \
+        --replace '-Wl,-rpath,''${SHLIBDIR}' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.lib.mk \
+        --replace '_INSTRANLIB=''${empty(PRESERVE):?-a "''${RANLIB} -t":}' '_INSTRANLIB='
+    '' + lib.optionalString stdenv.isDarwin ''
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.sys.mk \
+        --replace '-Wl,--fatal-warnings' "" \
+        --replace '-Wl,--warn-shared-textrel' ""
+      substituteInPlace $NETBSDSRCDIR/share/mk/bsd.lib.mk \
+        --replace '-Wl,-soname,''${_LIB}.so.''${SHLIB_SOVERSION}' "" \
+        --replace '-Wl,--whole-archive' "" \
+        --replace '-Wl,--no-whole-archive' "" \
+        --replace '-Wl,--warn-shared-textrel' "" \
+        --replace '-Wl,-Map=''${_LIB}.so.''${SHLIB_SOVERSION}.map' "" \
+        --replace '-Wl,-rpath,''${SHLIBDIR}' ""
+    '';
+    postInstall = ''
+      (cd $NETBSDSRCDIR/share/mk && make FILESDIR=/share/mk install)
+    '';
+    extraPaths = [
+      (fetchNetBSD "share/mk" "7.1.2" "0570v0siv0wygn8ygs1yy9pgk9xjw9x1axr5qg4xrddv3lskf9xa")
+    ];
+  };
+
+  mtree = netBSDDerivation {
+    path = "usr.sbin/mtree";
+    version = "7.1.2";
+    sha256 = "1dhsyfvcm67kf5zdbg5dmx5y8fimnbll6qxwp3gjfmbxqigmc52m";
+  };
+
+  who = netBSDDerivation {
+    path = "usr.bin/who";
+    version = "7.1.2";
+    sha256 = "17ffwww957m3qw0b6fkgjpp12pd5ydg2hs9dxkkw0qpv11j00d88";
+    postPatch = lib.optionalString stdenv.isLinux ''
+      substituteInPlace $NETBSDSRCDIR/usr.bin/who/utmpentry.c \
+        --replace "utmptime = st.st_mtimespec" "utmptime = st.st_mtim" \
+        --replace "timespeccmp(&st.st_mtimespec, &utmptime, >)" "st.st_mtim.tv_sec == utmptime.tv_sec ? st.st_mtim.tv_nsec > utmptime.tv_nsec : st.st_mtim.tv_sec > utmptime.tv_sec"
+   '' + lib.optionalString stdenv.isDarwin ''
+      substituteInPlace $NETBSDSRCDIR/usr.bin/who/utmpentry.c \
+        --replace "timespeccmp(&st.st_mtimespec, &utmpxtime, >)" "st.st_mtimespec.tv_sec == utmpxtime.tv_sec ? st.st_mtimespec.tv_nsec > utmpxtime.tv_nsec : st.st_mtimespec.tv_sec > utmpxtime.tv_sec"
+   '' + ''
+      substituteInPlace $NETBSDSRCDIR/usr.bin/who/utmpentry.c \
+        --replace "strncpy(e->name, up->ut_name, sizeof(up->ut_name))" "strncpy(e->name, up->ut_user, sizeof(up->ut_user))" \
+        --replace "timespecclear(&utmptime)" "utmptime.tv_sec = utmptime.tv_nsec = 0" \
+        --replace "timespecclear(&utmpxtime)" "utmpxtime.tv_sec = utmpxtime.tv_nsec = 0"
+    '';
+  };
+
+in rec {
+  inherit compat install netBSDDerivation fts;
+
+  getent = netBSDDerivation {
+    path = "usr.bin/getent";
+    sha256 = "1ylhw4dnpyrmcy8n5kjcxywm8qc9p124dqnm17x4magiqx1kh9iz";
+    version = "7.1.2";
+    patches = [ ./getent.patch ];
+  };
+
+  getconf = netBSDDerivation {
+    path = "usr.bin/getconf";
+    sha256 = "122vslz4j3h2mfs921nr2s6m078zcj697yrb75rwp2hnw3qz4s8q";
+    version = "7.1.2";
+  };
+
+  dict = netBSDDerivation {
+    path = "share/dict";
+    version = "7.1.2";
+    sha256 = "0nickhsjwgnr2h9nvwflvgfz93kqms5hzdnpyq02crpj35w98bh4";
+    makeFlags = [ "BINDIR=/share" ];
+  };
+
+  games = netBSDDerivation {
+    path = "games";
+    sha256 = "04wjsang8f8kxsifiayklbxaaxmm3vx9rfr91hfbxj4hk8gkqzy1";
+    version = "7.1.2";
+    makeFlags = [ "BINDIR=/bin"
+                  "SCRIPTSDIR=/bin" ];
+    postPatch = ''
+      sed -i '1i #include <time.h>' adventure/save.c
+
+      for f in $(find . -name pathnames.h); do
+        substituteInPlace $f \
+          --replace /usr/share/games $out/share/games \
+          --replace /usr/games $out/bin \
+          --replace /usr/libexec $out/libexec \
+          --replace /usr/bin/more ${less}/bin/less \
+          --replace /usr/share/dict ${dict}/share/dict
+      done
+      substituteInPlace boggle/boggle/bog.h \
+        --replace /usr/share/games $out/share/games
+      substituteInPlace ching/ching/ching.sh \
+        --replace /usr/share $out/share \
+        --replace /usr/libexec $out/libexec
+      substituteInPlace hunt/huntd/driver.c \
+        --replace "(void) setpgrp(getpid(), getpid());" ""
+
+      # Disable some games that don't build. They should be possible
+      # to build but need to look at how to implement stuff in
+      # Linux. macOS is missing gettime. TODO try to get these
+      # working.
+      disableGame() {
+        substituteInPlace Makefile --replace $1 ""
+      }
+
+      disableGame atc
+      disableGame dm
+      disableGame dab
+      disableGame sail
+      disableGame trek
+      ${lib.optionalString stdenv.isLinux "disableGame boggle"}
+      ${lib.optionalString stdenv.isLinux "disableGame hunt"}
+      ${lib.optionalString stdenv.isLinux "disableGame larn"}
+      ${lib.optionalString stdenv.isLinux "disableGame phantasia"}
+      ${lib.optionalString stdenv.isLinux "disableGame rogue"}
+      ${lib.optionalString stdenv.isDarwin "disableGame adventure"}
+      ${lib.optionalString stdenv.isDarwin "disableGame factor"}
+      ${lib.optionalString stdenv.isDarwin "disableGame gomoku"}
+      ${lib.optionalString stdenv.isDarwin "disableGame mille"}
+    '';
+
+    # HACK strfile needs to be installed first & in the path. The
+    # Makefile should do this for us but haven't gotten it to work
+    preBuild = ''
+      (cd fortune/strfile && make && make BINDIR=/bin install)
+      export PATH=$out/bin:$PATH
+    '';
+
+    postInstall = ''
+      substituteInPlace $out/usr/share/games/quiz.db/index \
+        --replace /usr $out
+    '';
+
+    NIX_CFLAGS_COMPILE = [
+      "-D__noinline="
+      "-D__scanflike(a,b)="
+      "-D__va_list=va_list"
+      "-DOXTABS=XTABS"
+      "-DRANDOM_MAX=RAND_MAX"
+      "-DINFTIM=-1"
+      (lib.optionalString hostPlatform.isMusl "-include sys/ttydefaults.h -include sys/file.h")
+      "-DBE32TOH(x)=((void)0)"
+      "-DBE64TOH(x)=((void)0)"
+      "-D__c99inline=__inline"
+    ];
+
+    buildInputs = [ compat libcurses libterminfo libressl ];
+    extraPaths = [ dict.src who.src ];
+  };
+
+  finger = netBSDDerivation {
+    path = "usr.bin/finger";
+    sha256 = "0jl672z50f2yf7ikp682b3xrarm6bnrrx9vi94xnp2fav8m8zfyi";
+    version = "7.1.2";
+    NIX_CFLAGS_COMPILE = [
+      (if stdenv.isLinux then "-DSUPPORT_UTMP" else "-USUPPORT_UTMP")
+      (if stdenv.isDarwin then "-DSUPPORT_UTMPX" else "-USUPPORT_UTMPX")
+    ];
+    postPatch = ''
+      NIX_CFLAGS_COMPILE+=" -I$NETBSDSRCDIR/include"
+
+      substituteInPlace extern.h \
+        --replace psort _psort
+
+      ${who.postPatch}
+    '';
+    extraPaths = [ who.src ]
+              ++ lib.optional stdenv.isDarwin (fetchNetBSD "include/utmp.h" "7.1.2" "05690fzz0825p2bq0sfyb00mxwd0wa06qryqgqkwpqk9y2xzc7px");
+  };
+
+  fingerd = netBSDDerivation {
+    path = "libexec/fingerd";
+    sha256 = "1hhdq70hrxxkjnjfmjm3w8w9g9xq2ngxaxk0chy4vm7chg9nfpmp";
+    version = "7.1.2";
+  };
+
+  libedit = netBSDDerivation {
+    path = "lib/libedit";
+    buildInputs = [ libterminfo libcurses ];
+    propagatedBuildInputs = [ compat ];
+    makeFlags = [ "INCSDIR=/include" ];
+    postPatch = ''
+      sed -i '1i #undef bool_t' el.h
+      substituteInPlace config.h \
+        --replace "#define HAVE_STRUCT_DIRENT_D_NAMLEN 1" ""
+    '';
+    NIX_CFLAGS_COMPILE = [
+      "-D__noinline="
+      "-D__scanflike(a,b)="
+      "-D__va_list=va_list"
+    ];
+    version = "7.1.2";
+    sha256 = "0qvr52j4qih10m7fa8nddn1psyjy9l0pa4ix02acyssjvgbz2kca";
+  };
+
+  libterminfo = netBSDDerivation {
+    path = "lib/libterminfo";
+    version = "7.1.2";
+    sha256 = "06plg0bjqgbb0aghpb9qlk8wkp1l2izdlr64vbr5laqyw8jg84zq";
+    buildInputs = [ compat tic nbperf ];
+    MKPIC = if stdenv.isDarwin then "no" else "yes";
+    makeFlags = [ "INCSDIR=/include" ];
+    postPatch = ''
+      substituteInPlace term.c --replace /usr/share $out/share
+    '';
+    postInstall = ''
+      (cd $NETBSDSRCDIR/share/terminfo && make && make BINDIR=/share install)
+    '';
+    extraPaths = [
+      (fetchNetBSD "share/terminfo" "7.1.2" "1z5vzq8cw24j05r6df4vd6r57cvdbv7vbm4h962kplp14xrbg2h3")
+    ];
+  };
+
+  libcurses = netBSDDerivation {
+    path = "lib/libcurses";
+    version = "7.1.2";
+    sha256 = "04djah9dadzw74nswn0xydkxn900kav8xdvxlxdl50nbrynxg9yf";
+    buildInputs = [ libterminfo ];
+    makeFlags = [ "INCSDIR=/include" ];
+    NIX_CFLAGS_COMPILE = [
+      "-D__scanflike(a,b)="
+      "-D__va_list=va_list"
+      "-D__warn_references(a,b)="
+    ] ++ lib.optional stdenv.isDarwin "-D__strong_alias(a,b)=";
+    propagatedBuildInputs = [ compat ];
+    MKDOC = "no"; # missing vfontedpr
+    MKPIC = if stdenv.isDarwin then "no" else "yes";
+    postPatch = lib.optionalString (!stdenv.isDarwin) ''
+      substituteInPlace printw.c \
+        --replace "funopen(win, NULL, __winwrite, NULL, NULL)" NULL \
+        --replace "__strong_alias(vwprintw, vw_printw)" 'extern int vwprintw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_printw")));'
+      substituteInPlace scanw.c \
+        --replace "__strong_alias(vwscanw, vw_scanw)" 'extern int vwscanw(WINDOW*, const char*, va_list) __attribute__ ((alias ("vw_scanw")));'
+    '';
+  };
+
+  nbperf = netBSDDerivation {
+    path = "usr.bin/nbperf";
+    version = "7.1.2";
+    sha256 = "0gzm0zv2400lasnsswnjw9bwzyizhxzdbrcjwcl1k65aj86aqyqb";
+  };
+
+  tic = netBSDDerivation {
+    path = "tools/tic";
+    version = "7.1.2";
+    sha256 = "092y7db7k4kh2jq8qc55126r5qqvlb8lq8mhmy5ipbi36hwb4zrz";
+    HOSTPROG = "tic";
+    buildInputs = [ compat nbperf ];
+    extraPaths = [
+      libterminfo.src
+      (fetchNetBSD "usr.bin/tic" "7.1.2" "1ghwsaag4gbwvgp3lfxscnh8hn27n8cscwmgjwp3bkx5vl85nfsa")
+      (fetchNetBSD "tools/Makefile.host" "7.1.2" "076r3amivb6xranpvqjmg7x5ibj4cbxaa3z2w1fh47h7d55dw9w8")
+    ];
+  };
+
+  misc = netBSDDerivation {
+    path = "share/misc";
+    version = "7.1.2";
+    sha256 = "1vyn30js14nnadlls55mg7g1gz8h14l75rbrrh8lgn49qg289665";
+    makeFlags = [ "BINDIR=/share" ];
+  };
+
+}
diff --git a/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh b/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
new file mode 100644
index 000000000000..6b7064174931
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/fts-setup-hook.sh
@@ -0,0 +1,16 @@
+ftsLdflags() {
+    # The `depHostOffset` describes how the host platform of the dependencies
+    # are slid relative to the depending package. It is brought into scope of
+    # the environment hook defined as the role of the dependency being applied.
+    case $depHostOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
+            return 1 ;;
+    esac
+
+    export NIX_${role}LDFLAGS+=" -lfts"
+}
+
+addEnvHooks "$hostOffset" ftsLdflags
diff --git a/pkgs/os-specific/bsd/netbsd/getent.patch b/pkgs/os-specific/bsd/netbsd/getent.patch
new file mode 100644
index 000000000000..e9e34d19a315
--- /dev/null
+++ b/pkgs/os-specific/bsd/netbsd/getent.patch
@@ -0,0 +1,455 @@
+Author: Matthew Bauer
+Description: Remove unavailable getent databases
+Version: 7.1.2
+--- a/getent.c	2018-04-16 13:33:49.000000000 -0500
++++ b/getent.c	2018-04-16 13:29:30.000000000 -0500
+@@ -42,7 +42,6 @@
+ #include <grp.h>
+ #include <limits.h>
+ #include <netdb.h>
+-#include <netgroup.h>
+ #include <pwd.h>
+ #include <stdio.h>
+ #include <stdarg.h>
+@@ -57,27 +56,16 @@
+ #include <arpa/nameser.h>
+ 
+ #include <net/if.h>
+-#include <net/if_ether.h>
+ 
+ #include <netinet/in.h>		/* for INET6_ADDRSTRLEN */
+ 
+-#include <rpc/rpcent.h>
+-
+-#include <disktab.h>
+-
+ static int	usage(void) __attribute__((__noreturn__));
+ static int	parsenum(const char *, unsigned long *);
+-static int	disktab(int, char *[]);
+-static int	gettytab(int, char *[]);
+-static int	ethers(int, char *[]);
+ static int	group(int, char *[]);
+ static int	hosts(int, char *[]);
+-static int	netgroup(int, char *[]);
+ static int	networks(int, char *[]);
+ static int	passwd(int, char *[]);
+-static int	printcap(int, char *[]);
+ static int	protocols(int, char *[]);
+-static int	rpc(int, char *[]);
+ static int	services(int, char *[]);
+ static int	shells(int, char *[]);
+ 
+@@ -92,17 +80,11 @@
+ 	const char	*name;
+ 	int		(*callback)(int, char *[]);
+ } databases[] = {
+-	{	"disktab",	disktab,	},
+-	{	"ethers",	ethers,		},
+-	{	"gettytab",	gettytab,	},
+ 	{	"group",	group,		},
+ 	{	"hosts",	hosts,		},
+-	{	"netgroup",	netgroup,	},
+ 	{	"networks",	networks,	},
+ 	{	"passwd",	passwd,		},
+-	{	"printcap",	printcap,	},
+ 	{	"protocols",	protocols,	},
+-	{	"rpc",		rpc,		},
+ 	{	"services",	services,	},
+ 	{	"shells",	shells,		},
+ 
+@@ -195,49 +177,6 @@
+ 	(void)printf("\n");
+ }
+ 
+-
+-		/*
+-		 * ethers
+-		 */
+-
+-static int
+-ethers(int argc, char *argv[])
+-{
+-	char		hostname[MAXHOSTNAMELEN + 1], *hp;
+-	struct ether_addr ea, *eap;
+-	int		i, rv;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define ETHERSPRINT	(void)printf("%-17s  %s\n", ether_ntoa(eap), hp)
+-
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		warnx("Enumeration not supported on ethers");
+-		rv = RV_NOENUM;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			if ((eap = ether_aton(argv[i])) == NULL) {
+-				eap = &ea;
+-				hp = argv[i];
+-				if (ether_hostton(hp, eap) != 0) {
+-					rv = RV_NOTFOUND;
+-					break;
+-				}
+-			} else {
+-				hp = hostname;
+-				if (ether_ntohost(hp, eap) != 0) {
+-					rv = RV_NOTFOUND;
+-					break;
+-				}
+-			}
+-			ETHERSPRINT;
+-		}
+-	}
+-	return rv;
+-}
+-
+ 		/*
+ 		 * group
+ 		 */
+@@ -298,7 +237,7 @@
+ hosts(int argc, char *argv[])
+ {
+ 	struct hostent	*he;
+-	char		addr[IN6ADDRSZ];
++	char		addr[NS_IN6ADDRSZ];
+ 	int		i, rv;
+ 
+ 	assert(argc > 1);
+@@ -312,9 +251,9 @@
+ 	} else {
+ 		for (i = 2; i < argc; i++) {
+ 			if (inet_pton(AF_INET6, argv[i], (void *)addr) > 0)
+-				he = gethostbyaddr(addr, IN6ADDRSZ, AF_INET6);
++				he = gethostbyaddr(addr, NS_IN6ADDRSZ, AF_INET6);
+ 			else if (inet_pton(AF_INET, argv[i], (void *)addr) > 0)
+-				he = gethostbyaddr(addr, INADDRSZ, AF_INET);
++				he = gethostbyaddr(addr, NS_INADDRSZ, AF_INET);
+ 			else
+ 				he = gethostbyname(argv[i]);
+ 			if (he != NULL)
+@@ -330,48 +269,6 @@
+ }
+ 
+ 		/*
+-		 * netgroup
+-		 */
+-static int
+-netgroup(int argc, char *argv[])
+-{
+-	int		rv, i;
+-	bool		first;
+-	const char	*host, *user, *domain;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define NETGROUPPRINT(s)	(((s) != NULL) ? (s) : "")
+-
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		warnx("Enumeration not supported on netgroup");
+-		rv = RV_NOENUM;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			setnetgrent(argv[i]);
+-			first = true;
+-			while (getnetgrent(&host, &user, &domain) != 0) {
+-				if (first) {
+-					first = false;
+-					(void)fputs(argv[i], stdout);
+-				}
+-				(void)printf(" (%s,%s,%s)",
+-				    NETGROUPPRINT(host),
+-				    NETGROUPPRINT(user),
+-				    NETGROUPPRINT(domain));
+-			}
+-			if (!first)
+-				(void)putchar('\n');
+-			endnetgrent();
+-		}
+-	}
+-
+-	return rv;
+-}
+-
+-		/*
+ 		 * networks
+ 		 */
+ 
+@@ -464,227 +361,6 @@
+ 	return rv;
+ }
+ 
+-static char *
+-mygetent(const char * const * db_array, const char *name)
+-{
+-	char *buf = NULL;
+-	int error;
+-
+-	switch (error = cgetent(&buf, db_array, name)) {
+-	case -3:
+-		warnx("tc= loop in record `%s' in `%s'", name, db_array[0]);
+-		break;
+-	case -2:
+-		warn("system error fetching record `%s' in `%s'", name,
+-		    db_array[0]);
+-		break;
+-	case -1:
+-	case 0:
+-		break;
+-	case 1:
+-		warnx("tc= reference not found in record for `%s' in `%s'",
+-		    name, db_array[0]);
+-		break;
+-	default:
+-		warnx("unknown error %d in record `%s' in `%s'", error, name,
+-		    db_array[0]);
+-		break;
+-	}
+-	return buf;
+-}
+-
+-static char *
+-mygetone(const char * const * db_array, int first)
+-{
+-	char *buf = NULL;
+-	int error;
+-
+-	switch (error = (first ? cgetfirst : cgetnext)(&buf, db_array)) {
+-	case -2:
+-		warnx("tc= loop in `%s'", db_array[0]);
+-		break;
+-	case -1:
+-		warn("system error fetching record in `%s'", db_array[0]);
+-		break;
+-	case 0:
+-	case 1:
+-		break;
+-	case 2:
+-		warnx("tc= reference not found in `%s'", db_array[0]);
+-		break;
+-	default:
+-		warnx("unknown error %d in `%s'", error, db_array[0]);
+-		break;
+-	}
+-	return buf;
+-}
+-
+-static void
+-capprint(const char *cap)
+-{
+-	char *c = strchr(cap, ':');
+-	if (c)
+-		if (c == cap)
+-			(void)printf("true\n");
+-		else {
+-			int l = (int)(c - cap);
+-			(void)printf("%*.*s\n", l, l, cap);
+-		}
+-	else
+-		(void)printf("%s\n", cap);
+-}
+-
+-static void
+-prettyprint(char *b)
+-{
+-#define TERMWIDTH 65
+-	int did = 0;
+-	size_t len;
+-	char *s, c;
+-
+-	for (;;) {
+-		len = strlen(b);
+-		if (len <= TERMWIDTH) {
+-done:
+-			if (did)
+-				printf("\t:");
+-			printf("%s\n", b);
+-			return;
+-		}
+-		for (s = b + TERMWIDTH; s > b && *s != ':'; s--)
+-			continue;
+-		if (*s++ != ':')
+-			goto done;
+-		c = *s;
+-		*s = '\0';
+-		if (did)
+-			printf("\t:");
+-		did++;
+-		printf("%s\\\n", b);
+-		*s = c;
+-		b = s;
+-	}
+-}
+-
+-static void
+-handleone(const char * const *db_array, char *b, int recurse, int pretty,
+-    int level)
+-{
+-	char *tc;
+-
+-	if (level && pretty)
+-		printf("\n");
+-	if (pretty)
+-		prettyprint(b);
+-	else
+-		printf("%s\n", b);
+-	if (!recurse || cgetstr(b, "tc", &tc) <= 0)
+-		return;
+-
+-	b = mygetent(db_array, tc);
+-	free(tc);
+-
+-	if (b == NULL)
+-		return;
+-
+-	handleone(db_array, b, recurse, pretty, ++level);
+-	free(b);
+-}
+-
+-static int
+-handlecap(const char *db, int argc, char *argv[])
+-{
+-	static const char sfx[] = "=#:";
+-	const char *db_array[] = { db, NULL };
+-	char	*b, *cap;
+-	int	i, rv, c;
+-	size_t	j;
+-	int	expand = 1, recurse = 0, pretty = 0;
+-
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-	argc--;
+-	argv++;
+-	while ((c = getopt(argc, argv, "pnr")) != -1)
+-		switch (c) {
+-		case 'n':
+-			expand = 0;
+-			break;
+-		case 'r':
+-			expand = 0;
+-			recurse = 1;
+-			break;
+-		case 'p':
+-			pretty = 1;
+-			break;
+-		default:
+-			usage();
+-			break;
+-		}
+-
+-	argc -= optind;
+-	argv += optind;
+-	csetexpandtc(expand);
+-	rv = RV_OK;
+-	if (argc == 0) {
+-		for (b = mygetone(db_array, 1); b; b = mygetone(db_array, 0)) {
+-			handleone(db_array, b, recurse, pretty, 0);
+-			free(b);
+-		}
+-	} else {
+-		if ((b = mygetent(db_array, argv[0])) == NULL)
+-			return RV_NOTFOUND;
+-		if (argc == 1)
+-			handleone(db_array, b, recurse, pretty, 0);
+-		else {
+-			for (i = 2; i < argc; i++) {
+-				for (j = 0; j < sizeof(sfx) - 1; j++) {
+-					cap = cgetcap(b, argv[i], sfx[j]);
+-					if (cap) {
+-						capprint(cap);
+-						break;
+-					} 
+-				}
+-				if (j == sizeof(sfx) - 1)
+-					printf("false\n");
+-			}
+-		}
+-		free(b);
+-	}
+-	return rv;
+-}
+-
+-		/*
+-		 * gettytab
+-		 */
+-
+-static int
+-gettytab(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_GETTYTAB, argc, argv);
+-}
+-
+-		/*
+-		 * printcap
+-		 */
+-
+-static int
+-printcap(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_PRINTCAP, argc, argv);
+-}
+-
+-		/*
+-		 * disktab
+-		 */
+-
+-static int
+-disktab(int argc, char *argv[])
+-{
+-	return handlecap(_PATH_DISKTAB, argc, argv);
+-}
+-
+ 		/*
+ 		 * protocols
+ 		 */
+@@ -726,47 +402,6 @@
+ }
+ 
+ 		/*
+-		 * rpc
+-		 */
+-
+-static int
+-rpc(int argc, char *argv[])
+-{
+-	struct rpcent	*re;
+-	unsigned long	id;
+-	int		i, rv;
+-	
+-	assert(argc > 1);
+-	assert(argv != NULL);
+-
+-#define RPCPRINT	printfmtstrings(re->r_aliases, "  ", " ", \
+-				"%-16s  %6d", \
+-				re->r_name, re->r_number)
+-
+-	setrpcent(1);
+-	rv = RV_OK;
+-	if (argc == 2) {
+-		while ((re = getrpcent()) != NULL)
+-			RPCPRINT;
+-	} else {
+-		for (i = 2; i < argc; i++) {
+-			if (parsenum(argv[i], &id))
+-				re = getrpcbynumber((int)id);
+-			else
+-				re = getrpcbyname(argv[i]);
+-			if (re != NULL)
+-				RPCPRINT;
+-			else {
+-				rv = RV_NOTFOUND;
+-				break;
+-			}
+-		}
+-	}
+-	endrpcent();
+-	return rv;
+-}
+-
+-		/*
+ 		 * services
+ 		 */
+ 
diff --git a/pkgs/os-specific/darwin/CoreSymbolication/default.nix b/pkgs/os-specific/darwin/CoreSymbolication/default.nix
new file mode 100644
index 000000000000..aa73c7f86c40
--- /dev/null
+++ b/pkgs/os-specific/darwin/CoreSymbolication/default.nix
@@ -0,0 +1,19 @@
+{ fetchFromGitHub, stdenv }:
+
+# Reverse engineered CoreSymbolication to make dtrace buildable
+
+stdenv.mkDerivation rec {
+  name = "CoreSymbolication";
+
+  src = fetchFromGitHub {
+    repo = name;
+    owner = "matthewbauer";
+    rev = "671fcb66c82eac1827f3f53dc4cc4e9b1b94da0a";
+    sha256 = "0qpw46gwgjxiwqqjxksb8yghp2q8dwad6hzaf4zl82xpvk9n5ahj";
+  };
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp -r CoreSymbolication $out/include
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 5a58410ae926..7f6f0cdd0c48 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -210,6 +210,13 @@ in rec {
       ];
     });
 
+    CoreMIDI = stdenv.lib.overrideDerivation super.CoreMIDI (drv: {
+      __propagatedImpureHostDeps = drv.__propagatedImpureHostDeps ++ [
+        "/System/Library/PrivateFrameworks/"
+      ];
+      setupHook = ./private-frameworks-setup-hook.sh;
+    });
+
     Security = stdenv.lib.overrideDerivation super.Security (drv: {
       setupHook = ./security-setup-hook.sh;
     });
diff --git a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
index 081f713d0549..f8c424089f09 100644
--- a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@@ -14,7 +14,6 @@ with frameworks; with libs; {
   AppKitScripting         = [];
   AppleScriptKit          = [];
   AppleScriptObjC         = [];
-  AppleShareClientCore    = [ CoreServices ];
   AudioToolbox            = [ AudioUnit CoreAudio CF CoreMIDI ];
   AudioUnit               = [ Carbon CoreAudio CF ];
   AudioVideoBridging      = [ Foundation ];
@@ -84,12 +83,10 @@ with frameworks; with libs; {
   PCSC                    = [ CoreData ];
   PreferencePanes         = [];
   PubSub                  = [];
-  Python                  = [ ApplicationServices ];
   QTKit                   = [ CoreMediaIO CoreMedia MediaToolbox QuickTime VideoToolbox ];
   QuickLook               = [ ApplicationServices CF ];
   QuickTime               = [ ApplicationServices AudioUnit Carbon CoreAudio CoreServices OpenGL QuartzCore ];
   Ruby                    = [];
-  RubyCocoa               = [];
   SceneKit                = [];
   ScreenSaver             = [];
   Scripting               = [];
@@ -105,11 +102,9 @@ with frameworks; with libs; {
   SystemConfiguration     = [ CF Security ];
   TWAIN                   = [ Carbon ];
   Tcl                     = [];
-  Tk                      = [ ApplicationServices Carbon X11 ];
   VideoDecodeAcceleration = [ CF CoreVideo ];
   VideoToolbox            = [ CF CoreMedia CoreVideo ];
   WebKit                  = [ ApplicationServices Carbon JavaScriptCore OpenGL ];
-  X11                     = []; # used by Tk, should this exist?
 
   # Umbrellas
   Accelerate          = [ CoreWLAN IOBluetooth ];
diff --git a/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
new file mode 100644
index 000000000000..fbd977f8552d
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
@@ -0,0 +1,8 @@
+addPrivateFrameworks() {
+    flag="-F/System/Library/PrivateFrameworks"
+    if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+        NIX_CFLAGS_COMPILE+=" $flag"
+    fi
+}
+
+addEnvHooks "$hostOffset" addPrivateFrameworks
diff --git a/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
new file mode 100644
index 000000000000..1cb85b1e9884
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/SmartCardServices/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, appleDerivation, xcbuild, gnumake, Security
+, libsecurity_utilities, libsecurity_cdsa_utilities }:
+
+appleDerivation {
+  buildInputs = [ xcbuild libsecurity_utilities libsecurity_cdsa_utilities ];
+
+  DSTROOT = "$out";
+
+  NIX_CFLAGS_COMPILE = "-I.";
+  preBuild = ''
+    mkdir -p Security
+    cp ${Security}/Library/Frameworks/Security.framework/Headers/*.h Security
+  '';
+
+  patchPhase = ''
+    substituteInPlace SmartCardServices.xcodeproj/project.pbxproj \
+      --replace "/usr/bin/gnumake" "${gnumake}/bin/make"
+    substituteInPlace src/PCSC/PCSC.exp \
+      --replace _PCSCVersionString "" \
+      --replace _PCSCVersionNumber ""
+    substituteInPlace Makefile.installPhase \
+      --replace chown "# chown" \
+      --replace /usr/bin/ ""
+  '';
+
+  installPhase = ''
+    make -f Makefile.installPhase install
+    make -f Makefile-exec.installPhase install
+    mv $out/usr/* $out
+    rmdir $out/usr
+
+    mkdir -p $out/Library/Frameworks
+    cp -r Products/Release/PCSC.bundle $out/Library/Frameworks/PCSC.framework
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ matthewbauer ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
index a3d4099399b3..dcfb4aefe1f5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/adv_cmds/xcode.nix
@@ -27,14 +27,14 @@ appleDerivation {
                 | grep -v -e Desktop -e Embedded -e mklocale -e colldef)
 
     for i in $targets; do
-      xcodebuild -target $i
+      xcodebuild SYMROOT=$PWD/Products OBJROOT=$PWD/Intermediates -target $i
     done
   '';
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install adv_cmds-*/Build/Products/Release/* $out/bin/
+    install Products/Release/* $out/bin/
 
     for n in 1 8; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
index 9e8b78e57d6c..b52ec3306dc4 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/basic_cmds/default.nix
@@ -14,7 +14,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install basic_cmds-*/Build/Products/Release/* $out/bin/
+    install Products/Release/* $out/bin/
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index cca729016c25..3120d8ae3d10 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -7,6 +7,7 @@ let
   # now it's staying here.
   versions = {
     "osx-10.11.6" = {
+      SmartCardServices = "55111";
       dtrace        = "168";
       xnu           = "3248.60.10";
       libpthread    = "138.10.4";
@@ -43,6 +44,9 @@ let
       file_cmds     = "264.1.1";
       shell_cmds    = "187";
       system_cmds   = "550.6";
+      diskdev_cmds   = "593";
+      top           = "108";
+      text_cmds     = "99";
     };
     "osx-10.11.5" = {
       Libc          = "1082.50.1"; # 10.11.6 still unreleased :/
@@ -53,6 +57,7 @@ let
       ICU           = "531.48";
       libdispatch   = "442.1.4";
       Security      = "57031.40.6";
+      security_systemkeychain = "55202";
 
       IOAudioFamily                        = "203.3";
       IOFireWireFamily                     = "458";
@@ -191,6 +196,8 @@ let
   adv_cmds = applePackage "adv_cmds" "osx-10.5.8" "102ssayxbg9wb35mdmhswbnw0bg7js3pfd8fcbic83c5q3bqa6c6" {};
 
   packages = {
+    SmartCardServices = applePackage "SmartCardServices" "osx-10.11.6" "1qqjlbi6j37mw9p3qpfnwf14xh9ff8h5786bmvzwc4kblfglabkm" {};
+
     inherit (adv_cmds) ps locale;
     architecture    = applePackage "architecture"      "osx-10.11.6"     "1pbpjcd7is69hn8y29i98ci0byik826if8gnp824ha92h90w0fq3" {};
     bootstrap_cmds  = applePackage "bootstrap_cmds"    "dev-tools-7.0"   "1v5dv2q3af1xwj5kz0a5g54fd5dm6j4c9dd2g66n4kc44ixyrhp3" {};
@@ -201,7 +208,8 @@ let
     configd         = applePackage "configd"           "osx-10.8.5"      "1gxakahk8gallf16xmhxhprdxkh3prrmzxnmxfvj0slr0939mmr2" {};
     copyfile        = applePackage "copyfile"          "osx-10.11.6"     "1rkf3iaxmjz5ycgrmf0g971kh90jb2z1zqxg5vlqz001s4y457gs" {};
     Csu             = applePackage "Csu"               "osx-10.11.6"     "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
-    dtrace          = applePackage "dtrace"            "osx-10.11.6"     "0pp5x8dgvzmg9vvg32hpy2brm17dpmbwrcr4prsmdmfvd4767wc0" {};
+    dtrace          = applePackage "dtrace"            "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
+    dtrace-xcode    = applePackage "dtrace/xcode.nix"  "osx-10.11.6"     "04mi0jy8gy0w59rk9i9dqznysv6fzz1v5mq779s41cp308yi0h1c" {};
     dyld            = applePackage "dyld"              "osx-10.11.6"     "0qkjmjazm2zpgvwqizhandybr9cm3gz9pckx8rmf0py03faafc08" {};
     eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
     ICU             = applePackage "ICU"               "osx-10.10.5"     "1qihlp42n5g4dl0sn0f9pc0bkxy1452dxzf0vr6y5gqpshlzy03p" {};
@@ -238,10 +246,15 @@ let
     adv_cmds        = applePackage "adv_cmds/xcode.nix" "osx-10.11.6"    "12gbv35i09aij9g90p6b3x2f3ramw43qcb2gjrg8lzkzmwvcyw9q" {};
     basic_cmds      = applePackage "basic_cmds"        "osx-10.11.6"     "0hvab4b1v5q2x134hdkal0rmz5gsdqyki1vb0dbw4py1bqf0yaw9" {};
     developer_cmds  = applePackage "developer_cmds"    "osx-10.11.6"     "1r9c2b6dcl22diqf90x58psvz797d3lxh4r2wppr7lldgbgn24di" {};
+    diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "1ssdyiaq5m1zfy96yy38yyknp682ki6bvabdqd5z18fa0rv3m2ar" {};
     network_cmds    = applePackage "network_cmds"      "osx-10.11.6"     "0lhi9wz84qr1r2ab3fb4nvmdg9gxn817n5ldg7zw9gnf3wwn42kw" {};
     file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "1zfxbmasps529pnfdjvc13p7ws2cfx8pidkplypkswyff0nff4wp" {};
     shell_cmds      = applePackage "shell_cmds"        "osx-10.11.6"     "0084k271v66h4jqp7q7rmjvv7w4mvhx3aq860qs8jbd30canm86n" {};
     system_cmds     = applePackage "system_cmds"       "osx-10.11.6"     "1h46j2c5v02pkv5d9fyv6cpgyg0lczvwicrx6r9s210cl03l77jl" {};
+    text_cmds       = applePackage "text_cmds"         "osx-10.11.6"     "1f93m7dd0ghqb2hwh905mjhzblyfr7dwffw98xhgmv1mfdnigxg0" {};
+    top             = applePackage "top"               "osx-10.11.6"     "0i9120rfwapgwdvjbfg0ya143i29s1m8zbddsxh39pdc59xnsg5l" {};
+
+    security_systemkeychain = applePackage "security_systemkeychain" "osx-10.10.5" "0xviskdgxsail15npi0billyiysvljlmg38mmhnr7qi4ymnnjr90" {};
 
     libsecurity_apple_csp      = libsecPackage "libsecurity_apple_csp"      "osx-10.7.5" "1ngyn1ik27n4x981px3kfd1z1n8zx7r5w812b6qfjpy5nw4h746w" {};
     libsecurity_apple_cspdl    = libsecPackage "libsecurity_apple_cspdl"    "osx-10.7.5" "1svqa5fhw7p7njzf8bzg7zgc5776aqjhdbnlhpwmr5hmz5i0x8r7" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
index 67fbf83496ed..1f35e3008b3b 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/developer_cmds/default.nix
@@ -11,7 +11,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install developer_cmds-*/Build/Products/Release/* $out/bin/
+    install Products/Release/* $out/bin/
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
new file mode 100644
index 000000000000..aba2472af602
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/diskdev_cmds/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, appleDerivation, xcbuild, lib, hostPlatform, Libc, xnu, libutil-new }:
+
+appleDerivation {
+  buildInputs = [ xcbuild libutil-new ];
+
+  NIX_CFLAGS_COMPILE = "-I.";
+  NIX_LDFLAGS = "-lutil";
+  patchPhase = ''
+    # ugly hacks for missing headers
+    # most are bsd related - probably should make this a drv
+    unpackFile ${Libc.src}
+    unpackFile ${xnu.src}
+    mkdir System sys machine i386
+    cp xnu-*/bsd/sys/disklabel.h sys
+    cp xnu-*/bsd/machine/disklabel.h machine
+    cp xnu-*/bsd/i386/disklabel.h i386
+    cp -r xnu-*/bsd/sys System
+    cp -r Libc-*/uuid System
+  '';
+  installPhase = ''
+    install -D Products/Release/libdisk.a $out/lib/libdisk.a
+    rm Products/Release/libdisk.a
+    for bin in Products/Release/*; do
+      install -D $bin $out/bin/$(basename $bin)
+    done
+  '';
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
new file mode 100644
index 000000000000..dd193f2c07dc
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/dtrace/xcode.nix
@@ -0,0 +1,45 @@
+{ appleDerivation, xcbuild, CoreSymbolication, xnu, bison, flex, darling, stdenv }:
+
+appleDerivation {
+  buildInputs = [ xcbuild CoreSymbolication xnu bison flex darling ];
+  NIX_CFLAGS_COMPILE = "-DCTF_OLD_VERSIONS -DPRIVATE -DYYDEBUG=1 -I${xnu}/Library/Frameworks/System.framework/Headers";
+  NIX_LDFLAGS = "-L./Products/Release";
+  xcbuildFlags = "-target dtrace";
+
+  patchPhase = ''
+    substituteInPlace dtrace.xcodeproj/project.pbxproj --replace "/usr/sbin" ""
+    substituteInPlace libdtrace/dt_open.c \
+      --replace "/usr/bin/clang" "${stdenv.cc}/bin/cpp" \
+      --replace "/usr/bin/ld" "${stdenv.cc}/bin/ld" \
+      --replace "/usr/bin/dtrace" $out/lib/dtrace
+  '';
+
+  # hack to handle xcbuild's broken lex handling
+  preBuild = ''
+    cd libdtrace
+    yacc -d dt_grammar.y
+    flex -l -d dt_lex.l
+    cd ..
+
+    substituteInPlace dtrace.xcodeproj/project.pbxproj \
+      --replace '6EBC9800099BFBBF0001019C /* dt_grammar.y */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.yacc; name = dt_grammar.y; path = libdtrace/dt_grammar.y; sourceTree = "<group>"; };' '6EBC9800099BFBBF0001019C /* y.tab.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = y.tab.c; path = libdtrace/y.tab.c; sourceTree = "<group>"; };' \
+      --replace '6EBC9808099BFBBF0001019C /* dt_lex.l */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.lex; name = dt_lex.l; path = libdtrace/dt_lex.l; sourceTree = "<group>"; };' '6EBC9808099BFBBF0001019C /* lex.yy.c */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.c; name = lex.yy.c; path = libdtrace/lex.yy.c; sourceTree = "<group>"; };'
+  '';
+
+  # xcbuild doesn't support install
+  installPhase = ''
+    mkdir -p $out
+
+    cp -r Products/Release/usr $out
+    mv $out/usr/* $out
+    rmdir $out/usr
+
+    mkdir $out/lib
+    cp Products/Release/*.dylib $out/lib
+
+    mkdir $out/bin
+    cp Products/Release/dtrace $out/bin
+
+    mkdir -p $out/lib/dtrace
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
index 8346ca7a9a76..47a587966b44 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/file_cmds/default.nix
@@ -19,7 +19,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install file_cmds-*/Build/Products/Release/* $out/bin
+    install Products/Release/* $out/bin
 
     for n in 1; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
index 13b6156492bb..d9b3dfb74049 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libiconv/default.nix
@@ -14,6 +14,8 @@ appleDerivation {
       -Wl,-reexport_library -Wl,$out/lib/libcharset.dylib
   '';
 
+  setup-hook = ../../../../development/libraries/libiconv/setup-hook.sh;
+
   meta = {
     platforms = stdenv.lib.platforms.darwin;
   };
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
index 083a8a85d17d..166b4e631c84 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_x509_tp/GNUmakefile
@@ -5,6 +5,7 @@ LIBRARY_NAME = security_apple_x509_tp
 security_apple_x509_tp_HEADER_FILES = $(notdir $(wildcard lib/*.h))
 security_apple_x509_tp_HEADER_FILES_DIR = lib
 
+security_apple_x509_tp_C_FILES = $(wildcard lib/*.c)
 security_apple_x509_tp_CC_FILES = $(wildcard lib/*.cpp)
 
 include $(GNUSTEP_MAKEFILES)/library.make
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
index c5ba9cc8d7ef..2a05855bd521 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_codesigning/default.nix
@@ -1,7 +1,33 @@
-{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities }:
+{ appleDerivation, libsecurity_cdsa_utilities, libsecurity_utilities
+, Security, xnu, xar, antlr, libsecurityd, apple_sdk
+, dtrace-xcode, osx_private_sdk }:
 appleDerivation {
-  buildInputs = [
-    libsecurity_utilities
-    libsecurity_cdsa_utilities
-  ];
-}
\ No newline at end of file
+  buildInputs = [ libsecurity_utilities libsecurity_cdsa_utilities dtrace-xcode
+                  Security xar antlr libsecurityd ];
+  NIX_CFLAGS_COMPILE = "-Iinclude -I${xnu}/Library/Frameworks/System.framework/Headers";
+  patchPhase = ''
+    substituteInPlace lib/policydb.cpp \
+      --replace "new MutableDictionary::MutableDictionary()" NULL
+    substituteInPlace lib/xpcengine.h \
+      --replace "#include <xpc/private.h>" ""
+    substituteInPlace lib/policyengine.cpp \
+      --replace "#include <OpenScriptingUtilPriv.h>" ""
+
+    rm lib/policyengine.cpp lib/quarantine++.cpp lib/codedirectory.cpp lib/xpcengine.cpp
+  '';
+  preBuild = ''
+    mkdir -p include
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/usr/include/quarantine.h include
+    mkdir -p include/CoreServices/
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreServices.framework/PrivateHeaders/*.h include/CoreServices/
+
+    unpackFile ${Security.src}
+    mkdir -p include/securityd_client
+    cp Security-*/libsecurityd/lib/*.h include/securityd_client
+    mkdir -p include/xpc
+    cp ${apple_sdk.sdk}/include/xpc/*.h include/xpc
+
+    sed -i '1i #define bool int' lib/security_codesigning.d
+    dtrace -h -C -s lib/security_codesigning.d -o codesigning_dtrace.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
index bb55fd48d8b2..e811c4c11a82 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
@@ -4,9 +4,12 @@ appleDerivation {
     libauto
     libobjc
     IOKit
+  ];
+  propagatedBuildInputs = [
     sqlite
     apple_sdk.frameworks.PCSC
   ];
+  NIX_LDFLAGS = "-framework PCSC";
   patchPhase = ''
     substituteInPlace lib/errors.h --replace \
       '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacTypes.h>' \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
index 860a74f61f7f..7facea2b8936 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/new.nix
@@ -4,22 +4,18 @@
 appleDerivation {
   buildInputs = [ xcbuild ];
 
-  dontUseXcbuild = true;
-
   prePatch = ''
     substituteInPlace tzlink.c \
       --replace '#include <xpc/xpc.h>' ""
   '';
 
-  buildPhase = ''
-    xcodebuild -target util
-  '';
+  xcbuildFlags = "-target util";
 
   installPhase = ''
     mkdir -p $out/lib $out/include
 
-    cp libutil-*/Build/Products/Release/*.dylib $out/lib
-    cp libutil-*/Build/Products/Release/*.h $out/include
+    cp Products/Release/*.dylib $out/lib
+    cp Products/Release/*.h $out/include
 
     # TODO: figure out how to get this to be right the first time around
     install_name_tool -id $out/lib/libutil.dylib $out/lib/libutil.dylib
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index 357a87689a03..23777c941576 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -7,17 +7,19 @@ appleDerivation rec {
 
   # "spray" requires some files that aren't compiling correctly in xcbuild.
   # "rtadvd" seems to fail with some missing constants.
-  # We disable spray and rtadvd here for now.
+  # "traceroute6" and "ping6" require ipsec which doesn't build correctly
   patchPhase = ''
     substituteInPlace network_cmds.xcodeproj/project.pbxproj \
       --replace "7294F0EA0EE8BAC80052EC88 /* PBXTargetDependency */," "" \
-      --replace "7216D34D0EE89FEC00AE70E4 /* PBXTargetDependency */," ""
+      --replace "7216D34D0EE89FEC00AE70E4 /* PBXTargetDependency */," "" \
+      --replace "72CD1D9C0EE8C47C005F825D /* PBXTargetDependency */," "" \
+      --replace "7216D2C20EE89ADF00AE70E4 /* PBXTargetDependency */," ""
   '';
 
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/bin/
-    install network_cmds-*/Build/Products/Release/* $out/bin/
+    install Products/Release/* $out/bin/
 
     for n in 1 5; do
       mkdir -p $out/share/man/man$n
diff --git a/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
new file mode 100644
index 000000000000..1a0208ef3a08
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/security_systemkeychain/default.nix
@@ -0,0 +1,31 @@
+{ appleDerivation, xcbuild, Security
+, libsecurity_codesigning, libsecurity_utilities, libsecurity_cdsa_utilities
+, xnu, osx_private_sdk, pcsclite}:
+
+appleDerivation {
+  buildInputs = [ xcbuild Security libsecurity_utilities
+                  libsecurity_cdsa_utilities libsecurity_codesigning
+                  pcsclite ];
+
+  NIX_LDFLAGS = "-lpcsclite";
+
+  # can't build the whole thing
+  xcbuildFlags = "-target codesign";
+
+  preBuild = ''
+    mkdir -p include/Security
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/PrivateHeaders/*.h include/Security
+    cp ${osx_private_sdk.src}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/Security.framework/Headers/*.h include/Security
+
+    unpackFile ${xnu.src}
+    mkdir -p include/sys
+    cp -r xnu-*/bsd/sys/codesign.h include/sys/codesign.h
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Iinclude";
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp Products/Release/codesign $out/bin/codesign
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
index f434e15794ea..8ce916feb38a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/shell_cmds/default.nix
@@ -10,10 +10,12 @@ appleDerivation rec {
     # - su ('security/pam_appl.h' file not found)
     # - find (Undefined symbol '_get_date')
     # - w (Undefined symbol '_res_9_init')
+    # - expr
     substituteInPlace shell_cmds.xcodeproj/project.pbxproj \
       --replace "FCBA168714A146D000AA698B /* PBXTargetDependency */," "" \
       --replace "FCBA165914A146D000AA698B /* PBXTargetDependency */," "" \
-      --replace "FCBA169514A146D000AA698B /* PBXTargetDependency */," ""
+      --replace "FCBA169514A146D000AA698B /* PBXTargetDependency */," "" \
+      --replace "FCBA165514A146D000AA698B /* PBXTargetDependency */," ""
 
     # disable w, test install
     # get rid of permission stuff
@@ -27,7 +29,7 @@ appleDerivation rec {
   # temporary install phase until xcodebuild has "install" support
   installPhase = ''
     mkdir -p $out/usr/bin
-    install shell_cmds-*/Build/Products/Release/* $out/usr/bin
+    install Products/Release/* $out/usr/bin
 
     export DSTROOT=$out
     export SRCROOT=$PWD
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 2247ef3ddd2f..1bbda6ab7add 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -1,37 +1,104 @@
-{ stdenv, appleDerivation, xcbuild }:
+{ stdenv, appleDerivation, xcbuild, lib, hostPlatform
+, Librpcsvc, apple_sdk, pam, CF, openbsm }:
 
 appleDerivation rec {
   # xcbuild fails with:
   # /nix/store/fc0rz62dh8vr648qi7hnqyik6zi5sqx8-xcbuild-wrapper/nix-support/setup-hook: line 1:  9083 Segmentation fault: 11  xcodebuild OTHER_CFLAGS="$NIX_CFLAGS_COMPILE" OTHER_CPLUSPLUSFLAGS="$NIX_CFLAGS_COMPILE" OTHER_LDFLAGS="$NIX_LDFLAGS" build
+  # see issue facebook/xcbuild#188
   # buildInputs = [ xcbuild ];
 
-  # # temporary install phase until xcodebuild has "install" support
-  # installPhase = ''
-  #   mkdir -p $out/bin/
-  #   install system_cmds-*/Build/Products/Release/* $out/bin/
-
-  #   for n in 1 5 8; do
-  #     mkdir -p $out/share/man/man$n
-  #     install */*.$n $out/share/man/man$n
-  #   done
-  # '';
-
-  # For now we just build sysctl because that's all I need... Please open a
-  # PR if you need any other utils before we fix the xcodebuild.
-  buildPhase = "cc sysctl.tproj/sysctl.c -o sysctl";
-
-  installPhase =
-    ''
-      mkdir -p $out/bin
-      install sysctl $out/bin
-      for n in 5 8; do
-        mkdir -p $out/share/man/man$n
-        install sysctl.tproj/*.$n $out/share/man/man$n
+  buildInputs = [ Librpcsvc apple_sdk.frameworks.OpenDirectory pam CF
+                  apple_sdk.frameworks.IOKit openbsm ];
+  # NIX_CFLAGS_COMPILE = lib.optionalString hostPlatform.isi686 "-D__i386__"
+  #                    + lib.optionalString hostPlatform.isx86_64 "-D__x86_64__"
+  #                    + lib.optionalString hostPlatform.isAarch32 "-D__arm__";
+  NIX_CFLAGS_COMPILE = [ "-DDAEMON_UID=1"
+                         "-DDAEMON_GID=1"
+                         "-DDEFAULT_AT_QUEUE=\'a\'"
+                         "-DDEFAULT_BATCH_QUEUE=\'b\'"
+                         "-DPERM_PATH=\"/usr/lib/cron/\""
+                         "-DOPEN_DIRECTORY"
+                         "-DNO_DIRECT_RPC"
+                         "-DAPPLE_GETCONF_UNDERSCORE"
+                         "-DAPPLE_GETCONF_SPEC"
+                         "-DUSE_PAM"
+                         "-DUSE_BSM_AUDIT"
+                         "-D_PW_NAME_LEN=MAXLOGNAME"
+                         "-D_PW_YPTOKEN=\"__YP!\""
+                         "-DAHZV1=64 "
+                         "-DAU_SESSION_FLAG_HAS_TTY=0x4000"
+                         "-DAU_SESSION_FLAG_HAS_AUTHENTICATED=0x4000"
+                       ] ++ lib.optional (!stdenv.isLinux) " -D__FreeBSD__ ";
+
+  patchPhase = ''
+    substituteInPlace login.tproj/login.c \
+      --replace bsm/audit_session.h bsm/audit.h
+    substituteInPlace login.tproj/login_audit.c \
+      --replace bsm/audit_session.h bsm/audit.h
+  '';
+
+  buildPhase = ''
+    for dir in *.tproj; do
+      name=$(basename $dir)
+      name=''${name%.tproj}
+
+      CFLAGS=""
+      case $name in
+           arch) CFLAGS="-framework CoreFoundation";;
+           atrun) CFLAGS="-Iat.tproj";;
+           chkpasswd)
+             CFLAGS="-framework OpenDirectory -framework CoreFoundation -lpam";;
+           getconf)
+               for f in getconf.tproj/*.gperf; do
+                   cfile=''${f%.gperf}.c
+                   LC_ALL=C awk -f getconf.tproj/fake-gperf.awk $f > $cfile
+               done
+           ;;
+           iostat) CFLAGS="-framework IOKit -framework CoreFoundation";;
+           login) CFLAGS="-lbsm -lpam";;
+           nvram) CFLAGS="-framework CoreFoundation -framework IOKit";;
+           sadc) CFLAGS="-framework IOKit -framework CoreFoundation";;
+           sar) CFLAGS="-Isadc.tproj";;
+      esac
+
+      echo "Building $name"
+
+      case $name in
+
+           # These are all broken currently.
+           arch) continue;;
+           chpass) continue;;
+           dirhelper) continue;;
+           dynamic_pager) continue;;
+           fs_usage) continue;;
+           latency) continue;;
+           pagesize) continue;;
+           passwd) continue;;
+           reboot) continue;;
+           sc_usage) continue;;
+           shutdown) continue;;
+           trace) continue;;
+
+           *) cc $dir/*.c -I''${dir} $CFLAGS -o $name ;;
+      esac
+    done
+  '';
+
+  installPhase = ''
+    for dir in *.tproj; do
+      name=$(basename $dir)
+      name=''${name%.tproj}
+      [ -x $name ] && install -D $name $out/bin/$name
+      for n in 1 2 3 4 5 6 7 8 9; do
+        for f in $dir/*.$n; do
+          install -D $f $out/share/man/man$n/$(basename $f)
+        done
       done
-    '';
+    done
+  '';
 
   meta = {
     platforms = stdenv.lib.platforms.darwin;
-    maintainers = with stdenv.lib.maintainers; [ shlevy ];
+    maintainers = with stdenv.lib.maintainers; [ shlevy matthewbauer ];
   };
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
new file mode 100644
index 000000000000..196276b0b273
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/text_cmds/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, appleDerivation, fetchurl, xcbuild, ncurses, bzip2, zlib, lzma }:
+
+appleDerivation {
+  buildInputs = [ xcbuild ncurses bzip2 zlib lzma ];
+
+  # patches to use ncursees
+  # disables md5
+  patchPhase = ''
+    substituteInPlace text_cmds.xcodeproj/project.pbxproj \
+		  --replace 'FC6C98FB149A94EB00DDCC47 /* libcurses.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libcurses.dylib; path = /usr/lib/libcurses.dylib; sourceTree = "<absolute>"; };' 'FC6C98FB149A94EB00DDCC47 /* libncurses.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libncurses.dylib; path = /usr/lib/libncurses.dylib; sourceTree = "<absolute>"; };' \
+      --replace 'FC7A7EB5149875E00086576A /* PBXTargetDependency */,' ""
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    for f in Products/Release/*; do
+      install -D $f $out/bin/$(basename $f)
+    done
+  '';
+
+  meta = {
+    platforms = stdenv.lib.platforms.darwin;
+    maintainers = with stdenv.lib.maintainers; [ matthewbauer ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-source-releases/top/default.nix b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
new file mode 100644
index 000000000000..4ddec2a30c90
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/top/default.nix
@@ -0,0 +1,15 @@
+{xcbuild, appleDerivation, apple_sdk, ncurses, libutil-new, lib}:
+
+appleDerivation {
+  buildInputs = [ xcbuild apple_sdk.frameworks.IOKit ncurses libutil-new ];
+  NIX_LDFLAGS = "-lutil";
+  installPhase = ''
+    install -D Products/Release/libtop.a $out/lib/libtop.a
+    install -D Products/Release/libtop.h $out/include/libtop.h
+    install -D Products/Release/top $out/bin/top
+  '';
+  meta = {
+    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ matthewbauer ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index 1fff4915da3c..21d64979d7ea 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, binutils-raw, cctools
+{ stdenv, binutils-unwrapped, cctools
 , hostPlatform, targetPlatform
 }:
 
 # Make sure both underlying packages claim to have prepended their binaries
 # with the same targetPrefix.
-assert binutils-raw.targetPrefix == cctools.targetPrefix;
+assert binutils-unwrapped.targetPrefix == cctools.targetPrefix;
 
 let
-  inherit (binutils-raw) targetPrefix;
+  inherit (binutils-unwrapped) targetPrefix;
   cmds = [
     "ar" "ranlib" "as" "dsymutil" "install_name_tool"
     "ld" "strip" "otool" "lipo" "nm" "strings" "size"
@@ -21,7 +21,7 @@ stdenv.mkDerivation {
   buildCommand = ''
     mkdir -p $out/bin $out/include
 
-    ln -s ${binutils-raw.bintools.out}/bin/${targetPrefix}c++filt $out/bin/${targetPrefix}c++filt
+    ln -s ${binutils-unwrapped.out}/bin/${targetPrefix}c++filt $out/bin/${targetPrefix}c++filt
 
     # We specifically need:
     # - ld: binutils doesn't provide it on darwin
@@ -38,15 +38,15 @@ stdenv.mkDerivation {
       ln -sf "${cctools}/bin/$i" "$out/bin/$i"
     done
 
-    ln -s ${binutils-raw.bintools.out}/share $out/share
+    ln -s ${binutils-unwrapped.out}/share $out/share
 
     ln -s ${cctools}/libexec $out/libexec
 
     mkdir -p "$info/nix-support" "$man/nix-support"
-    printWords ${binutils-raw.bintools.info} \
+    printWords ${binutils-unwrapped.info} \
       >> $info/nix-support/propagated-build-inputs
     # FIXME: cctools missing man pages
-    printWords ${binutils-raw.bintools.man} \
+    printWords ${binutils-unwrapped.man} \
       >> $man/nix-support/propagated-build-inputs
   '';
 
diff --git a/pkgs/os-specific/darwin/cctools/ld-tbd-v2.patch b/pkgs/os-specific/darwin/cctools/ld-tbd-v2.patch
new file mode 100644
index 000000000000..9aae2be1d033
--- /dev/null
+++ b/pkgs/os-specific/darwin/cctools/ld-tbd-v2.patch
@@ -0,0 +1,98 @@
+diff --git a/cctools/ld64/src/ld/parsers/textstub_dylib_file.cpp b/cctools/ld64/src/ld/parsers/textstub_dylib_file.cpp
+index 09c0e12..ac6b085 100644
+--- a/cctools/ld64/src/ld/parsers/textstub_dylib_file.cpp
++++ b/cctools/ld64/src/ld/parsers/textstub_dylib_file.cpp
+@@ -187,6 +187,7 @@ struct DynamicLibrary {
+ 	ld::File::ObjcConstraint _objcConstraint;
+ 	Options::Platform _platform;
+ 	std::vector<Token> _allowedClients;
++	std::vector<Token> _allowableClients;
+ 	std::vector<Token> _reexportedLibraries;
+ 	std::vector<Token> _symbols;
+ 	std::vector<Token> _classes;
+@@ -246,6 +247,14 @@ class TBDFile {
+ 		});
+ 	}
+ 
++	void parseAllowableClients(DynamicLibrary& lib) {
++		if ( !hasOptionalToken("allowable-clients") )
++			return;
++		parseFlowSequence([&](Token name) {
++			lib._allowableClients.emplace_back(name);
++		});
++	}
++
+ 	void parseReexportedDylibs(DynamicLibrary& lib) {
+ 		if ( !hasOptionalToken("re-exports") )
+ 			return;
+@@ -306,6 +315,21 @@ class TBDFile {
+ 		return false;
+ 	}
+ 
++	void skipUUIDs(DynamicLibrary& lib) {
++		expectToken("uuids");
++		while ( true ) {
++			auto token = next();
++			if ( token == "]" )
++				break;
++		}
++	}
++
++	void skipParentUmbrella(DynamicLibrary& lib) {
++		if (!hasOptionalToken("parent-umbrella"))
++			return;
++		next();
++	}
++
+ 	void parsePlatform(DynamicLibrary& lib) {
+ 		expectToken("platform");
+ 
+@@ -410,6 +434,7 @@ class TBDFile {
+ 			}
+ 
+ 			parseAllowedClients(lib);
++			parseAllowableClients(lib);
+ 			parseReexportedDylibs(lib);
+ 			parseSymbols(lib);
+ 			if ( !hasOptionalToken("-") )
+@@ -455,17 +480,21 @@ class TBDFile {
+ 			return result.front();
+ 	}
+ 
+-	void parseDocument(DynamicLibrary& lib, std::string &requestedArchName) {
++	void parseDocument(DynamicLibrary& lib, std::string &requestedArchName, bool isTbdV2) {
+ 		auto selectedArchName = parseAndSelectArchitecture(requestedArchName);
+ 		if (selectedArchName.empty())
+ 			throwf("invalid arch");
+ 
++		if(isTbdV2)
++			skipUUIDs(lib);
+ 		parsePlatform(lib);
+ 		parseInstallName(lib);
+ 		parseCurrentVersion(lib);
+ 		parseCompatibilityVersion(lib);
+ 		parseSwiftVersion(lib);
+ 		parseObjCConstraint(lib);
++		if(isTbdV2)
++			skipParentUmbrella(lib);
+ 		parseExportsBlock(lib, selectedArchName);
+ 	}
+ 
+@@ -476,7 +505,8 @@ public:
+ 		_tokenizer.reset();
+ 		DynamicLibrary lib;
+ 		expectToken("---");
+-		parseDocument(lib, requestedArchName);
++		auto isTbdV2 = hasOptionalToken("!tapi-tbd-v2");
++		parseDocument(lib, requestedArchName, isTbdV2);
+ 		expectToken("...");
+ 		return lib;
+ 	}
+@@ -486,6 +516,7 @@ public:
+ 		auto token = next();
+ 		if ( token != "---" )
+ 			return false;
++		hasOptionalToken("!tapi-tbd-v2");
+ 		return !parseAndSelectArchitecture(requestedArchName).empty();
+ 	}
+ 
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index 55995c1592d1..d8abdc2c6f84 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, makeWrapper, autoconf, automake, libtool_2
+{ stdenv, fetchFromGitHub, makeWrapper, autoconf, automake, libtool_2, autoreconfHook
 , llvm, libcxx, libcxxabi, clang, libuuid
 , libobjc ? null, maloader ? null, xctoolchain ? null
 , hostPlatform, targetPlatform
@@ -6,6 +6,14 @@
 }:
 
 let
+
+  # We need to use an old version of cctools-port to support linking TBD files
+  # in the iOS SDK. Note that this only provides support for SDK versions up to
+  # 10.x. For 11.0 and higher we will need to upgrade to a newer cctools than the
+  # default version here, which can support the new TBD format via Apple's
+  # libtapi.
+  useOld = targetPlatform.isiOS;
+
   # The targetPrefix prepended to binary names to allow multiple binuntils on the
   # PATH to both be usable.
   targetPrefix = stdenv.lib.optionalString
@@ -16,10 +24,12 @@ in
 # Non-Darwin alternatives
 assert (!hostPlatform.isDarwin) -> (maloader != null && xctoolchain != null);
 
+assert enableDumpNormalizedLibArgs -> (!useOld);
+
 let
   baseParams = rec {
     name = "${targetPrefix}cctools-port-${version}";
-    version = "895";
+    version = if useOld then "886" else "895";
 
     src = fetchFromGitHub (if enableDumpNormalizedLibArgs then {
       owner  = "tpoechtrager";
@@ -27,6 +37,11 @@ let
       # master with https://github.com/tpoechtrager/cctools-port/pull/34
       rev    = "8395d4b2c3350356e2fb02f5e04f4f463c7388df";
       sha256 = "10vbf1cfzx02q8chc77s84fp2kydjpx2y682mr6mrbb7sq5rwh8f";
+    } else if useOld then {
+      owner  = "tpoechtrager";
+      repo   = "cctools-port";
+      rev    = "02f0b8ecd87a3951653d838a321ae744815e21a5";
+      sha256 = "0bzyabzr5dvbxglr74d0kbrk2ij5x7s5qcamqi1v546q1had1wz1";
     } else {
       owner  = "tpoechtrager";
       repo   = "cctools-port";
@@ -36,7 +51,11 @@ let
 
     outputs = [ "out" "dev" ];
 
-    nativeBuildInputs = [ autoconf automake libtool_2 ];
+    nativeBuildInputs = [
+      autoconf automake libtool_2
+    ] ++ stdenv.lib.optionals useOld [
+      autoreconfHook
+    ];
     buildInputs = [ libuuid ] ++
       # Only need llvm and clang if the stdenv isn't already clang-based (TODO: just make a stdenv.cc.isClang)
       stdenv.lib.optionals (!stdenv.isDarwin) [ llvm clang ] ++
@@ -44,9 +63,14 @@ let
 
     patches = [
       ./ld-rpath-nonfinal.patch ./ld-ignore-rpath-link.patch
+    ] ++ stdenv.lib.optionals useOld [
+      # See https://github.com/tpoechtrager/cctools-port/issues/24. Remove when that's fixed.
+      ./undo-unknown-triple.patch
+      ./ld-tbd-v2.patch
+      ./support-ios.patch
     ];
 
-    __propagatedImpureHostDeps = [
+    __propagatedImpureHostDeps = stdenv.lib.optionals (!useOld) [
       # As far as I can tell, otool from cctools is the only thing that depends on these two, and we should fix them
       "/usr/lib/libobjc.A.dylib"
       "/usr/lib/libobjc.dylib"
@@ -86,12 +110,15 @@ let
       EOF
     '' + stdenv.lib.optionalString (!stdenv.isDarwin) ''
       sed -i -e 's|clang++|& -I${libcxx}/include/c++/v1|' cctools/autogen.sh
+    '' + stdenv.lib.optionalString useOld ''
+      cd cctools
     '';
 
     # TODO: this builds an ld without support for LLVM's LTO. We need to teach it, but that's rather
     # hairy to handle during bootstrap. Perhaps it could be optional?
-    preConfigure = ''
+    preConfigure = stdenv.lib.optionalString (!useOld) ''
       cd cctools
+    '' + ''
       sh autogen.sh
     '';
 
diff --git a/pkgs/os-specific/darwin/cctools/support-ios.patch b/pkgs/os-specific/darwin/cctools/support-ios.patch
new file mode 100644
index 000000000000..f78c6b63ac80
--- /dev/null
+++ b/pkgs/os-specific/darwin/cctools/support-ios.patch
@@ -0,0 +1,13 @@
+diff --git a/cctools/configure.ac b/cctools/configure.ac
+index 56e8f24..0b4b3ff 100644
+--- a/cctools/configure.ac
++++ b/cctools/configure.ac
+@@ -39,7 +39,7 @@ EXTRACXXFLAGS=""
+ WARNINGS=""
+ 
+ case $host_os in
+-  darwin* )
++  darwin* | ios*)
+     isdarwin=yes
+     AM_CONDITIONAL([ISDARWIN], [true])
+   ;;
diff --git a/pkgs/os-specific/darwin/cctools/undo-unknown-triple.patch b/pkgs/os-specific/darwin/cctools/undo-unknown-triple.patch
new file mode 100644
index 000000000000..7df9bdd16dab
--- /dev/null
+++ b/pkgs/os-specific/darwin/cctools/undo-unknown-triple.patch
@@ -0,0 +1,17 @@
+diff --git a/cctools/as/driver.c b/cctools/as/driver.c
+index b06d085..c03397a 100644
+--- a/cctools/as/driver.c
++++ b/cctools/as/driver.c
+@@ -363,12 +363,6 @@ char **envp)
+ 	    /* Add -c or clang will run ld(1). */
+ 	    new_argv[j] = "-c";
+ 	    j++;
+-	    /* cctools-port start */
+-	    new_argv[j] = "-target";
+-	    j++;
+-	    new_argv[j] = "unknown-apple-darwin";
+-	    j++;
+-	    /* cctools-port end */
+ 	    new_argv[j] = NULL;
+ 	    if(execute(new_argv, verbose))
+ 		exit(0);
diff --git a/pkgs/os-specific/darwin/darling/default.nix b/pkgs/os-specific/darwin/darling/default.nix
new file mode 100644
index 000000000000..c1e29843147c
--- /dev/null
+++ b/pkgs/os-specific/darwin/darling/default.nix
@@ -0,0 +1,39 @@
+{stdenv, lib, fetchzip, cmake, bison, flex}:
+
+stdenv.mkDerivation rec {
+  pname = "darling";
+  name = pname;
+
+  src = fetchzip {
+    url = "https://github.com/darlinghq/darling/archive/d2cc5fa748003aaa70ad4180fff0a9a85dc65e9b.tar.gz";
+    sha256 = "11b51fw47nl505h63bgx5kqiyhf3glhp1q6jkpb6nqfislnzzkrf";
+    postFetch = ''
+      # Get rid of case conflict
+      mkdir $out
+      cd $out
+      tar -xzf $downloadedFile --strip-components=1
+      rm -r $out/src/libm
+    '';
+  };
+
+  # only packaging sandbox for now
+  buildPhase = ''
+    cc -c src/sandbox/sandbox.c -o src/sandbox/sandbox.o
+    cc -dynamiclib -flat_namespace src/sandbox/sandbox.o -o libsystem_sandbox.dylib
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp -rL src/sandbox/include/ $out/
+    cp libsystem_sandbox.dylib $out/lib/
+  '';
+
+  # buildInputs = [ cmake bison flex ];
+
+  meta = with lib; {
+    maintainers = with maintainers; [ matthewbauer ];
+    license = licenses.gpl3;
+    description = "Darwin/macOS emulation layer for Linux";
+    platforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/os-specific/darwin/ios-cross/default.nix b/pkgs/os-specific/darwin/ios-cross/default.nix
deleted file mode 100644
index 175e9738ef9e..000000000000
--- a/pkgs/os-specific/darwin/ios-cross/default.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-{ runCommand
-, lib
-, llvm
-, clang
-, binutils
-, stdenv
-, coreutils
-, gnugrep
-, buildPackages
-, hostPlatform
-, targetPlatform
-}:
-
-/* As of this writing, known-good prefix/arch/simulator triples:
- * aarch64-apple-darwin14 | arm64  | false
- * arm-apple-darwin10     | armv7  | false
- * i386-apple-darwin11    | i386   | true
- * x86_64-apple-darwin14  | x86_64 | true
- */
-
-# Apple uses somewhat non-standard names for this. We could fall back on
-# `targetPlatform.parsed.cpu.name`, but that would be a more standard one and
-# likely to fail. Better just to require something manual.
-assert targetPlatform ? arch;
-
-let
-
-  prefix = targetPlatform.config;
-  inherit (targetPlatform) arch;
-  simulator = targetPlatform.isiPhoneSimulator or false;
-
-  sdkType = if simulator then "Simulator" else "OS";
-
-  sdkVer = "10.2";
-
-  sdk = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhone${sdkType}.platform/Developer/SDKs/iPhone${sdkType}${sdkVer}.sdk";
-
-in (import ../../../build-support/cc-wrapper {
-    inherit stdenv coreutils gnugrep runCommand buildPackages;
-    nativeTools = false;
-    nativeLibc = false;
-    inherit binutils;
-    libc = runCommand "empty-libc" {} "mkdir -p $out/{lib,include}";
-    inherit (clang) cc;
-    inherit hostPlatform targetPlatform;
-    extraBuildCommands = ''
-      if ! [ -d ${sdk} ]; then
-          echo "You must have ${sdkVer} of the iPhone${sdkType} sdk installed at ${sdk}" >&2
-          exit 1
-      fi
-      # ugh
-      tr '\n' ' ' < $out/nix-support/cc-cflags > cc-cflags.tmp
-      mv cc-cflags.tmp $out/nix-support/cc-cflags
-      echo "-target ${prefix} -arch ${arch} -idirafter ${sdk}/usr/include ${if simulator then "-mios-simulator-version-min=7.0" else "-miphoneos-version-min=7.0"}" >> $out/nix-support/cc-cflags
-
-      # Purposefully overwrite libc-ldflags-before, cctools ld doesn't know dynamic-linker and cc-wrapper doesn't do cross-compilation well enough to adjust
-      echo "-arch ${arch} -L${sdk}/usr/lib ${lib.optionalString simulator "-L${sdk}/usr/lib/system "}-i${if simulator then "os_simulator" else "phoneos"}_version_min 7.0.0" > $out/nix-support/libc-ldflags-before
-    '';
-  }) // {
-    inherit sdkType sdkVer sdk;
-  }
diff --git a/pkgs/os-specific/darwin/ios-sdk-pkgs/default.nix b/pkgs/os-specific/darwin/ios-sdk-pkgs/default.nix
new file mode 100644
index 000000000000..f336b14ee37b
--- /dev/null
+++ b/pkgs/os-specific/darwin/ios-sdk-pkgs/default.nix
@@ -0,0 +1,68 @@
+{ lib, hostPlatform, targetPlatform
+, clang-unwrapped
+, binutils-unwrapped
+, runCommand
+, stdenv
+, wrapBintoolsWith
+, wrapCCWith
+, buildIosSdk, targetIosSdkPkgs
+}:
+
+let
+
+minSdkVersion = "9.0";
+
+iosPlatformArch = { parsed, ... }: {
+  "armv7a"  = "armv7";
+  "aarch64" = "arm64";
+  "x86_64"  = "x86_64";
+}.${parsed.cpu.name};
+
+in
+
+rec {
+  # TODO(kmicklas): Make a pure version of this for each supported SDK version.
+  sdk = rec {
+    name = "ios-sdk";
+    type = "derivation";
+    outPath = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhone${sdkType}.platform/Developer/SDKs/iPhone${sdkType}${version}.sdk";
+
+    sdkType = if targetPlatform.isiPhoneSimulator then "Simulator" else "OS";
+    version = targetPlatform.sdkVer;
+  };
+
+  binutils = wrapBintoolsWith {
+    libc = targetIosSdkPkgs.libraries;
+    bintools = binutils-unwrapped;
+    extraBuildCommands = ''
+      echo "-arch ${iosPlatformArch targetPlatform}" >> $out/nix-support/libc-ldflags
+    '';
+  };
+
+  clang = (wrapCCWith {
+    cc = clang-unwrapped;
+    bintools = binutils;
+    libc = targetIosSdkPkgs.libraries;
+    extraBuildCommands = ''
+      tr '\n' ' ' < $out/nix-support/cc-cflags > cc-cflags.tmp
+      mv cc-cflags.tmp $out/nix-support/cc-cflags
+      echo "-target ${targetPlatform.config} -arch ${iosPlatformArch targetPlatform}" >> $out/nix-support/cc-cflags
+      echo "-isystem ${sdk}/usr/include -isystem ${sdk}/usr/include/c++/4.2.1/ -stdlib=libstdc++" >> $out/nix-support/cc-cflags
+      echo "${if targetPlatform.isiPhoneSimulator then "-mios-simulator-version-min" else "-miphoneos-version-min"}=${minSdkVersion}" >> $out/nix-support/cc-cflags
+    '';
+  }) // {
+    inherit sdk;
+  };
+
+  libraries = let sdk = buildIosSdk; in runCommand "libSystem-prebuilt" {
+    passthru = {
+      inherit sdk;
+    };
+  } ''
+    if ! [ -d ${sdk} ]; then
+        echo "You must have version ${sdk.version} of the iPhone${sdk.sdkType} sdk installed at ${sdk}" >&2
+        exit 1
+    fi
+    ln -s ${sdk}/usr $out
+  '';
+}
diff --git a/pkgs/os-specific/darwin/maloader/default.nix b/pkgs/os-specific/darwin/maloader/default.nix
index 5f4306ec0c12..133266ec95aa 100644
--- a/pkgs/os-specific/darwin/maloader/default.nix
+++ b/pkgs/os-specific/darwin/maloader/default.nix
@@ -32,5 +32,6 @@ stdenv.mkDerivation {
     description = "Mach-O loader for Linux";
     homepage = https://github.com/shinh/maloader;
     license = stdenv.lib.licenses.bsd2;
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/darwin/native-x11-and-opengl/default.nix b/pkgs/os-specific/darwin/native-x11-and-opengl/default.nix
index 3844912f6ba3..fa3d4284e597 100644
--- a/pkgs/os-specific/darwin/native-x11-and-opengl/default.nix
+++ b/pkgs/os-specific/darwin/native-x11-and-opengl/default.nix
@@ -1,7 +1,5 @@
 { stdenv, writeScript }:
 
-assert stdenv.isDarwin;
-
 stdenv.mkDerivation rec {
   name = "darwin-native-x11-and-opengl";
 
diff --git a/pkgs/os-specific/darwin/opencflite/default.nix b/pkgs/os-specific/darwin/opencflite/default.nix
index 09a346e4446d..960e0677da1e 100644
--- a/pkgs/os-specific/darwin/opencflite/default.nix
+++ b/pkgs/os-specific/darwin/opencflite/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0jgmzs0ycl930hmzcvx0ykryik56704yw62w394q1q3xw5kkjn9v";
   };
 
-  configureFlags = [ "--with-uuid=${libuuid}" ];
+  configureFlags = [ "--with-uuid=${libuuid.dev}" ];
   buildInputs = [ icu tzdata.dev ];
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/darwin/skhd/default.nix b/pkgs/os-specific/darwin/skhd/default.nix
new file mode 100644
index 000000000000..3331084d807e
--- /dev/null
+++ b/pkgs/os-specific/darwin/skhd/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, Carbon }:
+
+stdenv.mkDerivation rec {
+  name = "skhd-${version}";
+  version = "0.0.14";
+
+  src = fetchFromGitHub {
+    owner = "koekeishiya";
+    repo = "skhd";
+    rev = "v${version}";
+    sha256 = "0kkmlka1hxsjdkx0ywkm48p9v1jhld26lfplls20n0hj97i5iwlz";
+  };
+
+  buildInputs = [ Carbon ];
+
+  makeFlags = [ "BUILD_PATH=$(out)/bin" ];
+
+  postInstall = ''
+    mkdir -p $out/Library/LaunchDaemons
+    cp ${./org.nixos.skhd.plist} $out/Library/LaunchDaemons/org.nixos.skhd.plist
+    substituteInPlace $out/Library/LaunchDaemons/org.nixos.skhd.plist --subst-var out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Simple hotkey daemon for macOS";
+    homepage = https://github.com/koekeishiya/skhd;
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [ lnl7 ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/os-specific/darwin/skhd/org.nixos.skhd.plist b/pkgs/os-specific/darwin/skhd/org.nixos.skhd.plist
new file mode 100644
index 000000000000..e6624487740b
--- /dev/null
+++ b/pkgs/os-specific/darwin/skhd/org.nixos.skhd.plist
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>org.nixos.skhd</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>@out@/bin/skhd</string>
+  </array>
+  <key>ProcessType</key>
+  <string>Interactive</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>@out@/bin:/nix/var/nix/profiles/default/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+</dict>
+</plist>
diff --git a/pkgs/os-specific/darwin/swift-corefoundation/default.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 969168fa54ba..969168fa54ba 100644
--- a/pkgs/os-specific/darwin/swift-corefoundation/default.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
diff --git a/pkgs/os-specific/darwin/swift-corelibs/default.nix b/pkgs/os-specific/darwin/swift-corelibs/default.nix
new file mode 100644
index 000000000000..fdc97304528d
--- /dev/null
+++ b/pkgs/os-specific/darwin/swift-corelibs/default.nix
@@ -0,0 +1,8 @@
+{callPackage, stdenv, darwin, xcbuild}:
+
+rec {
+  corefoundation = callPackage ./corefoundation.nix {};
+  libdispatch = callPackage ./libdispatch.nix {
+   inherit (darwin) apple_sdk_sierra xnu;
+  };
+}
diff --git a/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix b/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix
new file mode 100644
index 000000000000..bd143b6071ba
--- /dev/null
+++ b/pkgs/os-specific/darwin/swift-corelibs/libdispatch.nix
@@ -0,0 +1,12 @@
+{ stdenv, fetchFromGitHub, cmake, apple_sdk_sierra, xnu-new }:
+
+stdenv.mkDerivation rec {
+  name = "swift-corelibs-libdispatch";
+  src = fetchFromGitHub {
+    owner = "apple";
+    repo = name;
+    rev = "f83b5a498bad8e9ff8916183cf6e8ccf677c346b";
+    sha256 = "1czkyyc9llq2mnqfp19mzcfsxzas0y8zrk0gr5hg60acna6jkz2l";
+  };
+  buildInputs = [ cmake apple_sdk_sierra.sdk xnu-new ];
+}
diff --git a/pkgs/os-specific/gnu/mig/default.nix b/pkgs/os-specific/gnu/mig/default.nix
index 34426b45d55e..2855f5b4240f 100644
--- a/pkgs/os-specific/gnu/mig/default.nix
+++ b/pkgs/os-specific/gnu/mig/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
 
     homepage = http://www.gnu.org/software/hurd/microkernel/mach/mig/gnu_mig.html;
 
-    # platforms = stdenv.lib.platforms.gnu;  # really GNU/Hurd
+    # platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;  # really GNU/Hurd
     maintainers = [ stdenv.lib.maintainers.ludo ];
   };
 }
diff --git a/pkgs/os-specific/linux/acpid/default.nix b/pkgs/os-specific/linux/acpid/default.nix
index c209cf6e3162..7a234b16c913 100644
--- a/pkgs/os-specific/linux/acpid/default.nix
+++ b/pkgs/os-specific/linux/acpid/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "acpid-2.0.28";
+  name = "acpid-2.0.29";
 
   src = fetchurl {
     url = "mirror://sourceforge/acpid2/${name}.tar.xz";
-    sha256 = "043igasvp1l6nv5rzh4sksmymay2qn20anl4zm4zvwnkn1a3l34q";
+    sha256 = "1zq38al07z92r2md18zivrzgjqnn7m2wahdpgri6wijwjwkknl2q";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-lib/default.nix
index 5b0d404faaf0..c2c612db5422 100644
--- a/pkgs/os-specific/linux/alsa-lib/default.nix
+++ b/pkgs/os-specific/linux/alsa-lib/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-lib-1.1.5";
+  name = "alsa-lib-1.1.6";
 
   src = fetchurl {
     urls = [
      "ftp://ftp.alsa-project.org/pub/lib/${name}.tar.bz2"
      "http://alsa.cybermirror.org/lib/${name}.tar.bz2"
     ];
-    sha256 = "1rhacnlj0grvfagjx5qzsnbhw7m7lyccghqs4jsv0dnsqv9qmxpl";
+    sha256 = "096pwrnhj36yndldvs2pj4r871zhcgisks0is78f1jkjn9sd4b2z";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/alsa-oss/default.nix b/pkgs/os-specific/linux/alsa-oss/default.nix
index 0d02daebe1d7..5cd937a37928 100644
--- a/pkgs/os-specific/linux/alsa-oss/default.nix
+++ b/pkgs/os-specific/linux/alsa-oss/default.nix
@@ -1,14 +1,14 @@
 {stdenv, fetchurl, alsaLib, gettext, ncurses, libsamplerate}:
 
 stdenv.mkDerivation rec {
-  name = "alsa-oss-1.0.28";
+  name = "alsa-oss-1.1.6";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/oss-lib/${name}.tar.bz2"
       "http://alsa.cybermirror.org/oss-lib/${name}.tar.bz2"
     ];
-    sha256 = "1mbabiywxjjlvdh257j3a0v4vvy69mwwnvc3xlq7pg50i2m2rris";
+    sha256 = "1sj512wyci5qv8cisps96xngh7y9r5mv18ybqnazy18zwr1zgly3";
   };
 
   buildInputs = [ alsaLib ncurses libsamplerate ];
diff --git a/pkgs/os-specific/linux/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-plugins/default.nix
index dc11d21ff1cb..f57f84b293b5 100644
--- a/pkgs/os-specific/linux/alsa-plugins/default.nix
+++ b/pkgs/os-specific/linux/alsa-plugins/default.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, lib, pkgconfig, alsaLib, libogg, libpulseaudio ? null, libjack2 ? null }:
 
 stdenv.mkDerivation rec {
-  name = "alsa-plugins-1.1.5";
+  name = "alsa-plugins-1.1.6";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/plugins/${name}.tar.bz2"
       "http://alsa.cybermirror.org/plugins/${name}.tar.bz2"
     ];
-    sha256 = "073zpgvj4pldmzqq97l40wngvbqnvrkc8yw153mgny9kypwaazbr";
+    sha256 = "04qcwkisbh0d6lnh0rw1k6n869fbs6zbfq6yvb41rymiwgmk27bg";
   };
 
   # ToDo: a52, etc.?
diff --git a/pkgs/os-specific/linux/alsa-tools/default.nix b/pkgs/os-specific/linux/alsa-tools/default.nix
index d1cae06d7fff..67cae46164fc 100644
--- a/pkgs/os-specific/linux/alsa-tools/default.nix
+++ b/pkgs/os-specific/linux/alsa-tools/default.nix
@@ -4,14 +4,14 @@
 
 stdenv.mkDerivation rec {
   name = "alsa-tools-${version}";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/tools/${name}.tar.bz2"
       "http://alsa.cybermirror.org/tools/${name}.tar.bz2"
     ];
-    sha256 = "0d6m5dm5yskfr6q42cv1ihp5lfgv4a67nj39gpp26ll3vrknag5w";
+    sha256 = "09rjb6hw1mn9y1jfdfj5djncgc2cr5wfps83k56rf6k4zg14v76n";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-utils/default.nix
index e2340939fce7..b8498c096d33 100644
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   name = "alsa-utils-${version}";
-  version = "1.1.5";
+  version = "1.1.6";
 
   src = fetchurl {
     urls = [
       "ftp://ftp.alsa-project.org/pub/utils/${name}.tar.bz2"
       "http://alsa.cybermirror.org/utils/${name}.tar.bz2"
     ];
-    sha256 = "1s727md6mb408y2cfwzjkx23abxhampyrjdkgpyygdhxx62x42rj";
+    sha256 = "0vnkyymgwj9rfdb11nvab30dnfrylmakdfildxl0y8mj836awp0m";
   };
 
   patchPhase = ''
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index 0272eccd800e..6828fbf6b1c9 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, elfutils, libGL
+{ stdenv, fetchurl, elfutils
 , xorg, patchelf, openssl, libdrm, libudev
 , libxcb, libxshmfence, epoxy, perl, zlib
 , fetchFromGitHub, ncurses
@@ -13,8 +13,6 @@ let
 
   kernelDir = if libsOnly then null else kernel.dev;
 
-  inherit (libGL) driverLink;
-
   bitness = if stdenv.is64bit then "64" else "32";
 
   libArch =
@@ -30,9 +28,9 @@ let
 
 in stdenv.mkDerivation rec {
 
-  version = "17.10";
+  version = "17.40";
   pname = "amdgpu-pro";
-  build = "${version}-401251";
+  build = "${version}-492261";
 
   libCompatDir = "/run/lib/${libArch}";
 
@@ -41,7 +39,7 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url =
     "https://www2.ati.com/drivers/linux/ubuntu/amdgpu-pro-${build}.tar.xz";
-    sha256 = "004n0df8acjpjz72z3bjxb2a0b7qwln13jlknfn7xxqvhhwwy40a";
+    sha256 = "1c073lp9cq1rc2mddky2r0j2dv9dd167qj02visz37vwaxbm2r5h";
     curlOpts = "--referer http://support.amd.com/en-us/kb-articles/Pages/AMD-Radeon-GPU-PRO-Linux-Beta-Driver%e2%80%93Release-Notes.aspx";
   };
 
@@ -57,15 +55,14 @@ in stdenv.mkDerivation rec {
     sourceRoot=.
   '';
 
-  modulePatches = [
-    ./patches/0001-disable-firmware-copy.patch
-    ./patches/0002-linux-4.9-fixes.patch
-    ./patches/0003-Change-seq_printf-format-for-64-bit-context.patch
-    ./patches/0004-fix-warnings-for-Werror.patch
-  ];
+  modulePatches = optionals (!libsOnly) ([
+    ./patches/0001-fix-warnings-for-Werror.patch
+    ./patches/0002-fix-sketchy-int-ptr-warning.patch
+    ./patches/0003-disable-firmware-copy.patch
+  ]);
 
   patchPhase = optionalString (!libsOnly) ''
-    pushd usr/src/amdgpu-pro-${build}
+    pushd usr/src/amdgpu-${build}
     for patch in $modulePatches
     do
       echo $patch
@@ -74,12 +71,18 @@ in stdenv.mkDerivation rec {
     popd
   '';
 
+  xreallocarray = ./xreallocarray.c;
+
   preBuild = optionalString (!libsOnly) ''
-    pushd usr/src/amdgpu-pro-${build}
+    pushd usr/src/amdgpu-${build}
     makeFlags="$makeFlags M=$(pwd)"
     patchShebangs pre-build.sh
     ./pre-build.sh ${kernel.version}
     popd
+    pushd lib
+    $CC -fPIC -shared -o libhack-xreallocarray.so $xreallocarray
+    strip libhack-xreallocarray.so
+    popd
   '';
 
   modules = [
@@ -89,7 +92,7 @@ in stdenv.mkDerivation rec {
   ];
 
   postBuild = optionalString (!libsOnly)
-    (concatMapStrings (m: "xz usr/src/amdgpu-pro-${build}/${m}\n") modules);
+    (concatMapStrings (m: "xz usr/src/amdgpu-${build}/${m}\n") modules);
 
   NIX_CFLAGS_COMPILE = "-Werror";
 
@@ -110,16 +113,17 @@ in stdenv.mkDerivation rec {
     pushd usr
     cp -r lib/${libArch}/* $out/lib
   '' + optionalString (!libsOnly) ''
-    cp -r src/amdgpu-pro-${build}/firmware $out/lib/firmware
+    cp -r src/amdgpu-${build}/firmware $out/lib/firmware
   '' + ''
     cp -r share $out/share
     popd
 
     pushd opt/amdgpu-pro
-  '' + optionalString (!stdenv.is64bit) ''
+  '' + optionalString (!libsOnly && stdenv.is64bit) ''
     cp -r bin $out/bin
   '' + ''
     cp -r include $out/include
+    cp -r share/* $out/share
     cp -r lib/${libArch}/* $out/lib
   '' + optionalString (!libsOnly) ''
     mv lib/xorg $out/lib/xorg
@@ -128,12 +132,12 @@ in stdenv.mkDerivation rec {
 
   '' + optionalString (!libsOnly)
     (concatMapStrings (m:
-      "install -Dm444 usr/src/amdgpu-pro-${build}/${m}.xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/${m}.xz\n") modules)
+      "install -Dm444 usr/src/amdgpu-${build}/${m}.xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/${m}.xz\n") modules)
   + ''
     mv $out/etc/vulkan $out/share
     interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
     libPath="$out/lib:$out/lib/gbm:$depLibPath"
-  '' + optionalString (!stdenv.is64bit) ''
+  '' + optionalString (!libsOnly && stdenv.is64bit) ''
     for prog in clinfo modetest vbltest kms-universal-planes kms-steal-crtc modeprint amdgpu_test kmstest proptest; do
       patchelf --interpreter "$interpreter" --set-rpath "$libPath" "$out/bin/$prog"
     done
@@ -147,10 +151,17 @@ in stdenv.mkDerivation rec {
     for lib in `find "$out/lib/" -name '*.so*' -type f`; do
       patchelf --set-rpath "$libPath" "$lib"
     done
-    for lib in libEGL.so.1 libGL.so.1.2 ${optionalString (!libsOnly) "xorg/modules/extensions/libglx.so"} dri/amdgpu_dri.so; do
+    for lib in libEGL.so.1 libGL.so.1.2 ${optionalString (!libsOnly) "xorg/modules/extensions/libglx.so"} dri/amdgpu_dri.so libamdocl${bitness}.so; do
       perl -pi -e 's:${libReplaceDir}:${libCompatDir}:g' "$out/lib/$lib"
     done
+    for lib in dri/amdgpu_dri.so libdrm_amdgpu.so.1.0.0 libgbm_amdgpu.so.1.0.0 libkms_amdgpu.so.1.0.0 libamdocl${bitness}.so; do
+      perl -pi -e 's:/opt/amdgpu-pro/:/run/amdgpu-pro/:g' "$out/lib/$lib"
+    done
     substituteInPlace "$out/share/vulkan/icd.d/amd_icd${bitness}.json" --replace "/opt/amdgpu-pro/lib/${libArch}" "$out/lib"
+  '' + optionalString (!libsOnly) ''
+    for lib in drivers/modesetting_drv.so libglamoregl.so; do
+      patchelf --add-needed $out/lib/libhack-xreallocarray.so $out/lib/xorg/modules/$lib
+    done
   '';
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0001-disable-firmware-copy.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0001-disable-firmware-copy.patch
deleted file mode 100644
index 4733e0580afa..000000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/patches/0001-disable-firmware-copy.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 704cef8638ffbdd8de9e57f28b43ea42c685ea87 Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Sat, 28 Jan 2017 16:57:26 -0400
-Subject: [PATCH 1/4] disable firmware copy
-
----
- pre-build.sh | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/pre-build.sh b/pre-build.sh
-index 622ff13..e3cd009 100755
---- a/pre-build.sh
-+++ b/pre-build.sh
-@@ -35,8 +35,3 @@ find ttm -name '*.c' -exec grep EXPORT_SYMBOL {} + \
-     | sort -u \
-     | awk -F'[()]' '{print "#define "$2" amd"$2" //"$0}'\
-     > include/rename_symbol.h
--
--FW_DIR="/lib/firmware/$KERNELVER"
--mkdir -p $FW_DIR
--cp -ar /usr/src/amdgpu-pro-17.10-401251/firmware/radeon $FW_DIR
--cp -ar /usr/src/amdgpu-pro-17.10-401251/firmware/amdgpu $FW_DIR
--- 
-2.12.2
-
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0001-fix-warnings-for-Werror.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0001-fix-warnings-for-Werror.patch
new file mode 100644
index 000000000000..ecde6401ac18
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0001-fix-warnings-for-Werror.patch
@@ -0,0 +1,71 @@
+From 9167d76c435a7c1df7954f0fbe5cc6d083f8ed2f Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Mon, 6 Feb 2017 22:13:49 -0400
+Subject: [PATCH 1/3] fix warnings for Werror
+
+---
+ amd/amdgpu/amdgpu_device.c         | 4 ++--
+ amd/amdgpu/amdgpu_sa.c             | 2 +-
+ amd/display/dc/bios/bios_parser2.c | 8 ++++----
+ 3 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/amd/amdgpu/amdgpu_device.c b/amd/amdgpu/amdgpu_device.c
+index fc1c543..186e06d 100644
+--- a/amd/amdgpu/amdgpu_device.c
++++ b/amd/amdgpu/amdgpu_device.c
+@@ -3164,7 +3164,7 @@ void amdgpu_debugfs_cleanup(struct drm_minor *minor)
+ 	struct drm_info_node *node, *tmp;
+ 
+ 	if (!&minor->debugfs_root)
+-		return 0;
++		return;
+ 
+ 	mutex_lock(&minor->debugfs_lock);
+ 	list_for_each_entry_safe(node, tmp,
+@@ -3175,7 +3175,7 @@ void amdgpu_debugfs_cleanup(struct drm_minor *minor)
+ 	}
+ 	mutex_unlock(&minor->debugfs_lock);
+ 
+-	return 0;
++	return;
+ }
+ #endif
+ 
+diff --git a/amd/amdgpu/amdgpu_sa.c b/amd/amdgpu/amdgpu_sa.c
+index 7206b34..8b7123c 100644
+--- a/amd/amdgpu/amdgpu_sa.c
++++ b/amd/amdgpu/amdgpu_sa.c
+@@ -430,7 +430,7 @@ void amdgpu_sa_bo_dump_debug_info(struct amdgpu_sa_manager *sa_manager,
+ 		if (i->fence)
+ #if defined(BUILD_AS_DKMS)
+ 			seq_printf(m, " protected by 0x%08x on context %d",
+-					i->fence->seqno, i->fence->context);
++					i->fence->seqno, (int)i->fence->context);
+ #else
+ 			seq_printf(m, " protected by 0x%08x on context %llu",
+ 				   i->fence->seqno, i->fence->context);
+diff --git a/amd/display/dc/bios/bios_parser2.c b/amd/display/dc/bios/bios_parser2.c
+index 86fce5a..99681c5 100644
+--- a/amd/display/dc/bios/bios_parser2.c
++++ b/amd/display/dc/bios/bios_parser2.c
+@@ -1326,13 +1326,13 @@ static enum bp_result get_embedded_panel_info_v2_1(
+ 	info->lcd_timing.misc_info.VERTICAL_CUT_OFF = 0;
+ 
+ 	info->lcd_timing.misc_info.H_REPLICATION_BY2 =
+-		lvds->lcd_timing.miscinfo & ATOM_H_REPLICATIONBY2;
++		(lvds->lcd_timing.miscinfo & ATOM_H_REPLICATIONBY2) != 0;
+ 	info->lcd_timing.misc_info.V_REPLICATION_BY2 =
+-		lvds->lcd_timing.miscinfo & ATOM_V_REPLICATIONBY2;
++		(lvds->lcd_timing.miscinfo & ATOM_V_REPLICATIONBY2) != 0;
+ 	info->lcd_timing.misc_info.COMPOSITE_SYNC =
+-		lvds->lcd_timing.miscinfo & ATOM_COMPOSITESYNC;
++		(lvds->lcd_timing.miscinfo & ATOM_COMPOSITESYNC) != 0;
+ 	info->lcd_timing.misc_info.INTERLACE =
+-		lvds->lcd_timing.miscinfo & ATOM_INTERLACE;
++		(lvds->lcd_timing.miscinfo & ATOM_INTERLACE) != 0;
+ 
+ 	/* not provided by VBIOS*/
+ 	info->lcd_timing.misc_info.DOUBLE_CLOCK = 0;
+-- 
+2.15.1
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0002-fix-sketchy-int-ptr-warning.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0002-fix-sketchy-int-ptr-warning.patch
new file mode 100644
index 000000000000..20f429757a51
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0002-fix-sketchy-int-ptr-warning.patch
@@ -0,0 +1,25 @@
+From a07ee5dec35ca24a013a6638543ef5030b2bab40 Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Tue, 9 Jan 2018 21:45:33 -0400
+Subject: [PATCH 2/3] fix sketchy int->ptr warning
+
+---
+ amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+index d0f091b..707815a 100644
+--- a/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
++++ b/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
+@@ -236,7 +236,7 @@ bool dm_helpers_dp_mst_write_payload_allocation_table(
+ 		pbn = drm_dp_calc_pbn_mode(clock, bpp);
+ 
+ 		slots = drm_dp_find_vcpi_slots(mst_mgr, pbn);
+-		ret = drm_dp_mst_allocate_vcpi(mst_mgr, mst_port, pbn, slots);
++		ret = drm_dp_mst_allocate_vcpi(mst_mgr, mst_port, pbn, &slots);
+ 
+ 		if (!ret)
+ 			return false;
+-- 
+2.15.1
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0002-linux-4.9-fixes.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0002-linux-4.9-fixes.patch
deleted file mode 100644
index aa6cbcc118dc..000000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/patches/0002-linux-4.9-fixes.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 0ead7017e1db18be971c24c891d4bdcc507deea7 Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Sun, 29 Jan 2017 18:23:47 -0400
-Subject: [PATCH 2/4] linux-4.9 fixes
-
----
- amd/amdkcl/kcl_io.c                     | 2 ++
- amd/display/amdgpu_dm/amdgpu_dm_types.c | 8 ++++++++
- 2 files changed, 10 insertions(+)
-
-diff --git a/amd/amdkcl/kcl_io.c b/amd/amdkcl/kcl_io.c
-index d8f843f..9a1bd9b 100644
---- a/amd/amdkcl/kcl_io.c
-+++ b/amd/amdkcl/kcl_io.c
-@@ -31,4 +31,6 @@ void amdkcl_io_init(void)
- 	_kcl_io_free_memtype = amdkcl_fp_setup("io_free_memtype", NULL);
- }
- #endif
-+#else
-+void amdkcl_io_init(void) {}
- #endif /* LINUX_VERSION_CODE < KERNEL_VERSION(4, 9, 0) */
-diff --git a/amd/display/amdgpu_dm/amdgpu_dm_types.c b/amd/display/amdgpu_dm/amdgpu_dm_types.c
-index 34313a9..44a4a71 100644
---- a/amd/display/amdgpu_dm/amdgpu_dm_types.c
-+++ b/amd/display/amdgpu_dm/amdgpu_dm_types.c
-@@ -1720,6 +1720,10 @@ static int dm_plane_helper_prepare_fb(
- static int dm_plane_helper_prepare_fb(
- 	struct drm_plane *plane,
- 	const struct drm_plane_state *new_state)
-+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
-+static int dm_plane_helper_prepare_fb(
-+	struct drm_plane *plane,
-+	struct drm_plane_state *new_state)
- #else
- static int dm_plane_helper_prepare_fb(
- 	struct drm_plane *plane,
-@@ -1766,6 +1770,10 @@ static void dm_plane_helper_cleanup_fb(
- static void dm_plane_helper_cleanup_fb(
- 	struct drm_plane *plane,
- 	const struct drm_plane_state *old_state)
-+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 9, 0)
-+static void dm_plane_helper_cleanup_fb(
-+	struct drm_plane *plane,
-+	struct drm_plane_state *old_state)
- #else
- static void dm_plane_helper_cleanup_fb(
- 	struct drm_plane *plane,
--- 
-2.12.2
-
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0003-Change-seq_printf-format-for-64-bit-context.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0003-Change-seq_printf-format-for-64-bit-context.patch
deleted file mode 100644
index 7a11c9bd4ef5..000000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/patches/0003-Change-seq_printf-format-for-64-bit-context.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From b6dd36dd90c5d88ae10b9dbc763d3bacb95ccddb Mon Sep 17 00:00:00 2001
-From: "Luke A. Guest" <laguest@archeia.com>
-Date: Sun, 25 Sep 2016 16:46:39 +0100
-Subject: [PATCH 3/4] Change seq_printf format for 64 bit context
-
----
- amd/amdgpu/amdgpu_sa.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/amd/amdgpu/amdgpu_sa.c b/amd/amdgpu/amdgpu_sa.c
-index 74932bf..db4119a 100644
---- a/amd/amdgpu/amdgpu_sa.c
-+++ b/amd/amdgpu/amdgpu_sa.c
-@@ -428,7 +428,7 @@ void amdgpu_sa_bo_dump_debug_info(struct amdgpu_sa_manager *sa_manager,
- 			   soffset, eoffset, eoffset - soffset);
- 
- 		if (i->fence)
--#if defined(BUILD_AS_DKMS)
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 8, 0)
- 			seq_printf(m, " protected by 0x%08x on context %d",
- 					i->fence->seqno, i->fence->context);
- #else
--- 
-2.12.2
-
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0003-disable-firmware-copy.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0003-disable-firmware-copy.patch
new file mode 100644
index 000000000000..0091c471680c
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/patches/0003-disable-firmware-copy.patch
@@ -0,0 +1,25 @@
+From 7a3062acbbabdb29239bbc8c984e62589a88576e Mon Sep 17 00:00:00 2001
+From: David McFarland <corngood@gmail.com>
+Date: Tue, 9 Jan 2018 21:49:55 -0400
+Subject: [PATCH 3/3] disable firmware copy
+
+---
+ pre-build.sh | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/pre-build.sh b/pre-build.sh
+index e7b8a32..bad8f25 100755
+--- a/pre-build.sh
++++ b/pre-build.sh
+@@ -38,8 +38,3 @@ find ttm -name '*.c' -exec grep EXPORT_SYMBOL {} + \
+     | sort -u \
+     | awk -F'[()]' '{print "#define "$2" amd"$2" //"$0}'\
+     >> include/rename_symbol.h
+-
+-FW_DIR="/lib/firmware/$KERNELVER"
+-mkdir -p $FW_DIR
+-cp -ar /usr/src/amdgpu-17.40-492261/firmware/radeon $FW_DIR
+-cp -ar /usr/src/amdgpu-17.40-492261/firmware/amdgpu $FW_DIR
+-- 
+2.15.1
+
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0004-fix-warnings-for-Werror.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0004-fix-warnings-for-Werror.patch
deleted file mode 100644
index cd360e18faac..000000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/patches/0004-fix-warnings-for-Werror.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From dbf01d3934c52acaaa37f008859f69c5edf19ad5 Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Mon, 6 Feb 2017 22:13:49 -0400
-Subject: [PATCH 4/4] fix warnings for Werror
-
----
- amd/amdgpu/amdgpu_ttm.c                 | 2 ++
- amd/display/amdgpu_dm/amdgpu_dm_types.c | 2 +-
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/amd/amdgpu/amdgpu_ttm.c b/amd/amdgpu/amdgpu_ttm.c
-index 0e30389..890aafa 100644
---- a/amd/amdgpu/amdgpu_ttm.c
-+++ b/amd/amdgpu/amdgpu_ttm.c
-@@ -1083,6 +1083,7 @@ uint32_t amdgpu_ttm_tt_pte_flags(struct amdgpu_device *adev, struct ttm_tt *ttm,
- 	return flags;
- }
- 
-+#if 0
- static void amdgpu_ttm_lru_removal(struct ttm_buffer_object *tbo)
- {
- 	struct amdgpu_device *adev = amdgpu_ttm_adev(tbo->bdev);
-@@ -1132,6 +1133,7 @@ static struct list_head *amdgpu_ttm_swap_lru_tail(struct ttm_buffer_object *tbo)
- 
- 	return res;
- }
-+#endif
- 
- static bool amdgpu_ttm_bo_eviction_valuable(struct ttm_buffer_object *bo,
- 					    const struct ttm_place *place)
-diff --git a/amd/display/amdgpu_dm/amdgpu_dm_types.c b/amd/display/amdgpu_dm/amdgpu_dm_types.c
-index 44a4a71..ae7e707 100644
---- a/amd/display/amdgpu_dm/amdgpu_dm_types.c
-+++ b/amd/display/amdgpu_dm/amdgpu_dm_types.c
-@@ -932,7 +932,7 @@ static void decide_crtc_timing_for_drm_display_mode(
- }
- 
- static struct dc_target *create_target_for_sink(
--		const struct amdgpu_connector *aconnector,
-+		struct amdgpu_connector *aconnector,
- 		const struct drm_display_mode *drm_mode,
- 		const struct dm_connector_state *dm_state)
- {
--- 
-2.12.2
-
diff --git a/pkgs/os-specific/linux/amdgpu-pro/xreallocarray.c b/pkgs/os-specific/linux/amdgpu-pro/xreallocarray.c
new file mode 100644
index 000000000000..ab47bacb8228
--- /dev/null
+++ b/pkgs/os-specific/linux/amdgpu-pro/xreallocarray.c
@@ -0,0 +1,5 @@
+#include <malloc.h>
+
+void *xreallocarray(void *ptr, size_t nmemb, size_t size) {
+  return reallocarray(ptr, nmemb, size);
+}
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 0bb5561e9572..c8e58dfbf6fb 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -8,6 +8,7 @@
 , swig
 , ncurses
 , pam
+, buildPackages
 }:
 
 let
@@ -29,8 +30,8 @@ let
   };
 
   prePatchCommon = ''
-    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${perl}/bin/pod2man"
-    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${perl}/bin/pod2html"
+    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man"
+    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html"
     substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
     substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"
   '';
@@ -70,9 +71,10 @@ let
       swig
       ncurses
       which
+      perl
     ];
 
-    buildInputs = [
+    buildInputs = stdenv.lib.optionals (!stdenv.isCross) [
       perl
       python
     ];
@@ -87,11 +89,12 @@ let
     inherit patches;
 
     postPatch = "cd ./libraries/libapparmor";
-    configureFlags = "--with-python --with-perl";
+    # https://gitlab.com/apparmor/apparmor/issues/1
+    configureFlags = stdenv.lib.optionalString (!stdenv.isCross) "--with-python --with-perl";
 
-    outputs = [ "out" "python" ];
+    outputs = if stdenv.isCross then [ "out" ] else [ "out" "python" ];
 
-    postInstall = ''
+    postInstall = stdenv.lib.optionalString (!stdenv.isCross) ''
       mkdir -p $python/lib
       mv $out/lib/python* $python/lib/
     '';
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 390bab849c28..7e14983a6d2b 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -6,11 +6,11 @@
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
-  name = "audit-2.8.2";
+  name = "audit-2.8.3";
 
   src = fetchurl {
     url = "http://people.redhat.com/sgrubb/audit/${name}.tar.gz";
-    sha256 = "1fmw8whraz1q3y3z5mgdpgsa3wz6r3zq0kgsgbc9xvmgfwmrpdb7";
+    sha256 = "06lacv9zjn0sf076dydwmvjhdmik3xzhdjvyrkq75917xv54ajbl";
   };
 
   outputs = [ "bin" "dev" "out" "man" ];
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 8c207e4a47d7..859593e4b9aa 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -1,15 +1,15 @@
-{ stdenv, lib, fetchurl, flex, bison, linuxHeaders, libtirpc, utillinux, nfs-utils, e2fsprogs
+{ stdenv, lib, fetchurl, flex, bison, linuxHeaders, libtirpc, mount, umount, nfs-utils, e2fsprogs
 , libxml2, kerberos, kmod, openldap, sssd, cyrus_sasl, openssl }:
 
 let
-  version = "5.1.3";
+  version = "5.1.4";
   name = "autofs-${version}";
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
     url = "mirror://kernel/linux/daemons/autofs/v5/${name}.tar.xz";
-    sha256 = "1gxifa93104pxlmxrikhwciy5zdgk20m63siyhq1myym7vzfnvp9";
+    sha256 = "08hpphawzcdibwbhw0r3y7hnfczlazpp90sf3bz2imgza7p31klg";
   };
 
   preConfigure = ''
@@ -17,10 +17,10 @@ in stdenv.mkDerivation {
     export sssldir="${sssd}/lib/sssd/modules"
     export HAVE_SSS_AUTOFS=1
 
-    export MOUNT=${utillinux}/bin/mount
+    export MOUNT=${mount}/bin/mount
     export MOUNT_NFS=${nfs-utils}/bin/mount.nfs
-    export UMOUNT=${utillinux}/bin/umount
-    export MODPROBE=${utillinux}/bin/modprobe
+    export UMOUNT=${umount}/bin/umount
+    export MODPROBE=${kmod}/bin/modprobe
     export E2FSCK=${e2fsprogs}/bin/fsck.ext2
     export E3FSCK=${e2fsprogs}/bin/fsck.ext3
     export E4FSCK=${e2fsprogs}/bin/fsck.ext4
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
index 9b7484932ebd..90489e12d690 100644
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, gpsd, libcap, libnl }:
 
 let
-  ver = "2018.0";
+  ver = "2018.1";
 in
 stdenv.mkDerivation rec {
   name = "alfred-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "0mzjgjkmgdrrqa6fbpii9q1xqvg3kvwgq2k2kpdf0vy4xxnypky7";
+    sha256 = "0xkd842yp227jzfybjq8c5s7y5c7amm1f5ai80k8wyjwysnad3w0";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index ef1d51501e85..a1a2cff70a83 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchurl, pkgconfig, libnl }:
 
 let
-  ver = "2018.0";
+  ver = "2018.1";
 in
 stdenv.mkDerivation rec {
   name = "batctl-${ver}";
 
   src = fetchurl {
     url = "http://downloads.open-mesh.org/batman/releases/batman-adv-${ver}/${name}.tar.gz";
-    sha256 = "1x7gy6agwk68s2cbhc4wfhvhdy2ccrq0vi7jzaj94pn8nqshi5ss";
+    sha256 = "0lxm0vb0w1gxyi5k553jgkpmhifc4cykzfybrsk8hvwilq6pv1r7";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index ade9b8f750f2..f5d3b4f5c4e1 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "A module for powering off hybrid GPUs";
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" "i686-linux" ];
     homepage = https://github.com/Bumblebee-Project/bbswitch;
     maintainers = with maintainers; [ abbradar ];
   };
diff --git a/pkgs/os-specific/linux/beegfs/default.nix b/pkgs/os-specific/linux/beegfs/default.nix
index 6cf233694cdc..f17bc9492c1b 100644
--- a/pkgs/os-specific/linux/beegfs/default.nix
+++ b/pkgs/os-specific/linux/beegfs/default.nix
@@ -5,7 +5,7 @@
 } :
 
 let
-  version = "6.17";
+  version = "6.18";
 
   subdirs = [
     "beeond_thirdparty/build"
@@ -30,7 +30,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://git.beegfs.com/pub/v6/repository/archive.tar.bz2?ref=${version}";
-    sha256 = "10xs7gzdmlg23k6zn1b7jij3lljn7rr1j6h476hq4lbg981qk3n3";
+    sha256 = "1g874qyxh4v53ah3lzchrqi0jci7wngr54q3f4d9q0kzvvifripn";
   };
 
   nativeBuildInputs = [ which unzip pkgconfig cppunit openjdk ant perl ];
diff --git a/pkgs/os-specific/linux/beegfs/kernel-module.nix b/pkgs/os-specific/linux/beegfs/kernel-module.nix
index 4525d156159b..63e45928f217 100644
--- a/pkgs/os-specific/linux/beegfs/kernel-module.nix
+++ b/pkgs/os-specific/linux/beegfs/kernel-module.nix
@@ -3,13 +3,13 @@
 } :
 
 let
-  version = "6.17";
+  version = "6.18";
 in stdenv.mkDerivation {
   name = "beegfs-module-${version}-${kernel.version}";
 
   src = fetchurl {
     url = "https://git.beegfs.com/pub/v6/repository/archive.tar.bz2?ref=${version}";
-    sha256 = "10xs7gzdmlg23k6zn1b7jij3lljn7rr1j6h476hq4lbg981qk3n3";
+    sha256 = "1g874qyxh4v53ah3lzchrqi0jci7wngr54q3f4d9q0kzvvifripn";
   };
 
   hardeningDisable = [ "fortify" "pic" "stackprotector" ];
@@ -41,6 +41,5 @@ in stdenv.mkDerivation {
     platforms = [ "i686-linux" "x86_64-linux" ];
     license = licenses.gpl2;
     maintainers = with maintainers; [ markuskowa ];
-    broken = versionAtLeast kernel.version "4.14";
   };
 }
diff --git a/pkgs/os-specific/linux/blcr/default.nix b/pkgs/os-specific/linux/blcr/default.nix
index ab1a93b3a703..275600d42785 100644
--- a/pkgs/os-specific/linux/blcr/default.nix
+++ b/pkgs/os-specific/linux/blcr/default.nix
@@ -2,7 +2,6 @@
 
 # BLCR version 0.8.6 should works with linux kernel up to version 3.17.x
 
-assert stdenv.isLinux;
 assert builtins.compareVersions "3.18" kernel.version == 1;
 
 stdenv.mkDerivation {
diff --git a/pkgs/os-specific/linux/bluez/bluez5_28.nix b/pkgs/os-specific/linux/bluez/bluez5_28.nix
deleted file mode 100644
index 11aee0d88f2c..000000000000
--- a/pkgs/os-specific/linux/bluez/bluez5_28.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
-  pythonPackages, readline, libsndfile, udev, libical,
-  systemd, enableWiimote ? false }:
-
-assert stdenv.isLinux;
-
-let
-  inherit (pythonPackages) python;
-in stdenv.mkDerivation rec {
-  name = "bluez-5.28";
-   
-  src = fetchurl {
-    url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "1a8qzh38wpq5c0rydpx9isf0jc6g14g2qs18j1rmi8a79f7v9fl5";
-  };
-
-  pythonPath = with pythonPackages;
-    [ dbus pygobject2 pygobject3 recursivePthLoader ];
-
-  buildInputs =
-    [ pkgconfig dbus glib alsaLib python pythonPackages.wrapPython
-      readline libsndfile udev libical
-      # Disables GStreamer; not clear what it gains us other than a
-      # zillion extra dependencies.
-      # gstreamer gst-plugins-base 
-    ];
-
-  preConfigure = ''
-      substituteInPlace tools/hid2hci.rules --replace /sbin/udevadm ${systemd}/bin/udevadm
-      substituteInPlace tools/hid2hci.rules --replace "hid2hci " "$out/lib/udev/hid2hci "
-    '';
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--enable-library"
-    "--enable-cups"
-    "--with-dbusconfdir=$(out)/etc"
-    "--with-dbussystembusdir=$(out)/share/dbus-1/system-services"
-    "--with-dbussessionbusdir=$(out)/share/dbus-1/services"
-    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-    "--with-systemduserunitdir=$(out)/etc/systemd/user"
-    "--with-udevdir=$(out)/lib/udev"
-    ] ++
-    stdenv.lib.optional enableWiimote [ "--enable-wiimote" ];
-
-  # Work around `make install' trying to create /var/lib/bluetooth.
-  installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth";
-
-  makeFlags = "rulesdir=$(out)/lib/udev/rules.d";
-
-  # FIXME: Move these into a separate package to prevent Bluez from
-  # depending on Python etc.
-  postInstall = ''
-    mkdir $out/test
-    cp -a test $out
-    pushd $out/test
-    for a in \
-            simple-agent \
-            test-adapter \
-            test-device \
-            test-thermometer \
-            list-devices \
-            monitor-bluetooth \
-            ; do
-      ln -s ../test/$a $out/bin/bluez-$a
-    done
-    popd
-    wrapPythonProgramsIn $out/test "$out/test $pythonPath"
-
-    # for bluez4 compatibility for NixOS
-    mkdir $out/sbin
-    ln -s ../libexec/bluetooth/bluetoothd $out/sbin/bluetoothd
-    ln -s ../libexec/bluetooth/obexd $out/sbin/obexd
-  '';
-
-  meta = with stdenv.lib; {
-    homepage = http://www.bluez.org/;
-    repositories.git = https://git.kernel.org/pub/scm/bluetooth/bluez.git;
-    description = "Bluetooth support for Linux";
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 62c3986569d0..bbf01e5027c3 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,15 +1,13 @@
 { stdenv, fetchurl, pkgconfig, dbus, glib, alsaLib,
   pythonPackages, readline, udev, libical,
-  systemd, enableWiimote ? false }:
-
-assert stdenv.isLinux;
+  systemd, enableWiimote ? false, enableMidi ? false }:
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.48";
+  name = "bluez-5.49";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "140fjyxa2q4y35d9n52vki649jzb094pf71hxkkvlrpgf8q75a5r";
+    sha256 = "15ffsaz7l3fgdg03l7g1xx9jw7xgs6pc548zxqsxawsca5x1sc1k";
   };
 
   pythonPath = with pythonPackages;
@@ -40,8 +38,8 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     "--with-systemduserunitdir=$(out)/etc/systemd/user"
     "--with-udevdir=$(out)/lib/udev"
-    ] ++
-    stdenv.lib.optional enableWiimote [ "--enable-wiimote" ];
+    ] ++ stdenv.lib.optional enableWiimote [ "--enable-wiimote" ]
+    ++ stdenv.lib.optional enableMidi [ "--enable-midi" ];
 
   # Work around `make install' trying to create /var/lib/bluetooth.
   installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth";
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 744f37b8b8c4..b844bf72d82a 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -33,14 +33,14 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.28.1";
+  name = "busybox-1.28.3";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "http://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "0bk52cxxlya5hg9va87snr9caz9ppdrpdyjwrnbwamhi64y1vzlq";
+    sha256 = "0via6faqj9xcyi8r39r4n0wxlk8r2292yk0slzwrdri37w1j43dd";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optionals enableStatic [ "fortify" ];
@@ -49,6 +49,8 @@ stdenv.mkDerivation rec {
     ./busybox-in-store.patch
   ];
 
+  postPatch = "patchShebangs .";
+
   configurePhase = ''
     export KCONFIG_NOTIMESTAMP=1
     make ${if enableMinimal then "allnoconfig" else "defconfig"}
diff --git a/pkgs/os-specific/linux/checkpolicy/default.nix b/pkgs/os-specific/linux/checkpolicy/default.nix
index 8e01bb2a5c80..6ea73c9ac6c3 100644
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -2,27 +2,18 @@
 
 stdenv.mkDerivation rec {
   name = "checkpolicy-${version}";
-  version = "2.4";
+  version = "2.7";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/checkpolicy-${version}.tar.gz";
-    sha256 = "1m5wjm43lzp6bld8higsvdm2dkddydihhwv9qw2w9r4dm0largcv";
+    sha256 = "009j9jc0hi4l7k8f21hn8fm25n0mqgzdpd4nk30nds6d3nglf4sl";
   };
 
-  # Don't build tests
-  postPatch = ''
-    sed '/-C test/d' -i Makefile
-    sed '1i#include <ctype.h>' -i checkpolicy.c
-  '';
-
   nativeBuildInputs = [ bison flex ];
   buildInputs = [ libsepol ];
 
-  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
-
   preBuild = ''
-    makeFlagsArray+=("LEX=flex")
     makeFlagsArray+=("LIBDIR=${libsepol}/lib")
     makeFlagsArray+=("PREFIX=$out")
   '';
diff --git a/pkgs/os-specific/linux/checksec/default.nix b/pkgs/os-specific/linux/checksec/default.nix
index 1a879ba33304..1ef18f703d3f 100644
--- a/pkgs/os-specific/linux/checksec/default.nix
+++ b/pkgs/os-specific/linux/checksec/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, file, findutils, binutils, glibc, procps, coreutils }:
+{ stdenv, fetchurl, file, findutils, binutils, glibc, procps, coreutils, sysctl }:
 
 stdenv.mkDerivation rec {
   name = "checksec-${version}";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/bin/checksec --replace " readelf -" " ${binutils.out}/bin/readelf -"
     substituteInPlace $out/bin/checksec --replace "(readelf -" "(${binutils.out}/bin/readelf -"
     substituteInPlace $out/bin/checksec --replace "command_exists readelf" "command_exists ${binutils.out}/bin/readelf"
-    substituteInPlace $out/bin/checksec --replace "/sbin/sysctl -" "${procps}/sbin/sysctl -"
+    substituteInPlace $out/bin/checksec --replace "/sbin/sysctl -" "${sysctl}/bin/sysctl -"
     substituteInPlace $out/bin/checksec --replace "/usr/bin/id -" "${coreutils}/bin/id -"
   '';
 
diff --git a/pkgs/os-specific/linux/cifs-utils/default.nix b/pkgs/os-specific/linux/cifs-utils/default.nix
index c2bea009ab7e..7b6dd6fba351 100644
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "cifs-utils-${version}";
-  version = "6.7";
+  version = "6.8";
 
   src = fetchurl {
     url = "mirror://samba/pub/linux-cifs/cifs-utils/${name}.tar.bz2";
-    sha256 = "1ayghnkryy1n1zm5dyvyyr7n3807nsm6glfcbbki5c2a8w91dwmj";
+    sha256 = "0ygz3pagjpaj5ky11hzh4byyymb7fpmqiqkprn11zwj31h2zdlg7";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index ea9c3f937d0e..e4c45a9440ab 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -27,6 +27,7 @@
 
 , wirelessSupport     ? true      , wirelesstools ? null
 , nvidiaSupport       ? false     , libXNVCtrl ? null
+, pulseSupport        ? false     , libpulseaudio ? null
 
 , curlSupport         ? true      , curl ? null
 , rssSupport          ? curlSupport
@@ -54,6 +55,7 @@ assert luaCairoSupport || luaImlib2Support
 
 assert wirelessSupport     -> wirelesstools != null;
 assert nvidiaSupport       -> libXNVCtrl != null;
+assert pulseSupport        -> libpulseaudio != null;
 
 assert curlSupport         -> curl != null;
 assert rssSupport          -> curlSupport && libxml2 != null;
@@ -100,6 +102,7 @@ stdenv.mkDerivation rec {
     ++ optional  rssSupport         libxml2
     ++ optional  weatherXoapSupport libxml2
     ++ optional  nvidiaSupport      libXNVCtrl
+    ++ optional  pulseSupport       libpulseaudio
     ;
 
   cmakeFlags = []
@@ -119,6 +122,7 @@ stdenv.mkDerivation rec {
     ++ optional weatherXoapSupport  "-DBUILD_WEATHER_XOAP=ON"
     ++ optional wirelessSupport     "-DBUILD_WLAN=ON"
     ++ optional nvidiaSupport       "-DBUILD_NVIDIA=ON"
+    ++ optional pulseSupport        "-DBUILD_PULSEAUDIO=ON"
     ;
 
   # `make -f src/CMakeFiles/conky.dir/build.make src/CMakeFiles/conky.dir/conky.cc.o`:
diff --git a/pkgs/os-specific/linux/cpufrequtils/default.nix b/pkgs/os-specific/linux/cpufrequtils/default.nix
index 65be409a75e3..e36aaa5e38d0 100644
--- a/pkgs/os-specific/linux/cpufrequtils/default.nix
+++ b/pkgs/os-specific/linux/cpufrequtils/default.nix
@@ -1,7 +1,5 @@
 { stdenv, fetchurl, libtool, gettext }:
 
-assert stdenv.system == "i686-linux" || stdenv.system == "x86_64-linux";
-
 stdenv.mkDerivation rec {
   name = "cpufrequtils-008";
 
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 4ef162e56c72..fc7a66dcf1b6 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   name    = "criu-${version}";
-  version = "3.7";
+  version = "3.8.1";
 
   src = fetchurl {
     url    = "http://download.openvz.org/criu/${name}.tar.bz2";
-    sha256 = "0qrpz7pvnks34v7d8lb73flz3mb7qwnib94pdwaxh0mskn8470fq";
+    sha256 = "0csyhsc5d6wkcjyvsp6h9x8zxn3zk574s84gfmy3gjagv3nwqd51";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index c97f1b54622a..c57650e0806f 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   name = "dbus-broker-${version}";
-  version = "11";
+  version = "13";
 
   src = fetchFromGitHub {
-    owner           = "bus1";
-    repo            = "dbus-broker";
-    rev             = "v${version}";
-    sha256          = "19sszb6ac7md494i996ixqmz9b3gim8rrv2nbrmlgjd59gk6hf7b";
+    owner  = "bus1";
+    repo   = "dbus-broker";
+    rev    = "v${version}";
+    sha256 = "1yjkxpnl54pky6ha3y8dsds57lnk10lmriyzpzy0ha2npng2614x";
     fetchSubmodules = true;
   };
 
@@ -17,13 +17,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ dbus glib linuxHeaders systemd ];
 
-  enableParallelBuilding = true;
-
-  prePatch = ''
-    substituteInPlace meson.build \
-      --replace "dep_systemd.get_pkgconfig_variable('systemdsystemunitdir')" "'$out/lib/systemd/system'" \
-      --replace "dep_systemd.get_pkgconfig_variable('systemduserunitdir')"   "'$out/lib/systemd/user'"
-  '';
+  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "lib/systemd/system";
+  PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "lib/systemd/user";
 
   postInstall = ''
     install -Dm644 ../README $out/share/doc/dbus-broker/README
@@ -32,8 +27,6 @@ stdenv.mkDerivation rec {
       -e 's,^ExecReload.*busctl,ExecReload=${systemd}/bin/busctl,'
   '';
 
-  checkPhase = "ninja test";
-
   doCheck = true;
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/drbd/default.nix b/pkgs/os-specific/linux/drbd/default.nix
index 971eef6a8b52..8d18d5980207 100644
--- a/pkgs/os-specific/linux/drbd/default.nix
+++ b/pkgs/os-specific/linux/drbd/default.nix
@@ -1,7 +1,5 @@
 { stdenv, fetchurl, flex, systemd, perl }:
 
-assert stdenv.isLinux;
-
 stdenv.mkDerivation rec {
   name = "drbd-8.4.4";
 
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index 9ed691d69f0f..e3f382ababc3 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, kmod }:
 
 stdenv.mkDerivation rec {
-  version = "1.5.0";
+  version = "1.5.2";
   name = "ena-${version}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "amzn";
     repo = "amzn-drivers";
     rev = "ena_linux_${version}";
-    sha256 = "1h3vnwa2129advyws69n0sqyra4nz68mng6g84whbvhzjyx810sj";
+    sha256 = "18wf36092kr3zlpnqdkcdlim3vvjxy5f24zzsv4fwa7xg12mcfjm";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/exfat/default.nix b/pkgs/os-specific/linux/exfat/default.nix
index 56da5b0f16f4..0adeac7115df 100644
--- a/pkgs/os-specific/linux/exfat/default.nix
+++ b/pkgs/os-specific/linux/exfat/default.nix
@@ -6,13 +6,13 @@ assert lib.versionAtLeast kernel.version  "4.2" || lib.versionOlder kernel.versi
 
 stdenv.mkDerivation rec {
   name = "exfat-nofuse-${version}-${kernel.version}";
-  version = "2017-06-19";
+  version = "2018-04-16";
 
   src = fetchFromGitHub {
     owner = "dorimanx";
     repo = "exfat-nofuse";
-    rev = "de4c760bc9a05ead83bc3ec6eec6cf1fb106f523";
-    sha256 = "0v979d8sbcb70lakm4jal2ck3gspkdgq9108k127f7ph08vf8djm";
+    rev = "01c30ad52625a7261e1b0d874553b6ca7af25966";
+    sha256 = "0n1ibamf1yj8iqapc86lfscnky9p07ngsi4f2kpv3d5r2s6mzsh6";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/fatrace/default.nix b/pkgs/os-specific/linux/fatrace/default.nix
index fd955676775a..6f6418edc3e5 100644
--- a/pkgs/os-specific/linux/fatrace/default.nix
+++ b/pkgs/os-specific/linux/fatrace/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "fatrace-${version}";
-  version = "0.12";
+  version = "0.13";
 
   src = fetchurl {
     url = "http://launchpad.net/fatrace/trunk/${version}/+download/${name}.tar.bz2";
-    sha256 = "0szn86rbbvmjcw192vjhhgc3v99s5lm2kg93gk1yzm6ay831grsh";
+    sha256 = "0hrh45bpzncw0jkxw3x2smh748r65k2yxvfai466043bi5q0d2vx";
   };
 
   buildInputs = [ python3 which ];
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index acdba5987bbf..724498b960c0 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -2,51 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "firmware-linux-nonfree-${version}";
-  version = "2018-01-04-${src.iwlRev}";
+  version = "2018-03-20";
 
-  # The src runCommand automates the process of building a merged repository of both
-  #
-  # https://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/
-  # https://git.kernel.org/cgit/linux/kernel/git/iwlwifi/linux-firmware.git/
-  #
-  # This gives us up to date iwlwifi firmware as well as
-  # the usual set of firmware. firmware/linux-firmware usually lags kernel releases
-  # so iwlwifi cards will fail to load on newly released kernels.
-  #
-  # To update, go to the above repositories and look for latest tags / commits, then
-  # update version to the more recent commit date
-
-  src = runCommand "firmware-linux-nonfree-src-merged-${version}" {
-    shallowSince = "2017-10-01";
-    baseRev = "65b1c68c63f974d72610db38dfae49861117cae2";
-    iwlRev = "iwlwifi-fw-2017-11-15";
-
-    # When updating this, you need to let it run with a wrong hash, in order to find out the desired hash
-    # randomly mutate the hash to break out of fixed hash, when updating
-    outputHash = "1anr7fblxfcrfrrgq98kzy64yrwygc2wdgi47skdmjxhi3wbrvxz";
-
-    outputHashAlgo = "sha256";
-    outputHashMode = "recursive";
-
-    # Doing the download on a remote machine just duplicates network
-    # traffic, so don't do that.
-    preferLocalBuild = true;
-
-    nativeBuildInputs = [ cacert git gnupg ];
-  } ''
-    git init src && (
-      cd src
-      git config user.email "build-daemon@nixos.org"
-      git config user.name "Nixos Build Daemon $name"
-      git remote add base https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git
-      git remote add iwl https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/linux-firmware.git
-      git fetch --shallow-since=$shallowSince base
-      git fetch --shallow-since=$shallowSince iwl
-      git checkout -b work $baseRev
-      git merge $iwlRev)
-    rm -rf src/.git
-    cp -a src $out
-  '';
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
+    rev = "8c1e439c967a50f0698d61aafdba3841aff10db0";
+    sha256 = "110vxgahyx5dvylqrxsm5cmx4a32cl2zchvm6cgc270jz75fg7wd";
+  };
 
   preInstall = ''
     mkdir -p $out
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index c71f1c0ea2e9..d00f1b148374 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -2,36 +2,25 @@
 
 stdenv.mkDerivation rec {
   name = "raspberrypi-firmware-${version}";
-  version = "1.20171029";
+  version = "1.20180328";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "12aisha8rlr28310hakps04z9p45kd2wvks0w1vxw1kwfh1ncy9s";
+    sha256 = "19h4lv11idy268pyrq21c5gsff77d5xr9xjkpmzfpcq34gjh3x21";
   };
 
-  dontStrip = true;    # Stripping breaks some of the binaries
-
   installPhase = ''
     mkdir -p $out/share/raspberrypi/boot
     cp -R boot/* $out/share/raspberrypi/boot
-    cp -R hardfp/opt/vc/* $out
-    cp opt/vc/LICENCE $out/share/raspberrypi
-
-    for f in $out/bin/*; do
-      if isELF "$f"; then
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$f"
-        patchelf --set-rpath "$out/lib" "$f"
-      fi
-    done
   '';
 
   meta = with stdenv.lib; {
     description = "Firmware for the Raspberry Pi board";
-    homepage = https://github.com/raspberrypi;
-    license = licenses.unfree;
+    homepage = https://github.com/raspberrypi/firmware;
+    license = licenses.unfreeRedistributableFirmware; # See https://github.com/raspberrypi/firmware/blob/master/boot/LICENCE.broadcom
     platforms = [ "armv6l-linux" "armv7l-linux" "aarch64-linux" ];
-    maintainers = with maintainers; [ viric tavyc ];
+    maintainers = with maintainers; [ dezgeg viric tavyc ];
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch b/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch
new file mode 100644
index 000000000000..e12aeeb0cdb8
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/tools-dont-install-sysv-init-scripts.patch
@@ -0,0 +1,20 @@
+diff --git a/interface/vmcs_host/linux/vcfiled/CMakeLists.txt b/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
+index aed0e83..b325676 100644
+--- a/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
++++ b/interface/vmcs_host/linux/vcfiled/CMakeLists.txt
+@@ -17,15 +17,6 @@ target_link_libraries(vcfiled
+ install(TARGETS vcfiled 
+         RUNTIME DESTINATION sbin)
+ 
+-configure_file (etc/init.d/vcfiled ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled)
+-
+-# script to start up vcfiled at start of day
+-install(PROGRAMS ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled
+-        DESTINATION /etc/init.d)
+-# install locally to the installation directory too
+-install(PROGRAMS ${PROJECT_BINARY_DIR}/etc/init.d/vcfiled
+-        DESTINATION ${VMCS_INSTALL_PREFIX}/share/install)
+-
+ # test program for vcfiled_check library
+ add_executable(vcfiled_lock_test vcfiled_lock_test.c)
+ target_link_libraries(vcfiled_lock_test vcfiled_check)
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
new file mode 100644
index 000000000000..7f4c9dae166a
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/tools.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, cmake, pkgconfig }:
+
+stdenv.mkDerivation rec {
+  name = "raspberrypi-tools-${version}";
+  version = "2018-02-05";
+
+  src = fetchFromGitHub {
+    owner = "raspberrypi";
+    repo = "userland";
+    rev = "a343dcad1dae4e93f4bfb99496697e207f91027e";
+    sha256 = "1z4qrwjb7x3a45mx978q8vyhnx068sgzhymm4z0ayhckji4ngal1";
+  };
+
+  patches = [ ./tools-dont-install-sysv-init-scripts.patch ];
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  preConfigure = ''
+    cmakeFlagsArray+=("-DVMCS_INSTALL_PREFIX=$out")
+  '' + stdenv.lib.optionalString stdenv.isAarch64 ''
+    cmakeFlagsArray+=("-DARM64=1")
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Userland tools for the Raspberry Pi board";
+    homepage = https://github.com/raspberrypi/userland;
+    license = licenses.bsd3;
+    platforms = [ "armv6l-linux" "armv7l-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ dezgeg viric tavyc ];
+  };
+}
diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index b9ac015f4591..95011653ad01 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -4,6 +4,7 @@
 , fusePackages, utillinux, gettext
 , autoconf, automake, libtool
 , meson, ninja, pkgconfig
+, autoreconfHook
 }:
 
 let
@@ -18,6 +19,8 @@ in stdenv.mkDerivation rec {
     sha256 = sha256Hash;
   };
 
+  preAutoreconf = "touch config.rpath";
+
   patches =
     stdenv.lib.optional
       (!isFuse3 && stdenv.isAarch64)
@@ -25,13 +28,14 @@ in stdenv.mkDerivation rec {
         url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
         sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa";
       })
-    ++ stdenv.lib.optional isFuse3 ./fuse3-install.patch;
+    ++ stdenv.lib.optional isFuse3 ./fuse3-install.patch
+    # TODO: Only relevant for 3.2.2 (opened an upstream issue)
+    ++ stdenv.lib.optional isFuse3 ./fuse3-fix-version.patch;
 
 
   nativeBuildInputs = if isFuse3
     then [ meson ninja pkgconfig ]
-    else [ autoconf automake libtool ];
-  buildInputs = stdenv.lib.optional (!isFuse3) gettext;
+    else [ autoreconfHook gettext ];
 
   outputs = [ "out" ] ++ stdenv.lib.optional isFuse3 "common";
 
@@ -61,11 +65,11 @@ in stdenv.mkDerivation rec {
   postFixup = "cd $out\n" + (if isFuse3 then ''
     mv bin/mount.fuse3 bin/mount.fuse
 
-    install -D -m555 bin/mount.fuse $common/bin/mount.fuse
-    install -D -m444 etc/udev/rules.d/99-fuse.rules $common/etc/udev/rules.d/99-fuse.rules
+    install -D -m444 etc/fuse.conf $common/etc/fuse.conf
+    install -D -m444 etc/udev/rules.d/99-fuse3.rules $common/etc/udev/rules.d/99-fuse.rules
     install -D -m444 share/man/man8/mount.fuse.8.gz $common/share/man/man8/mount.fuse.8.gz
   '' else ''
-    cp ${fusePackages.fuse_3.common}/bin/mount.fuse bin/mount.fuse
+    cp ${fusePackages.fuse_3.common}/etc/fuse.conf etc/fuse.conf
     cp ${fusePackages.fuse_3.common}/etc/udev/rules.d/99-fuse.rules etc/udev/rules.d/99-fuse.rules
     cp ${fusePackages.fuse_3.common}/share/man/man8/mount.fuse.8.gz share/man/man8/mount.fuse.8.gz
   '');
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index 97744968d7b3..ddf280bbe2f7 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -13,8 +13,8 @@ in {
   };
 
   fuse_3 = mkFuse {
-    version = "3.2.1";
-    sha256Hash = "19bsvb5lc8k1i0h5ld109kixn6mdshzvg3y7820k9mnw34kh09y0";
+    version = "3.2.2";
+    sha256Hash = "1a0x4vpyg9lc6clwvx995mk0v6jqd37xabzp9rpdir37x814g3wh";
     maintainers = [ maintainers.primeos ];
   };
 }
diff --git a/pkgs/os-specific/linux/fuse/fuse3-fix-version.patch b/pkgs/os-specific/linux/fuse/fuse3-fix-version.patch
new file mode 100644
index 000000000000..b6351aab3c01
--- /dev/null
+++ b/pkgs/os-specific/linux/fuse/fuse3-fix-version.patch
@@ -0,0 +1,8 @@
+--- a/meson.build	2018-04-01 01:05:19.612723597 +0200
++++ b/meson.build	2018-04-01 01:40:58.171109615 +0200
+@@ -1,4 +1,4 @@
+-project('libfuse3', 'c', version: '3.2.1',
++project('libfuse3', 'c', version: '3.2.2',
+         meson_version: '>= 0.38',
+         default_options: [ 'buildtype=debugoptimized' ])
+
diff --git a/pkgs/os-specific/linux/fuse/fuse3-install.patch b/pkgs/os-specific/linux/fuse/fuse3-install.patch
index f77639367acf..639dc7e07a4d 100644
--- a/pkgs/os-specific/linux/fuse/fuse3-install.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-install.patch
@@ -1,6 +1,6 @@
---- a/util/install_helper.sh	1970-01-01 01:00:01.000000000 +0100
-+++ b/util/install_helper.sh	2017-09-21 23:43:50.703942577 +0200
-@@ -11,19 +11,11 @@
+--- a/util/install_helper.sh	2018-04-01 01:05:19.613723599 +0200
++++ b/util/install_helper.sh	2018-04-01 01:06:02.952845382 +0200
+@@ -11,22 +11,14 @@
  udevrulesdir="$3"
  prefix="${MESON_INSTALL_DESTDIR_PREFIX}"
  
@@ -14,11 +14,15 @@
 -
  install -D -m 644 "${MESON_SOURCE_ROOT}/util/udev.rules" \
 -        "${DESTDIR}/${udevrulesdir}/99-fuse3.rules"
-+        "${prefix}/${udevrulesdir}/99-fuse.rules"
++        "${prefix}/${udevrulesdir}/99-fuse3.rules"
  
  install -D -m 755 "${MESON_SOURCE_ROOT}/util/init_script" \
 -        "${DESTDIR}/etc/init.d/fuse3"
 +        "${prefix}/etc/init.d/fuse3"
  
+ install -D -m 644 "${MESON_SOURCE_ROOT}/util/fuse.conf" \
+-	"${DESTDIR}/etc/fuse.conf"
++	"${prefix}/etc/fuse.conf"
+
  if test -x /usr/sbin/update-rc.d && test -z "${DESTDIR}"; then
      /usr/sbin/update-rc.d fuse3 start 34 S . start 41 0 6 . || /bin/true
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index 4c393a0f3266..c02bfb1615c3 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "fwts-${version}";
-  version = "18.01.00";
+  version = "18.03.00";
 
   src = fetchzip {
     url = "http://fwts.ubuntu.com/release/fwts-V${version}.tar.gz";
-    sha256 = "043wkq4hz5pz79masppya67b8i5jw61p1j8dw17jwc8w6gp8csfb";
+    sha256 = "1f2gdnaygsj0spd6a559bzf3wii7l59k3sk49rjbbdb9g77nkhg2";
     stripRoot = false;
   };
 
diff --git a/pkgs/os-specific/linux/gogoclient/default.nix b/pkgs/os-specific/linux/gogoclient/default.nix
index 521b81cd690d..53895faa66cb 100644
--- a/pkgs/os-specific/linux/gogoclient/default.nix
+++ b/pkgs/os-specific/linux/gogoclient/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, openssl, nettools, iproute, procps}:
+{stdenv, fetchurl, openssl, nettools, iproute, sysctl}:
 
 let baseName = "gogoclient";
     version  = "1.2";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
       --replace "/sbin/ifconfig" "${nettools}/bin/ifconfig" \
       --replace "/sbin/route"    "${nettools}/bin/route" \
       --replace "/sbin/ip"       "${iproute}/sbin/ip" \
-      --replace "/sbin/sysctl"   "${procps}/sbin/sysctl"
+      --replace "/sbin/sysctl"   "${sysctl}/bin/sysctl"
     sed -i -e 's/^.*Exec \$route -A.*$/& metric 128/' $out/template/linux.sh
   '';
 
diff --git a/pkgs/os-specific/linux/google-authenticator/default.nix b/pkgs/os-specific/linux/google-authenticator/default.nix
index 1494d9f06a8a..41bdd5d12ac3 100644
--- a/pkgs/os-specific/linux/google-authenticator/default.nix
+++ b/pkgs/os-specific/linux/google-authenticator/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "google-authenticator-libpam-${version}";
-  version = "1.03";
+  version = "1.05";
 
   src = fetchurl {
     url = "https://github.com/google/google-authenticator-libpam/archive/${version}.tar.gz";
-    sha256 = "0wb95z5v1w4sk0p7y9pbn4v95w9hrbf80vw9k2z2sgs0156ljkb7";
+    sha256 = "026vljmddi0zqcb3c0vdpabmi4r17kahc00mh6fs3qbyjbb14946";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/os-specific/linux/gpu-switch/default.nix b/pkgs/os-specific/linux/gpu-switch/default.nix
new file mode 100644
index 000000000000..d56253c6cedd
--- /dev/null
+++ b/pkgs/os-specific/linux/gpu-switch/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, lib, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  name = "gpu-switch-unstable-${version}";
+  version = "2017-04-28";
+  src = fetchFromGitHub {
+    owner = "0xbb";
+    repo = "gpu-switch";
+    rev = "a365f56d435c8ef84c4dd2ab935ede4992359e31";
+    sha256 = "1jnh43nijkqd83h7piq7225ixziggyzaalabgissyxdyz6szcn0r";
+  };
+  installPhase = ''
+    mkdir -p $out/bin
+    cp gpu-switch $out/bin/
+  '';
+  meta = with lib; {
+    description = "Application that allows to switch between the graphic cards of dual-GPU MacBook Pro models";
+    homepage = https://github.com/0xbb/gpu-switch;
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.msiedlarek ];
+  };
+}
diff --git a/pkgs/os-specific/linux/hdparm/default.nix b/pkgs/os-specific/linux/hdparm/default.nix
index 87cb17329e8c..cbdbefeb2a0e 100644
--- a/pkgs/os-specific/linux/hdparm/default.nix
+++ b/pkgs/os-specific/linux/hdparm/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "hdparm-9.54";
+  name = "hdparm-9.56";
 
   src = fetchurl {
     url = "mirror://sourceforge/hdparm/${name}.tar.gz";
-    sha256 = "0ghnhdj7wfw6acfyhdawpfa5n9kvkvzgi1fw6i7sghgbjx5nhyjd";
+    sha256 = "1np42qyhb503khvacnjcl3hb1dqly68gj0a1xip3j5qhbxlyvybg";
 
   };
 
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 6f2dc807fbab..070ddfd77789 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "hwdata-${version}";
-  version = "0.309";
+  version = "0.312";
 
   src = fetchurl {
-    url = "https://github.com/vcrhonek/hwdata/archive/v0.309.tar.gz";
-    sha256 = "1njx4lhg7a0cawz82x535vk4mslmnfj7nmf8dbq8kgqxiqh6h2c7";
+    url = "https://github.com/vcrhonek/hwdata/archive/v0.312.tar.gz";
+    sha256 = "04dbxfn40b8vyw49qpkslv20akbqm5hwl3cndmqacp6cik1l0gai";
   };
 
   preConfigure = "patchShebangs ./configure";
diff --git a/pkgs/os-specific/linux/i2c-tools/default.nix b/pkgs/os-specific/linux/i2c-tools/default.nix
index 1f67743af0d4..eacac156c975 100644
--- a/pkgs/os-specific/linux/i2c-tools/default.nix
+++ b/pkgs/os-specific/linux/i2c-tools/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "i2c-tools-${version}";
-  version = "3.1.2";
+  version = "4.0";
 
   src = fetchurl {
-    url = "http://http.debian.net/debian/pool/main/i/i2c-tools/i2c-tools_${version}.orig.tar.bz2";
-    sha256 = "0hd4c1w8lnwc3j95h3vpd125170l1d4myspyrlpamqx6wbr6jpnv";
+    url = "https://www.kernel.org/pub/software/utils/i2c-tools/${name}.tar.xz";
+    sha256 = "1mi8mykvl89y6liinc9jv1x8m2q093wrdc2hm86a47n524fcl06r";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 269c59f5e6fe..7d412d7e15d0 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "iproute2-${version}";
-  version = "4.15.0";
+  version = "4.16.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "0mc3g4kj7h3jhwz2b2gdf41gp6bhqn7axh4mnyvhkdnpk5m63m28";
+    sha256 = "02pfalg319jpbjz273ph725br8dnkzpfvi98azi9yd6p1w128p0c";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index c78a4eadfa4e..d736caa535d4 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libmnl }:
 
 stdenv.mkDerivation rec {
-  name = "ipset-6.35";
+  name = "ipset-6.38";
 
   src = fetchurl {
     url = "http://ipset.netfilter.org/${name}.tar.bz2";
-    sha256 = "1p7l1fj3lbv6rr24zxjiwq7jk1yvazk8db6yyni0qbprw49i01rp";
+    sha256 = "0i72wcljl0nkpmzc20jcch3hpphrm0qp4v4j4ajamq0zlddn5vyf";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index a7fbcce31753..d2eab02f6753 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -24,26 +24,32 @@ stdenv.mkDerivation rec {
   # Disable idn usage w/musl: https://github.com/iputils/iputils/pull/111
   makeFlags = [ "USE_GNUTLS=no" ] ++ stdenv.lib.optional stdenv.hostPlatform.isMusl "USE_IDN=no";
 
+  depsBuildBuild = [ opensp SGMLSpm docbook_sgml_dtd_31 ];
   buildInputs = [
-    libsysfs opensp openssl libcap docbook_sgml_dtd_31 SGMLSpm libgcrypt nettle
+    libsysfs openssl libcap libgcrypt nettle
   ] ++ stdenv.lib.optional (!stdenv.hostPlatform.isMusl) libidn;
 
-  buildFlags = "man all ninfod";
+  # ninfod probably could build on cross, but the Makefile doesn't pass --host etc to the sub configure...
+  buildFlags = "man all" + stdenv.lib.optionalString (!stdenv.isCross) " ninfod";
 
   installPhase =
     ''
       mkdir -p $out/bin
-      cp -p ping tracepath clockdiff arping rdisc ninfod/ninfod $out/bin/
+      cp -p ping tracepath clockdiff arping rdisc rarpd $out/bin/
+      if [ -x ninfod/ninfod ]; then
+        cp -p ninfod/ninfod $out/bin
+      fi
 
       mkdir -p $out/share/man/man8
       cp -p \
-        doc/clockdiff.8 doc/arping.8 doc/ping.8 doc/rdisc.8 doc/tracepath.8 doc/ninfod.8 \
+        doc/clockdiff.8 doc/arping.8 doc/ping.8 doc/rdisc.8 doc/rarpd.8 doc/tracepath.8 doc/ninfod.8 \
         $out/share/man/man8
     '';
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = https://github.com/iputils/iputils;
     description = "A set of small useful utilities for Linux networking";
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lheckemann ];
   };
 }
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index f4f870f16c3b..792c7bcb0849 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -3,16 +3,17 @@
 let
   ell = fetchgit {
      url = https://git.kernel.org/pub/scm/libs/ell/ell.git;
-     rev = "8192131685be0f27d6f51b14b78ef93fa7f3c692";
-     sha256 = "1k74qz3w0l4zq8llrxc4p62xy0c0n33f260vy3d14wx5rhvf0544";
+     rev = "0.5";
+     sha256 = "0xw53bigh99nhacjb67qs1g145fwls7065l8vsrziwzpkyd5s6a8";
   };
 in stdenv.mkDerivation rec {
-  name = "iwd-unstable-2017-12-14";
+  name = "iwd-${version}";
+  version = "0.2";
 
   src = fetchgit {
     url = https://git.kernel.org/pub/scm/network/wireless/iwd.git;
-    rev = "cf3372235c4592ca7366b27548abc4e89a982414";
-    sha256 = "0dg28j919w1v8sqr6jdj12c233rsjzd2jzkcpag1hx2h3g35hnlz";
+    rev = version;
+    sha256 = "0khc017s27n6y6c6wbqhmcghzggnagxbi8j36hl5g73y6s44vx42";
   };
 
   nativeBuildInputs = [
@@ -24,7 +25,7 @@ in stdenv.mkDerivation rec {
     readline
     python3Packages.python
   ];
-  
+
   pythonPath = [
     python3Packages.dbus-python
     python3Packages.pygobject3
@@ -33,7 +34,8 @@ in stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   configureFlags = [
-    "--with-dbusconfdir=$(out)/etc/"
+    "--with-dbus-datadir=$(out)/etc/"
+    "--disable-systemd-service"
   ];
 
   postUnpack = ''
diff --git a/pkgs/os-specific/linux/ixgbevf/default.nix b/pkgs/os-specific/linux/ixgbevf/default.nix
index ffdf0d678d77..6bcc548ba521 100644
--- a/pkgs/os-specific/linux/ixgbevf/default.nix
+++ b/pkgs/os-specific/linux/ixgbevf/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "ixgbevf-${version}-${kernel.version}";
-  version = "4.3.3";
+  version = "4.3.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/e1000/ixgbevf-${version}.tar.gz";
-    sha256 = "0kq8y0944kaprw445wb8iswdck2jmc0xpkx0iv6idy3r5cc4hvyg";
+    sha256 = "122zn9nd8f95bpidiiinc8xaizypkirqs8vlmsdy2iv3w65md9k3";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/jfbview/default.nix b/pkgs/os-specific/linux/jfbview/default.nix
index 89a220c85e2d..dafe9069b5a8 100644
--- a/pkgs/os-specific/linux/jfbview/default.nix
+++ b/pkgs/os-specific/linux/jfbview/default.nix
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   name = "${package}-${version}";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     repo = "JFBView";
     owner = "jichu4n";
     rev = version;
-    sha256 = "0p12b5n07yfkmfswjdb3a4c5c50jcphl030n3i71djcq4jjvrxlw";
+    sha256 = "1w844ha9lp49ik79yfislib34455nl9gcksbx22hiz30gmqwzakz";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 8107f7d96575..01cab57f7196 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -39,14 +39,6 @@ let
       echo "${version}-default" > $out/include/config/kernel.release
     '';
 
-    # !!! hacky
-    fixupPhase = ''
-      ln -s asm $out/include/asm-$platform
-      if test "$platform" = "i386" -o "$platform" = "x86_64"; then
-        ln -s asm $out/include/asm-x86
-      fi
-    '';
-
     meta = with lib; {
       description = "Header files and scripts for Linux kernel";
       license = licenses.gpl2;
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 50f5999c557f..4af5889fd1cd 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -32,7 +32,6 @@ with stdenv.lib;
   # Debugging.
   DEBUG_KERNEL y
   DYNAMIC_DEBUG y
-  BACKTRACE_SELF_TEST n
   DEBUG_DEVRES n
   DEBUG_STACK_USAGE n
   DEBUG_STACKOVERFLOW n
@@ -116,7 +115,6 @@ with stdenv.lib;
   # Enable various subsystems.
   ACCESSIBILITY y # Accessibility support
   AUXDISPLAY y # Auxiliary Display support
-  DONGLE y # Serial dongle support
   HIPPI y
   MTD_COMPLEX_MAPPINGS y # needed for many devices
   SCSI_LOWLEVEL y # enable lots of SCSI devices
@@ -125,6 +123,9 @@ with stdenv.lib;
   SPI y # needed for many devices
   SPI_MASTER y
   WAN y
+  ${optionalString (versionOlder version "4.17") ''
+    DONGLE y # Serial dongle support
+  ''}
 
   # Networking options.
   NET y
@@ -135,6 +136,7 @@ with stdenv.lib;
   NETFILTER y
   NETFILTER_ADVANCED y
   CGROUP_BPF? y # Required by systemd per-cgroup firewalling
+  CGROUP_NET_PRIO y # Required by systemd
   IP_ROUTE_VERBOSE y
   IP_MROUTE_MULTIPLE_TABLES y
   IP_VS_PROTO_TCP y
@@ -420,7 +422,9 @@ with stdenv.lib;
   ${optionalString (versionAtLeast version "4.3") ''
     IDLE_PAGE_TRACKING y
   ''}
-  IRDA_ULTRA y # Ultra (connectionless) protocol
+  ${optionalString (versionOlder version "4.17") ''
+    IRDA_ULTRA y # Ultra (connectionless) protocol
+  ''}
   JOYSTICK_IFORCE_232? y # I-Force Serial joysticks and wheels
   JOYSTICK_IFORCE_USB? y # I-Force USB joysticks and wheels
   JOYSTICK_XPAD_FF? y # X-Box gamepad rumble support
@@ -640,43 +644,46 @@ with stdenv.lib;
   # This menu disables all/most of them on >= 4.16
   RUNTIME_TESTING_MENU? n
   # For older kernels, painstakingly disable each symbol.
-  ARM_KPROBES_TEST? n
-  ASYNC_RAID6_TEST? n
-  ATOMIC64_SELFTEST? n
-  BACKTRACE_SELF_TEST? n
+  ${optionalString (versionOlder version "4.16") ''
+    ARM_KPROBES_TEST? n
+    ASYNC_RAID6_TEST? n
+    ATOMIC64_SELFTEST? n
+    BACKTRACE_SELF_TEST? n
+    INTERVAL_TREE_TEST? n
+    PERCPU_TEST? n
+    RBTREE_TEST? n
+    TEST_BITMAP? n
+    TEST_BPF? n
+    TEST_FIRMWARE? n
+    TEST_HASH? n
+    TEST_HEXDUMP? n
+    TEST_KMOD? n
+    TEST_KSTRTOX? n
+    TEST_LIST_SORT? n
+    TEST_LKM? n
+    TEST_PARMAN? n
+    TEST_PRINTF? n
+    TEST_RHASHTABLE? n
+    TEST_SORT? n
+    TEST_STATIC_KEYS? n
+    TEST_STRING_HELPERS? n
+    TEST_UDELAY? n
+    TEST_USER_COPY? n
+    TEST_UUID? n
+  ''}
+
   CRC32_SELFTEST? n
   CRYPTO_TEST? n
   DRM_DEBUG_MM_SELFTEST? n
   EFI_TEST? n
   GLOB_SELFTEST? n
-  INTERVAL_TREE_TEST? n
   LNET_SELFTEST? n
   LOCK_TORTURE_TEST? n
   MTD_TESTS? n
   NOTIFIER_ERROR_INJECTION? n
-  PERCPU_TEST? n
-  RBTREE_TEST? n
   RCU_PERF_TEST? n
   RCU_TORTURE_TEST? n
   TEST_ASYNC_DRIVER_PROBE? n
-  TEST_BITMAP? n
-  TEST_BPF? n
-  TEST_FIRMWARE? n
-  TEST_HASH? n
-  TEST_HEXDUMP? n
-  TEST_KMOD? n
-  TEST_KSTRTOX? n
-  TEST_LIST_SORT? n
-  TEST_LKM? n
-  TEST_PARMAN? n
-  TEST_PRINTF? n
-  TEST_RHASHTABLE? n
-  TEST_SORT? n
-  TEST_STATIC_KEYS? n
-  TEST_STRING_HELPERS? n
-  TEST_UDELAY? n
-  TEST_USER_COPY? n
-  TEST_UUID? n
   WW_MUTEX_SELFTEST? n
   XZ_DEC_TEST? n
 
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index f69865cdc4df..2b44ff51ad0a 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -1,12 +1,10 @@
-{ buildPackages, runCommand, nettools, bc, bison, flex, perl, gmp, libmpc, mpfr, openssl
+{ buildPackages
 , ncurses
-, libelf
-, utillinux
-, writeTextFile, ubootTools
 , callPackage
-}:
-
-{ stdenv, buildPackages, perl, buildLinux
+, perl
+, bison ? null
+, flex ? null
+, stdenv
 
 , # The kernel source tarball.
   src
@@ -35,6 +33,12 @@
                        hostPlatform != stdenv.buildPlatform
 , extraMeta ? {}
 , hostPlatform
+
+# easy overrides to hostPlatform.platform members
+, autoModules ? hostPlatform.platform.kernelAutoModules
+, preferBuiltin ? hostPlatform.platform.kernelPreferBuiltin or false
+, kernelArch ? hostPlatform.platform.kernelArch
+
 , ...
 } @ args:
 
@@ -67,12 +71,13 @@ let
     in lib.concatStringsSep "\n" ([baseConfig] ++ configFromPatches);
 
   configfile = stdenv.mkDerivation {
-    inherit ignoreConfigErrors;
+    inherit ignoreConfigErrors autoModules preferBuiltin kernelArch;
     name = "linux-config-${version}";
 
     generateConfig = ./generate-config.pl;
 
     kernelConfig = kernelConfigFun config;
+    passAsFile = [ "kernelConfig" ];
 
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     nativeBuildInputs = [ perl ]
@@ -83,9 +88,6 @@ let
     kernelBaseConfig = hostPlatform.platform.kernelBaseConfig;
     # e.g. "bzImage"
     kernelTarget = hostPlatform.platform.kernelTarget;
-    autoModules = hostPlatform.platform.kernelAutoModules;
-    preferBuiltin = hostPlatform.platform.kernelPreferBuiltin or false;
-    arch = hostPlatform.platform.kernelArch;
 
     prePatch = kernel.prePatch + ''
       # Patch kconfig to print "###" after every question so that
@@ -99,12 +101,12 @@ let
       export buildRoot="''${buildRoot:-build}"
 
       # Get a basic config file for later refinement with $generateConfig.
-      make HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc -C . O="$buildRoot" $kernelBaseConfig ARCH=$arch
+      make HOSTCC=${buildPackages.stdenv.cc.targetPrefix}gcc -C . O="$buildRoot" $kernelBaseConfig ARCH=$kernelArch
 
       # Create the config file.
       echo "generating kernel configuration..."
-      echo "$kernelConfig" > "$buildRoot/kernel-config"
-      DEBUG=1 ARCH=$arch KERNEL_CONFIG="$buildRoot/kernel-config" AUTO_MODULES=$autoModules \
+      ln -s "$kernelConfigPath" "$buildRoot/kernel-config"
+      DEBUG=1 ARCH=$kernelArch KERNEL_CONFIG="$buildRoot/kernel-config" AUTO_MODULES=$autoModules \
            PREFER_BUILTIN=$preferBuiltin BUILD_ROOT="$buildRoot" SRC=. perl -w $generateConfig
     '';
 
diff --git a/pkgs/os-specific/linux/kernel/hardened-config.nix b/pkgs/os-specific/linux/kernel/hardened-config.nix
index 3a82c00c5010..a00ba9ab7b8e 100644
--- a/pkgs/os-specific/linux/kernel/hardened-config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened-config.nix
@@ -78,6 +78,9 @@ ${optionalString (versionAtLeast version "4.13") ''
 
 # Perform usercopy bounds checking.
 HARDENED_USERCOPY y
+${optionalString (versionAtLeast version "4.16") ''
+  HARDENED_USERCOPY_FALLBACK n
+''}
 
 # Randomize allocator freelists.
 SLAB_FREELIST_RANDOM y
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 4b8515a86d33..f798a3a85e59 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,13 +3,13 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.24";
+  version = "4.14.39";
 
   # branchVersion needs to be x.y
   extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "00cqhc8198f4gj6cpz7nblpgi5zh2145arjx1yp0p4gmswdjslds";
+    sha256 = "1gdpq4w6srz2fpyi8bqpgz0p5wm3mrk7ir967c6f2285mdvcb7r6";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.15.nix b/pkgs/os-specific/linux/kernel/linux-4.16.nix
index 1c4889892439..acafd0bd89f7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.16.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.15.7";
+  version = "4.16.7";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1in8gy82ccpri7xhbgim3jrh15lbfrfzjgg69g0yvq534d5xyi6d";
+    sha256 = "0f81mxc5b3zf5m29bwc3afv07k60661zl18098cjjqv6qpvbwynq";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 4f42f7b81c7f..725f3385a80c 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.120";
+  version = "4.4.131";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0y7li4vcvv04aqkrgl01i98pgwm9njzrb8y8wdvwaq9658vhfpx2";
+    sha256 = "02f7sx20l0ljkgffac0yqav1kk7x1gl6026icslcsnn46pfpl4k5";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index d1bf5fb5c622..b09a58c6eb79 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.86";
+  version = "4.9.98";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "11bf1jcxn5gwd1g99ml2kn65vkpciq8hdz7xc0bjy66gxysnxkx7";
+    sha256 = "1vqh33wdiqf3j4xfakxndhb8x6yr5ppwv9asx7kldjfvb8sr1k8j";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-copperhead-lts.nix b/pkgs/os-specific/linux/kernel/linux-copperhead-lts.nix
new file mode 100644
index 000000000000..a1c93e565905
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-copperhead-lts.nix
@@ -0,0 +1,30 @@
+{ stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, ... } @ args:
+
+with stdenv.lib;
+
+let
+  version = "4.14.39";
+  revision = "a";
+  sha256 = "19nx537a8kbbyp5d67anrqfw8i8hliw3yb1gyrf70isl3fqifjaa";
+
+  # modVersion needs to be x.y.z, will automatically add .0 if needed
+  modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
+
+  # branchVersion needs to be x.y
+  branchVersion = concatStrings (intersperse "." (take 2 (splitString "." version)));
+
+  modDirVersion = "${modVersion}-hardened";
+in
+buildLinux (args // {
+  inherit modDirVersion;
+
+  version = "${version}-${revision}";
+  extraMeta.branch = "${branchVersion}";
+
+  src = fetchFromGitHub {
+    inherit sha256;
+    owner = "copperhead";
+    repo = "linux-hardened";
+    rev = "${version}.${revision}";
+  };
+} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix b/pkgs/os-specific/linux/kernel/linux-copperhead-stable.nix
index 85d31048ffc2..9d4b729060ae 100644
--- a/pkgs/os-specific/linux/kernel/linux-copperhead-hardened.nix
+++ b/pkgs/os-specific/linux/kernel/linux-copperhead-stable.nix
@@ -3,9 +3,9 @@
 with stdenv.lib;
 
 let
-  version = "4.15.7";
+  version = "4.16.7";
   revision = "a";
-  sha256 = "19kgy1fa4flnqm3a50hilgjczqkscay10183cvkzy3vxrnf8fl0f";
+  sha256 = "1kdy3sqrn161hm5avhk3nd75p07a21ja0rzar3ybibh1bl2mc6zq";
 
   # modVersion needs to be x.y.z, will automatically add .0 if needed
   modVersion = concatStrings (intersperse "." (take 3 (splitString "." "${version}.0")));
diff --git a/pkgs/os-specific/linux/kernel/linux-mptcp.nix b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
index c4bade2abeda..d486bd1d6d24 100644
--- a/pkgs/os-specific/linux/kernel/linux-mptcp.nix
+++ b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
@@ -33,8 +33,7 @@ buildLinux (rec {
     DEFAULT_MPTCP_PM default
 
     # MPTCP scheduler selection.
-    # Disabled as the only non-default is the useless round-robin.
-    MPTCP_SCHED_ADVANCED n
+    MPTCP_SCHED_ADVANCED y
     DEFAULT_MPTCP_SCHED default
 
     # Smarter TCP congestion controllers
diff --git a/pkgs/os-specific/linux/kernel/linux-riscv.nix b/pkgs/os-specific/linux/kernel/linux-riscv.nix
index 45795e24c542..60370311865f 100644
--- a/pkgs/os-specific/linux/kernel/linux-riscv.nix
+++ b/pkgs/os-specific/linux/kernel/linux-riscv.nix
@@ -1,15 +1,15 @@
 { stdenv, buildPackages, hostPlatform, fetchFromGitHub, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.16-rc2";
-  modDirVersion = "4.16.0-rc2";
+  version = "4.16-rc6";
+  modDirVersion = "4.16.0-rc6";
   extraMeta.branch = "4.16";
 
   src = fetchFromGitHub {
     owner = "shlevy";
     repo ="riscv-linux";
-    rev = "f0c42cff9292c0a8e6ca702a54aafa04b35758a6";
-    sha256 = "050mdciyz1595z81zsss0v9vqsaysppyzqaqpfs5figackifv3iv";
+    rev = "a54f259c2adce68e3bd7600be8989bf1ddf9ea3a";
+    sha256 = "140w6mj4hm1vf4zsmcr2w5cghcaalbvw5d4m9z57dmq1z5plsl4q";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index 5aae37418ce8..1366a11b573c 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,15 +1,15 @@
 { stdenv, buildPackages, hostPlatform, fetchgit, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.15.2018.02.09";
+  version = "4.15.2018.04.14";
   modDirVersion = "4.15.0";
   extraMeta.branch = "master";
-  extraMeta.maintainers = [ stdenv.lib.maintainers.davidak ];
+  extraMeta.maintainers = [ stdenv.lib.maintainers.davidak stdenv.lib.maintainers.chiiruno ];
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs.git";
-    rev = "4506cd5ead31209a6a646c2412cbc7be735ebda4";
-    sha256 = "0fcyf3y27k2lga5na4dhdyc47br840gkqynv8gix297pqxgidrib";
+    rev = "3b7c824e9330a640312fce1b04537c684c1d602c";
+    sha256 = "1l5ib28qkhrxggn6zj9b2839543anbxk2ip75yizgzlv9vr5m4pk";
   };
 
   extraConfig = ''
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 5286ecaf34cc..922256703307 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPackages, hostPlatform, fetchurl, perl, buildLinux, libelf, utillinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.16-rc4";
-  modDirVersion = "4.16.0-rc4";
-  extraMeta.branch = "4.16";
+  version = "4.17-rc4";
+  modDirVersion = "4.17.0-rc4";
+  extraMeta.branch = "4.17";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "0fxs3i7rdw5mybmim0npmzqpp7i3ppy1f6f72q2w3qdbjmbqm7w6";
+    sha256 = "1y34hpzgxblwqslhsfsmzmpv9f3s936r93wgn4kmhkcwsm0in292";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 60fb00645139..9833bb57bafb 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -35,6 +35,8 @@ in {
   extraMeta ? {},
   # Whether to utilize the controversial import-from-derivation feature to parse the config
   allowImportFromDerivation ? false,
+  # ignored
+  features ? null,
 
   hostPlatform
 }:
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index e163459d7f4f..cedb2dfc2230 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -73,4 +73,15 @@ rec {
     };
   };
 
+  # https://patchwork.kernel.org/patch/9626797/
+  # Should be included in 4.17, so this patch can be dropped when 4.16 becomes obsolete.
+  bcm2835_mmal_v4l2_camera_driver = rec {
+    name = "bcm2835_mmal_v4l2_camera_driver";
+    patch = fetchpatch {
+      name = name + ".patch";
+      url = https://patchwork.kernel.org/patch/9626797/raw/;
+      sha256 = "0iwb0yxsf95zv4qxkvlvhqfmzx0rk13g9clvxsharvwkb4w5lwa0";
+    };
+  };
+
 }
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 06552eb35799..a6f399c0fba4 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -12,7 +12,7 @@ assert versionAtLeast kernel.version "3.12";
 stdenv.mkDerivation {
   name = "perf-linux-${kernel.version}";
 
-  inherit (kernel) src makeFlags;
+  inherit (kernel) src;
 
   preConfigure = ''
     cd tools/perf
@@ -24,17 +24,21 @@ stdenv.mkDerivation {
       substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
     done
 
-    [ -f bash_completion ] && sed -i 's,^have perf,_have perf,' bash_completion
-    export makeFlags="DESTDIR=$out WERROR=0 $makeFlags"
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -DTIPDIR=\"$out/share/doc/perf-tip\""
+    if [ -f bash_completion ]; then
+      sed -i 's,^have perf,_have perf,' bash_completion
+    fi
   '';
 
+  makeFlags = ["prefix=$(out)" "WERROR=0"] ++ kernel.makeFlags;
+
   # perf refers both to newt and slang
-  nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-      flex bison libiberty libaudit makeWrapper pkgconfig python perl ];
-  buildInputs =
-    [ elfutils newt slang libunwind libbfd zlib openssl systemtap.stapBuild numactl
-    ] ++ stdenv.lib.optional withGtk gtk2;
+  nativeBuildInputs = [
+    asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
+    flex bison libiberty libaudit makeWrapper pkgconfig python perl
+  ];
+  buildInputs = [
+    elfutils newt slang libunwind libbfd zlib openssl systemtap.stapBuild numactl
+  ] ++ stdenv.lib.optional withGtk gtk2;
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.
@@ -50,7 +54,7 @@ stdenv.mkDerivation {
     ];
 
   separateDebugInfo = true;
-  installFlags = "install install-man ASCIIDOC8=1";
+  installFlags = "install install-man ASCIIDOC8=1 prefix=$(out)";
 
   preFixup = ''
     wrapProgram $out/bin/perf \
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index c4c5b7cc3b91..26f3d89c6628 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -22,5 +22,6 @@ stdenv.mkDerivation rec {
     homepage = http://horms.net/projects/kexec/kexec-tools;
     description = "Tools related to the kexec Linux feature";
     platforms = platforms.linux;
+    badPlatforms = platforms.riscv;
   };
 }
diff --git a/pkgs/os-specific/linux/kmod/aggregator.nix b/pkgs/os-specific/linux/kmod/aggregator.nix
index 9bd7c8480c1c..7d46a13f3562 100644
--- a/pkgs/os-specific/linux/kmod/aggregator.nix
+++ b/pkgs/os-specific/linux/kmod/aggregator.nix
@@ -9,6 +9,12 @@ buildEnv {
     ''
       source ${stdenv}/setup
 
+      if ! test -d "$out/lib/modules"; then
+        echo "No modules found."
+        # To support a kernel without modules
+        exit 0
+      fi
+
       kernelVersion=$(cd $out/lib/modules && ls -d *)
       if test "$(echo $kernelVersion | wc -w)" != 1; then
          echo "inconsistent kernel versions: $kernelVersion"
diff --git a/pkgs/os-specific/linux/kmscube/default.nix b/pkgs/os-specific/linux/kmscube/default.nix
index 2fb4fe93cc81..27ffaca61e71 100644
--- a/pkgs/os-specific/linux/kmscube/default.nix
+++ b/pkgs/os-specific/linux/kmscube/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, autoreconfHook, libdrm, libX11, libGL, pkgconfig }:
+{ stdenv, fetchgit, autoreconfHook, libdrm, libX11, libGL, mesa_noglu, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "kmscube-2017-03-19";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ libdrm libX11 libGL ];
+  buildInputs = [ libdrm libX11 libGL mesa_noglu ];
 
   meta = with stdenv.lib; {
     description = "Example OpenGL app using KMS/GBM";
diff --git a/pkgs/os-specific/linux/libaio/default.nix b/pkgs/os-specific/linux/libaio/default.nix
index 1e85182d6c35..e2be136adee1 100644
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   version = "0.3.110";
@@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
     sha256 = "0zjzfkwd1kdvq6zpawhzisv7qbq1ffs343i5fs9p498pcf7046g0";
   };
 
+  patches = [ (fetchpatch {
+    url = https://pagure.io/libaio/c/da47c32b2ff39e52fbed1622c34b86bc88d7c217.patch;
+    sha256 = "1kqpiswjn549s3w3m89bw5qkl7bw5pvq6gp5cdzd926ymlgivj5c";
+  }) ];
+
   makeFlags = "prefix=$(out)";
 
   hardeningDisable = stdenv.lib.optional (stdenv.isi686) "stackprotector";
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index f00d6272902d..8248a628f0ac 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -1,5 +1,4 @@
-{ stdenv, buildPackages, fetchurl, attr, perl, pam ? null }:
-assert pam != null -> stdenv.isLinux;
+{ stdenv, buildPackages, fetchurl, attr, perl, pam }:
 
 stdenv.mkDerivation rec {
   name = "libcap-${version}";
@@ -10,8 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "0qjiqc5pknaal57453nxcbz3mn1r4hkyywam41wfcglq3v2qlg39";
   };
 
-  outputs = [ "out" "dev" "lib" "man" "doc" ]
-    ++ stdenv.lib.optional (pam != null) "pam";
+  outputs = [ "out" "dev" "lib" "man" "doc" "pam" ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ perl ];
@@ -22,7 +20,7 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "lib=lib"
-    (stdenv.lib.optional (pam != null) "PAM_CAP=yes")
+    "PAM_CAP=yes"
     "BUILD_CC=$(CC_FOR_BUILD)"
     "CC:=$(CC)"
   ];
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index 541ead7258f6..59d5db52ac68 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -1,5 +1,6 @@
-{ stdenv, fetchurl, fetchpatch, pkgconfig, libsepol, pcre
+{ stdenv, fetchurl, pcre, pkgconfig, libsepol
 , enablePython ? true, swig ? null, python ? null
+, musl-fts
 }:
 
 assert enablePython -> swig != null && python != null;
@@ -8,48 +9,37 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "libselinux-${version}";
-  version = "2.4";
+  version = "2.7";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "0yqg73ns97jwjh1iyv0jr5qxb8k5sqq5ywfkx11lzfn5yj8k0126";
+    sha256 = "0mwcq78v6ngbq06xmb9dvilpg0jnl2vs9fgrpakhmmiskdvc1znh";
   };
 
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libsepol pcre ]
-             ++ optionals enablePython [ swig python ];
+             ++ optionals enablePython [ swig python ]
+             ++ optional stdenv.hostPlatform.isMusl musl-fts;
 
-  # Avoid this false warning:
-  # avc_internal.c: In function 'avc_netlink_receive':
-  # avc_internal.c:105:25: error: cast increases required alignment of target type [-Werror=cast-align]
-  #  struct nlmsghdr *nlh = (struct nlmsghdr *)buf;
-  #                         ^
+  # drop fortify here since package uses it by default, leading to compile error:
+  # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
+  hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = "-std=gnu89 -Wno-error=cast-align";
-
-  # Unreleased upstream patch that fixes Python package issue arising
-  # from recent SWIG changes.
-  patches = optional enablePython (fetchpatch {
-    name = "fix-python-swig.patch";
-    url = "https://github.com/SELinuxProject/selinux/commit/a9604c30a5e2f71007d31aa6ba41cf7b95d94822.patch";
-    sha256 = "0mjrclh0sd8m7vq0wvl6pg29ss415j3kn0266v8ixy4fprafagfp";
-    stripLen = 1;
-  });
+  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
 
   postPatch = optionalString enablePython ''
     sed -i -e 's|\$(LIBDIR)/libsepol.a|${libsepol}/lib/libsepol.a|' src/Makefile
-  ''
-  + ''
-    sed '1i#include <sys/uio.h>' -i src/setrans_client.c
   '';
 
+  # fix install locations
   preBuild = ''
-    # Build fails without this precreated
-    mkdir -p $out/include
-
     makeFlagsArray+=("PREFIX=$out")
     makeFlagsArray+=("DESTDIR=$out")
+    makeFlagsArray+=("MAN3DIR=$out/share/man/man3")
+    makeFlagsArray+=("MAN5DIR=$out/share/man/man5")
+    makeFlagsArray+=("MAN8DIR=$out/share/man/man8")
+    makeFlagsArray+=("PYSITEDIR=$out/lib/${python.libPrefix}/site-packages")
   '';
 
   installTargets = [ "install" ] ++ optional enablePython "install-pywrap";
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index c60d96bba784..45222bee6b00 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -1,25 +1,33 @@
-{ stdenv, fetchurl, bison, flex, libsepol, libselinux, ustr, bzip2, libaudit }:
+{ stdenv, fetchurl, pkgconfig, bison, flex, libsepol, libselinux, bzip2, libaudit
+, enablePython ? true, swig ? null, python ? null
+}:
+
+with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "libsemanage-${version}";
-  version = "2.4";
+  version = "2.7";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsemanage-${version}.tar.gz";
-    sha256 = "1134ka4mi4387ac5yv68bpp2y7ln5xxhwp07xhqnay0nxzjaqk0s";
+    sha256 = "0xnlp1yg8b1aqc6kq3pss1i1nl06rfj4x4pyl5blasnf2ivlgs87";
   };
 
-  nativeBuildInputs = [ bison flex ];
-  buildInputs = [ libsepol libselinux ustr bzip2 libaudit ];
-
-  NIX_CFLAGS_COMPILE = "-fstack-protector-all -std=gnu89";
+  nativeBuildInputs = [ bison flex pkgconfig ];
+  buildInputs = [ libsepol libselinux bzip2 libaudit ]
+    ++ optionals enablePython [ swig python ];
 
   preBuild = ''
     makeFlagsArray+=("PREFIX=$out")
     makeFlagsArray+=("DESTDIR=$out")
+    makeFlagsArray+=("MAN3DIR=$out/share/man/man3")
+    makeFlagsArray+=("MAN5DIR=$out/share/man/man5")
+    makeFlagsArray+=("PYSITEDIR=$out/lib/${python.libPrefix}/site-packages")
   '';
 
+  installTargets = [ "install" ] ++ optionals enablePython [ "install-pywrap" ];
+
   meta = libsepol.meta // {
     description = "Policy management tools for SELinux";
     license = stdenv.lib.licenses.lgpl21;
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index f7f393afb39d..40872f7c1ac8 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libsepol-${version}";
-  version = "2.4";
-  se_release = "20150202";
+  version = "2.7";
+  se_release = "20170804";
   se_url = "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases";
 
   src = fetchurl {
     url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "0ncnwhpc1gx4hrrb822fqkwy5h75zzngsrfkd5mlqh1jk7aib419";
+    sha256 = "1rzr90d3f1g5wy1b8sh6fgnqb9migys2zgpjmpakn6lhxkc3p7fn";
   };
 
   nativeBuildInputs = [ flex ];
@@ -16,9 +16,11 @@ stdenv.mkDerivation rec {
   preBuild = ''
     makeFlagsArray+=("PREFIX=$out")
     makeFlagsArray+=("DESTDIR=$out")
+    makeFlagsArray+=("MAN8DIR=$out/share/man/man8")
+    makeFlagsArray+=("MAN3DIR=$out/share/man/man3")
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=implicit-fallthrough" ];
+  NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
 
   passthru = { inherit se_release se_url; };
 
diff --git a/pkgs/os-specific/linux/lsscsi/default.nix b/pkgs/os-specific/linux/lsscsi/default.nix
index 833c032ccd2c..084a7e7c9a3b 100644
--- a/pkgs/os-specific/linux/lsscsi/default.nix
+++ b/pkgs/os-specific/linux/lsscsi/default.nix
@@ -1,7 +1,5 @@
 { stdenv, fetchurl }:
 
-assert stdenv.isLinux;
-
 stdenv.mkDerivation {
   name = "lsscsi-0.28";
 
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index ff6db1b41ee5..7c2233714d4c 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   version = "2.10.5";
 
   src = fetchurl {
-    url = "http://lttng.org/files/lttng-modules/lttng-modules-${version}.tar.bz2";
+    url = "https://lttng.org/files/lttng-modules/lttng-modules-${version}.tar.bz2";
     sha256 = "07rs01zwr4bmjamplix5qz1c6mb6wdawb68vyn0w6wx68ppbpnxq";
   };
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Linux kernel modules for LTTng tracing";
-    homepage = http://lttng.org/;
+    homepage = https://lttng.org/;
     license = with licenses; [ lgpl21 gpl2 mit ];
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 2e2ef610de6a..1b15edcc923c 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -1,29 +1,26 @@
 { stdenv, fetchurl, fetchpatch, autoreconfHook, pkgconfig, perl, docbook2x
-, docbook_xml_dtd_45, python3Packages
+, docbook_xml_dtd_45, python3Packages, pam
 
 # Optional Dependencies
 , libapparmor ? null, gnutls ? null, libselinux ? null, libseccomp ? null
-, cgmanager ? null, libnih ? null, dbus ? null, libcap ? null, systemd ? null
+, libcap ? null, systemd ? null
 }:
 
-let
-  enableCgmanager = cgmanager != null && libnih != null && dbus != null;
-in
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "lxc-${version}";
-  version = "2.1.1";
+  version = "3.0.0";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz";
-    sha256 = "1xpghrinxhm2072fwmn42pxhjwh7qx6cbsipw4s6g38a8mkklrk8";
+    sha256 = "12ldpkd17cy6fg7z1icr91cfs86jkkrsj61b6wdj0l7h4x624c32";
   };
 
   nativeBuildInputs = [
     autoreconfHook pkgconfig perl docbook2x python3Packages.wrapPython
   ];
   buildInputs = [
-    libapparmor gnutls libselinux libseccomp cgmanager libnih dbus libcap
+    pam libapparmor gnutls libselinux libseccomp libcap
     python3Packages.python python3Packages.setuptools systemd
   ];
 
@@ -37,15 +34,8 @@ stdenv.mkDerivation rec {
 
   XML_CATALOG_FILES = "${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml";
 
-  # FIXME
-  # glibc 2.25 moved major()/minor() to <sys/sysmacros.h>.
-  # this commit should detect this: https://github.com/lxc/lxc/pull/1388/commits/af6824fce9c9536fbcabef8d5547f6c486f55fdf
-  # However autotools checks if mkdev is still defined in <sys/types.h> runs before
-  # checking if major()/minor() is defined there. The mkdev check succeeds with
-  # a warning and the check which should set MAJOR_IN_SYSMACROS is skipped.
-  NIX_CFLAGS_COMPILE = [ "-DMAJOR_IN_SYSMACROS" ];
-
   configureFlags = [
+    "--enable-pam"
     "--localstatedir=/var"
     "--sysconfdir=/etc"
     "--disable-api-docs"
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
index 4f62b7eb128a..6f7dd2f56ff7 100644
--- a/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/pkgs/os-specific/linux/lxcfs/default.nix
@@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, help2man, fuse, pam
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, help2man, fuse
 , enableDebugBuild ? false }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "lxcfs-2.0.8";
+  name = "lxcfs-3.0.0";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxcfs";
     rev = name;
-    sha256 = "04dzn6snqgw0znf7a7qdm64400jirip6q8amcx5fmz4705qdqahc";
+    sha256 = "0fsy2h7b5dkzvfm6m8vqzhnji42cszdn0b3ndnaxiwv3402ccmvk";
   };
 
   nativeBuildInputs = [ pkgconfig help2man autoreconfHook ];
-  buildInputs = [ fuse pam ];
+  buildInputs = [ fuse ];
 
   preConfigure = stdenv.lib.optionalString enableDebugBuild ''
     sed -i 's,#AM_CFLAGS += -DDEBUG,AM_CFLAGS += -DDEBUG,' Makefile.am
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index ac176c7d3b36..4ebc1c00f7af 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "mcelog-${version}";
-  version = "154";
+  version = "157";
 
   src = fetchFromGitHub {
     owner  = "andikleen";
     repo   = "mcelog";
     rev    = "v${version}";
-    sha256 = "0vq7r3zknr62rmi9g0zd7mmxframm79vmrdw029pc7z6wrlv40cy";
+    sha256 = "1965axyfizv2jg412a4wrrghgswwvvgymk7mbwaraw3xl9p21wgv";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index 85a65b8f824d..b6fdae75bac2 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -1,10 +1,19 @@
-{ stdenv
+{ stdenv, writeScript
 , fetchurl, groff
 , buildPlatform, hostPlatform
 }:
 
-assert stdenv.isLinux;
+let
+  sendmail-script = writeScript "sendmail-script" ''
+    #!/bin/sh
 
+    if [ -x /run/wrappers/bin/sendmail ]; then
+      /run/wrappers/bin/sendmail "$@"
+    else
+      /run/current-system/sw/bin/sendmail "$@"
+    fi
+  '';
+in
 stdenv.mkDerivation rec {
   name = "mdadm-4.0";
 
@@ -15,7 +24,7 @@ stdenv.mkDerivation rec {
 
   # This is to avoid self-references, which causes the initrd to explode
   # in size and in turn prevents mdraid systems from booting.
-  allowedReferences = [ stdenv.cc.libc.out ];
+  allowedReferences = [ stdenv.cc.libc.out sendmail-script ];
 
   patches = [ ./no-self-references.patch ];
 
@@ -32,7 +41,7 @@ stdenv.mkDerivation rec {
   preConfigure = ''
     sed -e 's@/lib/udev@''${out}/lib/udev@' \
         -e 's@ -Werror @ @' \
-        -e 's@/usr/sbin/sendmail@/run/wrappers/bin/sendmail@' -i Makefile
+        -e 's@/usr/sbin/sendmail@${sendmail-script}@' -i Makefile
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index 97843b2253fc..857a3b580a8e 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "microcode-intel-${version}";
-  version = "20171117";
+  version = "20180312";
 
   src = fetchurl {
-    url = "https://downloadmirror.intel.com/27337/eng/microcode-${version}.tgz";
-    sha256 = "1p14ypbg28bdkbza6dx6dpjrdr5p13vmgrh2cw0y1v2qzalivgck";
+    url = "https://downloadmirror.intel.com/27591/eng/microcode-${version}.tgz";
+    sha256 = "0yg7q5blcqgq8jyjxhn9n48rxws77ylqzyn4kn10l6yzwan1yf0b";
   };
 
   buildInputs = [ libarchive ];
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 0f8f088945aa..3d515f7b762f 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -17,6 +17,16 @@ let
     sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
   };
 
+  # iconv tool, implemented by musl author.
+  # Original: http://git.etalabs.net/cgit/noxcuse/plain/src/iconv.c?id=02d288d89683e99fd18fe9f54d4e731a6c474a4f
+  # We use copy from Alpine which fixes error messages, see:
+  # https://git.alpinelinux.org/cgit/aports/commit/main/musl/iconv.c?id=a3d97e95f766c9c378194ee49361b375f093b26f
+  iconv_c = fetchurl {
+    name = "iconv.c";
+    url = "https://git.alpinelinux.org/cgit/aports/plain/main/musl/iconv.c?id=a3d97e95f766c9c378194ee49361b375f093b26f";
+    sha256 = "1mzxnc2ncq8lw9x6n7p00fvfklc9p3wfv28m68j0dfz5l8q2k6pp";
+  };
+
 in
 stdenv.mkDerivation rec {
   name    = "musl-${version}";
@@ -33,6 +43,21 @@ stdenv.mkDerivation rec {
   # so musl can selectively disable as needed
   hardeningDisable = [ "stackprotector" ];
 
+  # Leave these, be friendlier to debuggers/perf tools
+  # Don't force them on, but don't force off either
+  postPatch = ''
+    substituteInPlace configure \
+      --replace -fno-unwind-tables "" \
+      --replace -fno-asynchronous-unwind-tables ""
+  '';
+
+  patches = [
+    # Minor touchup to build system making dynamic linker symlink relative
+    (fetchurl {
+      url = https://raw.githubusercontent.com/openwrt/openwrt/87606e25afac6776d1bbc67ed284434ec5a832b4/toolchain/musl/patches/300-relative.patch;
+      sha256 = "0hfadrycb60sm6hb6by4ycgaqc9sgrhh42k39v8xpmcvdzxrsq2n";
+    })
+  ];
   preConfigure = ''
     configureFlagsArray+=("--syslibdir=$out/lib")
   '';
@@ -40,26 +65,45 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--enable-shared"
     "--enable-static"
+    "--enable-debug"
     "CFLAGS=-fstack-protector-strong"
-    # Fix cycle between outputs
-    "--disable-wrapper"
+    "--enable-wrapper=all"
   ];
 
   outputs = [ "out" "dev" ];
 
   dontDisableStatic = true;
-  dontStrip = true;
+  separateDebugInfo = true;
 
-  postInstall =
-  ''
+  NIX_DONT_SET_RPATH = true;
+
+  postInstall = ''
     # Not sure why, but link in all but scsi directory as that's what uclibc/glibc do.
     # Apparently glibc provides scsi itself?
     (cd $dev/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
-  '' +
-  ''
+
+    # Strip debug out of the static library
+    $STRIP -S $out/lib/libc.a
     mkdir -p $out/bin
+
     # Create 'ldd' symlink, builtin
-    ln -s $out/lib/libc.so $out/bin/ldd
+    ln -rs $out/lib/libc.so $out/bin/ldd
+
+    # (impure) cc wrapper around musl for interactive usuage
+    for i in musl-gcc musl-clang ld.musl-clang; do
+      moveToOutput bin/$i $dev
+    done
+    moveToOutput lib/musl-gcc.specs $dev
+    substituteInPlace $dev/bin/musl-gcc \
+      --replace $out/lib/musl-gcc.specs $dev/lib/musl-gcc.specs
+
+    # provide 'iconv' utility, using just-built headers, libc/ldso
+    $CC ${iconv_c} -o $out/bin/iconv \
+      -I$dev/include \
+      -L$out/lib -Wl,-rpath=$out/lib \
+      -lc \
+      -B $out/lib \
+      -Wl,-dynamic-linker=$(ls $out/lib/ld-*)
   '' + lib.optionalString useBSDCompatHeaders ''
     install -D ${queue_h} $dev/include/sys/queue.h
     install -D ${cdefs_h} $dev/include/sys/cdefs.h
diff --git a/pkgs/os-specific/linux/musl/fts-setup-hook.sh b/pkgs/os-specific/linux/musl/fts-setup-hook.sh
new file mode 100644
index 000000000000..3962dcb19a20
--- /dev/null
+++ b/pkgs/os-specific/linux/musl/fts-setup-hook.sh
@@ -0,0 +1,17 @@
+ftsLdflags() {
+    # The `depHostOffset` describes how the host platform of the dependencies
+    # are slid relative to the depending package. It is brought into scope of
+    # the environment hook defined as the role of the dependency being applied.
+    case $depHostOffset in
+        -1) local role='BUILD_' ;;
+        0)  local role='' ;;
+        1)  local role='TARGET_' ;;
+        *)  echo "cc-wrapper: Error: Cannot be used with $depHostOffset-offset deps" >2;
+            return 1 ;;
+    esac
+
+    export NIX_${role}LDFLAGS+=" -lfts"
+}
+
+addEnvHooks "$hostOffset" ftsLdflags
+
diff --git a/pkgs/os-specific/linux/musl/fts.nix b/pkgs/os-specific/linux/musl/fts.nix
index 083541e5e935..0f16e8cc79bf 100644
--- a/pkgs/os-specific/linux/musl/fts.nix
+++ b/pkgs/os-specific/linux/musl/fts.nix
@@ -11,4 +11,6 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
+
+  setupHook = ./fts-setup-hook.sh;
 }
diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index e2abbd7335ee..72095bc8cdab 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -5,9 +5,6 @@ with stdenv.lib;
 # The Magewell Pro Capture drivers are not supported for kernels older than 3.2
 assert versionAtLeast kernel.version "3.2.0";
 
-# this package currently only supports x86 and x86_64, as I have no ARM device to test on
-assert (stdenv.system == "x86_64-linux") || (stdenv.system == "i686-linux");
-
 let
   bits =
   if stdenv.is64bit then "64"
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 7edc7b58c6c3..be52cbc2029d 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -2,11 +2,12 @@
 , flex, bison, libmnl, libnftnl, gmp, readline }:
 
 stdenv.mkDerivation rec {
-  name = "nftables-0.8.2";
+  version = "0.8.3";
+  name = "nftables-${version}";
 
   src = fetchurl {
     url = "http://netfilter.org/projects/nftables/files/${name}.tar.bz2";
-    sha256 = "1v370wzh3fzby0cdb9iykkhdj1yjcp5qkp33xyn7w7pii2phlpv7";
+    sha256 = "0f2yv7as1ybkfvn75f72x0z9y1ydibw4s3hbzhlmvsc8vgsy2syi";
   };
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/nmon/default.nix b/pkgs/os-specific/linux/nmon/default.nix
new file mode 100644
index 000000000000..ae6abeb1f56f
--- /dev/null
+++ b/pkgs/os-specific/linux/nmon/default.nix
@@ -0,0 +1,27 @@
+{ fetchurl, stdenv, ncurses }:
+
+stdenv.mkDerivation rec {
+  name = "nmon-${version}";
+  version = "16g";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/nmon/lmon${version}.c";
+    sha256 = "127n8xvmg7byp42sm924mdr7hd3bsfsxpryzahl0cfsh7dlxv0ns";
+  };
+
+  buildInputs = [ ncurses ];
+  unpackPhase = ":";
+  buildPhase = "cc -o nmon ${src} -g -O2 -D JFS -D GETUSER -Wall -D LARGEMEM -lncurses -lm -g -D X86";
+  installPhase = ''
+    mkdir -p $out/bin
+    cp nmon $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "AIX & Linux Performance Monitoring tool";
+    homepage = "http://nmon.sourceforge.net";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ sveitser ];
+  };
+}
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh b/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
deleted file mode 100755
index 5d47df9a87a7..000000000000
--- a/pkgs/os-specific/linux/nvidia-x11/builder-legacy173.sh
+++ /dev/null
@@ -1,99 +0,0 @@
-source $stdenv/setup
-
-dontPatchELF=1 # must keep libXv, $out in RPATH
-
-
-unpackFile() {
-    sh $src -x
-}
-
-
-buildPhase() {
-    if test -z "$libsOnly"; then
-        echo "Building linux driver against kernel: " $kernel;
-
-        cd usr/src/nv/
-
-        shopt -s nullglob
-
-        for a in $kpatches; do
-          patch -p1 < $a
-        done
-
-        # Workaround: get it to build on kernels that have CONFIG_XEN
-        # set.  Disable the test, apply a patch to disable the Xen
-        # functionality.
-        
-        #substituteInPlace Makefile.kbuild --replace xen_sanity_check fnord
-        #patch -p1 < $xenPatch
-
-        # Create the module.
-        kernelVersion=$(cd $kernel/lib/modules && ls)
-        sysSource=$(echo $kernel/lib/modules/$kernelVersion/source)
-        sysOut=$(echo $kernel/lib/modules/$kernelVersion/build)
-        unset src # used by the nv makefile
-        make SYSSRC=$sysSource SYSOUT=$sysOut module
-        cd ../../..
-    fi
-}
-
-
-installPhase() {
-
-    # Install libGL and friends.
-    mkdir -p $out/lib
-    cp -prd usr/lib/* usr/X11R6/lib/libXv* $out/lib/
-
-    ln -snf libGLcore.so.$versionNumber $out/lib/libGLcore.so
-    ln -snf libGLcore.so.$versionNumber $out/lib/libGLcore.so.1
-    ln -snf libGL.so.$versionNumber $out/lib/libGL.so
-    ln -snf libGL.so.$versionNumber $out/lib/libGL.so.1
-    ln -snf libnvidia-cfg.so.$versionNumber $out/lib/libnvidia-cfg.so.1
-    ln -snf libnvidia-tls.so.$versionNumber $out/lib/libnvidia-tls.so.1
-    ln -snf libnvidia-tls.so.$versionNumber $out/lib/tls/libnvidia-tls.so.1
-    ln -snf libXvMCNVIDIA.so.$versionNumber $out/lib/libXvMCNVIDIA_dynamic.so.1
-    ln -snf libcuda.so.$versionNumber $out/lib/libcuda.so.1
-
-    patchelf --set-rpath $out/lib:$glPath $out/lib/libGL.so.*.*
-    patchelf --set-rpath $out/lib:$glPath $out/lib/libXvMCNVIDIA.so.*.*
-    set +e
-    # Legacy nvidia doesn't have cuda
-    patchelf --set-rpath $cudaPath $out/lib/libcuda.so.*.*
-    set -e
-    
-    if test -z "$libsOnly"; then
-        
-        # Install the kernel module.
-        mkdir -p $out/lib/modules/$kernelVersion/misc
-        cp usr/src/nv/nvidia.ko $out/lib/modules/$kernelVersion/misc
-
-        # Install the X driver.
-        mkdir -p $out/lib/xorg/modules
-        cp -prd usr/X11R6/lib/modules/* $out/lib/xorg/modules/
-
-        ln -snf libnvidia-wfb.so.$versionNumber $out/lib/xorg/modules/libnvidia-wfb.so.1
-        ln -snf libglx.so.$versionNumber $out/lib/xorg/modules/extensions/libglx.so
-
-        patchelf --set-rpath $out/lib $out/lib/xorg/modules/extensions/libglx.so.*.*
-
-        # Install the programs.
-        mkdir -p $out/bin
-
-        for i in nvidia-settings nvidia-xconfig; do
-	    cp usr/bin/$i $out/bin/$i
-	    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-	        --set-rpath $out/lib:$programPath:$glPath $out/bin/$i
-        done
-    
-        # Header files etc.
-        cp -prd usr/include usr/share $out
-
-        # Patch the `nvidia-settings.desktop' file.
-        substituteInPlace $out/share/applications/nvidia-settings.desktop \
-            --replace '__UTILS_PATH__' $out/bin \
-            --replace '__PIXMAP_PATH__' $out/share/pixmaps
-    fi
-}
-
-
-genericBuild
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index d0348bd67d45..11a97d420a83 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -17,11 +17,13 @@ in
 rec {
   # Policy: use the highest stable version as the default (on our master).
   stable = generic {
-    version = "390.25";
-    sha256_32bit = "0fkbpx01l46pprrd4nlc2y6hfmkb55ddlwm1r84kr6j08qmmb0qi";
-    sha256_64bit = "0whsls1mm6vkll5qmxnyz8vjgspp1rmqpsampgi83k62n514c08r";
-    settingsSha256 = "1jhbr68z36s3fr9vx3ga2f6yrzlwpc0j5mw8h12g65p7wdsbk6y7";
-    persistencedSha256 = "033azbhi50f1b0lw759sncgf7ckh2m2c0khj5v15sch9kl1fzk8i";
+    version = "390.48";
+    sha256_32bit = "1y6n2hfz9vd0h7gd31fgxcl76s5pjf8afwqyq5slqpcxpd78j5ai";
+    sha256_64bit = "16a3blvizcksmaxr644s857yanw3i3vcvqvn7qnwbsbqpmxga09c";
+    settingsSha256 = "058xaiw5g0kxrvc3lvy4424fqbjkvmsznj2v73cgbm25i1m83krl";
+    persistencedSha256 = "0y86bhzl42lqyrbibqzf8a8yd49zbq3ryb78vgsl13i44f9sl79k";
+
+    patches = [ ./fix_missing_symbol.patch ];
   };
 
   beta = stable; # not enough interest to maintain beta ATM
@@ -46,12 +48,13 @@ rec {
     persistencedSha256 = null;
     useGLVND = false;
     useProfiles = false;
+    settings32Bit = true;
 
     prePatch = let
       debPatches = fetchurl {
         url = "mirror://debian/pool/non-free/n/nvidia-graphics-drivers-legacy-304xx/"
-            + "nvidia-graphics-drivers-legacy-304xx_304.135-2.debian.tar.xz";
-        sha256 = "0mhji0ssn7075q5a650idigs48kzf11pzj2ca2n07rwxg3vj6pdr";
+            + "nvidia-graphics-drivers-legacy-304xx_304.137-5.debian.tar.xz";
+        sha256 = "0n8512mfcnvklfbg8gv4lzbkm3z6nncwj6ix2b8ngdkmc04f3b6l";
       };
       prefix = "debian/module/debian/patches";
       applyPatches = pnames: if pnames == [] then null else
@@ -63,6 +66,4 @@ rec {
     in applyPatches [ "fix-typos" ];
     patches = maybePatch_drm_legacy;
   };
-
-  legacy_173 = callPackage ./legacy173.nix { };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch b/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch
new file mode 100644
index 000000000000..ea783b4f011e
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/fix_missing_symbol.patch
@@ -0,0 +1,19 @@
+https://devtalk.nvidia.com/default/topic/1030082/linux/kernel-4-16-rc1-breaks-latest-drivers-unknown-symbol-swiotlb_map_sg_attrs-/
+--- a/kernel/common/inc/nv-linux.h~     2018-01-25 06:09:41.000000000 +0100
++++ b/kernel/common/inc/nv-linux.h      2018-03-05 13:58:17.746725638 +0100
+@@ -1209,6 +1209,7 @@ static inline NvU32 nv_alloc_init_flags(
+ static inline NvBool nv_dma_maps_swiotlb(struct pci_dev *dev)
+ {
+     NvBool swiotlb_in_use = NV_FALSE;
++#if 0
+ #if defined(CONFIG_SWIOTLB)
+   #if defined(NV_DMA_OPS_PRESENT) || defined(NV_GET_DMA_OPS_PRESENT)
+     /*
+@@ -1251,7 +1252,7 @@ static inline NvBool nv_dma_maps_swiotlb
+     swiotlb_in_use = (swiotlb == 1);
+   #endif
+ #endif
+-
++#endif
+     return swiotlb_in_use;
+ }
diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index bde8ad361dcd..13e5d1b76ea6 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -6,6 +6,7 @@
 , useGLVND ? true
 , useProfiles ? true
 , preferGtk2 ? false
+, settings32Bit ? false
 
 , prePatch ? ""
 , patches ? []
@@ -68,7 +69,7 @@ let
     disallowedReferences = optional (!libsOnly) [ kernel.dev ];
 
     passthru = {
-      settings = callPackage (import ./settings.nix self settingsSha256) {
+      settings = (if settings32Bit then callPackage_i686 else callPackage) (import ./settings.nix self settingsSha256) {
         withGtk2 = preferGtk2;
         withGtk3 = !preferGtk2;
       };
@@ -79,7 +80,7 @@ let
       homepage = http://www.nvidia.com/object/unix.html;
       description = "X.org driver and kernel module for NVIDIA graphics cards";
       license = licenses.unfreeRedistributable;
-      platforms = platforms.linux;
+      platforms = [ "i686-linux" "x86_64-linux" ];
       maintainers = [ maintainers.vcunat ];
       priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
     };
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy173.nix b/pkgs/os-specific/linux/nvidia-x11/legacy173.nix
deleted file mode 100644
index 51a230974c86..000000000000
--- a/pkgs/os-specific/linux/nvidia-x11/legacy173.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{stdenv, fetchurl, kernel, xorg, zlib, gtk2, atk, pango, glib, gdk_pixbuf}:
-
-let
-
-  versionNumber = "173.14.39";
-
-in
-
-stdenv.mkDerivation {
-  name = "nvidia-x11-${versionNumber}-${kernel.version}";
-
-  builder = ./builder-legacy173.sh;
-
-  src =
-    if stdenv.system == "i686-linux" then
-      fetchurl {
-        url = "https://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}-pkg0.run";
-        sha256 = "08xb7s7cxmj4zv4i3645kjhlhhwxiq6km9ixmsw3vv91f7rkb6d0";
-      }
-    else if stdenv.system == "x86_64-linux" then
-      fetchurl {
-        url = "https://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-pkg0.run";
-        sha256 = "1p2ls0xj81l8v4n6dbjj3p5wlw1iyhgzyvqcv4h5fdxhhs2cb3md";
-      }
-    else throw "nvidia-x11 does not support platform ${stdenv.system}";
-
-  kernel = kernel.dev;
-
-  hardeningDisable = [ "pic" "format" ];
-
-  inherit versionNumber;
-
-  dontStrip = true;
-
-  glPath = stdenv.lib.makeLibraryPath [xorg.libXext xorg.libX11 xorg.libXrandr];
-
-  cudaPath = stdenv.lib.makeLibraryPath [zlib stdenv.cc.cc];
-
-  programPath = stdenv.lib.makeLibraryPath [ gtk2 atk pango glib gdk_pixbuf xorg.libXv ];
-
-  passthru = {
-    settings = null;
-    persistenced = null;
-    useGLVND = false;
-    useProfiles = false;
-  };
-
-  meta = {
-    homepage = http://www.nvidia.com/object/unix.html;
-    description = "X.org driver and kernel module for Legacy NVIDIA graphics cards";
-    license = stdenv.lib.licenses.unfree;
-  };
-}
diff --git a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
index 22fd12427005..21e6cb5d500b 100644
--- a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.nvidia.com/object/unix.html;
     description = "Settings application for NVIDIA graphics cards";
     license = licenses.unfreeRedistributable;
-    platforms = platforms.linux;
+    platforms = nvidia_x11.meta.platforms;
     maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/settings.nix b/pkgs/os-specific/linux/nvidia-x11/settings.nix
index bbe3af5d0169..e2ef51da3803 100644
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -1,6 +1,6 @@
 nvidia_x11: sha256:
 
-{ stdenv, lib, fetchurl, pkgconfig, m4, jansson, gtk2, dbus, gtk3, libXv, libXrandr, libvdpau, libXext
+{ stdenv, lib, fetchurl, pkgconfig, m4, jansson, gtk2, dbus, gtk3, libXv, libXrandr, libXext, libXxf86vm, libvdpau
 , librsvg, wrapGAppsHook
 , withGtk2 ? false, withGtk3 ? true
 }:
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig m4 ];
 
-  buildInputs = [ jansson libXv libXrandr libvdpau nvidia_x11 gtk2 dbus libXv ]
+  buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 gtk2 dbus ]
              ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
 
   makeFlags = [ "NV_USE_BUNDLED_LIBJANSSON=0" ];
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
     homepage = http://www.nvidia.com/object/unix.html;
     description = "Settings application for NVIDIA graphics cards";
     license = licenses.unfreeRedistributable;
-    platforms = platforms.linux;
+    platforms = nvidia_x11.meta.platforms;
     maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/os-specific/linux/nvidiabl/default.nix b/pkgs/os-specific/linux/nvidiabl/default.nix
index 6f9af040b8a3..02161f7133ce 100644
--- a/pkgs/os-specific/linux/nvidiabl/default.nix
+++ b/pkgs/os-specific/linux/nvidiabl/default.nix
@@ -2,18 +2,19 @@
 
 stdenv.mkDerivation rec {
   name = "nvidiabl-${version}-${kernel.version}";
-  version = "0.87";
+  version = "2017-09-26";
 
+  # We use a fork which adds support for newer kernels -- upstream has been abandoned.
   src = fetchFromGitHub {
-    owner = "guillaumezin";
+    owner = "yorickvP";
     repo = "nvidiabl";
-    rev = "v${version}";
-    sha256 = "1hs61dxn84vsyvrd2s899dhgg342mhfkbdn1nkhcvly45hdp2nca";
+    rev = "2d909f4dfceb24ce98479fd571411c6ec3b71bea";
+    sha256 = "0dsar8fsaxwywjh6rbrxkhdp142vqjnsyxfz6bgpbqml6slpiqs1";
   };
 
   hardeningDisable = [ "pic" ];
 
-  patches = [ ./linux4compat.patch ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   preConfigure = ''
     sed -i 's|/sbin/depmod|#/sbin/depmod|' Makefile
@@ -25,11 +26,11 @@ stdenv.mkDerivation rec {
     "KVER=${kernel.modDirVersion}"
   ];
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Linux driver for setting the backlight brightness on laptops using NVIDIA GPU";
     homepage = https://github.com/guillaumezin/nvidiabl;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
-    broken = !stdenv.lib.versionOlder kernel.version "4.9";
+    license = licenses.gpl2;
+    platforms = [ "x86_64-linux" "i686-linux" ];
+    maintainers = with maintainers; [ yorickvp ];
   };
 }
diff --git a/pkgs/os-specific/linux/nvidiabl/linux4compat.patch b/pkgs/os-specific/linux/nvidiabl/linux4compat.patch
deleted file mode 100644
index ad8236a2b630..000000000000
--- a/pkgs/os-specific/linux/nvidiabl/linux4compat.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 2bf6f08b2492cc04a2c39fdcb22a2d0c18963d1c Mon Sep 17 00:00:00 2001
-From: sonic414 <sonic414@gmail.com>
-Date: Tue, 28 Apr 2015 19:30:15 +0530
-Subject: [PATCH] strnicmp to strncasecmp in Linux 4.0.0
-
----
- nvidiabl-module.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/nvidiabl-module.c b/nvidiabl-module.c
-index b789ea4..b306579 100644
---- a/nvidiabl-module.c
-+++ b/nvidiabl-module.c
-@@ -214,7 +214,7 @@ static int __init nvidiabl_init(void)
- #if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,39)
- 	
- 	for (iii = 0 ; iii < sizeof(backlight_type_ids) ; iii++) {
--		if (strnicmp(bl_type, backlight_type_ids[iii].id, sizeof(bl_type)) == 0) {
-+		if (strncasecmp(bl_type, backlight_type_ids[iii].id, sizeof(bl_type)) == 0) {
- 			props.type = backlight_type_ids[iii].type;
- 			printk(KERN_INFO "nvidiabl: backlight type is %s\n", backlight_type_ids[iii].id);
- 		}
diff --git a/pkgs/os-specific/linux/open-isns/default.nix b/pkgs/os-specific/linux/open-isns/default.nix
index 36cbd1581a6b..c8b404c6be7f 100644
--- a/pkgs/os-specific/linux/open-isns/default.nix
+++ b/pkgs/os-specific/linux/open-isns/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "open-isns-${version}";
-  version = "0.97";
+  version = "0.98";
 
   src = fetchFromGitHub {
     owner = "gonzoleeman";
     repo = "open-isns";
     rev = "v${version}";
-    sha256 = "17aichjgkwjfp9dx1piw7dw8ddz1bgm5mk3laid2zvjks1h739k3";
+    sha256 = "055gjwz5hxaj5jk23bf7dy9wbxk9m8cfgl1msbzjc60gr2mmcbdg";
   };
 
   propagatedBuildInputs = [ openssl ];
diff --git a/pkgs/os-specific/linux/pam_krb5/default.nix b/pkgs/os-specific/linux/pam_krb5/default.nix
index 3f8c3c28f317..76dbbf1e1be4 100644
--- a/pkgs/os-specific/linux/pam_krb5/default.nix
+++ b/pkgs/os-specific/linux/pam_krb5/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pam, kerberos }:
 
 stdenv.mkDerivation rec {
-  name = "pam-krb5-4.7";
+  name = "pam-krb5-4.8";
 
   src = fetchurl {
     url = "http://archives.eyrie.org/software/kerberos/${name}.tar.gz";
-    sha256 = "04klg9a2rhdz0a2dw4f0ybcm28vcbab6lrynwq7rm4sn0hnzakwv";
+    sha256 = "0j96jfaxzkj1ifc3qxagjmaxvgda7ndqaaxx2ka018is9f5lbfrs";
   };
 
   buildInputs = [ pam kerberos ];
diff --git a/pkgs/os-specific/linux/pam_u2f/default.nix b/pkgs/os-specific/linux/pam_u2f/default.nix
index f58dadfd10ce..5cc235c3104a 100644
--- a/pkgs/os-specific/linux/pam_u2f/default.nix
+++ b/pkgs/os-specific/linux/pam_u2f/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name    = "pam_u2f-${version}";
-  version = "1.0.4";
+  version = "1.0.6";
 
   src     = fetchurl {
     url = "https://developers.yubico.com/pam-u2f/Releases/${name}.tar.gz";
-    sha256 = "189j0wgx6fs146vfp88djqpl1flpfb3962l1a2marlp6d12jwm3i";
+    sha256 = "0fpdb49596zywnbx1cfcx1k83rbs1ylhi1cnn25pq9d3b92hj50h";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/pcm/default.nix b/pkgs/os-specific/linux/pcm/default.nix
new file mode 100644
index 000000000000..43810210a88b
--- /dev/null
+++ b/pkgs/os-specific/linux/pcm/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  version = "201710";
+  name = "pcm-${version}";
+
+  src = fetchFromGitHub {
+    owner = "opcm";
+    repo = "pcm";
+    rev = "${version}";
+    sha256 = "02rq8739zwwbfrhagvcgf6qpmnswxl9b0qsld26rg6zp91v2npbj";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp pcm*.x $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Processor counter monitor";
+    homepage = https://www.intel.com/software/pcm;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ roosemberth ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/pcmciautils/default.nix b/pkgs/os-specific/linux/pcmciautils/default.nix
index 8a5171824d0d..93e2c097ff74 100644
--- a/pkgs/os-specific/linux/pcmciautils/default.nix
+++ b/pkgs/os-specific/linux/pcmciautils/default.nix
@@ -8,11 +8,11 @@
 
 # FIXME: should add an option to choose between hotplug and udev.
 stdenv.mkDerivation rec {
-  name = "pcmciautils-017";
+  name = "pcmciautils-018";
 
   src = fetchurl {
     url = "https://kernel.org/pub/linux/utils/kernel/pcmcia/${name}.tar.gz";
-    sha256 = "5d8e2efad8a7f692129610603da232f2144851753d8d49a70eeb8eb1be6f6bc3";
+    sha256 = "0sfm3w2n73kl5w7gb1m6q8gy5k4rgwvzz79n6yhs9w3sag3ix8sk";
   };
 
   buildInputs = [udev yacc sysfsutils kmod flex];
diff --git a/pkgs/os-specific/linux/phc-intel/default.nix b/pkgs/os-specific/linux/phc-intel/default.nix
index 81db8a9f26d0..68acbb83531e 100644
--- a/pkgs/os-specific/linux/phc-intel/default.nix
+++ b/pkgs/os-specific/linux/phc-intel/default.nix
@@ -1,19 +1,18 @@
 { stdenv, fetchurl, kernel, which }:
 
-assert stdenv.isLinux;
 # Don't bother with older versions, though some might even work:
 assert stdenv.lib.versionAtLeast kernel.version "4.10";
 
 let
   release = "0.4.0";
-  revbump = "rev24"; # don't forget to change forum download id...
+  revbump = "rev25"; # don't forget to change forum download id...
 in stdenv.mkDerivation rec {
   name = "linux-phc-intel-${version}-${kernel.version}";
   version = "${release}-${revbump}";
 
   src = fetchurl {
-    sha256 = "02b4j8ap1fy09z36pmpplbw4vpwqdi16jyzw5kl0a60ydgxkmrpz";
-    url = "http://www.linux-phc.org/forum/download/file.php?id=178";
+    sha256 = "1w91hpphd8i0br7g5qra26jdydqar45zqwq6jq8yyz6l0vb10zlz";
+    url = "http://www.linux-phc.org/forum/download/file.php?id=194";
     name = "phc-intel-pack-${revbump}.tar.bz2";
   };
 
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index 536c69ff5573..a7cac46ae6a0 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -1,68 +1,36 @@
-{ stdenv, fetchurl, pythonPackages, gettext
-, setools, libsepol, libselinux, libcap_ng, libsemanage, sepolgen
-}:
+{ stdenv, fetchurl, gettext, libsepol, libselinux, libsemanage }:
 
 stdenv.mkDerivation rec {
   name = "policycoreutils-${version}";
-  version = "2.4";
+  version = "2.7";
   inherit (libsepol) se_release se_url;
 
   src = fetchurl {
     url = "${se_url}/${se_release}/policycoreutils-${version}.tar.gz";
-    sha256 = "0y9l9k60iy21hj0lcvfdfxs1fxydg6d3pxp9rhy7hwr4y5vgh6dq";
+    sha256 = "1x742c7lkw30namhkw87yg7z384qzqjz0pvmqs0lk19v6958l6qa";
   };
 
-  patches = [ ./fix-printf-type.patch ];
-
   postPatch = ''
-    # Fix references to libsepol.a
-    find . -name Makefile -exec sed -i 's,[^ ]*/libsepol.a,${libsepol}/lib/libsepol.a,g' {} \;
-
     # Fix install references
-    substituteInPlace po/Makefile --replace /usr/bin/install install
-
-    # Fix references to /usr/share
-    grep -r '/usr/share' | awk -F: '{print $1}' | xargs sed -i "s,\(\$(DESTDIR)\)*/usr/share,$out/share,g"
-
-    # Fix sepolicy install
-    sed -i "s,\(setup.py install\).*,\1 --prefix=$out,g" sepolicy/Makefile
-
-    # Fix setuid install
-    sed -i 's|-m 4755|-m 755|' sandbox/Makefile
+    substituteInPlace po/Makefile \
+       --replace /usr/bin/install install --replace /usr/share /share
+    substituteInPlace newrole/Makefile --replace /usr/share /share
   '';
 
-  nativeBuildInputs = [ pythonPackages.python gettext ];
-  buildInputs = [ setools libsepol libselinux libcap_ng libsemanage ];
-  pythonPath = [ libselinux sepolgen ];
+  nativeBuildInputs = [ gettext ];
+  buildInputs = [ libsepol libselinux libsemanage ];
 
   preBuild = ''
     makeFlagsArray+=("PREFIX=$out")
     makeFlagsArray+=("DESTDIR=$out")
+    makeFlagsArray+=("BASHCOMPLETIONDIR=$out/share/bash-completion/completions")
+    makeFlagsArray+=("LOCALEDIR=$out/share/locale")
+    makeFlagsArray+=("MAN5DIR=$out/share/man/man5")
   '';
 
-  # Creation of the system-config-selinux directory is broken
-  preInstall = ''
-    mkdir -p $out/share/system-config-selinux
-  '';
-
-  # Fix the python scripts to include paths to libraries
-  # NOTE: We are not using wrapPythonPrograms or makeWrapper as these scripts
-  # purge the environment as a security measure
-  postInstall = ''
-    grep -r '#!.*python' $out/bin | awk -F: '{print $1}' | xargs sed -i "1a \
-    import sys; \
-    sys.path.append('$(toPythonPath "$out")'); \
-    ${stdenv.lib.flip stdenv.lib.concatMapStrings pythonPath (lib: ''
-      sys.path.append('$(toPythonPath "${lib}")'); \
-    '')}"
-  '';
-
-  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
-
   meta = with stdenv.lib; {
     description = "SELinux policy core utilities";
     license = licenses.gpl2;
     inherit (libsepol.meta) homepage platforms maintainers;
   };
 }
-
diff --git a/pkgs/os-specific/linux/policycoreutils/fix-printf-type.patch b/pkgs/os-specific/linux/policycoreutils/fix-printf-type.patch
deleted file mode 100644
index 6ab2d6dccc73..000000000000
--- a/pkgs/os-specific/linux/policycoreutils/fix-printf-type.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Nru policycoreutils-2.4/setfiles/restore.c policycoreutils-2.4.new/setfiles/restore.c
---- policycoreutils-2.4/setfiles/restore.c	2015-02-02 09:38:10.000000000 -0500
-+++ policycoreutils-2.4.new/setfiles/restore.c	2015-08-29 20:44:13.693023222 -0400
-@@ -118,7 +118,7 @@
- 		r_opts->count++;
- 		if (r_opts->count % STAR_COUNT == 0) {
- 			if (r_opts->progress == 1) {
--				fprintf(stdout, "\r%luk", (size_t) r_opts->count / STAR_COUNT );
-+				fprintf(stdout, "\r%zuk", (size_t) r_opts->count / STAR_COUNT );
- 			} else {
- 				if (r_opts->nfile > 0) {
- 					progress = (r_opts->count < r_opts->nfile) ? (100.0 * r_opts->count / r_opts->nfile) : 100;
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 7679262a9899..5ec708dd69fd 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext, libnl, ncurses, pciutils, pkgconfig, zlib }:
+{ stdenv, fetchurl, fetchpatch, gettext, libnl, ncurses, pciutils, pkgconfig, zlib }:
 
 stdenv.mkDerivation rec {
   name = "powertop-${version}";
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ gettext libnl ncurses pciutils zlib ];
 
+  patches = stdenv.lib.optional stdenv.hostPlatform.isMusl (
+    fetchpatch {
+      name = "strerror_r.patch";
+      url = "https://git.alpinelinux.org/cgit/aports/plain/main/powertop/strerror_r.patch?id=3b9214d436f1611f297b01f72469d66bfe729d6e";
+      sha256 = "1kzddhcrb0n2iah4lhgxwwy4mkhq09ch25jjngyq6pdj6pmfkpfw";
+    }
+  );
+
   postPatch = ''
     substituteInPlace src/main.cpp --replace "/sbin/modprobe" "modprobe"
     substituteInPlace src/calibrate/calibrate.cpp --replace "/usr/bin/xset" "xset"
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index cc5e3dd5190c..316f0ad1a28d 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -1,15 +1,38 @@
-{ lib, stdenv, fetchurl, ncurses }:
+{ lib, stdenv, fetchFromGitLab, fetchpatch, ncurses, libtool, gettext, autoconf, automake, pkgconfig }:
 
 stdenv.mkDerivation rec {
   name = "procps-${version}";
-  version = "3.3.12";
+  version = "3.3.13";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/procps-ng/procps-ng-${version}.tar.xz";
-    sha256 = "1m57w6jmry84njd5sgk5afycbglql0al80grx027kwqqcfw5mmkf";
+  src = fetchFromGitLab {
+    owner ="procps-ng";
+    repo = "procps";
+    rev = "v${version}";
+    sha256 = "0r3h9adhqi5fi62lx65z839fww35lfh2isnknhkaw71xndjpzr0q";
   };
 
   buildInputs = [ ncurses ];
+  nativeBuildInputs = [ libtool gettext autoconf automake pkgconfig ];
+
+  # https://gitlab.com/procps-ng/procps/issues/88
+  # Patches needed for musl and glibc 2.28
+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.com/procps-ng/procps/uploads/f91ff094be1e4638aeffb67bdbb751ba/numa.h.diff";
+      sha256 = "16r537d2wfrvbv6dg9vyfck8n31xa58903mnssw1s4kb5ap83yd5";
+      extraPrefix = "";
+    })
+    (fetchpatch {
+      url = "https://gitlab.com/procps-ng/procps/uploads/6a7bdea4d82ba781451316fda74192ae/libio_detection.diff";
+      sha256 = "0qp0j60kiycjsv213ih10imjirmxz8zja3rk9fq5lr5xf7k2lr3p";
+    })
+  ];
+
+  # autoreconfHook doesn't quite get, what procps-ng buildprocss does
+  # with po/Makefile.in.in and stuff.
+  preConfigure = ''
+    ./autogen.sh
+  '';
 
   makeFlags = "usrbin_execdir=$(out)/bin";
 
@@ -22,10 +45,11 @@ stdenv.mkDerivation rec {
       "ac_cv_func_realloc_0_nonnull=yes" ];
 
   meta = {
-    homepage = https://sourceforge.net/projects/procps-ng/;
+    homepage = https://gitlab.com/procps-ng/procps;
     description = "Utilities that give information about processes using the /proc filesystem";
     priority = 10; # less than coreutils, which also provides "kill" and "uptime"
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux ++ lib.platforms.cygwin;
+    maintainers = [ lib.maintainers.typetetris ];
   };
 }
diff --git a/pkgs/os-specific/linux/psmisc/default.nix b/pkgs/os-specific/linux/psmisc/default.nix
index edc7220d6586..358fa700382f 100644
--- a/pkgs/os-specific/linux/psmisc/default.nix
+++ b/pkgs/os-specific/linux/psmisc/default.nix
@@ -1,7 +1,5 @@
 {stdenv, fetchurl, ncurses}:
 
-assert stdenv.isLinux;
-
 stdenv.mkDerivation rec {
   name = "psmisc-23.1";
 
diff --git a/pkgs/os-specific/linux/radeontop/default.nix b/pkgs/os-specific/linux/radeontop/default.nix
index c87bec3a5264..504d25957858 100644
--- a/pkgs/os-specific/linux/radeontop/default.nix
+++ b/pkgs/os-specific/linux/radeontop/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "radeontop-${version}";
-  version = "2016-10-28";
+  version = "2018-03-25";
 
   src = fetchFromGitHub {
-    sha256 = "0y4rl8pm7p22s1ipyb75mlsk9qb6j4rd6nlqb3digmimnyxda1q3";
-    rev = "v1.0";
+    sha256 = "0s41xy9nrzxmimkdg23fr86rqcfiw6iqh99zpph0j990l8yzmv9b";
+    rev = "v1.1";
     repo = "radeontop";
     owner = "clbr";
   };
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index b25ed85ce4b3..9aa938068791 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -3,7 +3,7 @@
 } :
 
 let
-  version = "17";
+  version = "17.1";
 
 in stdenv.mkDerivation {
   name = "rdma-core-${version}";
@@ -12,7 +12,7 @@ in stdenv.mkDerivation {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "1xql46favv8i4ni4zqkk9ra2kcqq2dyn7jyi940c869lndmjw9ni";
+    sha256 = "019h5q0szjccdgfk13qy0f2dxd0n1fr407b3qqq1vcmx41w9b6vz";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index 4fd716ab8db8..868dcc9a58ea 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -24,6 +24,12 @@ stdenv.mkDerivation rec {
       url = "http://git.0pointer.net/rtkit.git/patch/?id=88d4082ef6caf6b071d749dca1c50e7edde914cc";
       sha256 = "0hp1blbi359qz8fmr6nj4w9yc0jf3dd176f8pn25wdj38n13qkix";
     })
+
+    # Fix format string errors due to -Werror=format-security
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/r/rtkit/0.11-6/debian/patches/0006-fix-format-strings.patch";
+      sha256 = "09mr89lh16jvz6cqw00zmh0xk919bjfhjkvna1czwmafwy9p7kgp";
+    })
   ];
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/selinux-python/default.nix b/pkgs/os-specific/linux/selinux-python/default.nix
new file mode 100644
index 000000000000..8ac207d64214
--- /dev/null
+++ b/pkgs/os-specific/linux/selinux-python/default.nix
@@ -0,0 +1,49 @@
+{ stdenv, fetchurl, python3
+, libselinux, libsemanage, libsepol, setools }:
+
+# this is python3 only because setools only supports python3
+
+with stdenv.lib;
+with python3.pkgs;
+
+stdenv.mkDerivation rec {
+  name = "selinux-python-${version}";
+  version = "2.7";
+  se_release = "20170804";
+  se_url = "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases";
+
+  src = fetchurl {
+    url = "${se_url}/${se_release}/selinux-python-${version}.tar.gz";
+    sha256 = "1va0y4b7cah7rprh04b3ylmwqgnivpkw5z2zw68nrafdbsbcn5s2";
+  };
+
+  nativeBuildInputs = [ wrapPython ];
+  buildInputs = [ libsepol python3 ];
+  propagatedBuildInputs = [ libselinux libsemanage setools ipy ];
+
+  postPatch = ''
+    substituteInPlace sepolicy/Makefile --replace "echo --root" "echo --prefix"
+  '';
+
+  preBuild = ''
+    makeFlagsArray+=("PREFIX=$out")
+    makeFlagsArray+=("DESTDIR=$out")
+    makeFlagsArray+=("LOCALEDIR=$out/share/locale")
+    makeFlagsArray+=("LIBSEPOLA=${libsepol}/lib/libsepol.a")
+    makeFlagsArray+=("BASHCOMPLETIONDIR=$out/share/bash-completion/completions")
+    makeFlagsArray+=("PYTHON=${python3}/bin/python")
+    makeFlagsArray+=("PYTHONLIBDIR=lib/${python3.libPrefix}/site-packages")
+  '';
+
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  meta = {
+    description = "SELinux policy core utilities written in Python";
+    license = licenses.gpl2;
+    homepage = https://selinuxproject.org;
+    platforms = platforms.linux;
+  };
+}
+
diff --git a/pkgs/os-specific/linux/selinux-sandbox/default.nix b/pkgs/os-specific/linux/selinux-sandbox/default.nix
new file mode 100644
index 000000000000..431f5e9ef517
--- /dev/null
+++ b/pkgs/os-specific/linux/selinux-sandbox/default.nix
@@ -0,0 +1,61 @@
+{ stdenv, fetchurl, bash, coreutils, python3
+, libcap_ng, policycoreutils, selinux-python, dbus
+, xorgserver, openbox, xmodmap }:
+
+# this is python3 only as it depends on selinux-python
+
+with stdenv.lib; 
+with python3.pkgs;
+
+stdenv.mkDerivation rec {
+  name = "selinux-sandbox-${version}";
+  version = "2.7";
+  se_release = "20170804";
+
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/${se_release}/selinux-sandbox-${version}.tar.gz";
+    sha256 = "0hf5chm90iapb42njaps6p5460ys3ajh5446ja544vdbh01n544l";
+  };
+
+  nativeBuildInputs = [ wrapPython ];
+  buildInputs = [ bash coreutils libcap_ng policycoreutils python3 xorgserver openbox xmodmap dbus ];
+  propagatedBuildInputs = [ pygobject3 selinux-python ];
+
+  postPatch = ''
+    # Fix setuid install
+    substituteInPlace Makefile --replace "-m 4755" "-m 755"
+    substituteInPlace sandboxX.sh \
+      --replace "#!/bin/sh" "#!${bash}/bin/sh" \
+      --replace "/usr/share/sandbox/start" "$out/share/sandbox/start" \
+      --replace "/usr/bin/cut" "${coreutils}/bin/cut" \
+      --replace "/usr/bin/Xephyr" "${xorgserver}/bin/Xepyhr" \
+      --replace "secon" "${policycoreutils}/bin/secon"
+    substituteInPlace sandbox \
+      --replace "/usr/sbin/seunshare" "$out/bin/seunshare" \
+      --replace "/usr/share/sandbox" "$out/share/sandbox" \
+      --replace "/usr/share/locale" "${policycoreutils}/share/locale" \
+      --replace "/usr/bin/openbox" "${openbox}/bin/openbox" \
+      --replace "#!/bin/sh" "#!${bash}/bin/sh" \
+      --replace "dbus-" "${dbus}/bin/dbus-" \
+      --replace "/usr/bin/xmodmap" "${xmodmap}/bin/xmodmap" \
+      --replace "/usr/bin/shred" "${coreutils}/bin/shred" \
+      --replace "/usr/bin/test" "${coreutils}/bin/test" \
+  '';
+
+  preBuild = ''
+    makeFlagsArray+=("PREFIX=$out")
+    makeFlagsArray+=("DESTDIR=$out")
+  '';
+
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  meta = {
+    description = "SELinux sandbox utility";
+    license = licenses.gpl2;
+    homepage = https://selinuxproject.org;
+    platforms = platforms.linux;
+  };
+}
+
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index 8262c03e1e52..9cb5785ca98f 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -1,35 +1,42 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, bison, flex
-, python, swig2, tcl, libsepol, libselinux, libxml2, sqlite, bzip2 }:
+{ stdenv, fetchFromGitHub, bison, flex, python3 , swig
+, libsepol, libselinux, checkpolicy
+, withGraphics ? false
+}:
 
-stdenv.mkDerivation rec {
-  name = "setools-2015-02-12";
+with stdenv.lib;
+with python3.pkgs;
+
+buildPythonApplication rec {
+  pname = "setools";
+  version = "2017-11-10";
 
   src = fetchFromGitHub {
     owner = "TresysTechnology";
-    repo = "setools3";
-    rev = "f1e5b208d507171968ca4d2eeefd7980f1004a3c";
-    sha256 = "02gzy2kpszhr13f0d9qfiwh2hj4201g2x366j53v5n5qz481aykd";
+    repo = pname;
+    rev = "a1aa0f33f5c428d3f9fe82960ed5de36f38047f7";
+    sha256 = "0iyj35fff93cprjkzbkg9dn5xz8dg5h2kjx3476fl625nxxskndn";
   };
 
-  configureFlags = [
-    "--disable-gui"
-    "--with-sepol-devel=${libsepol}"
-    "--with-selinux-devel=${libselinux}"
-    "--with-tcl=${tcl}/lib"
-  ];
+  nativeBuildInputs = [ bison flex ];
+  buildInputs = [ libsepol swig ];
+  propagatedBuildInputs = [ enum34 libselinux networkx ]
+    ++ optionals withGraphics [ pyqt5 ];
 
-  hardeningDisable = [ "format" ];
+  checkInputs = [ tox checkpolicy ];
+  preCheck = ''
+    export CHECKPOLICY=${checkpolicy}/bin/checkpolicy
+  '';
 
-  NIX_CFLAGS_COMPILE = "-fstack-protector-all";
-  NIX_LDFLAGS = "-L${libsepol}/lib -L${libselinux}/lib";
+  setupPyBuildFlags = [ "-i" ];
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig python swig2 bison flex ];
-  buildInputs = [ tcl libxml2 sqlite bzip2 ];
+  preBuild = ''
+    export SEPOL="${libsepol}/lib/libsepol.a"
+  '';
 
   meta = {
     description = "SELinux Tools";
-    homepage = http://oss.tresys.com/projects/setools/;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
+    homepage = https://github.com/TresysTechnology/setools/wiki;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index ca15571d1ede..3a76450a8308 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -60,8 +60,10 @@ stdenv.mkDerivation rec {
     configureFlags="$configureFlags --with-xml-catalog=$PWD/xmlcatalog ";
   '';
 
-  configureFlags = " --enable-man "
-    + stdenv.lib.optionalString (hostPlatform.libc != "glibc") " --disable-nscd ";
+  configureFlags = [
+    "--enable-man"
+    "--with-group-name-max-length=32"
+  ] ++ stdenv.lib.optional (hostPlatform.libc != "glibc") "--disable-nscd";
 
   preBuild = stdenv.lib.optionalString (hostPlatform.libc == "glibc")
     ''
diff --git a/pkgs/os-specific/linux/sinit/default.nix b/pkgs/os-specific/linux/sinit/default.nix
index 46abb6ccc662..32761970d81c 100644
--- a/pkgs/os-specific/linux/sinit/default.nix
+++ b/pkgs/os-specific/linux/sinit/default.nix
@@ -5,7 +5,7 @@ let
     baseName="sinit";
     version="1.0";
     name="${baseName}-${version}";
-    url="http://git.suckless.org/sinit/";
+    url="https://git.suckless.org/sinit/";
     sha256="0cf8yylgrrj1wxm5v6jdlbnxpx97m38yxrc9nmv1l8hldjqsj9pc";
     rev = "refs/tags/v${version}";
   };
@@ -32,6 +32,6 @@ stdenv.mkDerivation {
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.linux;
     homepage = https://tools.suckless.org/sinit;
-    downloadPage = "http://git.suckless.org/sinit";
+    downloadPage = "https://git.suckless.org/sinit";
   };
 }
diff --git a/pkgs/os-specific/linux/spl/const.patch b/pkgs/os-specific/linux/spl/const.patch
deleted file mode 100644
index 932e8a9eb1c4..000000000000
--- a/pkgs/os-specific/linux/spl/const.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/module/spl/spl-proc.c b/module/spl/spl-proc.c
-index eb00505..6f38cef 100644
---- a/module/spl/spl-proc.c
-+++ b/module/spl/spl-proc.c
-@@ -36,7 +36,7 @@
- #include <linux/uaccess.h>
- #include <linux/version.h>
- 
--#if defined(CONSTIFY_PLUGIN) && LINUX_VERSION_CODE >= KERNEL_VERSION(3,8,0)
-+#if defined(CONSTIFY_PLUGIN)
- typedef struct ctl_table __no_const spl_ctl_table;
- #else
- typedef struct ctl_table spl_ctl_table;
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 57698b5ad455..7c37d18c8684 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -11,6 +11,7 @@ let
     , sha256
     , rev ? "spl-${version}"
     , broken ? false
+    , patches ? []
     } @ args : stdenv.mkDerivation rec {
       name = "spl-${version}-${kernel.version}";
 
@@ -20,7 +21,7 @@ let
         inherit rev sha256;
       };
 
-      patches = [ ./const.patch ./install_prefix.patch ];
+      inherit patches;
 
       nativeBuildInputs = [ autoreconfHook ] ++ kernel.moduleBuildDependencies;
 
@@ -61,19 +62,22 @@ in
   assert kernel != null;
 {
     splStable = common {
-      version = "0.7.6";
-      sha256 = "1l641d89k48ngmarx9mxh8gw2zzrf7fw7n8zmslhz4h1152plddb";
+      version = "0.7.8";
+      sha256 = "0ypyy7ij280n7rly6ifrvna9k55gxwdx9a7lalf4r1ka714379fi";
+      patches = [ ./install_prefix-0.7.8.patch ];
     };
 
     splUnstable = common {
-      version = "2018-01-24";
-      rev = "23602fdb39e1254c669707ec9d2d0e6bcdbf1771";
-      sha256 = "09py2dwj77f6s2qcnkwdslg5nxb3hq2bq39zpxpm6msqyifhl69h";
+      version = "2018-04-10";
+      rev = "9125f8f5bdb36bfbd2d816d30b6b29b9f89ae3d8";
+      sha256 = "00zrbca906rzjd62m4khiw3sdv8x18dapcmvkyaawripwvzc4iri";
+      patches = [ ./install_prefix.patch ];
     };
 
     splLegacyCrypto = common {
       version = "2018-01-24";
       rev = "23602fdb39e1254c669707ec9d2d0e6bcdbf1771";
       sha256 = "09py2dwj77f6s2qcnkwdslg5nxb3hq2bq39zpxpm6msqyifhl69h";
+      patches = [ ./install_prefix.patch ];
     };
 }
diff --git a/pkgs/os-specific/linux/spl/install_prefix-0.7.8.patch b/pkgs/os-specific/linux/spl/install_prefix-0.7.8.patch
new file mode 100644
index 000000000000..dc91392bd2fe
--- /dev/null
+++ b/pkgs/os-specific/linux/spl/install_prefix-0.7.8.patch
@@ -0,0 +1,174 @@
+diff --git a/Makefile.am b/Makefile.am
+index 4977448..ac17217 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -12,10 +12,10 @@ endif
+ if CONFIG_KERNEL
+ SUBDIRS += module
+ 
+-extradir = @prefix@/src/spl-$(VERSION)
++extradir = @prefix@/libexec/spl
+ extra_HEADERS = spl.release.in spl_config.h.in
+ 
+-kerneldir = @prefix@/src/spl-$(VERSION)/$(LINUX_VERSION)
++kerneldir = @prefix@/libexec/spl/$(LINUX_VERSION)
+ nodist_kernel_HEADERS = spl.release spl_config.h module/$(LINUX_SYMBOLS)
+ endif
+ 
+diff --git a/include/Makefile.am b/include/Makefile.am
+index 3200222..4a47aaa 100644
+--- a/include/Makefile.am
++++ b/include/Makefile.am
+@@ -13,6 +13,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include
++kerneldir = @prefix@/libexec/spl/include
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/fs/Makefile.am b/include/fs/Makefile.am
+index e0da4b3..d6d7af0 100644
+--- a/include/fs/Makefile.am
++++ b/include/fs/Makefile.am
+@@ -8,6 +8,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/fs
++kerneldir = @prefix@/libexec/spl/include/fs
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/linux/Makefile.am b/include/linux/Makefile.am
+index 712e94e..4af9fb7 100644
+--- a/include/linux/Makefile.am
++++ b/include/linux/Makefile.am
+@@ -18,6 +18,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/linux
++kerneldir = @prefix@/libexec/spl/include/linux
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/rpc/Makefile.am b/include/rpc/Makefile.am
+index cfc8246..4fbd33d 100644
+--- a/include/rpc/Makefile.am
++++ b/include/rpc/Makefile.am
+@@ -9,6 +9,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/rpc
++kerneldir = @prefix@/libexec/spl/include/rpc
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/sharefs/Makefile.am b/include/sharefs/Makefile.am
+index 10e7093..febecdf 100644
+--- a/include/sharefs/Makefile.am
++++ b/include/sharefs/Makefile.am
+@@ -8,6 +8,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sharefs
++kerneldir = @prefix@/libexec/spl/include/sharefs
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/sys/Makefile.am b/include/sys/Makefile.am
+index 73c4a84..31a9f50 100644
+--- a/include/sys/Makefile.am
++++ b/include/sys/Makefile.am
+@@ -107,7 +107,7 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sys
++kerneldir = @prefix@/libexec/spl/include/sys
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+ 
+diff --git a/include/sys/fm/Makefile.am b/include/sys/fm/Makefile.am
+index 2821cbe..a84ce8e 100644
+--- a/include/sys/fm/Makefile.am
++++ b/include/sys/fm/Makefile.am
+@@ -9,6 +9,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sys/fm
++kerneldir = @prefix@/libexec/spl/include/sys/fm
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/sys/fs/Makefile.am b/include/sys/fs/Makefile.am
+index 581083e..0c35fb7 100644
+--- a/include/sys/fs/Makefile.am
++++ b/include/sys/fs/Makefile.am
+@@ -8,6 +8,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sys/fs
++kerneldir = @prefix@/libexec/spl/include/sys/fs
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/sys/sysevent/Makefile.am b/include/sys/sysevent/Makefile.am
+index 63d9af3..de1aa18 100644
+--- a/include/sys/sysevent/Makefile.am
++++ b/include/sys/sysevent/Makefile.am
+@@ -8,6 +8,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/sys/sysevent
++kerneldir = @prefix@/libexec/spl/include/sys/sysevent
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/util/Makefile.am b/include/util/Makefile.am
+index e2bf09f..3f5d6ce 100644
+--- a/include/util/Makefile.am
++++ b/include/util/Makefile.am
+@@ -9,6 +9,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/util
++kerneldir = @prefix@/libexec/spl/include/util
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/include/vm/Makefile.am b/include/vm/Makefile.am
+index 7faab0a..8148b3d 100644
+--- a/include/vm/Makefile.am
++++ b/include/vm/Makefile.am
+@@ -10,6 +10,6 @@ USER_H =
+ EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
+ 
+ if CONFIG_KERNEL
+-kerneldir = @prefix@/src/spl-$(VERSION)/include/vm
++kerneldir = @prefix@/libexec/spl/include/vm
+ kernel_HEADERS = $(KERNEL_H)
+ endif
+diff --git a/module/Makefile.in b/module/Makefile.in
+index d4e62e1..73fa01c 100644
+--- a/module/Makefile.in
++++ b/module/Makefile.in
+@@ -21,15 +21,15 @@ clean:
+ modules_install:
+ 	@# Install the kernel modules
+ 	$(MAKE) -C @LINUX_OBJ@ SUBDIRS=`pwd` $@ \
+-		INSTALL_MOD_PATH=$(DESTDIR)$(INSTALL_MOD_PATH) \
++		INSTALL_MOD_PATH=@prefix@/$(INSTALL_MOD_PATH) \
+ 		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR) \
+ 		KERNELRELEASE=@LINUX_VERSION@
+ 	@# Remove extraneous build products when packaging
+-	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
+-	if [ -n "$(DESTDIR)" ]; then \
++	kmoddir=@prefix@/$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
++	if [ -n "@prefix@" ]; then \
+ 		find $$kmoddir -name 'modules.*' | xargs $(RM); \
+ 	fi
+-	sysmap=$(DESTDIR)$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
++	sysmap=@prefix@/$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
+ 	if [ -f $$sysmap ]; then \
+ 		depmod -ae -F $$sysmap @LINUX_VERSION@; \
+ 	fi
diff --git a/pkgs/os-specific/linux/spl/install_prefix.patch b/pkgs/os-specific/linux/spl/install_prefix.patch
index dc91392bd2fe..114ca1231470 100644
--- a/pkgs/os-specific/linux/spl/install_prefix.patch
+++ b/pkgs/os-specific/linux/spl/install_prefix.patch
@@ -112,18 +112,6 @@ index 581083e..0c35fb7 100644
 +kerneldir = @prefix@/libexec/spl/include/sys/fs
  kernel_HEADERS = $(KERNEL_H)
  endif
-diff --git a/include/sys/sysevent/Makefile.am b/include/sys/sysevent/Makefile.am
-index 63d9af3..de1aa18 100644
---- a/include/sys/sysevent/Makefile.am
-+++ b/include/sys/sysevent/Makefile.am
-@@ -8,6 +8,6 @@ USER_H =
- EXTRA_DIST = $(COMMON_H) $(KERNEL_H) $(USER_H)
- 
- if CONFIG_KERNEL
--kerneldir = @prefix@/src/spl-$(VERSION)/include/sys/sysevent
-+kerneldir = @prefix@/libexec/spl/include/sys/sysevent
- kernel_HEADERS = $(KERNEL_H)
- endif
 diff --git a/include/util/Makefile.am b/include/util/Makefile.am
 index e2bf09f..3f5d6ce 100644
 --- a/include/util/Makefile.am
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index 516f0b92df6b..3d89fdfdc281 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   name = "sssd-${version}";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchurl {
     url = "https://fedorahosted.org/released/sssd/${name}.tar.gz";
-    sha256 = "03wllgbxxz2zv14dcqr8d2xssppi7ibckh0rlky8gvsw6vjsd0f5";
+    sha256 = "0vjh1c5960wh86zjsamdjhljls7bb5fz5jpcazgzrpmga5w6ggrd";
   };
 
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 5c7b2e69edf2..6223c967619d 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -3,13 +3,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   name = "sysdig-${version}";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "0nbsfm2jh5gjy2wh79f35rqk3c3z15lymmcz3gviw0jaxdv6drzw";
+    sha256 = "0dakxv2pkbsivavz09fwvav4dla7qzklnv45zb7x306gankkjgi1";
   };
 
   buildInputs = [
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index d8e95ff74c43..db9f05f5f4d8 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "sysstat-11.7.2";
+  name = "sysstat-11.7.3";
 
   src = fetchurl {
     url = "http://perso.orange.fr/sebastien.godard/${name}.tar.xz";
-    sha256 = "169yh9d0ags9xrn5g0k42wd1c895117zbzs257cjxqnb2vk0a38v";
+    sha256 = "1sk6rhdqr8xsm456fkhkcmbnqgkymqqs3jkapcf8mrnsx36gz94f";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix b/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix
index f69269347e37..c89a8ff91479 100644
--- a/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix
+++ b/pkgs/os-specific/linux/systemd/cryptsetup-generator.nix
@@ -1,7 +1,5 @@
 { stdenv, systemd, cryptsetup }:
 
-assert stdenv.isLinux;
-
 stdenv.lib.overrideDerivation systemd (p: {
   version = p.version;
   name = "systemd-cryptsetup-generator";
@@ -13,6 +11,17 @@ stdenv.lib.overrideDerivation systemd (p: {
     ninja systemd-cryptsetup systemd-cryptsetup-generator
   '';
 
+  # As ninja install is not used here, the rpath needs to be manually fixed.
+  # Otherwise the resulting binary doesn't properly link against systemd-shared.so
+  postFixup = ''
+    sharedLib=libsystemd-shared-${p.version}.so
+    for prog in `find $out -type f -executable`; do
+      (patchelf --print-needed $prog | grep $sharedLib > /dev/null) && (
+        patchelf --set-rpath `patchelf --print-rpath $prog`:"$out/lib/systemd" $prog
+      ) || true
+    done
+  '';
+
   installPhase = ''
     mkdir -p $out/lib/systemd/
     cp systemd-cryptsetup $out/lib/systemd/systemd-cryptsetup
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 5992c1ffa95b..58a1c7ca7147 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -9,22 +9,24 @@
 , patchelf
 , getent
 , hostPlatform
+, buildPackages
+, withSelinux ? false, libselinux
 }:
 
-assert stdenv.isLinux;
-
 let
-  pythonLxmlEnv = python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]);
+  pythonLxmlEnv = buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]);
 
 in stdenv.mkDerivation rec {
-  version = "237";
+  version = "238";
   name = "systemd-${version}";
 
+  # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
+  # Also fresh patches should be cherry-picked from that tree to our current one.
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "systemd";
-    rev = "98067cc806ae0d2759cdd2334f230cd8548e5317";
-    sha256 = "077svfs2xy3g30s62q69wcv5pb9vfhzh8i7lhfri73vvhwbpzd5q";
+    rev = "02042d012c4d6c0a2854d8436dd6636d4327774f";
+    sha256 = "0iv6fygzac0z6dagbmw1nf8dx7rrr6d9cxp0fr304rn3ir58g5f0";
   };
 
   outputs = [ "out" "lib" "man" "dev" ];
@@ -33,15 +35,20 @@ in stdenv.mkDerivation rec {
     [ pkgconfig intltool gperf libxslt gettext docbook_xsl docbook_xml_dtd_42 docbook_xml_dtd_45
       ninja meson
       coreutils # meson calls date, stat etc.
-      pythonLxmlEnv glibcLocales
-      patchelf getent
+      glibcLocales
+      patchelf getent m4
     ];
   buildInputs =
     [ linuxHeaders libcap kmod xz pam acl
-      /* cryptsetup */ libuuid m4 glib libgcrypt libgpgerror libidn2
-      libmicrohttpd kexectools libseccomp libffi audit lz4 bzip2 libapparmor
+      /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2
+      libmicrohttpd ] ++
+      stdenv.lib.meta.enableIfAvailable kexectools ++
+      stdenv.lib.meta.enableIfAvailable libseccomp ++
+    [ libffi audit lz4 bzip2 libapparmor
       iptables gnu-efi
-    ];
+      # This is actually native, but we already pull it from buildPackages
+      pythonLxmlEnv
+    ] ++ stdenv.lib.optionals withSelinux [ libselinux ];
 
   #dontAddPrefix = true;
 
@@ -70,13 +77,19 @@ in stdenv.mkDerivation rec {
     "-Dsystem-gid-max=499"
     # "-Dtime-epoch=1"
 
-    (if stdenv.isAarch32 || !hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
+    (if stdenv.isAarch32 || stdenv.isAarch64 || !hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
     "-Defi-libdir=${toString gnu-efi}/lib"
     "-Defi-includedir=${toString gnu-efi}/include/efi"
     "-Defi-ldsdir=${toString gnu-efi}/lib"
 
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
+
+    "-Dkill-path=${coreutils}/bin/kill"
+    "-Dkmod-path=${kmod}/bin/kmod"
+    "-Dsulogin-path=${utillinux}/bin/sulogin"
+    "-Dmount-path=${utillinux}/bin/mount"
+    "-Dumount-path=${utillinux}/bin/umount"
   ];
 
   preConfigure = ''
@@ -124,7 +137,7 @@ in stdenv.mkDerivation rec {
 
     for i in src/basic/generate-gperfs.py src/resolve/generate-dns_type-gperf.py src/test/generate-sym-test.py ; do
       substituteInPlace $i \
-        --replace "#!/usr/bin/env python" "#!${python3Packages.python}/bin/python"
+        --replace "#!/usr/bin/env python" "#!${buildPackages.python3Packages.python}/bin/python"
     done
 
     substituteInPlace src/journal/catalog.c \
@@ -168,13 +181,6 @@ in stdenv.mkDerivation rec {
 
     rm -rf $out/etc/systemd/system
 
-    # Install SysV compatibility commands.
-    mkdir -p $out/sbin
-    ln -s $out/lib/systemd/systemd $out/sbin/telinit
-    for i in init halt poweroff runlevel reboot shutdown; do
-      ln -s $out/bin/systemctl $out/sbin/$i
-    done
-
     # Fix reference to /bin/false in the D-Bus services.
     for i in $out/share/dbus-1/system-services/*.service; do
       substituteInPlace $i --replace /bin/false ${coreutils}/bin/false
@@ -192,18 +198,6 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  # The rpath to the shared systemd library is not added by meson. The
-  # functionality was removed by a nixpkgs patch because it would overwrite
-  # the existing rpath.
-  postFixup = ''
-    sharedLib=libsystemd-shared-${version}.so
-    for prog in `find $out -type f -executable`; do
-      (patchelf --print-needed $prog | grep $sharedLib > /dev/null) && (
-        patchelf --set-rpath `patchelf --print-rpath $prog`:"$out/lib/systemd" $prog
-      ) || true
-    done
-  '';
-
   # The interface version prevents NixOS from switching to an
   # incompatible systemd at runtime.  (Switching across reboots is
   # fine, of course.)  It should be increased whenever systemd changes
diff --git a/pkgs/os-specific/linux/sysvinit/default.nix b/pkgs/os-specific/linux/sysvinit/default.nix
index 6ec8abdc1760..b516cfe65edd 100644
--- a/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/pkgs/os-specific/linux/sysvinit/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, withoutInitTools ? false }:
 
-let version = "2.88dsf"; in
+let version = "2.89"; in
 
 stdenv.mkDerivation {
   name = (if withoutInitTools then "sysvtools" else "sysvinit") + "-" + version;
 
   src = fetchurl {
     url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.bz2";
-    sha256 = "068mvzaz808a673zigyaqb63xc8bndh2klk16zi5c83rw70wifv0";
+    sha256 = "0rdw5lgg2rpcfdmq90br388qr01w89vsqmpvrqcqjqsmxk9zw3c2";
   };
 
   prePatch = ''
diff --git a/pkgs/os-specific/linux/tbs/default.nix b/pkgs/os-specific/linux/tbs/default.nix
new file mode 100644
index 000000000000..291666c0b450
--- /dev/null
+++ b/pkgs/os-specific/linux/tbs/default.nix
@@ -0,0 +1,63 @@
+{ stdenv, lib, fetchFromGitHub, kernel, kmod, perl, patchutils, perlPackages, libelf }:
+let
+
+  media = fetchFromGitHub rec {
+    name = repo;
+    owner = "tbsdtv";
+    repo = "linux_media";
+    rev = "efe31531b77efd3a4c94516504a5823d31cdc776";
+    sha256 = "1533qi3sb91v00289hl5zaj4l35r2sf9fqc6z5ky1vbb7byxgnlr";
+  };
+
+  build = fetchFromGitHub rec {
+    name = repo;
+    owner = "tbsdtv";
+    repo = "media_build";
+    rev = "a0d62eba4d429e0e9d2c2f910fb203e817cac84b";
+    sha256 = "1329s7w9xlqjqwkpaqsd6b5dmzhm97jw0c7c7zzmmbdkl289i4i4";
+  };
+
+in stdenv.mkDerivation {
+  name = "tbs-2018.04.18-${kernel.version}";
+
+  srcs = [ media build ];
+  sourceRoot = "${build.name}";
+
+  preConfigure = ''
+    make dir DIR=../${media.name}
+  '';
+
+  postPatch = ''
+    patchShebangs .
+
+    sed -i v4l/Makefile \
+      -i v4l/scripts/make_makefile.pl \
+      -e 's,/sbin/depmod,${kmod}/bin/depmod,g' \
+      -e 's,/sbin/lsmod,${kmod}/bin/lsmod,g'
+
+    sed -i v4l/Makefile \
+      -e 's,^OUTDIR ?= /lib/modules,OUTDIR ?= ${kernel.dev}/lib/modules,' \
+      -e 's,^SRCDIR ?= /lib/modules,SRCDIR ?= ${kernel.dev}/lib/modules,'
+  '';
+
+  buildFlags = [ "VER=${kernel.modDirVersion}" ];
+  installFlags = [ "DESTDIR=$(out)" ];
+
+  hardeningDisable = [ "all" ];
+
+  nativeBuildInputs = [ patchutils kmod perl perlPackages.ProcProcessTable ]
+  ++ kernel.moduleBuildDependencies;
+
+   postInstall = ''
+    xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/media/dvb-core/dvb-core.ko
+    xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/media/v4l2-core/videodev.ko
+  '';
+
+  meta = with lib; {
+    homepage = https://www.tbsdtv.com/;
+    description = "Linux driver for TBSDTV cards";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ ck3d ];
+    priority = -1;
+  };
+}
diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix
new file mode 100644
index 000000000000..01c84a1d1faa
--- /dev/null
+++ b/pkgs/os-specific/linux/tmon/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, kernel, ncurses }:
+
+stdenv.mkDerivation {
+  name = "tmon-${kernel.version}";
+
+  inherit (kernel) src;
+
+  buildInputs = [ ncurses ];
+
+  configurePhase = ''
+    cd tools/thermal/tmon
+  '';
+
+  makeFlags = kernel.makeFlags ++ [ "INSTALL_ROOT=\"$(out)\"" "BINDIR=bin" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Monitoring and Testing Tool for Linux kernel thermal subsystem";
+    homepage = https://www.kernel.org/;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/trinity/default.nix b/pkgs/os-specific/linux/trinity/default.nix
index b69bd576ed23..4c3a92cd87e6 100644
--- a/pkgs/os-specific/linux/trinity/default.nix
+++ b/pkgs/os-specific/linux/trinity/default.nix
@@ -11,6 +11,9 @@ stdenv.mkDerivation rec {
     sha256 = "19asyrypjhx2cgjdmwfvmgc0hk3xg00zvgkl89vwxngdb40bkwfq";
   };
 
+  # Fails on 32-bit otherwise
+  NIX_CFLAGS_COMPILE = "-Wno-error";
+
   postPatch = ''
     patchShebangs ./configure
     patchShebangs ./scripts/
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index 725b1cd25643..1c8e429c9455 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -5,11 +5,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "udisks-2.1.6";
+  name = "udisks-2.1.8";
 
   src = fetchurl {
     url = "http://udisks.freedesktop.org/releases/${name}.tar.bz2";
-    sha256 = "0spl155k0g2l2hvqf8xyjv08i68gfyhzpjva6cwlzxx0bz4gbify";
+    sha256 = "1nkxhnqh39c9pzvm4zfj50rgv6apqawdx09bv3sfaxrah4a6jhfs";
   };
 
   outputs = [ "out" "man" "dev" ];
@@ -27,7 +27,11 @@ stdenv.mkDerivation rec {
         --replace "/bin/sh" "${stdenv.shell}" \
         --replace "/sbin/mdadm" "${mdadm}/bin/mdadm" \
         --replace " sed " " ${gnused}/bin/sed "
-    '';
+  '' + stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
+      substituteInPlace udisks/udisksclient.c \
+        --replace 'defined( __GNUC_PREREQ)' 1 \
+        --replace '__GNUC_PREREQ(4,6)' 1
+  '';
 
   nativeBuildInputs = [ pkgconfig intltool gobjectIntrospection ];
 
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 713ef974f9fb..8c1d117bc8b8 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -3,8 +3,6 @@
 , useSystemd ? true, systemd, gobjectIntrospection
 }:
 
-assert stdenv.isLinux;
-
 stdenv.mkDerivation rec {
   name = "upower-0.99.7";
 
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index e8a2b3428496..618ba42e7416 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -30,7 +30,8 @@ in stdenv.mkDerivation rec {
 
   crossAttrs = {
     # Work around use of `AC_RUN_IFELSE'.
-    preConfigure = "export scanf_cv_type_modifier=ms";
+    preConfigure = "export scanf_cv_type_modifier=ms" + lib.optionalString (systemd != null)
+      "\nconfigureFlags+=\" --with-systemd --with-systemdsystemunitdir=$bin/lib/systemd/system/\"";
   };
 
   preConfigure = lib.optionalString (systemd != null) ''
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 920c8c0bdee0..3db2814a0878 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, fetchurl, kernel, kmod }:
+{ stdenv, fetchFromGitHub, kernel, kmod }:
 
 stdenv.mkDerivation rec {
   name = "v4l2loopback-${version}-${kernel.version}";
-  version = "0.9.1";
+  version = "0.11.0";
 
-  src = fetchurl {
-    url = "https://github.com/umlaeute/v4l2loopback/archive/v${version}.tar.gz";
-    sha256 = "1crkhxlnskqrfj3f7jmiiyi5m75zmj7n0s26xz07wcwdzdf2p568";
+  src = fetchFromGitHub {
+    owner = "umlaeute";
+    repo = "v4l2loopback";
+    rev = "v${version}";
+    sha256 = "1wb5qmy13w8rl4279bwp69s4sb1x5hk5d2n563p1yk8yi567p2az";
   };
 
   hardeningDisable = [ "format" "pic" ];
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 0029353ba20c..6e3e444240ac 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.10";
 let
   name = "wireguard-${version}";
 
-  version = "0.0.20180218";
+  version = "0.0.20180420";
 
   src = fetchurl {
     url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "4ac4c4e4ad4dc2cf9dcb831b0cf347567ccea675ca524528cf5a4d9dccb2fe52";
+    sha256 = "05nsn5pkzvkfsc8z0mm4fdb1znklpmb00v608j8gxlz8z6nd535m";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/xf86-input-multitouch/default.nix b/pkgs/os-specific/linux/xf86-input-multitouch/default.nix
index e1bafa93ea6f..527471bad328 100644
--- a/pkgs/os-specific/linux/xf86-input-multitouch/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-multitouch/default.nix
@@ -11,8 +11,6 @@
 , libpciaccess
 }:
 
-assert stdenv.isLinux;
-
 stdenv.mkDerivation {
   name = "xf86-input-multitouch-20110312";
 
diff --git a/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index 2ebb2b1890d5..b5937dff3752 100644
--- a/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -3,11 +3,11 @@
 , ncurses, pkgconfig, randrproto, xorgserver, xproto, udev, libXinerama, pixman }:
 
 stdenv.mkDerivation rec {
-  name = "xf86-input-wacom-0.35.0";
+  name = "xf86-input-wacom-0.36.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxwacom/${name}.tar.bz2";
-    sha256 = "0za44snc0zirq65a4lxsmg7blp1bynj6j835hm459x8yx1qhmxjm";
+    sha256 = "1xi39hl8ddgj9m7m2k2ll2r3wh0k0aq45fvrsv43651bhz9cbrza";
   };
 
   buildInputs = [ inputproto libX11 libXext libXi libXrandr libXrender
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 868e354c7b55..bdc43a092f7f 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -1,8 +1,11 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, utillinux, nukeReferences, coreutils, fetchpatch
+{ stdenv, fetchFromGitHub, autoreconfHook, utillinux, nukeReferences, coreutils
+, perl, fetchpatch
 , configFile ? "all"
 
 # Userspace dependencies
 , zlib, libuuid, python, attr, openssl
+, libtirpc
+, nfs-utils
 
 # Kernel dependencies
 , kernel ? null, spl ? null, splUnstable ? null, splLegacyCrypto ? null
@@ -26,7 +29,7 @@ let
         versionAtLeast kernel.version incompatibleKernelVersion then
        throw ''
          Linux v${kernel.version} is not yet supported by zfsonlinux v${version}.
-         ${stdenv.lib.optional (!isUnstable) "Try zfsUnstable or set the NixOS option boot.zfs.enableUnstable."}
+         ${stdenv.lib.optionalString (!isUnstable) "Try zfsUnstable or set the NixOS option boot.zfs.enableUnstable."}
        ''
     else stdenv.mkDerivation rec {
       name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
@@ -39,12 +42,20 @@ let
 
       patches = extraPatches;
 
+      postPatch = optionalString buildKernel ''
+        patchShebangs scripts
+      '' + optionalString stdenv.hostPlatform.isMusl ''
+        substituteInPlace config/user-libtirpc.m4 \
+          --replace /usr/include/tirpc ${libtirpc}/include/tirpc
+      '';
+
       nativeBuildInputs = [ autoreconfHook nukeReferences ]
-         ++ optional buildKernel kernel.moduleBuildDependencies;
+         ++ optional buildKernel (kernel.moduleBuildDependencies ++ [ perl ]);
       buildInputs =
            optionals buildKernel [ spl ]
         ++ optionals buildUser [ zlib libuuid python attr ]
-        ++ optionals (buildUser && (isUnstable || isLegacyCrypto)) [ openssl ];
+        ++ optionals (buildUser && (isUnstable || isLegacyCrypto)) [ openssl ]
+        ++ optional stdenv.hostPlatform.isMusl [ libtirpc ];
 
       # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
       NIX_CFLAGS_LINK = "-lgcc_s";
@@ -56,6 +67,7 @@ let
         substituteInPlace ./module/zfs/zfs_ctldir.c   --replace "mount -t zfs"            "${utillinux}/bin/mount -t zfs"
         substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/umount"             "${utillinux}/bin/umount"
         substituteInPlace ./lib/libzfs/libzfs_mount.c --replace "/bin/mount"              "${utillinux}/bin/mount"
+        substituteInPlace ./lib/libshare/nfs.c        --replace "/usr/sbin/exportfs"      "${nfs-utils}/bin/exportfs"
         substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/ztest"         "$out/sbin/ztest"
         substituteInPlace ./cmd/ztest/ztest.c         --replace "/usr/sbin/zdb"           "$out/sbin/zdb"
         substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
@@ -72,6 +84,7 @@ let
         done
 
         ./autogen.sh
+        configureFlagsArray+=("--libexecdir=$out/libexec")
       '';
 
       configureFlags = [
@@ -81,6 +94,7 @@ let
         "--with-udevdir=$(out)/lib/udev"
         "--with-systemdunitdir=$(out)/etc/systemd/system"
         "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
+        "--with-systemdgeneratordir=$(out)/lib/systemd/system-generator"
         "--with-mounthelperdir=$(out)/bin"
         "--sysconfdir=/etc"
         "--localstatedir=/var"
@@ -139,12 +153,12 @@ in {
   # to be adapted
   zfsStable = common {
     # comment/uncomment if breaking kernel versions are known
-    incompatibleKernelVersion = null;
+    incompatibleKernelVersion = "4.16";
 
     # this package should point to the latest release.
-    version = "0.7.6";
+    version = "0.7.8";
 
-    sha256 = "1k3a69zfdk4ia4z2l69lbz0mj26bwdanxd2wynkdpm2kl3zjj18h";
+    sha256 = "0m7j5cpz81lqcfbh4w3wvqjjka07wickl27klgy1zplv6vr0baix";
 
     extraPatches = [
       (fetchpatch {
@@ -156,30 +170,32 @@ in {
     inherit spl;
   };
 
-  zfsUnstable = common {
+  zfsUnstable = common rec {
     # comment/uncomment if breaking kernel versions are known
-    incompatibleKernelVersion = null;
+    incompatibleKernelVersion = "4.16";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2018-02-02";
+    version = "2018-04-10";
 
-    rev = "fbd42542686af053f0d162ec4630ffd4fff1cc30";
-    sha256 = "0qzkwnnk7kz1hwvcaqlpzi5yspfhhmd2alklc07k056ddzbx52qb";
+    rev = "74df0c5e251a920a1966a011c16f960cd7ba562e";
+    sha256 = "1x3mipj3ryznnd7kx84r3n607hv6jqs66mb61g3zcdmvk6al4yq4";
     isUnstable = true;
 
     extraPatches = [
       (fetchpatch {
-        url = "https://github.com/Mic92/zfs/compare/fbd42542686af053f0d162ec4630ffd4fff1cc30...nixos-zfs-2018-02-02.patch";
-        sha256 = "05wqwjm9648x60vkwxbp8l6z1q73r2a5l2ni28i2f4pla8s3ahln";
+        url = "https://github.com/Mic92/zfs/compare/${rev}...nixos-zfs-2018-02-02.patch";
+        sha256 = "1gqmgqi39qhk5kbbvidh8f2xqq25vj58i9x0wjqvcx6a71qj49ch";
       })
     ];
 
     spl = splUnstable;
   };
 
+  # TODO: Remove this module before 18.09
+  # also remove boot.zfs.enableLegacyCrypto
   zfsLegacyCrypto = common {
     # comment/uncomment if breaking kernel versions are known
-    incompatibleKernelVersion = null;
+    incompatibleKernelVersion = "4.16";
 
     # this package should point to a version / git revision compatible with the latest kernel release
     version = "2018-02-01";
diff --git a/pkgs/os-specific/windows/mingw-w64/common.nix b/pkgs/os-specific/windows/mingw-w64/common.nix
index ece2586dc806..102d9489fe9f 100644
--- a/pkgs/os-specific/windows/mingw-w64/common.nix
+++ b/pkgs/os-specific/windows/mingw-w64/common.nix
@@ -1,11 +1,16 @@
 { fetchurl }:
 
 rec {
-  version = "4.0.6";
+  version = "5.0.3";
   name = "mingw-w64-${version}";
 
   src = fetchurl {
     url = "mirror://sourceforge/mingw-w64/mingw-w64-v${version}.tar.bz2";
-    sha256 = "0p01vm5kx1ixc08402z94g1alip4vx66gjpvyi9maqyqn2a76h0c";
+    sha256 = "1d4wrjfdlq5xqpv9zg6ssw4lm8jnv6522xf7d6zbjygmkswisq1a";
   };
+
+  configureFlags = [
+    "--enable-idl"
+    "--enable-secure-api"
+  ];
 }
diff --git a/pkgs/os-specific/windows/pthread-w32/default.nix b/pkgs/os-specific/windows/pthread-w32/default.nix
index f0b6852d5bf9..ef42dadc2973 100644
--- a/pkgs/os-specific/windows/pthread-w32/default.nix
+++ b/pkgs/os-specific/windows/pthread-w32/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, mingw_headers }:
+{ fetchurl, stdenv, mingw_header, hostPlatform, buildPlatform }:
 
 # This file is tweaked for cross-compilation only.
 assert hostPlatform != buildPlatform;