Merge remote-tracking branch 'upstream/master' into wrapper-pname-support

138 files changed, 1506 insertions, 774 deletions

diff --git a/pkgs/os-specific/bsd/netbsd/default.nix b/pkgs/os-specific/bsd/netbsd/default.nix
index 7370901f3193..2d51c11f04a6 100644
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@@ -68,9 +68,9 @@ let
   } // lib.optionalAttrs stdenv'.isDarwin {
     MKRELRO = "no";
   } // lib.optionalAttrs (stdenv'.cc.isClang or false) {
-    HAVE_LLVM = lib.head (lib.splitString "." (lib.getVersion stdenv'.cc.cc));
+    HAVE_LLVM = lib.versions.major (lib.getVersion stdenv'.cc.cc);
   } // lib.optionalAttrs (stdenv'.cc.isGNU or false) {
-    HAVE_GCC = lib.head (lib.splitString "." (lib.getVersion stdenv'.cc.cc));
+    HAVE_GCC = lib.versions.major (lib.getVersion stdenv'.cc.cc);
   } // lib.optionalAttrs (attrs.headersOnly or false) {
     installPhase = "includesPhase";
     dontBuild = true;
@@ -127,6 +127,11 @@ let
     nativeBuildInputs = [ makeMinimal ];
     buildInputs = [ zlib ];
 
+    # the build system re-runs `./configure` with `HOST_CC` (which is their
+    # name for Build CC) as a compiler to make `defs.mk`, which is installed
+    depsBuildBuild = [ buildPackages.stdenv.cc ] ++ buildInputs;
+    HOST_CC = "${buildPackages.stdenv.cc.targetPrefix}cc";
+
     # temporarily use gnuinstall for bootstrapping
     # bsdinstall will be built later
     makeFlags = [
@@ -218,9 +223,9 @@ let
     ];
     skipIncludesPhase = true;
     buildPhase = ''
-      cc  -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
+      "$CC" -c -Iinclude -Ilib/libc/include lib/libc/gen/fts.c \
           -o lib/libc/gen/fts.o
-      ar -rsc libfts.a lib/libc/gen/fts.o
+      "$AR" -rsc libfts.a lib/libc/gen/fts.o
     '';
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
index 66e24fe58770..86c241cd0f56 100644
--- a/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/cf-setup-hook.sh
@@ -1,5 +1,5 @@
 linkSystemCoreFoundationFramework() {
-  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks $NIX_CFLAGS_COMPILE"
+  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks${NIX_CFLAGS_COMPILE:+ }${NIX_CFLAGS_COMPILE-}"
   # gross! many symbols (such as _OBJC_CLASS_$_NSArray) are defined in system CF, but not
   # in the opensource release
   # if the package needs private headers, we assume they also want to link with system CF
diff --git a/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
index fbd977f8552d..a351c39de130 100644
--- a/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/private-frameworks-setup-hook.sh
@@ -1,6 +1,6 @@
 addPrivateFrameworks() {
     flag="-F/System/Library/PrivateFrameworks"
-    if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+    if [[ "${NIX_CFLAGS_COMPILE-}" != *$flag* ]]; then
         NIX_CFLAGS_COMPILE+=" $flag"
     fi
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
index ed9bdbd912db..35cea773f98b 100644
--- a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
+++ b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
@@ -2,7 +2,7 @@ noDeprecatedDeclarations() {
   # Security.framework has about 2000 deprecated constants, all of which the user will be
   # warned about at compilation time
   flag="-Wno-deprecated-declarations"
-  if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+  if [[ "${NIX_CFLAGS_COMPILE-}" != *$flag* ]]; then
     NIX_CFLAGS_COMPILE+=" $flag"
   fi
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
index 03556296ca1d..16454cbc1a5f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/system_cmds/default.nix
@@ -14,8 +14,8 @@ appleDerivation {
   #                    + lib.optionalString hostPlatform.isAarch32 "-D__arm__";
   NIX_CFLAGS_COMPILE = [ "-DDAEMON_UID=1"
                          "-DDAEMON_GID=1"
-                         "-DDEFAULT_AT_QUEUE=\'a\'"
-                         "-DDEFAULT_BATCH_QUEUE=\'b\'"
+                         "-DDEFAULT_AT_QUEUE='a'"
+                         "-DDEFAULT_BATCH_QUEUE='b'"
                          "-DPERM_PATH=\"/usr/lib/cron/\""
                          "-DOPEN_DIRECTORY"
                          "-DNO_DIRECT_RPC"
diff --git a/pkgs/os-specific/darwin/osxsnarf/default.nix b/pkgs/os-specific/darwin/osxsnarf/default.nix
new file mode 100644
index 000000000000..e391be1807c1
--- /dev/null
+++ b/pkgs/os-specific/darwin/osxsnarf/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, lib, fetchFromGitHub, plan9port, darwin, ... }:
+
+stdenv.mkDerivation rec {
+  pname = "osxsnarf";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "eraserhd";
+    repo = "osxsnarf";
+    rev = "v${version}";
+    sha256 = "1vpg39mpc5avnv1j0yfx0x2ncvv38slmm83zv6nmm7alfwfjr2ss";
+  };
+
+  buildInputs = [ plan9port darwin.apple_sdk.frameworks.Carbon ];
+  makeFlags = [ "prefix=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "A Plan 9-inspired way to share your OS X clipboard.";
+    homepage = https://github.com/eraserhd/osxsnarf;
+    license = licenses.unlicense;
+    platforms = platforms.darwin;
+    maintainers = [ maintainers.eraserhd ];
+  };
+}
diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 6f7caa8ec02c..1df7070e7a3f 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -63,10 +63,31 @@ stdenv.mkDerivation {
   # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
   # and this version is a version from there. No idea how accurate it is.
   LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
-  configurePhase = "../configure release --sysroot UNUSED";
+
+  configurePhase = ''
+    ../configure release --sysroot UNUSED
+  '';
 
   enableParallelBuilding = true;
-  buildPhase = "ninja -j $NIX_BUILD_CORES";
+
+  # FIXME: Workaround for intermittent build failures of CFRuntime.c.
+  # Based on testing this issue seems to only occur with clang_7, so
+  # please remove this when updating the default llvm versions to 8 or
+  # later.
+  buildPhase = stdenv.lib.optionalString true ''
+    for i in {1..512}; do
+        if ninjaBuildPhase; then
+          break
+        fi
+
+        echo >&2
+        echo "[$i/512] retrying build, workaround for #66811" >&2
+        echo "  With clang_7 the build of CFRuntime.c fails intermittently." >&2
+        echo "  See https://github.com/NixOS/nixpkgs/issues/66811 for more details." >&2
+        echo >&2
+        continue
+    done
+  '';
 
   # TODO: their build system sorta kinda can do this, but it doesn't seem to work right now
   # Also, this includes a bunch of private headers in the framework, which is not what we want
diff --git a/pkgs/os-specific/darwin/wifi-password/default.nix b/pkgs/os-specific/darwin/wifi-password/default.nix
new file mode 100644
index 000000000000..801e180f7344
--- /dev/null
+++ b/pkgs/os-specific/darwin/wifi-password/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  version = "0.1.0";
+  pname = "wifi-password";
+
+  src = fetchFromGitHub {
+    owner = "rauchg";
+    repo = pname;
+    rev = version;
+    sha256 = "0sfvb40h7rz9jzp4l9iji3jg80paklqsbmnk5h7ipsv2xbsplp64";
+  };
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp wifi-password.sh $out/bin/wifi-password
+  '';
+
+  meta = {
+    homepage = https://github.com/rauchg/wifi-password;
+    description = "Get the password of the wifi you're on";
+    platforms = stdenv.lib.platforms.darwin;
+    license = stdenv.lib.licenses.mit;
+    maintainers = [ stdenv.lib.maintainers.nikitavoloboev ];
+  };
+}
diff --git a/pkgs/os-specific/linux/acpitool/default.nix b/pkgs/os-specific/linux/acpitool/default.nix
index ce47932587cf..86e6b54906ad 100644
--- a/pkgs/os-specific/linux/acpitool/default.nix
+++ b/pkgs/os-specific/linux/acpitool/default.nix
@@ -3,7 +3,7 @@
 let
    acpitool-patch-051-4 = params: fetchpatch rec {
      inherit (params) name sha256;
-     url = "https://anonscm.debian.org/cgit/pkg-acpi/acpitool.git/plain/debian/patches/${name}?h=debian/0.5.1-4&id=3fd9f396f12ec9c1cae3337a2a25026b7faad2ae";
+     url = "https://salsa.debian.org/debian/acpitool/raw/33e2ef42a663de820457b212ea2925e506df3b88/debian/patches/${name}";
    };
 
 in stdenv.mkDerivation rec {
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index aed0ed374a78..2aa71b92beb1 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20190315";
+  version = "20191103";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    sha256 = "1w8zkww3cj6yzcsfzwvj1gkf4dfflhp1vd9fixnmlbm43kwkqrdr";
+    sha256 = "0x2f2sv0x0ry7kccp47s0hlxps3hbpg37dj3xjjgpdm5hmn2cjq3";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 06c37d00d5e7..658c84412763 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -14,7 +14,7 @@
 
 let
   apparmor-series = "2.13";
-  apparmor-patchver = "1";
+  apparmor-patchver = "3";
   apparmor-version = apparmor-series + "." + apparmor-patchver;
 
   apparmor-meta = component: with stdenv.lib; {
@@ -27,7 +27,7 @@ let
 
   apparmor-sources = fetchurl {
     url = "https://launchpad.net/apparmor/${apparmor-series}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "7a060d94c275e59f96bacd1da150e6fee2c9152a85bf57800109d07d51ef8afb";
+    sha256 = "0fbnk9fzjsffwcijsv2wwykmybvfdckpqk99qlib3kb89him6w16";
   };
 
   prePatchCommon = ''
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 38e2fa9bd344..591a9a8792fc 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -2,14 +2,14 @@
 , libxml2, kerberos, kmod, openldap, sssd, cyrus_sasl, openssl }:
 
 let
-  version = "5.1.5";
+  version = "5.1.6";
   name = "autofs-${version}";
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
     url = "mirror://kernel/linux/daemons/autofs/v5/${name}.tar.xz";
-    sha256 = "1nn0z60f49zchpv8yw67fk8hmbjszpnczs0bj2ql2vgxwbcxmbr3";
+    sha256 = "1vya21mb4izj3khcr3flibv7xc15vvx2v0rjfk5yd31qnzcy7pnx";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index 014ebe80cdcc..449f8e3d40ba 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -4,7 +4,7 @@
 }:
 
 python.pkgs.buildPythonApplication rec {
-  version = "0.10.0";
+  version = "0.11.0";
   name = "bcc-${version}";
 
   srcs = [
@@ -12,7 +12,7 @@ python.pkgs.buildPythonApplication rec {
       owner  = "iovisor";
       repo   = "bcc";
       rev    = "v${version}";
-      sha256 = "0qbqygj7ia494fbira9ajavvnxlpffx1jlzbb1vsf1wa8h3y4xn1";
+      sha256 = "1v2gzdd4k58f3yxmq4z97a7xh5vyd84flzzfr9k2cm29i93cwcam";
       name   = "bcc";
     })
 
@@ -21,8 +21,8 @@ python.pkgs.buildPythonApplication rec {
     (fetchFromGitHub {
       owner  = "libbpf";
       repo   = "libbpf";
-      rev    = "0e37e0d03ac99987401e4496d3d76d44237b9963";
-      sha256 = "0wjf9dhvqkwiwnygzikamrgmpxgq77h2pxx6mi4pnbw0lxlppivr";
+      rev    = "a30df5c09fb3941fc42c4570ed2545e7057bf82a";
+      sha256 = "088vb9sfs1zazlqi6abb3ia1xgpmwiz5pmz6y3a6gbh0zdrgh6px";
       name   = "libbpf";
     })
   ];
diff --git a/pkgs/os-specific/linux/blcr/default.nix b/pkgs/os-specific/linux/blcr/default.nix
deleted file mode 100644
index e018f4622b48..000000000000
--- a/pkgs/os-specific/linux/blcr/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{ stdenv, fetchurl, kernel, perl, makeWrapper }:
-
-# BLCR version 0.8.6 should works with linux kernel up to version 3.17.x
-
-assert stdenv.lib.versionOlder "3.18" kernel.version;
-
-stdenv.mkDerivation {
-  name = "blcr_${kernel.version}-0.8.6pre4";
-
-  src = fetchurl {
-    url = https://upc-bugs.lbl.gov/blcr-dist/blcr-0.8.6_b4.tar.gz;
-    sha256 = "1a3gdhdnmk592jc652szxgfz8rjd8dax5jwxfsypiqx5lgkj3m21";
-  };
-
-  buildInputs = [ perl makeWrapper ];
-
-  hardeningDisable = [ "pic" ];
-
-  preConfigure = ''
-    configureFlagsArray=(
-      --with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build
-      --with-kmod-dir=$out/lib/modules/${kernel.modDirVersion}
-      --with-system-map=${kernel}/System.map
-    )
-  '';
-
-  postInstall = ''
-    for prog in "$out/bin/"*
-    do
-      wrapProgram "$prog" --prefix LD_LIBRARY_PATH ":" "$out/lib"
-    done
-  '';
-
-  meta = {
-    description = "Berkeley Lab Checkpoint/Restart for Linux (BLCR)";
-    homepage = https://ftg.lbl.gov/projects/CheckpointRestart/;
-    license = stdenv.lib.licenses.gpl2;
-    platforms = stdenv.lib.platforms.linux;
-    maintainers = with stdenv.lib.maintainers; [
-      z77z
-    ];
-  };
-}
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index be43d23d6115..cca3674bdd1c 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -48,12 +48,12 @@ stdenv.mkDerivation rec {
     "--enable-library"
     "--enable-cups"
     "--enable-pie"
-    "--with-dbusconfdir=$(out)/etc"
-    "--with-dbussystembusdir=$(out)/share/dbus-1/system-services"
-    "--with-dbussessionbusdir=$(out)/share/dbus-1/services"
-    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-    "--with-systemduserunitdir=$(out)/etc/systemd/user"
-    "--with-udevdir=$(out)/lib/udev"
+    "--with-dbusconfdir=${placeholder "out"}/share"
+    "--with-dbussystembusdir=${placeholder "out"}/share/dbus-1/system-services"
+    "--with-dbussessionbusdir=${placeholder "out"}/share/dbus-1/services"
+    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    "--with-systemduserunitdir=${placeholder "out"}/etc/systemd/user"
+    "--with-udevdir=${placeholder "out"}/lib/udev"
     ] ++ optional enableWiimote [ "--enable-wiimote" ]
       ++ optional enableMidi    [ "--enable-midi" ]
       ++ optional enableSixaxis [ "--enable-sixaxis" ]);
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
   # Work around `make install' trying to create /var/lib/bluetooth.
   installFlags = "statedir=$(TMPDIR)/var/lib/bluetooth";
 
-  makeFlags = "rulesdir=$(out)/lib/udev/rules.d";
+  makeFlags = "rulesdir=${placeholder "out"}/lib/udev/rules.d";
 
   postInstall = ''
     mkdir -p $test/{bin,test}
diff --git a/pkgs/os-specific/linux/bpftrace/default.nix b/pkgs/os-specific/linux/bpftrace/default.nix
index 7f5cd206f32c..02a46e5a7764 100644
--- a/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/pkgs/os-specific/linux/bpftrace/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner  = "iovisor";
     repo   = "bpftrace";
     rev    = "refs/tags/v${version}";
-    sha256 = "17qf1c3h99iyxkc0xzix4jnxwqvxbg9ki23zm7l04qw73lj01g1m";
+    sha256 = "19lblnhx3p0qk8s3qgxrx9wl0d6dgz5dfp4gw6a6cvhhyn78cldm";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch b/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch
new file mode 100644
index 000000000000..efa41075644d
--- /dev/null
+++ b/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch
@@ -0,0 +1,25 @@
+diff --git a/configure.in b/configure.in
+index 5e3f89b..19be6d9 100644
+--- a/configure.in
++++ b/configure.in
+@@ -9,6 +9,7 @@ dnl Checks for programs.
+ AC_PROG_CC
+ AC_PROG_INSTALL
+ AC_PROG_RANLIB
++AC_CHECK_TOOL([AR], [ar])
+ 
+ dnl Checks for header files.
+ AC_HEADER_STDC
+diff --git a/libbridge/Makefile.in b/libbridge/Makefile.in
+index 20512c4..83c802b 100644
+--- a/libbridge/Makefile.in
++++ b/libbridge/Makefile.in
+@@ -1,7 +1,7 @@
+ 
+ KERNEL_HEADERS=-I@KERNEL_HEADERS@
+ 
+-AR=ar
++AR=@AR@
+ RANLIB=@RANLIB@
+ 
+ CC=@CC@
diff --git a/pkgs/os-specific/linux/bridge-utils/default.nix b/pkgs/os-specific/linux/bridge-utils/default.nix
index 2725a5909b7b..e3207fdf37d1 100644
--- a/pkgs/os-specific/linux/bridge-utils/default.nix
+++ b/pkgs/os-specific/linux/bridge-utils/default.nix
@@ -8,11 +8,12 @@ stdenv.mkDerivation rec {
     sha256 = "42f9e5fb8f6c52e63a98a43b81bd281c227c529f194913e1c51ec48a393b6688";
   };
 
-  # Remove patch once the kernel headers are updated
-  patches = [ ./add-ip6-header.patch ];
+  patches = [
+    ./autoconf-ar.patch
+    ./add-ip6-header.patch # Remove patch once the kernel headers are updated
+  ];
 
   nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ ];
 
   postInstall = ''
     # The bridge utils build does not fail even if the brctl binary
diff --git a/pkgs/os-specific/linux/brillo/default.nix b/pkgs/os-specific/linux/brillo/default.nix
new file mode 100644
index 000000000000..3ad4acf127b7
--- /dev/null
+++ b/pkgs/os-specific/linux/brillo/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchFromGitLab , go-md2man, coreutils, substituteAll }:
+
+stdenv.mkDerivation rec {
+  pname = "brillo";
+  version = "1.4.8";
+
+  src = fetchFromGitLab {
+    owner= "cameronnemo";
+    repo= "brillo";
+    rev= "v${version}";
+    sha256 = "0wxvg541caiwm3bjwbmk7xcng7jd9xsiga2agxwp7gpkrlp74j9f";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./udev-rule.patch;
+      inherit coreutils;
+    })
+  ];
+
+  nativeBuildInputs = [ go-md2man ];
+
+  makeFlags = [ "PREFIX=$(out)" "AADIR=$(out)/etc/apparmor.d" ];
+
+  installTargets = "install-dist";
+
+  meta = with stdenv.lib; {
+    description = "Backlight and Keyboard LED control tool";
+    homepage = https://gitlab.com/cameronnemo/brillo;
+    license = [ licenses.gpl3 licenses.bsd0 ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.alexarice ];
+  };
+}
diff --git a/pkgs/os-specific/linux/brillo/udev-rule.patch b/pkgs/os-specific/linux/brillo/udev-rule.patch
new file mode 100644
index 000000000000..7b1cf4840675
--- /dev/null
+++ b/pkgs/os-specific/linux/brillo/udev-rule.patch
@@ -0,0 +1,13 @@
+diff --git a/contrib/udev.in b/contrib/udev.in
+index 0625952..a6c940e 100644
+--- a/contrib/udev.in
++++ b/contrib/udev.in
+@@ -1,4 +1,4 @@
+-ACTION=="add", SUBSYSTEM=="backlight", RUN+="/bin/chgrp @group@ /sys/class/backlight/%k/brightness"
+-ACTION=="add", SUBSYSTEM=="backlight", RUN+="/bin/chmod g+w /sys/class/backlight/%k/brightness"
+-ACTION=="add", SUBSYSTEM=="leds", RUN+="/bin/chgrp @group@ /sys/class/leds/%k/brightness"
+-ACTION=="add", SUBSYSTEM=="leds", RUN+="/bin/chmod g+w /sys/class/leds/%k/brightness"
++ACTION=="add", SUBSYSTEM=="backlight", RUN+="@coreutils@/bin/chgrp @group@ /sys/class/backlight/%k/brightness"
++ACTION=="add", SUBSYSTEM=="backlight", RUN+="@coreutils@/bin/chmod g+w /sys/class/backlight/%k/brightness"
++ACTION=="add", SUBSYSTEM=="leds", RUN+="@coreutils@/bin/chgrp @group@ /sys/class/leds/%k/brightness"
++ACTION=="add", SUBSYSTEM=="leds", RUN+="@coreutils@/bin/chmod g+w /sys/class/leds/%k/brightness"
diff --git a/pkgs/os-specific/linux/btfs/default.nix b/pkgs/os-specific/linux/btfs/default.nix
index 27fa40887ed2..d2e5d91e3651 100644
--- a/pkgs/os-specific/linux/btfs/default.nix
+++ b/pkgs/os-specific/linux/btfs/default.nix
@@ -3,25 +3,20 @@
 
 stdenv.mkDerivation rec {
   pname = "btfs";
-  version = "2.19";
+  version = "2.20";
 
   src = fetchFromGitHub {
     owner  = "johang";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "1b58zqha2hpnk4ysp9870wd9pkyy6l106ghp0z0x655q70npj0wn";
+    sha256 = "1xil18nmivakdv6rz4sd3203gzfisdvj79spni59kv7dby64rxdz";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
   buildInputs = [
-    boost fuse libtorrentRasterbar curl
+    boost fuse libtorrentRasterbar curl python3
   ];
 
-  preInstall = ''
-    substituteInPlace scripts/btplay \
-      --replace "/usr/bin/env python" "${python3.interpreter}"
-  '';
-
   meta = with stdenv.lib; {
     description = "A bittorrent filesystem based on FUSE";
     homepage    = https://github.com/johang/btfs;
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index f041d2b50429..41ac6e94ab37 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -1,6 +1,8 @@
 { stdenv, lib, buildPackages, fetchurl
 , enableStatic ? false
 , enableMinimal ? false
+# Allow forcing musl without switching stdenv itself, e.g. for our bootstrapping:
+# nix build -f pkgs/top-level/release.nix stdenvBootstrapTools.x86_64-linux.dist
 , useMusl ? stdenv.hostPlatform.libc == "musl", musl
 , extraConfig ? ""
 }:
@@ -32,14 +34,14 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.30.1";
+  name = "busybox-1.31.1";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "1p7vbnwj60q6zkzrzq3pa8ybb7mviv2aa5a8g7s4hh6kvfj0879x";
+    sha256 = "1659aabzp8w4hayr4z8kcpbk2z1q2wqhw7i1yb0l72b45ykl1yfh";
   };
 
   hardeningDisable = [ "format" "pie" ]
@@ -88,7 +90,7 @@ stdenv.mkDerivation rec {
     runHook postConfigure
   '';
 
-  postConfigure = lib.optionalString useMusl ''
+  postConfigure = lib.optionalString (useMusl && stdenv.hostPlatform.libc != "musl") ''
     makeFlagsArray+=("CC=${stdenv.cc.targetPrefix}cc -isystem ${musl.dev}/include -B${musl}/lib -L${musl}/lib")
   '';
 
diff --git a/pkgs/os-specific/linux/busybox/sandbox-shell.nix b/pkgs/os-specific/linux/busybox/sandbox-shell.nix
index c2d82ebc487a..036ea0a0f486 100644
--- a/pkgs/os-specific/linux/busybox/sandbox-shell.nix
+++ b/pkgs/os-specific/linux/busybox/sandbox-shell.nix
@@ -2,8 +2,6 @@
 
 # Minimal shell for use as basic /bin/sh in sandbox builds
 busybox.override {
-  # musl roadmap has RISC-V support projected for 1.1.20
-  useMusl = !stdenv.hostPlatform.isRiscV && stdenv.hostPlatform.libc != "bionic";
   enableStatic = true;
   enableMinimal = true;
   extraConfig = ''
diff --git a/pkgs/os-specific/linux/cpustat/default.nix b/pkgs/os-specific/linux/cpustat/default.nix
new file mode 100644
index 000000000000..23ed2b07c966
--- /dev/null
+++ b/pkgs/os-specific/linux/cpustat/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, lib, fetchurl, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "cpustat";
+  version = "0.02.09";
+
+  src = fetchurl {
+    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "12xahv65yrhs5r830clkl1qnwg3dnrk5qn3zsznzbv1iy2f3cj7y";
+  };
+
+  buildInputs = [ ncurses ];
+
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+  ];
+
+  meta = with lib; {
+    description = "CPU usage monitoring tool";
+    homepage = "https://kernel.ubuntu.com/~cking/cpustat/";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index 354eea40b24b..3210a0106a6f 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "criu";
-  version = "3.12";
+  version = "3.13";
 
   src = fetchurl {
     url    = "https://download.openvz.org/criu/${pname}-${version}.tar.bz2";
-    sha256 = "1z0fpym8fi2jqx99himqs8pm5l4mzrswjqxcyfwjmbabzb77dwhf";
+    sha256 = "1yn9ix9lqvqvjrs3a3g6g1wqfniyf9n7giy0mr3jvijmrcm7y0pa";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/device-tree/raspberrypi.nix b/pkgs/os-specific/linux/device-tree/raspberrypi.nix
index a77200a68f7d..5e99e870ac83 100644
--- a/pkgs/os-specific/linux/device-tree/raspberrypi.nix
+++ b/pkgs/os-specific/linux/device-tree/raspberrypi.nix
@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation {
 
     cp ${raspberrypifw}/share/raspberrypi/boot/bcm*.dtb .
 
-    cp bcm2708-rpi-0-w.dtb bcm2835-rpi-zero-w.dtb
+    cp bcm2708-rpi-zero-w.dtb bcm2835-rpi-zero-w.dtb
     cp bcm2708-rpi-b.dtb bcm2835-rpi-a.dtb
     cp bcm2708-rpi-b.dtb bcm2835-rpi-b.dtb
     cp bcm2708-rpi-b.dtb bcm2835-rpi-b-rev2.dtb
@@ -23,6 +23,7 @@ stdenvNoCC.mkDerivation {
     cp bcm2710-rpi-3-b.dtb bcm2837-rpi-3-b.dtb
     cp bcm2710-rpi-3-b-plus.dtb bcm2837-rpi-3-b-plus.dtb
     cp bcm2710-rpi-cm3.dtb bcm2837-rpi-cm3.dtb
+    cp bcm2711-rpi-4-b.dtb bcm2838-rpi-4-b.dtb
   '';
 
   passthru = {
diff --git a/pkgs/os-specific/linux/digimend/default.nix b/pkgs/os-specific/linux/digimend/default.nix
new file mode 100644
index 000000000000..40f801881fcd
--- /dev/null
+++ b/pkgs/os-specific/linux/digimend/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub, kernel }:
+
+assert stdenv.lib.versionAtLeast kernel.version "3.5";
+
+stdenv.mkDerivation rec {
+  pname = "digimend";
+  version = "unstable-2019-06-18";
+
+  src = fetchFromGitHub {
+    owner = "digimend";
+    repo = "digimend-kernel-drivers";
+    rev = "8b228a755e44106c11f9baaadb30ce668eede5d4";
+    sha256 = "1l54j85540386a8aypqka7p5hy1b63cwmpsscv9rmmf10f78v8mm";
+  };
+
+  INSTALL_MOD_PATH = "\${out}";
+
+  postPatch = ''
+    sed 's/udevadm /true /' -i Makefile
+    sed 's/depmod /true /' -i Makefile
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  postInstall = ''
+    # Remove module reload hack.
+    # The hid-rebind unloads and then reloads the hid-* module to ensure that
+    # the extra/ module is loaded.
+    rm -r $out/lib/udev
+  '';
+
+  makeFlags = [
+    "KVERSION=${kernel.modDirVersion}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "DESTDIR=${placeholder "out"}"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "DIGImend graphics tablet drivers for the Linux kernel";
+    homepage = "https://digimend.github.io/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ gebner ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/displaylink/default.nix b/pkgs/os-specific/linux/displaylink/default.nix
index 7ce5535313c2..642d05e4beb6 100644
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -11,22 +11,22 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "displaylink";
-  version = "4.4.24";
+  version = "5.2.14";
 
   src = requireFile rec {
     name = "displaylink.zip";
-    sha256 = "0c02mg7vbijpfpk9imh0hmls1yiglc216zfllw5ar86r1slhd5y0";
+    sha256 = "03b176y95f04rg3lcnjps9llsjbvd8yksh1fpvjwaciz48mnxh2i";
     message = ''
       In order to install the DisplayLink drivers, you must first
       comply with DisplayLink's EULA and download the binaries and
       sources from here:
 
-      http://www.displaylink.com/downloads/file?id=1261
+      http://www.displaylink.com/downloads/file?id=1369
 
       Once you have downloaded the file, please use the following
       commands and re-run the installation:
 
-      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu ${version}.zip" \$PWD/${name}
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu ${lib.versions.majorMinor version}.zip" \$PWD/${name}
       nix-prefetch-url file://\$PWD/${name}
     '';
   };
@@ -36,7 +36,7 @@ in stdenv.mkDerivation rec {
   unpackPhase = ''
     unzip $src
     chmod +x displaylink-driver-${version}.run
-    ./displaylink-driver-${version}.run --target . --noexec
+    ./displaylink-driver-${version}.run --target . --noexec --nodiskspace
   '';
 
   patches = [ (substituteAll {
@@ -67,8 +67,9 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
+    maintainers = with maintainers; [ nshalman abbradar peterhoeg ];
     platforms = [ "x86_64-linux" "i686-linux" ];
     license = licenses.unfree;
-    homepage = https://www.displaylink.com/;
+    homepage = "https://www.displaylink.com/";
   };
 }
diff --git a/pkgs/os-specific/linux/displaylink/udev-installer.patch b/pkgs/os-specific/linux/displaylink/udev-installer.patch
index 3e62e20c3150..bd7d9d145c9a 100644
--- a/pkgs/os-specific/linux/displaylink/udev-installer.patch
+++ b/pkgs/os-specific/linux/displaylink/udev-installer.patch
@@ -4,13 +4,13 @@
    cat <<'EOF'
  start_service()
  {
--  systemctl start dlm
+-  systemctl start displaylink-driver
 +  @systemd@/bin/systemctl start --no-block dlm
  }
  
  stop_service()
  {
--  systemctl stop dlm
+-  systemctl stop displaylink-driver
 +  @systemd@/bin/systemctl stop dlm
  }
  
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index 1d67b16a4921..0f7f2f9817a5 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dmtcp";
-  version = "2.5.2";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
-    owner = "dmtcp";
-    repo = "dmtcp";
+    owner = pname;
+    repo = pname;
     rev = version;
-    sha256 = "1sq38in4wk855yhfnzbs9xpnps97fhja93w08xjmx7szzm33g5a8";
+    sha256 = "01skyhr573w1dygvkwz66lvir2jsq443fjwkysglwxvmrdfz9kwd";
   };
 
   dontDisableStatic = true;
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
       --replace "os.getenv('USER')" "\"nixbld1\""
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Distributed MultiThreaded Checkpointing";
     longDescription = ''
       DMTCP (Distributed MultiThreaded Checkpointing) is a tool to
@@ -41,7 +41,8 @@ stdenv.mkDerivation rec {
       programs spread across many machines and connected by sockets. It does
       not modify the user's program or the operating system.
     '';
-    homepage = http://dmtcp.sourceforge.net/;
-    license = stdenv.lib.licenses.lgpl3Plus; # most files seem this or LGPL-2.1+
+    homepage = "http://dmtcp.sourceforge.net/";
+    license = licenses.lgpl3Plus; # most files seem this or LGPL-2.1+
+    platforms = intersectLists platforms.linux platforms.x86; # broken on ARM and Darwin
   };
 }
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index 13614493f610..7525fc8e405b 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -8,11 +8,11 @@ let
 
 in stdenv.mkDerivation rec {
   name = "dpdk-${version}" + lib.optionalString mod "-${kernel.version}";
-  version = "17.11.2";
+  version = "19.08.2";
 
   src = fetchurl {
     url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
-    sha256 = "19m5l3jkrns8r1zbjb6ry18w50ff36kbl5b5g6pfcp9p57sfisd2";
+    sha256 = "141bqqy4w6nzs9z70x7yv94a4gmxjfal46pxry9bwdh3zi1jwnyd";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -59,6 +59,6 @@ EOF
     homepage = http://dpdk.org/;
     license = with licenses; [ lgpl21 gpl2 bsd2 ];
     platforms =  [ "x86_64-linux" ];
-    maintainers = with maintainers; [ domenkozar orivej ];
+    maintainers = with maintainers; [ domenkozar magenbluten orivej ];
   };
 }
diff --git a/pkgs/os-specific/linux/drbd/default.nix b/pkgs/os-specific/linux/drbd/default.nix
index 5e990511eed7..0e35f45f042a 100644
--- a/pkgs/os-specific/linux/drbd/default.nix
+++ b/pkgs/os-specific/linux/drbd/default.nix
@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./pass-force.patch ];
 
-  buildInputs = [ flex perl ];
+  nativeBuildInputs = [ flex ];
+  buildInputs = [ perl ];
 
   configureFlags = [
     "--without-distro"
diff --git a/pkgs/os-specific/linux/dropwatch/default.nix b/pkgs/os-specific/linux/dropwatch/default.nix
index f5b7e44a3fbc..061dce048607 100644
--- a/pkgs/os-specific/linux/dropwatch/default.nix
+++ b/pkgs/os-specific/linux/dropwatch/default.nix
@@ -3,17 +3,16 @@
 
 stdenv.mkDerivation rec {
   pname = "dropwatch";
-  version = "1.5";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "nhorman";
     repo = pname;
-    rev = version;
-    sha256 = "085hyyl28v0vpxfnmzchl97fjfnzj46ynhkg6y4i6h194y0d99m7";
+    rev = "v${version}";
+    sha256 = "1qmax0l7z1qik42c949fnvjh5r6awk4gpgzdsny8iwnmwzjyp8b8";
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-
   buildInputs = [ libbfd libnl ncurses readline zlib ];
 
   # To avoid running into https://sourceware.org/bugzilla/show_bug.cgi?id=14243 we need to define:
@@ -25,8 +24,8 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    description = "Kernel dropped packet monitor";
-    homepage = https://github.com/nhorman/dropwatch;
+    description = "Linux kernel dropped packet monitor";
+    homepage = "https://github.com/nhorman/dropwatch";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = [ maintainers.c0bw3b ];
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index b10d45d8a4b6..bd0ddb4ce1df 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.21";
+  version = "0.26";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
      url = "https://git.kernel.org/pub/scm/libs/${pname}/${pname}.git";
      rev = version;
-     sha256 = "0m7fk2xgzsz7am0wjw98sqa42zpw3cz3hz399niw5rj8dbqh0zpy";
+     sha256 = "1gnqd7dghwkcn48f6fr9qvkkm976b3x4bn3l7l2k9pamzpng084i";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
index 9d836b30dc76..d087a9e2e26d 100644
--- a/pkgs/os-specific/linux/eudev/default.nix
+++ b/pkgs/os-specific/linux/eudev/default.nix
@@ -3,10 +3,10 @@ let
   s = # Generated upstream information
   rec {
     baseName="eudev";
-    version = "3.2.8";
+    version = "3.2.9";
     name="${baseName}-${version}";
     url="http://dev.gentoo.org/~blueness/eudev/eudev-${version}.tar.gz";
-    sha256 = "1f7n8dz01yr7qvk64401xw1xs1mj60d33d9brqy1q9siks799r31";
+    sha256 = "1z6lfhhbjs6j7pbp6ybn17ywjsdl87ql6g1p3m2y26aa10cqcqc9";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 2508fb851a88..72f3b1fbd9c2 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -2,20 +2,23 @@
 
 stdenv.mkDerivation rec {
   pname = "evdi";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ajjsh1fw7w0k28r6qq7kh3qcr87gzzjp8s890algbglynlafzfw";
+    sha256 = "1gp8xbhd5pmcl95izhpvw9gxfcsbv5f80s6q39l4y3z9j734rb8j";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   buildInputs = [ kernel libdrm ];
 
-  makeFlags = [ "KVER=${kernel.modDirVersion}" "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  makeFlags = [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "KVER=${kernel.modDirVersion}"
+  ];
 
   hardeningDisable = [ "format" "pic" "fortify" ];
 
@@ -26,9 +29,9 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Extensible Virtual Display Interface";
-    platforms = platforms.linux;
+    homepage = "https://www.displaylink.com/";
     license = with licenses; [ lgpl21 gpl2 ];
-    homepage = https://www.displaylink.com/;
-    broken = versionOlder kernel.version "4.9" || versionAtLeast kernel.version "5.3" || stdenv.isAarch64;
+    platforms = platforms.linux;
+    broken = versionOlder kernel.version "4.9" || stdenv.isAarch64;
   };
 }
diff --git a/pkgs/os-specific/linux/exfat/default.nix b/pkgs/os-specific/linux/exfat/default.nix
index 036cd3f28a1b..e66ac4d65ab9 100644
--- a/pkgs/os-specific/linux/exfat/default.nix
+++ b/pkgs/os-specific/linux/exfat/default.nix
@@ -6,13 +6,13 @@ assert lib.versionAtLeast kernel.version  "4.2" || lib.versionOlder kernel.versi
 
 stdenv.mkDerivation rec {
   name = "exfat-nofuse-${version}-${kernel.version}";
-  version = "2018-04-16";
+  version = "2019-09-06";
 
   src = fetchFromGitHub {
-    owner = "dorimanx";
+    owner = "AdrianBan";
     repo = "exfat-nofuse";
-    rev = "01c30ad52625a7261e1b0d874553b6ca7af25966";
-    sha256 = "0n1ibamf1yj8iqapc86lfscnky9p07ngsi4f2kpv3d5r2s6mzsh6";
+    rev = "5536f067373c196f152061f5000fe0032dc07c48";
+    sha256 = "00mhadsv2iw8z00a6170hwbvk3afx484nn3irmd5f5kmhs34sw7k";
   };
 
   hardeningDisable = [ "pic" ];
@@ -27,18 +27,9 @@ stdenv.mkDerivation rec {
     install -m644 -b -D exfat.ko $out/lib/modules/${kernel.modDirVersion}/kernel/fs/exfat/exfat.ko
   '';
 
-  patches = [
-    # fix compile-errors in 4.18 and 4.20
-    # ref: https://github.com/dorimanx/exfat-nofuse/pull/137
-    (fetchpatch {
-      url = https://github.com/dorimanx/exfat-nofuse/compare/01c30ad52625a7261e1b0d874553b6ca7af25966...f93a47e6414d567a1e7f6ab7f34b015b20f9a050.patch ;
-      sha256 = "0w57pi9h6dwjxfgc3zpwy6sr4zw42hn1zj72f7wgfpqrx6d8xkh5";
-    } )
-  ];
-
   meta = {
     description = "exfat kernel module";
-    homepage = https://github.com/dorimanx/exfat-nofuse;
+    inherit (src.meta) homepage;
     license = lib.licenses.gpl2;
     maintainers = with lib.maintainers; [ makefu ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/fbterm/default.nix b/pkgs/os-specific/linux/fbterm/default.nix
index c8fc633f8bd3..d56b254d3821 100644
--- a/pkgs/os-specific/linux/fbterm/default.nix
+++ b/pkgs/os-specific/linux/fbterm/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
     inherit (s) url sha256;
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ncurses ];
   inherit buildInputs;
 
   preConfigure = ''
@@ -31,6 +31,7 @@ stdenv.mkDerivation {
   preBuild = ''
     mkdir -p "$out/share/terminfo"
     tic -a -v2 -o"$out/share/terminfo" terminfo/fbterm
+    makeFlagsArray+=("AR=$AR")
   '';
 
   patches = [
@@ -47,6 +48,7 @@ stdenv.mkDerivation {
       url = "https://raw.githubusercontent.com/glitsj16/fbterm-patched/d1fe03313be4654dd0a1c0bb5f51530732345134/miscoloring-fix.patch";
       sha256 = "1mjszji0jgs2jsagjp671fv0d1983wmxv009ff1jfhi9pbay6jd0";
     })
+    ./select.patch
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/fbterm/select.patch b/pkgs/os-specific/linux/fbterm/select.patch
new file mode 100644
index 000000000000..549674047a93
--- /dev/null
+++ b/pkgs/os-specific/linux/fbterm/select.patch
@@ -0,0 +1,12 @@
+diff --git a/src/fbio.cpp b/src/fbio.cpp
+index e5afc44..2485227 100644
+--- a/src/fbio.cpp
++++ b/src/fbio.cpp
+@@ -18,6 +18,7 @@
+  *
+  */
+ 
++#include <sys/select.h>
+ #include <unistd.h>
+ #include <fcntl.h>
+ #include "config.h"
diff --git a/pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix b/pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix
index c9723c944ab1..1a1c1ec39d7b 100644
--- a/pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix
@@ -2,7 +2,7 @@
 
 let
 
-  version = "1.43_4";
+  version = "1.43_5";
 
 
   # Updated according to https://github.com/patjak/bcwc_pcie/pull/81/files
@@ -10,8 +10,8 @@ let
   # and https://github.com/patjak/bcwc_pcie/blob/5a7083bd98b38ef3bd223f7ee531d58f4fb0fe7c/firmware/extract-firmware.sh
 
   # From the Makefile:
-  dmgUrl = "https://support.apple.com/downloads/DL1877/en_US/osxupd10.11.5.dmg";
-  dmgRange = "205261917-208085450"; # the whole download is 1.3GB, this cuts it down to 2MB
+  dmgUrl = "https://updates.cdn-apple.com/2019/cert/041-88431-20191011-e7ee7d98-2878-4cd9-bc0a-d98b3a1e24b1/OSXUpd10.11.5.dmg";
+  dmgRange = "204909802-207733123"; # the whole download is 1.3GB, this cuts it down to 2MB
   # Notes:
   # 1. Be sure to update the sha256 below in the fetch_url
   # 2. Be sure to update the homepage in the meta
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
   inherit version;
   src = fetchurl {
     url = dmgUrl;
-    sha256 = "0xqkl4yds0n9fdjvnk0v5mj382q02crry6wm2q7j3ncdqwsv02sv";
+    sha256 = "0s8crlh8rvpanzk1w4z3hich0a3mw0m5xhpcg07bxy02calhpdk1";
     curlOpts = "-r ${dmgRange}";
   };
 
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "facetimehd firmware";
-    homepage = https://support.apple.com/downloads/DL1877;
+    homepage = https://support.apple.com/kb/DL1877;
     license = licenses.unfree;
     maintainers = with maintainers; [ womfoo grahamc ];
     platforms = [ "i686-linux" "x86_64-linux" ];
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 380444f02693..8db9d4fb3b5d 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -1,13 +1,13 @@
-{ stdenv, fetchgit }:
+{ stdenv, fetchgit, lib }:
 
 stdenv.mkDerivation rec {
   pname = "firmware-linux-nonfree";
-  version = "2019-07-17";
+  version = "2019-10-22";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
-    rev = "20190717";
-    sha256 = "1dcaqdqyffxiadx420pg20157wqidz0c0ca5mrgyfxgrbh6a4mdj";
+    rev = lib.replaceStrings ["-"] [""] version;
+    sha256 = "03ycc55h7vgd4fmb7v7gl7lplf7pg7acs16aa2rramgldxqvyx7j";
   };
 
   installFlags = [ "DESTDIR=$(out)" ];
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "1q3zqa3xxg4679p893xzwpa43afvdnnkg5xb0qs6mac75sizngid";
+  outputHash = "15nm0xh2xq8mnk7a66iljcklc15gvh6jcpz2d9llg1fkv6w8lqc6";
 
   meta = with stdenv.lib; {
     description = "Binary firmware collection packaged by kernel.org";
diff --git a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
index 4903eadef4b5..81e82d68dbc4 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,30 +1,21 @@
 diff --git a/data/meson.build b/data/meson.build
-index 61664cd6..f10abbba 100644
+index 25db9509..f394eb25 100644
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -11,7 +11,7 @@ if get_option('daemon')
+@@ -13,7 +13,7 @@
+ if build_daemon
+   subdir('installed-tests')
+   install_data(['daemon.conf'],
+-    install_dir : join_paths(sysconfdir, 'fwupd')
++    install_dir : join_paths(sysconfdir_install, 'fwupd')
+   )
  endif
  
- install_data(['daemon.conf'],
--  install_dir : join_paths(sysconfdir, 'fwupd')
-+  install_dir : join_paths(sysconfdir_install, 'fwupd')
- )
- 
- install_data(['org.freedesktop.fwupd.metainfo.xml'],
-@@ -23,7 +23,7 @@ install_data(['org.freedesktop.fwupd.svg'],
- )
- 
- install_data(['org.freedesktop.fwupd.conf'],
--  install_dir : join_paths(sysconfdir, 'dbus-1', 'system.d')
-+  install_dir : join_paths(sysconfdir_install, 'dbus-1', 'system.d')
- )
- 
- if get_option('daemon')
 diff --git a/data/pki/meson.build b/data/pki/meson.build
 index eefcc914..dc801fa1 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -4,14 +4,14 @@ if get_option('gpg')
+@@ -4,14 +4,14 @@
        'GPG-KEY-Linux-Foundation-Firmware',
        'GPG-KEY-Linux-Vendor-Firmware-Service',
      ],
@@ -41,7 +32,7 @@ index eefcc914..dc801fa1 100644
    )
  endif
  
-@@ -19,12 +19,12 @@ if get_option('pkcs7')
+@@ -19,12 +19,12 @@
    install_data([
        'LVFS-CA.pem',
      ],
@@ -57,10 +48,10 @@ index eefcc914..dc801fa1 100644
  endif
  
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index a27c31ef..374e09b6 100644
+index 826a3c1d..b78db663 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
-@@ -3,7 +3,7 @@ if get_option('daemon') and get_option('lvfs')
+@@ -3,7 +3,7 @@
        'lvfs.conf',
        'lvfs-testing.conf',
      ],
@@ -69,7 +60,7 @@ index a27c31ef..374e09b6 100644
    )
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
-@@ -37,12 +37,12 @@ configure_file(
+@@ -37,12 +37,12 @@
    output : 'vendor.conf',
    configuration : con2,
    install: true,
@@ -85,10 +76,10 @@ index a27c31ef..374e09b6 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index a89f9b3f..736896eb 100644
+index 8e1de887..a5bb1fe6 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -145,6 +145,12 @@ localstatedir = join_paths(prefix, get_option('localstatedir'))
+@@ -158,6 +158,12 @@
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
  
@@ -99,13 +90,13 @@ index a89f9b3f..736896eb 100644
 +endif
 +
  gio = dependency('gio-2.0', version : '>= 2.45.8')
+ giounix = dependency('gio-unix-2.0', version : '>= 2.45.8')
  if gio.version().version_compare ('>= 2.55.0')
-   conf.set('HAVE_GIO_2_55_0', '1')
 diff --git a/meson_options.txt b/meson_options.txt
-index 5d4163e8..db81fd1f 100644
+index 71b50c6a..561c2031 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -21,6 +21,7 @@ option('plugin_modem_manager', type : 'boolean', value : false, description : 'e
+@@ -24,6 +24,7 @@
  option('systemd', type : 'boolean', value : true, description : 'enable systemd support')
  option('systemdunitdir', type: 'string', value: '', description: 'Directory for systemd units')
  option('elogind', type : 'boolean', value : false, description : 'enable elogind support')
@@ -117,7 +108,7 @@ diff --git a/plugins/dell-esrt/meson.build b/plugins/dell-esrt/meson.build
 index cb9f4555..b972d7fb 100644
 --- a/plugins/dell-esrt/meson.build
 +++ b/plugins/dell-esrt/meson.build
-@@ -36,5 +36,5 @@ configure_file(
+@@ -36,5 +36,5 @@
    output : 'dell-esrt.conf',
    configuration : con2,
    install: true,
@@ -128,7 +119,7 @@ diff --git a/plugins/redfish/meson.build b/plugins/redfish/meson.build
 index 5c88504e..7706da71 100644
 --- a/plugins/redfish/meson.build
 +++ b/plugins/redfish/meson.build
-@@ -26,7 +26,7 @@ shared_module('fu_plugin_redfish',
+@@ -26,7 +26,7 @@
  )
  
  install_data(['redfish.conf'],
@@ -137,11 +128,24 @@ index 5c88504e..7706da71 100644
  )
  
  if get_option('tests')
+diff --git a/plugins/thunderbolt/meson.build b/plugins/thunderbolt/meson.build
+index 42718abf..bc815491 100644
+--- a/plugins/thunderbolt/meson.build
++++ b/plugins/thunderbolt/meson.build
+@@ -46,7 +46,7 @@
+ )
+ 
+ install_data(['thunderbolt.conf'],
+-  install_dir:  join_paths(sysconfdir, 'fwupd')
++  install_dir:  join_paths(sysconfdir_install, 'fwupd')
+ )
+ # we use functions from 2.52 in the tests
+ if get_option('tests') and umockdev.found() and gio.version().version_compare('>= 2.52')
 diff --git a/plugins/uefi/meson.build b/plugins/uefi/meson.build
-index ac9f5dd8..1ab51b5e 100644
+index 45b18d7d..ef8e0b04 100644
 --- a/plugins/uefi/meson.build
 +++ b/plugins/uefi/meson.build
-@@ -79,7 +79,7 @@ executable(
+@@ -85,7 +85,7 @@
  )
  
  install_data(['uefi.conf'],
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index c688d8c6ab39..1f6a7145b779 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -45,6 +45,7 @@
 , freetype
 , fontconfig
 , pango
+, tpm2-tss
 , bubblewrap
 , efibootmgr
 , flashrom
@@ -57,6 +58,7 @@ let
     pygobject3
     pycairo
     pillow
+    setuptools
   ]);
 
   installedTestsPython = python3.withPackages (p: with p; [
@@ -78,18 +80,18 @@ let
 
   # # Currently broken on Aarch64
   # haveFlashrom = isx86;
-  # Experimental in 1.2.10
+  # Experimental
   haveFlashrom = false;
 
 in
 
 stdenv.mkDerivation rec {
   pname = "fwupd";
-  version = "1.2.10";
+  version = "1.3.3";
 
   src = fetchurl {
     url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-    sha256 = "0inngs7i48akm9c7fmdsf9zjif595rkaba69rl76jfwfv8r21vjb";
+    sha256 = "0nqzqvx8nzflhb4kzvkdcv7kixb50vh6h21kpkd7pjxp942ndzql";
   };
 
   outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
@@ -136,6 +138,7 @@ stdenv.mkDerivation rec {
     freetype
     fontconfig
     pango
+    tpm2-tss
     efivar
   ] ++ stdenv.lib.optionals haveDell [
     libsmbios
@@ -145,6 +148,10 @@ stdenv.mkDerivation rec {
     ./fix-paths.patch
     ./add-option-for-installation-sysconfdir.patch
 
+    # do not require which
+    # https://github.com/fwupd/fwupd/pull/1568
+    ./no-which.patch
+
     # installed tests are installed to different output
     # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle
     (substituteAll {
@@ -194,6 +201,7 @@ stdenv.mkDerivation rec {
   '';
 
   mesonFlags = [
+    "-Dgtkdoc=true"
     "-Dplugin_dummy=true"
     "-Dudevdir=lib/udev"
     "-Dsystemdunitdir=lib/systemd/system"
@@ -208,8 +216,8 @@ stdenv.mkDerivation rec {
     "-Dplugin_synaptics=false"
   ] ++ stdenv.lib.optionals (!haveRedfish) [
     "-Dplugin_redfish=false"
-  ] ++ stdenv.lib.optionals (!haveFlashrom) [
-    "-Dplugin_flashrom=false"
+  ] ++ stdenv.lib.optionals haveFlashrom [
+    "-Dplugin_flashrom=true"
   ];
 
   # TODO: We need to be able to override the directory flags from meson setup hook
@@ -230,15 +238,18 @@ stdenv.mkDerivation rec {
   # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
   PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
 
+  # cannot install to systemd prefix
+  PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMPRESETDIR = "${placeholder "out"}/lib/systemd/system-preset";
+
   # TODO: wrapGAppsHook wraps efi capsule even though it is not elf
   dontWrapGApps = true;
   # so we need to wrap the executables manually
   postFixup = ''
     find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
       | while IFS= read -r -d ''' file; do
-      if [[ "''${file}" != *.efi ]]; then
-        echo "Wrapping program ''${file}"
-        wrapProgram "''${file}" "''${gappsWrapperArgs[@]}"
+      if [[ "$file" != *.efi ]]; then
+        echo "Wrapping program $file"
+        wrapGApp "$file"
       fi
     done
   '';
@@ -246,11 +257,15 @@ stdenv.mkDerivation rec {
   # /etc/fwupd/uefi.conf is created by the services.hardware.fwupd NixOS module
   passthru = {
     filesInstalledToEtc = [
+      # "fwupd/daemon.conf" # already created by the module
+      "fwupd/redfish.conf"
       "fwupd/remotes.d/dell-esrt.conf"
       "fwupd/remotes.d/lvfs-testing.conf"
       "fwupd/remotes.d/lvfs.conf"
       "fwupd/remotes.d/vendor.conf"
       "fwupd/remotes.d/vendor-directory.conf"
+      "fwupd/thunderbolt.conf"
+      # "fwupd/uefi.conf" # already created by the module
       "pki/fwupd/GPG-KEY-Hughski-Limited"
       "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
       "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
@@ -261,12 +276,12 @@ stdenv.mkDerivation rec {
     ];
 
     tests = {
-      installedTests = nixosTests.fwupd;
+      installedTests = nixosTests.installed-tests.fwupd;
     };
   };
 
   meta = with stdenv.lib; {
-    homepage = https://fwupd.org/;
+    homepage = "https://fwupd.org/";
     maintainers = with maintainers; [ jtojnar ];
     license = [ licenses.gpl2 ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch b/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
index 9efd7b8d6abd..474b250097d0 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
@@ -6,14 +6,3 @@ index c7a430c0..e69de29b 100644
 -install_data('README.md',
 -  install_dir : join_paths(localstatedir, 'lib', 'fwupd', 'builder')
 -)
-diff --git a/meson_post_install.sh b/meson_post_install.sh
-index 0cbb6f41..d757a81a 100755
---- a/meson_post_install.sh
-+++ b/meson_post_install.sh
-@@ -11,6 +11,4 @@ LOCALSTATEDIR=$2
-     echo 'Updating systemd deps'
-     mkdir -p ${DESTDIR}${SYSTEMDUNITDIR}/system-update.target.wants
-     ln -sf ../fwupd-offline-update.service ${DESTDIR}${SYSTEMDUNITDIR}/system-update.target.wants/fwupd-offline-update.service
--    echo 'Creating stateful directory'
--    mkdir -p ${DESTDIR}${LOCALSTATEDIR}/lib/fwupd
- #fi
diff --git a/pkgs/os-specific/linux/firmware/fwupd/no-which.patch b/pkgs/os-specific/linux/firmware/fwupd/no-which.patch
new file mode 100644
index 000000000000..c0c65e42539d
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/fwupd/no-which.patch
@@ -0,0 +1,31 @@
+--- a/plugins/uefi/efi/generate_binary.sh
++++ b/plugins/uefi/efi/generate_binary.sh
+@@ -1,9 +1,9 @@
+ #!/bin/sh
+ output=$2
+-objcopy_cmd=$(which objcopy)
+-genpeimg_cmd=$(which genpeimg)
++objcopy_cmd=$(command -v objcopy)
++genpeimg_cmd=$(command -v genpeimg)
+ 
+-$objcopy_cmd  -j .text \
++"$objcopy_cmd"  -j .text \
+               -j .sdata \
+               -j .data \
+               -j .dynamic \
+@@ -11,7 +11,7 @@
+               -j .rel \
+               -j .rela \
+               -j .reloc \
+-              $*
++              "$@"
+ 
+ if [ -n "${genpeimg_cmd}" ]; then
+         $genpeimg_cmd -d \
+@@ -20,5 +20,5 @@
+                       +n \
+                       -d \
+                       +s \
+-                      $output
++                      "$output"
+ fi
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
index e9ee91a2de7b..392ddda6f573 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
@@ -2,22 +2,22 @@
 
 stdenv.mkDerivation {
   pname = "raspberrypi-wireless-firmware";
-  version = "2018-08-20";
+  version = "2019-08-16";
 
   srcs = [
     (fetchFromGitHub {
       name = "bluez-firmware";
       owner = "RPi-Distro";
       repo = "bluez-firmware";
-      rev = "ade2bae1aaaebede09abb8fb546f767a0e4c7804";
-      sha256 = "07gm76gxp5anv6paryvxcp34a86fkny8kdlzqhzcpfczzglkp6ag";
+      rev = "96eefffcccc725425fd83be5e0704a5c32b79e54";
+      sha256 = "05h57gcxhb2c84h99cyxxx4mzi6kd5fm8pjqkz3nq5vs3nv8cqhr";
     })
     (fetchFromGitHub {
       name = "firmware-nonfree";
       owner = "RPi-Distro";
       repo = "firmware-nonfree";
-      rev = "b518de45ced519e8f7a499f4778100173402ae43";
-      sha256 = "1d5026ic9awji6c67irpwsxpxgsc0dhn11d3abkxi2vvra1pir4g";
+      rev = "130cb86fa30cafbd575d38865fa546350d4c5f9c";
+      sha256 = "0jmhgbpldzz8n8lncpzwfl5ym8zgss05y952rfpwcf9v5c7vgabx";
     })
   ];
 
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "1s5gb00v42s5izbaw8irs1fwvhh7z9wl07czc0nkw6p91871ivb7";
+  outputHash = "1r4alf1fbj6vkkf54d0anm47ymb6gn2ykl4a2hhd34b0hnf1dnhn";
 
   meta = with stdenv.lib; {
     description = "Firmware for builtin Wifi/Bluetooth devices in the Raspberry Pi 3 and Zero W";
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index ebd69d1fe12b..a8c4bd559d3c 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "raspberrypi-firmware";
-  version = "1.20190620+1";
+  version = "1.20190925";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "0gbqlkr50qlmbpwr0n61pb58w0k3sfjfirh2y683rlkp5rlq7mrf";
+    sha256 = "0xyj3f04dcfnl9hp8hakgwcb1msqh7934n0pclcmzy47xjkz7ris";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index cdd42e98f06b..92594ea99de4 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -4,17 +4,15 @@
 
 buildGoPackage rec {
   pname = "fscrypt";
-  version = "unstable-2019-08-29";
+  version = "0.2.5";
 
   goPackagePath = "github.com/google/fscrypt";
 
-  goDeps = ./deps.nix;
-
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
-    rev = "8a3acda2011e9a080ee792c1e11646e6118a4930";
-    sha256 = "17h6r5lqiz0cw9vsixv48a1p78nd7bs1kncg6p4lfagl7kr5hpls";
+    rev = "v${version}";
+    sha256 = "1jf6363kc9id3ar93znlcglx3llgv01ccp3nlbamm98rm9dps4qk";
   };
 
   buildInputs = [ pam ];
diff --git a/pkgs/os-specific/linux/fscrypt/deps.nix b/pkgs/os-specific/linux/fscrypt/deps.nix
deleted file mode 100644
index 5d3e8a89a91f..000000000000
--- a/pkgs/os-specific/linux/fscrypt/deps.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "v1.2.0";
-      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "v0.8.0";
-      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
-    };
-  }
-  {
-    goPackagePath = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev = "v1.20.0";
-      sha256 = "0y6f4sbzkiiwrxbl15biivj8c7qwxnvm3zl2dd3mw4wzg4x10ygj";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "614d502a4dac";
-      sha256 = "1rcyvsl8b8pk7h8lwl0fpiflrx8zs121wi5490ln0qnvkk8d4bwy";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "8a410e7b638d";
-      sha256 = "0hp0l8f6fir5gmgrjq0mhh5ikc0rlrm72774228800kfwqjrxxny";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev = "1d60e4601c6f";
-      sha256 = "046jlanz2lkxq1r57x9bl6s4cvfqaic6p2xybsj8mq1120jv4rs6";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "d99a578cf41b";
-      sha256 = "10q9xx4pmnq92qn6ff4xp7n1hx766wvw2rf7pqcd6rx5plgwz8cm";
-    };
-  }
-]
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index f48e528b486d..edee6a52ba2b 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -11,7 +11,7 @@ in {
   };
 
   fuse_3 = mkFuse {
-    version = "3.6.2";
-    sha256Hash = "1cxx94q6zqns1iw5d4g3ll8f78swqxl6h25bpxmqkqsj6c91pzkl";
+    version = "3.8.0";
+    sha256Hash = "0zbj5l2pffs0q38lqfrnkafsgxf50mw5mqmh4m2jmqab1fxg5mip";
   };
 }
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index b5df553a97c3..2f725952f0a3 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "19.08.00";
+  version = "19.09.00";
 
   src = fetchzip {
     url = "http://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "14v4vxvfsl008xalsmlhl9wh89xlrfffh3pky9m90flaizdzwyp4";
+    sha256 = "039dc1sy2pfj3b7kqcww3qaabrhzks1xfkynzwbjwdk04fjiwxfw";
     stripRoot = false;
   };
 
diff --git a/pkgs/os-specific/linux/fwts/module.nix b/pkgs/os-specific/linux/fwts/module.nix
new file mode 100644
index 000000000000..ef90e0c303ba
--- /dev/null
+++ b/pkgs/os-specific/linux/fwts/module.nix
@@ -0,0 +1,31 @@
+{ stdenv, fwts, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "fwts-efi-runtime";
+  version = "${fwts.version}-${kernel.version}";
+
+  inherit (fwts) src;
+
+  sourceRoot = "source/efi_runtime";
+
+  postPatch = ''
+    substituteInPlace Makefile --replace \
+      '/lib/modules/$(KVER)/build' \
+      '${kernel.dev}/lib/modules/${kernel.modDirVersion}/build'
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  hardeningDisable = [ "pic" ];
+
+  makeFlags = [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  meta = with stdenv.lib; {
+    inherit (fwts.meta) homepage license;
+    description = fwts.meta.description + "(efi-runtime kernel module)";
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/health-check/default.nix b/pkgs/os-specific/linux/health-check/default.nix
new file mode 100644
index 000000000000..c6dc7bf66e2c
--- /dev/null
+++ b/pkgs/os-specific/linux/health-check/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, lib, fetchurl, json_c, libbsd }:
+
+stdenv.mkDerivation rec {
+  pname = "health-check";
+  version = "0.03.03";
+
+  src = fetchurl {
+    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "1bvgfzmvbqqhf1ailbwrsma6sbp5wcl6a35pb1n0y1n1p1hnqzph";
+  };
+
+  buildInputs = [ json_c libbsd ];
+
+  makeFlags = [ "JSON_OUTPUT=y" "FNOTIFY=y" ];
+
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+  ];
+
+  meta = with lib; {
+    description = "Process monitoring tool";
+    homepage = "https://kernel.ubuntu.com/~cking/health-check/";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index e90470cd5891..41d7f2366822 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://hostap.epitest.fi;
+    homepage = https://hostap.epitest.fi;
     repositories.git = git://w1.fi/hostap.git;
     description = "A user space daemon for access point and authentication servers";
     license = licenses.gpl2;
diff --git a/pkgs/os-specific/linux/hyperv-daemons/default.nix b/pkgs/os-specific/linux/hyperv-daemons/default.nix
index a209f1ab4bb9..1a111a295a42 100644
--- a/pkgs/os-specific/linux/hyperv-daemons/default.nix
+++ b/pkgs/os-specific/linux/hyperv-daemons/default.nix
@@ -1,7 +1,10 @@
-{ stdenv, lib, python, kernel, makeWrapper, writeText }:
+{ stdenv, lib, python, kernel, makeWrapper, writeText
+, gawk, iproute }:
 
 let
-  daemons = stdenv.mkDerivation {
+  libexec = "libexec/hypervkvpd";
+
+  daemons = stdenv.mkDerivation rec {
     pname = "hyperv-daemons-bin";
     inherit (kernel) src version;
 
@@ -10,10 +13,15 @@ let
     # as of 4.9 compilation will fail due to -Werror=format-security
     hardeningDisable = [ "format" ];
 
-    preConfigure = ''
+    postPatch = ''
       cd tools/hv
+      substituteInPlace hv_kvp_daemon.c \
+        --replace /usr/libexec/hypervkvpd/ $out/${libexec}/
     '';
 
+    # We don't actually need the hv_get_{dhcp,dns}_info scripts on NixOS in
+    # their current incarnation but with them in place, we stop the spam of
+    # errors in the log.
     installPhase = ''
       runHook preInstall
 
@@ -21,7 +29,9 @@ let
         install -Dm755 hv_''${f}_daemon -t $out/bin
       done
 
-      install -Dm755 hv_get_dns_info.sh lsvmbus -t $out/bin
+      install -Dm755 lsvmbus             $out/bin/lsvmbus
+      install -Dm755 hv_get_dhcp_info.sh $out/${libexec}/hv_get_dhcp_info
+      install -Dm755 hv_get_dns_info.sh  $out/${libexec}/hv_get_dns_info
 
       # I don't know why this isn't being handled automatically by fixupPhase
       substituteInPlace $out/bin/lsvmbus \
@@ -31,8 +41,8 @@ let
     '';
 
     postFixup = ''
-      # kvp needs to be able to find the script(s)
-      wrapProgram $out/bin/hv_kvp_daemon --prefix PATH : $out/bin
+      wrapProgram $out/bin/hv_kvp_daemon \
+        --prefix PATH : $out/bin:${lib.makeBinPath [ gawk iproute ]}
     '';
   };
 
@@ -56,24 +66,19 @@ let
 
 in stdenv.mkDerivation {
   pname = "hyperv-daemons";
-
   inherit (kernel) version;
 
   # we just stick the bins into out as well as it requires "out"
   outputs = [ "bin" "lib" "out" ];
 
-  phases = [ "installPhase" ];
-
   buildInputs = [ daemons ];
 
-  installPhase = ''
+  buildCommand = ''
     system=$lib/lib/systemd/system
 
-    mkdir -p $system
-
-    cp ${service "fcopy" "file copy (FCOPY)" "hv_fcopy" } $system/hv-fcopy.service
-    cp ${service "kvp"   "key-value pair (KVP)"     ""  } $system/hv-kvp.service
-    cp ${service "vss"   "volume shadow copy (VSS)" ""  } $system/hv-vss.service
+    install -Dm444 ${service "fcopy" "file copy (FCOPY)" "hv_fcopy" } $system/hv-fcopy.service
+    install -Dm444 ${service "kvp"   "key-value pair (KVP)"     ""  } $system/hv-kvp.service
+    install -Dm444 ${service "vss"   "volume shadow copy (VSS)" ""  } $system/hv-vss.service
 
     cat > $system/hyperv-daemons.target <<EOF
     [Unit]
@@ -102,7 +107,7 @@ in stdenv.mkDerivation {
       Microsoft calls their guest agents "Integration Services" which is why
       we use that name here.
     '';
-    homepage = https://kernel.org;
+    homepage = "https://kernel.org";
     maintainers = with maintainers; [ peterhoeg ];
     platforms = kernel.meta.platforms;
   };
diff --git a/pkgs/os-specific/linux/iio-sensor-proxy/default.nix b/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
index 76ec9be27985..a1d488adcfa1 100644
--- a/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
+++ b/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iio-sensor-proxy";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchFromGitHub {
     owner  = "hadess";
     repo   = pname;
     rev    = version;
-    sha256 = "05ipljw78d8z90cnkygcrpd0qq4vh14bb9hy06vqxnpdbyq46fxh";
+    sha256 = "07rzm1z2p6lh4iv5pyp0p2x5805m9gsh19kcsjls3fi25p3a2c00";
   };
 
   configurePhase = ''
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
new file mode 100644
index 000000000000..5021d12acecd
--- /dev/null
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -0,0 +1,57 @@
+{ stdenv
+, fetchFromGitHub
+, patchelf
+, cmake
+, pkgconfig
+
+, intel-gmmlib
+, intel-graphics-compiler
+, libva
+}:
+
+stdenv.mkDerivation rec {
+  pname = "intel-compute-runtime";
+  version = "19.34.13959";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "compute-runtime";
+    rev = version;
+    sha256 = "1m54w5p5pilrkmlmqgvgrsm3d5dqfdr4jai5siq5ccsqj4gnv1wz";
+  };
+
+  # Build script tries to write the ICD to /etc
+  patches = [ ./etc-dir.patch ];
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [ intel-gmmlib intel-graphics-compiler libva ];
+
+  cmakeFlags = [
+    "-DSKIP_UNIT_TESTS=1"
+
+    "-DIGC_DIR=${intel-graphics-compiler}"
+    "-DETC_DIR=${placeholder "out"}/etc"
+
+    # The install script assumes this path is relative to CMAKE_INSTALL_PREFIX
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+
+  postInstall = ''
+    # Avoid clash with intel-ocl
+    mv $out/etc/OpenCL/vendors/intel.icd $out/etc/OpenCL/vendors/intel-neo.icd
+  '';
+
+  postFixup = ''
+    patchelf --set-rpath ${stdenv.lib.makeLibraryPath [ intel-gmmlib intel-graphics-compiler libva ]} \
+      $out/lib/intel-opencl/libigdrcl.so
+  '';
+
+  meta = with stdenv.lib; {
+    homepage    = https://github.com/intel/compute-runtime;
+    description = "Intel Graphics Compute Runtime for OpenCL. Replaces Beignet for Gen8 (Broadwell) and beyond.";
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ gloaming ];
+  };
+}
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/etc-dir.patch b/pkgs/os-specific/linux/intel-compute-runtime/etc-dir.patch
new file mode 100644
index 000000000000..d9a80ffa6f97
--- /dev/null
+++ b/pkgs/os-specific/linux/intel-compute-runtime/etc-dir.patch
@@ -0,0 +1,15 @@
+diff --git a/package.cmake b/package.cmake
+index 24960d5..e9a21e7 100644
+--- a/package.cmake
++++ b/package.cmake
+@@ -24,7 +24,9 @@ if(UNIX)
+ 
+   get_os_release_info(os_name os_version)
+ 
+-  if("${os_name}" STREQUAL "clear-linux-os")
++  if(DEFINED ETC_DIR)
++    set(_dir_etc ${ETC_DIR})
++  elseif("${os_name}" STREQUAL "clear-linux-os")
+     # clear-linux-os distribution avoids /etc for distribution defaults.
+     set(_dir_etc "/usr/share/defaults/etc")
+   else()
diff --git a/pkgs/os-specific/linux/intel-speed-select/default.nix b/pkgs/os-specific/linux/intel-speed-select/default.nix
new file mode 100644
index 000000000000..cf0dd75a8a46
--- /dev/null
+++ b/pkgs/os-specific/linux/intel-speed-select/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, kernel }:
+
+stdenv.mkDerivation {
+  pname = "intel-speed-select";
+  inherit (kernel) src version;
+
+  makeFlags = [ "bindir=${placeholder "out"}/bin" ];
+
+  postPatch = ''
+    cd tools/power/x86/intel-speed-select
+    sed -i 's,/usr,,g' Makefile
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Tool to enumerate and control the Intel Speed Select Technology features";
+    homepage = https://www.kernel.org/;
+    license = licenses.gpl2;
+    platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
+  };
+}
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 87b7de4736f9..d30ac5e62bb4 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.2.0";
+  version = "5.3.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1a2dywa2kam24951byv9pl32mb9z6klh7d4vp8fwfgrm4vn5vfd5";
+    sha256 = "0gvv269wjn4279hxr5zzwsk2c5qgswr47za3hm1x4frsk52iw76b";
   };
 
   preConfigure = ''
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace " netem " " "
   '';
 
-  outputs = [ "out" "dev"];
+  outputs = [ "out" "dev" ];
 
   makeFlags = [
     "DESTDIR="
diff --git a/pkgs/os-specific/linux/ipsec-tools/CVE-2016-10396.patch b/pkgs/os-specific/linux/ipsec-tools/CVE-2016-10396.patch
new file mode 100644
index 000000000000..b644d46f8c9d
--- /dev/null
+++ b/pkgs/os-specific/linux/ipsec-tools/CVE-2016-10396.patch
@@ -0,0 +1,193 @@
+From: Antoine_Beaupre <anarcat@orangeseeds.org>
+Acked-by: Jiri Bohac <jbohac@suse.cz>
+Subject: PR/51682: Avoid DoS with fragment out of order insertion; keep fragments sorted in the list.
+References: bsc#1047443, CVE-2016-10396
+
+
+
+Index: a/src/racoon/handler.h
+===================================================================
+--- a/src/racoon/handler.h.orig	2018-01-26 18:05:21.114764376 +0100
++++ a/src/racoon/handler.h	2018-01-26 18:05:33.986741103 +0100
+@@ -141,6 +141,7 @@ struct ph1handle {
+ #endif
+ #ifdef ENABLE_FRAG
+ 	int frag;			/* IKE phase 1 fragmentation */
++	int frag_last_index;
+ 	struct isakmp_frag_item *frag_chain;	/* Received fragments */
+ #endif
+ 
+Index: a/src/racoon/isakmp.c
+===================================================================
+--- a/src/racoon/isakmp.c.orig	2018-01-26 18:05:21.118764369 +0100
++++ a/src/racoon/isakmp.c	2018-01-26 18:05:33.986741103 +0100
+@@ -1069,6 +1069,7 @@ isakmp_ph1begin_i(rmconf, remote, local)
+ 		iph1->frag = 1;
+ 	else
+ 		iph1->frag = 0;
++	iph1->frag_last_index = 0;
+ 	iph1->frag_chain = NULL;
+ #endif
+ 	iph1->approval = NULL;
+@@ -1173,6 +1174,7 @@ isakmp_ph1begin_r(msg, remote, local, et
+ #endif
+ #ifdef ENABLE_FRAG
+ 	iph1->frag = 0;
++	iph1->frag_last_index = 0;
+ 	iph1->frag_chain = NULL;
+ #endif
+ 	iph1->approval = NULL;
+Index: a/src/racoon/isakmp_frag.c
+===================================================================
+--- a/src/racoon/isakmp_frag.c.orig	2018-01-26 18:05:21.118764369 +0100
++++ a/src/racoon/isakmp_frag.c	2018-01-26 18:05:33.986741103 +0100
+@@ -173,6 +173,43 @@ vendorid_frag_cap(gen)
+ 	return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]);
+ }
+ 
++static int 
++isakmp_frag_insert(struct ph1handle *iph1, struct isakmp_frag_item *item)
++{
++	struct isakmp_frag_item *pitem = NULL;
++	struct isakmp_frag_item *citem = iph1->frag_chain;
++
++	/* no frag yet, just insert at beginning of list */
++	if (iph1->frag_chain == NULL) {
++		iph1->frag_chain = item;
++		return 0;
++	}
++
++	do {
++		/* duplicate fragment number, abort (CVE-2016-10396) */
++		if (citem->frag_num == item->frag_num)
++			return -1;
++
++		/* need to insert before current item */
++		if (citem->frag_num > item->frag_num) {
++			if (pitem != NULL)
++				pitem->frag_next = item;
++			else
++				/* insert at the beginning of the list  */
++				iph1->frag_chain = item;
++			item->frag_next = citem;
++			return 0;
++		}
++
++		pitem = citem;
++		citem = citem->frag_next;
++	} while (citem != NULL);
++
++	/* we reached the end of the list, insert */
++	pitem->frag_next = item;
++	return 0;
++}
++
+ int 
+ isakmp_frag_extract(iph1, msg)
+ 	struct ph1handle *iph1;
+@@ -224,39 +261,43 @@ isakmp_frag_extract(iph1, msg)
+ 	item->frag_next = NULL;
+ 	item->frag_packet = buf;
+ 
+-	/* Look for the last frag while inserting the new item in the chain */
+-	if (item->frag_last)
+-		last_frag = item->frag_num;
++	/* Check for the last frag before inserting the new item in the chain */
++	if (item->frag_last) {
++		/* if we have the last fragment, indices must match */
++		if (iph1->frag_last_index != 0 &&
++		    item->frag_last != iph1->frag_last_index) {
++			plog(LLV_ERROR, LOCATION, NULL,
++			     "Repeated last fragment index mismatch\n");
++			racoon_free(item);
++			vfree(buf);
++			return -1;
++		}
+ 
+-	if (iph1->frag_chain == NULL) {
+-		iph1->frag_chain = item;
+-	} else {
+-		struct isakmp_frag_item *current;
++		last_frag = iph1->frag_last_index = item->frag_num;
++	}
+ 
+-		current = iph1->frag_chain;
+-		while (current->frag_next) {
+-			if (current->frag_last)
+-				last_frag = item->frag_num;
+-			current = current->frag_next;
+-		}
+-		current->frag_next = item;
++	/* insert fragment into chain */
++	if (isakmp_frag_insert(iph1, item) == -1) {
++		plog(LLV_ERROR, LOCATION, NULL,
++		    "Repeated fragment index mismatch\n");
++		racoon_free(item);
++		vfree(buf);
++		return -1;
+ 	}
+ 
+-	/* If we saw the last frag, check if the chain is complete */
++	/* If we saw the last frag, check if the chain is complete
++	 * we have a sorted list now, so just walk through */
+ 	if (last_frag != 0) {
++		item = iph1->frag_chain;
+ 		for (i = 1; i <= last_frag; i++) {
+-			item = iph1->frag_chain;
+-			do {
+-				if (item->frag_num == i)
+-					break;
+-				item = item->frag_next;
+-			} while (item != NULL);
+-
++			if (item->frag_num != i)
++				break;
++			item = item->frag_next;
+ 			if (item == NULL) /* Not found */
+ 				break;
+ 		}
+ 
+-		if (item != NULL) /* It is complete */
++		if (i > last_frag) /* It is complete */
+ 			return 1;
+ 	}
+ 		
+@@ -291,15 +332,9 @@ isakmp_frag_reassembly(iph1)
+ 	}
+ 	data = buf->v;
+ 
++	item = iph1->frag_chain;
+ 	for (i = 1; i <= frag_count; i++) {
+-		item = iph1->frag_chain;
+-		do {
+-			if (item->frag_num == i)
+-				break;
+-			item = item->frag_next;
+-		} while (item != NULL);
+-
+-		if (item == NULL) {
++		if (item->frag_num != i) {
+ 			plog(LLV_ERROR, LOCATION, NULL, 
+ 			    "Missing fragment #%d\n", i);
+ 			vfree(buf);
+@@ -308,6 +343,7 @@ isakmp_frag_reassembly(iph1)
+ 		}
+ 		memcpy(data, item->frag_packet->v, item->frag_packet->l);
+ 		data += item->frag_packet->l;
++		item = item->frag_next;
+ 	}
+ 
+ out:
+
+
+diff -u -p -r1.50 -r1.51
+--- a/src/racoon/isakmp_inf.c	2013/04/12 09:53:10	1.50
++++ a/src/racoon/isakmp_inf.c	2017/01/24 19:23:56	1.51
+@@ -720,6 +720,7 @@ isakmp_info_send_nx(isakmp, remote, loca
+ #endif
+ #ifdef ENABLE_FRAG
+ 	iph1->frag = 0;
++	iph1->frag_last_index = 0;
+ 	iph1->frag_chain = NULL;
+ #endif
+ 
diff --git a/pkgs/os-specific/linux/ipsec-tools/default.nix b/pkgs/os-specific/linux/ipsec-tools/default.nix
index 0aa074b4df8f..551fc61f8145 100644
--- a/pkgs/os-specific/linux/ipsec-tools/default.nix
+++ b/pkgs/os-specific/linux/ipsec-tools/default.nix
@@ -19,10 +19,7 @@ stdenv.mkDerivation rec {
   patches = [
     ./dont-create-localstatedir-during-install.patch
     ./CVE-2015-4047.patch
-    (fetchpatch {
-      url = "https://anonscm.debian.org/cgit/pkg-ipsec-tools/pkg-ipsec-tools.git/plain/debian/patches/CVE-2016-10396.patch?id=62ac12648a4eb7c5ba5dba0f81998d1acf310d8b";
-      sha256 = "1kf7j2pf1blni52z7q41n0yisqb7gvk01lvldr319zaxxg7rm84a";
-    })
+    ./CVE-2016-10396.patch
   ];
 
   # fix build with newer gcc versions
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index cf06ff353253..882c24057bbb 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,32 +1,48 @@
-{ stdenv, fetchurl, bison, flex, pkgconfig, pruneLibtoolFiles
-, libnetfilter_conntrack, libnftnl, libmnl, libpcap }:
+{ stdenv, fetchurl, pkgconfig, pruneLibtoolFiles, flex, bison
+, libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap
+, nftablesCompat ? false
+}:
+
+with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  pname = "iptables";
   version = "1.8.3";
+  pname = "iptables";
 
   src = fetchurl {
     url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
     sha256 = "106xkkg5crsscjlinxvqvprva23fwwqfgrzl8m2nn841841sqg52";
   };
 
-  nativeBuildInputs = [ bison flex pkgconfig pruneLibtoolFiles ];
+  nativeBuildInputs = [ pkgconfig pruneLibtoolFiles flex bison ];
 
-  buildInputs = [ libnetfilter_conntrack libnftnl libmnl libpcap ];
+  buildInputs = [ libmnl libnetfilter_conntrack libnfnetlink libnftnl libpcap ];
 
   preConfigure = ''
     export NIX_LDFLAGS="$NIX_LDFLAGS -lmnl -lnftnl"
   '';
 
   configureFlags = [
+    "--enable-bpf-compiler"
     "--enable-devel"
+    "--enable-libipq"
+    "--enable-nfsynproxy"
     "--enable-shared"
-    "--enable-bpf-compiler"
-  ];
+  ] ++ optional (!nftablesCompat) "--disable-nftables";
 
   outputs = [ "out" "dev" ];
 
-  meta = with stdenv.lib; {
+  postInstall = optional nftablesCompat ''
+    rm $out/sbin/{iptables,iptables-restore,iptables-save,ip6tables,ip6tables-restore,ip6tables-save}
+    ln -sv xtables-nft-multi $out/bin/iptables
+    ln -sv xtables-nft-multi $out/bin/iptables-restore
+    ln -sv xtables-nft-multi $out/bin/iptables-save
+    ln -sv xtables-nft-multi $out/bin/ip6tables
+    ln -sv xtables-nft-multi $out/bin/ip6tables-restore
+    ln -sv xtables-nft-multi $out/bin/ip6tables-save
+  '';
+
+  meta = {
     description = "A program to configure the Linux IP packet filtering ruleset";
     homepage = https://www.netfilter.org/projects/iptables/index.html;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index a1bb98b82975..2ee5629451ea 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -1,26 +1,38 @@
-{ stdenv, fetchgit, autoreconfHook, pkgconfig, ell, coreutils, readline, python3Packages }:
+{ stdenv
+, fetchgit
+, fetchpatch
+, autoreconfHook
+, pkgconfig
+, ell
+, coreutils
+, docutils
+, readline
+, python3Packages
+, systemd
+}:
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-
-  version = "0.19";
+  version = "1.1";
 
   src = fetchgit {
     url = https://git.kernel.org/pub/scm/network/wireless/iwd.git;
     rev = version;
-    sha256 = "0848r06bnx5k6wlmy425hljc3f03x9xx0r83vdvf630jryc9llmz";
+    sha256 = "1rvsr5i79wpdicghplrxamb4qbkdm5cpgw3mk0rsqzwwj6d6l0vs";
   };
 
   nativeBuildInputs = [
     autoreconfHook
+    docutils
     pkgconfig
     python3Packages.wrapPython
   ];
 
   buildInputs = [
     ell
-    readline
     python3Packages.python
+    readline
+    systemd
   ];
 
   pythonPath = [
@@ -29,13 +41,14 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "--with-dbus-datadir=${placeholder "out"}/etc/"
+    "--enable-external-ell"
+    "--enable-wired"
+    "--localstatedir=/var/"
     "--with-dbus-busdir=${placeholder "out"}/share/dbus-1/system-services/"
-    "--with-systemd-unitdir=${placeholder "out"}/lib/systemd/system/"
+    "--with-dbus-datadir=${placeholder "out"}/share/"
     "--with-systemd-modloaddir=${placeholder "out"}/etc/modules-load.d/" # maybe
-    "--localstatedir=/var/"
-    "--enable-wired"
-    "--enable-external-ell"
+    "--with-systemd-unitdir=${placeholder "out"}/lib/systemd/system/"
+    "--with-systemd-networkdir=${placeholder "out"}/lib/systemd/network/"
   ];
 
   postUnpack = ''
@@ -55,16 +68,18 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     substituteInPlace $out/share/dbus-1/system-services/net.connman.ead.service \
-                      --replace /bin/false ${coreutils}/bin/false
+      --replace /bin/false ${coreutils}/bin/false
     substituteInPlace $out/share/dbus-1/system-services/net.connman.iwd.service \
-                      --replace /bin/false ${coreutils}/bin/false
+      --replace /bin/false ${coreutils}/bin/false
   '';
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     homepage = https://git.kernel.org/pub/scm/network/wireless/iwd.git;
     description = "Wireless daemon for Linux";
     license = licenses.lgpl21;
     platforms = platforms.linux;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = with maintainers; [ dtzWill fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/jool/source.nix b/pkgs/os-specific/linux/jool/source.nix
index 0dd0eeed616f..9e8de46edba7 100644
--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@@ -1,11 +1,11 @@
 { fetchFromGitHub }:
 
 rec {
-  version = "4.0.0";
+  version = "4.0.5";
   src = fetchFromGitHub {
     owner = "NICMx";
     repo = "Jool";
     rev = "v${version}";
-    sha256 = "1ivnx7ijqf41kxmi2bmsf9qfcv6b1rvag35754ddlndry3sgvimr";
+    sha256 = "0zfda8mbcg4mgg39shxdx5n2bq6zi9w3v8bcx03b3dp09lmq45y3";
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 7bffc54673bd..736e872f1baf 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -33,7 +33,6 @@ let
       DYNAMIC_DEBUG             = yes;
       TIMER_STATS               = whenOlder "4.11" yes;
       DEBUG_NX_TEST             = whenOlder "4.11" no;
-      CPU_NOTIFIER_ERROR_INJECT = whenOlder "4.4" (option no);
       DEBUG_STACK_USAGE         = no;
       DEBUG_STACKOVERFLOW       = mkIf (!features.grsecurity) no;
       RCU_TORTURE_TEST          = no;
@@ -42,6 +41,8 @@ let
       CRASH_DUMP                = option no;
       # Easier debugging of NFS issues.
       SUNRPC_DEBUG              = yes;
+      # Provide access to tunables like sched_migration_cost_ns
+      SCHED_DEBUG               = yes;
     };
 
     power-management = {
@@ -52,6 +53,9 @@ let
       CPU_FREQ_DEFAULT_GOV_PERFORMANCE = yes;
       CPU_FREQ_GOV_SCHEDUTIL           = whenAtLeast "4.9" yes;
       PM_WAKELOCKS                     = yes;
+      # Power-capping framework and support for INTEL RAPL
+      POWERCAP                         = yes;
+      INTEL_RAPL                       = module;
     };
 
     external-firmware = {
@@ -94,8 +98,6 @@ let
     networking = {
       NET                = yes;
       IP_PNP             = no;
-      NETFILTER          = yes;
-      NETFILTER_ADVANCED = yes;
       IP_VS_PROTO_TCP    = yes;
       IP_VS_PROTO_UDP    = yes;
       IP_VS_PROTO_ESP    = yes;
@@ -140,12 +142,32 @@ let
       KEY_DH_OPERATIONS = whenAtLeast "4.7" yes;
 
       # needed for nftables
-      NF_TABLES_INET              = whenAtLeast "4.17" yes;
-      NF_TABLES_NETDEV            = whenAtLeast "4.17" yes;
-      NF_TABLES_IPV4              = whenAtLeast "4.17" yes;
-      NF_TABLES_ARP               = whenAtLeast "4.17" yes;
-      NF_TABLES_IPV6              = whenAtLeast "4.17" yes;
-      NF_TABLES_BRIDGE            = whenAtLeast "4.17" yes;
+      # Networking Options
+      NETFILTER                   = yes;
+      NETFILTER_ADVANCED          = yes;
+      # Core Netfilter Configuration
+      NF_CONNTRACK_ZONES          = yes;
+      NF_CONNTRACK_EVENTS         = yes;
+      NF_CONNTRACK_TIMEOUT        = yes;
+      NF_CONNTRACK_TIMESTAMP      = yes;
+      NETFILTER_NETLINK_GLUE_CT   = yes;
+      NF_TABLES_INET              = whenAtLeast "4.19" yes;
+      NF_TABLES_NETDEV            = whenAtLeast "4.19" yes;
+      # IP: Netfilter Configuration
+      NF_TABLES_IPV4              = yes;
+      NF_TABLES_ARP               = whenAtLeast "4.19" yes;
+      # IPv6: Netfilter Configuration
+      NF_TABLES_IPV6              = yes;
+      # Bridge Netfilter Configuration
+      NF_TABLES_BRIDGE            = mkMerge [ (whenBetween "4.19" "5.3" yes)
+                                              (whenAtLeast "5.3" module) ];
+
+      # needed for ss
+      INET_DIAG         = yes;
+      INET_TCP_DIAG     = module;
+      INET_UDP_DIAG     = module;
+      INET_RAW_DIAG     = whenAtLeast "4.14" module;
+      INET_DIAG_DESTROY = whenAtLeast "4.9" yes;
     };
 
     wireless = {
@@ -158,6 +180,9 @@ let
       ATH9K_AHB             = option yes; # Ditto, AHB bus
       B43_PHY_HT            = option yes;
       BCMA_HOST_PCI         = option yes;
+      RTW88                 = whenAtLeast "5.2" module;
+      RTW88_8822BE          = whenAtLeast "5.2" yes;
+      RTW88_8822CE          = whenAtLeast "5.2" yes;
     };
 
     fb = {
@@ -179,8 +204,6 @@ let
     };
 
     video = {
-      # Enable KMS for devices whose X.org driver supports it
-      DRM_I915_KMS           = whenOlder "4.3" yes;
       # Allow specifying custom EDID on the kernel command line
       DRM_LOAD_EDID_FIRMWARE = yes;
       VGA_SWITCHEROO         = yes; # Hybrid graphics support
@@ -249,7 +272,6 @@ let
       EXT2_FS_XATTR     = yes;
       EXT2_FS_POSIX_ACL = yes;
       EXT2_FS_SECURITY  = yes;
-      EXT2_FS_XIP       = whenOlder "4.0" yes; # Ext2 execute in place support
 
       EXT3_FS_POSIX_ACL = yes;
       EXT3_FS_SECURITY  = yes;
@@ -351,10 +373,6 @@ let
       MICROCODE       = yes;
       MICROCODE_INTEL = yes;
       MICROCODE_AMD   = yes;
-
-      MICROCODE_EARLY       = whenOlder "4.4" yes;
-      MICROCODE_INTEL_EARLY = whenOlder "4.4" yes;
-      MICROCODE_AMD_EARLY   = whenOlder "4.4" yes;
     } // optionalAttrs (versionAtLeast version "4.10") {
       # Write Back Throttling
       # https://lwn.net/Articles/682582/
@@ -631,11 +649,13 @@ let
       IDLE_PAGE_TRACKING  = yes;
       IRDA_ULTRA          = whenOlder "4.17" yes; # Ultra (connectionless) protocol
 
-      JOYSTICK_IFORCE_232 = option yes; # I-Force Serial joysticks and wheels
-      JOYSTICK_IFORCE_USB = option yes; # I-Force USB joysticks and wheels
+      JOYSTICK_IFORCE_232 = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force Serial joysticks and wheels
+      JOYSTICK_IFORCE_USB = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force USB joysticks and wheels
       JOYSTICK_XPAD_FF    = option yes; # X-Box gamepad rumble support
       JOYSTICK_XPAD_LEDS  = option yes; # LED Support for Xbox360 controller 'BigX' LED
 
+      KEYBOARD_APPLESPI = whenAtLeast "5.3" module;
+
       KEXEC_FILE      = option yes;
       KEXEC_JUMP      = option yes;
 
@@ -700,6 +720,8 @@ let
       PREEMPT = no;
       PREEMPT_VOLUNTARY = yes;
 
+      X86_AMD_PLATFORM_DEVICE = yes;
+
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Enable CPU/memory hotplug support
       # Allows you to dynamically add & remove CPUs/memory to a VM client running NixOS without requiring a reboot
diff --git a/pkgs/os-specific/linux/kernel/export_kernel_fpu_functions.patch b/pkgs/os-specific/linux/kernel/export_kernel_fpu_functions_4_14.patch
index 205497aee2da..205497aee2da 100644
--- a/pkgs/os-specific/linux/kernel/export_kernel_fpu_functions.patch
+++ b/pkgs/os-specific/linux/kernel/export_kernel_fpu_functions_4_14.patch
diff --git a/pkgs/os-specific/linux/kernel/export_kernel_fpu_functions_5_3.patch b/pkgs/os-specific/linux/kernel/export_kernel_fpu_functions_5_3.patch
new file mode 100644
index 000000000000..dc9ca64bdc1f
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/export_kernel_fpu_functions_5_3.patch
@@ -0,0 +1,42 @@
+From 1e010beda2896bdf3082fb37a3e49f8ce20e04d8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Thu, 2 May 2019 05:28:08 +0100
+Subject: [PATCH] x86/fpu: Export kernel_fpu_{begin,end}() with
+ EXPORT_SYMBOL_GPL
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+We need these symbols in zfs as the fpu implementation breaks userspace:
+
+https://github.com/zfsonlinux/zfs/issues/9346
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ arch/x86/kernel/fpu/core.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c
+index 12c70840980e..352538b3bb5d 100644
+--- a/arch/x86/kernel/fpu/core.c
++++ b/arch/x86/kernel/fpu/core.c
+@@ -102,7 +102,7 @@ void kernel_fpu_begin(void)
+ 	}
+ 	__cpu_invalidate_fpregs_state();
+ }
+-EXPORT_SYMBOL_GPL(kernel_fpu_begin);
++EXPORT_SYMBOL(kernel_fpu_begin);
+ 
+ void kernel_fpu_end(void)
+ {
+@@ -111,7 +111,7 @@ void kernel_fpu_end(void)
+ 	this_cpu_write(in_kernel_fpu, false);
+ 	preempt_enable();
+ }
+-EXPORT_SYMBOL_GPL(kernel_fpu_end);
++EXPORT_SYMBOL(kernel_fpu_end);
+ 
+ /*
+  * Save the FPU state (mark it for reload if necessary):
+-- 
+2.23.0
+
diff --git a/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch b/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch
new file mode 100644
index 000000000000..0639f8b4e8fb
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch
@@ -0,0 +1,86 @@
+From 2cc99c9cdc8fde5e92e34f9655829449cebd3e00 Mon Sep 17 00:00:00 2001
+From: Dmitry Goldin <dgoldin+lkml@protonmail.ch>
+Date: Fri, 4 Oct 2019 10:40:07 +0000
+Subject: kheaders: make headers archive reproducible
+
+In commit 43d8ce9d65a5 ("Provide in-kernel headers to make
+extending kernel easier") a new mechanism was introduced, for kernels
+>=5.2, which embeds the kernel headers in the kernel image or a module
+and exposes them in procfs for use by userland tools.
+
+The archive containing the header files has nondeterminism caused by
+header files metadata. This patch normalizes the metadata and utilizes
+KBUILD_BUILD_TIMESTAMP if provided and otherwise falls back to the
+default behaviour.
+
+In commit f7b101d33046 ("kheaders: Move from proc to sysfs") it was
+modified to use sysfs and the script for generation of the archive was
+renamed to what is being patched.
+
+Signed-off-by: Dmitry Goldin <dgoldin+lkml@protonmail.ch>
+Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
+
+---
+
+nixos note: This patch is from
+https://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild.git/commit/?h=fixes&id=2cc99c9cdc8fde5e92e34f9655829449cebd3e00
+I commented out the documentation part here, so that it easily applies
+to linux 5.2 and 5.3, which does not ship with the reproducible build
+documentation yet, which only was introduced recently.
+
+---
+ Documentation/kbuild/reproducible-builds.rst | 13 +++++++++----
+ kernel/gen_kheaders.sh                       |  5 ++++-
+ 2 files changed, 13 insertions(+), 5 deletions(-)
+
+#diff --git a/Documentation/kbuild/reproducible-builds.rst b/Documentation/kbuild/reproducible-builds.rst
+#index ab92e98c89c8..503393854e2e 100644
+# --- a/Documentation/kbuild/reproducible-builds.rst
+#+++ b/Documentation/kbuild/reproducible-builds.rst
+#@@ -16,16 +16,21 @@ the kernel may be unreproducible, and how to avoid them.
+# Timestamps
+# ----------
+#
+#-The kernel embeds a timestamp in two places:
+#+The kernel embeds timestamps in three places:
+#
+# * The version string exposed by ``uname()`` and included in
+#   ``/proc/version``
+#
+# * File timestamps in the embedded initramfs
+#
+#-By default the timestamp is the current time.  This must be overridden
+#-using the `KBUILD_BUILD_TIMESTAMP`_ variable.  If you are building
+#-from a git commit, you could use its commit date.
+#+* If enabled via ``CONFIG_IKHEADERS``, file timestamps of kernel
+#+  headers embedded in the kernel or respective module,
+#+  exposed via ``/sys/kernel/kheaders.tar.xz``
+#+
+#+By default the timestamp is the current time and in the case of
+#+``kheaders`` the various files' modification times. This must
+#+be overridden using the `KBUILD_BUILD_TIMESTAMP`_ variable.
+#+If you are building from a git commit, you could use its commit date.
+#
+# The kernel does *not* use the ``__DATE__`` and ``__TIME__`` macros,
+# and enables warnings if they are used.  If you incorporate external
+diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh
+index 9ff449888d9c..aff79e461fc9 100755
+--- a/kernel/gen_kheaders.sh
++++ b/kernel/gen_kheaders.sh
+@@ -71,7 +71,10 @@ done | cpio --quiet -pd $cpio_dir >/dev/null 2>&1
+ find $cpio_dir -type f -print0 |
+ 	xargs -0 -P8 -n1 perl -pi -e 'BEGIN {undef $/;}; s/\/\*((?!SPDX).)*?\*\///smg;'
+
+-tar -Jcf $tarfile -C $cpio_dir/ . > /dev/null
++# Create archive and try to normalize metadata for reproducibility
++tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
++    --owner=0 --group=0 --sort=name --numeric-owner \
++    -Jcf $tarfile -C $cpio_dir/ . > /dev/null
+
+ echo "$src_files_md5" >  kernel/kheaders.md5
+ echo "$obj_files_md5" >> kernel/kheaders.md5
+--
+cgit 1.2-0.3.lf.el7
+
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index ae39047a9d3d..738a55129b1f 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,16 +3,16 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.142";
+  version = "4.14.155";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
+  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
 
   # branchVersion needs to be x.y
-  extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
+  extraMeta.branch = versions.majorMinor version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1wwhnm1n1b6yzsd2zzzf9i3n4hlvgnph70p67cwahw0ik4ssayz6";
+    sha256 = "10g4493ldc398qza304z5yz8qdp93w7a2bs5h5dwk0bbamwikmkp";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 56d254c1ecb8..eaf2f7a3ec09 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,16 +3,16 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.71";
+  version = "4.19.85";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
+  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
 
   # branchVersion needs to be x.y
-  extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
+  extraMeta.branch = versions.majorMinor version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1bjwkb7k82l646ryyy0jbwsnygm2qsxgcwli8bdrj844skzynlqz";
+    sha256 = "1dsgbys73jga5h0a9icgif6qbi31g84315zlcdid9bzf1abkbx3v";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 2889dc34aba7..35bd141ae468 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.191";
+  version = "4.4.202";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0x3lnq4xyj5v6r1cz4jizm4vdspws1nb806f5qczwi3yil5nm6bh";
+    sha256 = "0adrmps7izfqy0yn4440isxvigslwzk1a375r9kh86idwbmcxb7x";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index d494c7bb6235..cb9d5a71dd90 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.191";
+  version = "4.9.202";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1g5p736p8zx5rmxaj56yw93jp768npl868jsn8973dny0rsbim6y";
+    sha256 = "1gsfbvsswpwj6r56ynb6mmx7dc8hp9yhi7sfr0hhii0gs4ffq241";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.2.nix b/pkgs/os-specific/linux/kernel/linux-5.3.nix
index dfce0f303987..86fc9af4f241 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.3.nix
@@ -3,16 +3,16 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.2.13";
+  version = "5.3.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
+  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
 
   # branchVersion needs to be x.y
-  extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
+  extraMeta.branch = versions.majorMinor version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "12hpph3iynr22mfwz7745lp01waf2kg579hr56d4pvhx4iahzdhp";
+    sha256 = "184pmjyqh4bkrc3vj65zn6xnljzv9d1x7c1z0hlgj6fakpwgdgsk";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index e4a4e40f370c..d29a2382c2a2 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,11 +1,11 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
-    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/tags/";
+    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
 
     # Update this if linux_latest-libre fails to build.
-    # $ curl https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/tags/ | grep -Eo 'Revision [0-9]+'
-    rev = "16604";
-    sha256 = "0d2dh52zv073zr74ilspy0fy3ivys5pq32j7fljs4fwi2bcljf51";
+    # $ curl https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/ | grep -Eo 'Revision [0-9]+'
+    rev = "16794";
+    sha256 = "1lpaka4hs7yrpnrzfybd6radjylwvw2p4aly68pypykqs2srvm7j";
   }
 , ...
 }:
@@ -25,7 +25,7 @@ in linux.override {
       name = "${linux.name}-libre-src";
       src = linux.src;
       buildPhase = ''
-        ${scripts}/${majorMinor}-gnu/deblob-${majorMinor} \
+        ${scripts}/${majorMinor}/deblob-${majorMinor} \
             ${major} ${minor} ${patch}
       '';
       checkPhase = ''
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 1b4700a2e392..6f5f2524276b 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,8 +1,8 @@
-{ stdenv, lib, buildPackages, fetchFromGitHub, perl, buildLinux, ... } @ args:
+{ stdenv, lib, buildPackages, fetchFromGitHub, perl, buildLinux, rpiVersion, ... } @ args:
 
 let
-  modDirVersion = "4.14.98";
-  tag = "1.20190215";
+  modDirVersion = "4.19.75";
+  tag = "1.20190925";
 in
 lib.overrideDerivation (buildLinux (args // {
   version = "${modDirVersion}-${tag}";
@@ -12,24 +12,32 @@ lib.overrideDerivation (buildLinux (args // {
     owner = "raspberrypi";
     repo = "linux";
     rev = "raspberrypi-kernel_${tag}-1";
-    sha256 = "1gc4x7p82m2v1jhahhyl7qfdkflj71ly6p0fpc1vf9sk13hbwgj2";
+    sha256 = "0l91kb4jjxg4fcp7d2aqm1fj34ns137rys93k907mdgnarcliafs";
   };
 
   defconfig = {
-    armv6l-linux = "bcmrpi_defconfig";
-    armv7l-linux = "bcm2709_defconfig";
-    aarch64-linux = "bcmrpi3_defconfig";
-  }.${stdenv.hostPlatform.system} or (throw "linux_rpi not supported on '${stdenv.hostPlatform.system}'");
+    "1" = "bcmrpi_defconfig";
+    "2" = "bcm2709_defconfig";
+    "3" = "bcmrpi3_defconfig";
+    "4" = "bcm2711_defconfig";
+  }.${toString rpiVersion};
 
   features = {
     efiBootStub = false;
   } // (args.features or {});
 
-  extraMeta.hydraPlatforms = [ "aarch64-linux" ];
+  extraMeta = if (rpiVersion < 3) then {
+    platforms = with lib.platforms; [ arm ];
+    hydraPlatforms = [];
+  } else {
+    platforms = with lib.platforms; [ arm aarch64 ];
+    hydraPlatforms = [ "aarch64-linux" ];
+  };
 } // (args.argsOverride or {}))) (oldAttrs: {
   postConfigure = ''
     # The v7 defconfig has this set to '-v7' which screws up our modDirVersion.
     sed -i $buildRoot/.config -e 's/^CONFIG_LOCALVERSION=.*/CONFIG_LOCALVERSION=""/'
+    sed -i $buildRoot/include/config/auto.conf -e 's/^CONFIG_LOCALVERSION=.*/CONFIG_LOCALVERSION=""/'
   '';
 
   # Make copies of the DTBs named after the upstream names so that U-Boot finds them.
@@ -41,8 +49,8 @@ lib.overrideDerivation (buildLinux (args // {
       cp -v "$dtbDir/$1" "$dtbDir/$2"
     }
   '' + lib.optionalString (lib.elem stdenv.hostPlatform.system ["armv6l-linux"]) ''
-    copyDTB bcm2708-rpi-0-w.dtb bcm2835-rpi-zero.dtb
-    copyDTB bcm2708-rpi-0-w.dtb bcm2835-rpi-zero-w.dtb
+    copyDTB bcm2708-rpi-zero-w.dtb bcm2835-rpi-zero.dtb
+    copyDTB bcm2708-rpi-zero-w.dtb bcm2835-rpi-zero-w.dtb
     copyDTB bcm2708-rpi-b.dtb bcm2835-rpi-a.dtb
     copyDTB bcm2708-rpi-b.dtb bcm2835-rpi-b.dtb
     copyDTB bcm2708-rpi-b.dtb bcm2835-rpi-b-rev2.dtb
@@ -54,7 +62,9 @@ lib.overrideDerivation (buildLinux (args // {
     copyDTB bcm2709-rpi-2-b.dtb bcm2836-rpi-2-b.dtb
   '' + lib.optionalString (lib.elem stdenv.hostPlatform.system ["armv7l-linux" "aarch64-linux"]) ''
     copyDTB bcm2710-rpi-3-b.dtb bcm2837-rpi-3-b.dtb
+    copyDTB bcm2710-rpi-3-b-plus.dtb bcm2837-rpi-3-a-plus.dtb
     copyDTB bcm2710-rpi-3-b-plus.dtb bcm2837-rpi-3-b-plus.dtb
     copyDTB bcm2710-rpi-cm3.dtb bcm2837-rpi-cm3.dtb
+    copyDTB bcm2711-rpi-4-b.dtb bcm2838-rpi-4-b.dtb
   '';
 })
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index 0b2ed76a4b4b..f4b9e5b8da63 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,13 +1,13 @@
 { stdenv, buildPackages, fetchgit, fetchpatch, perl, buildLinux, ... } @ args:
 
 buildLinux (args // {
-  version = "5.1.2019.08.21";
-  modDirVersion = "5.1.0";
+  version = "5.2.2019.10.12";
+  modDirVersion = "5.2.0";
 
   src = fetchgit {
     url = "https://evilpiepirate.org/git/bcachefs.git";
-    rev = "ece184f718c2b678738bc2c42906e90eeb8ba7dc";
-    sha256 = "08cbisgcww8fklpxwqkm2c8ddz0mm7v11ycp7ch0kalwdv2f81lr";
+    rev = "de906c3e2eddad291d46bd0e7c81c68eaadcd08a";
+    sha256 = "1ahabp8pd9slf4lchkbyfkagg9vhic0cw3kwvwryzaxxxjmf2hkk";
   };
 
   extraConfig = "BCACHEFS_FS m";
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 59b406a91eec..63a9c47a5160 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,15 +3,15 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.2-rc7";
-  extraMeta.branch = "5.2";
+  version = "5.4-rc7";
+  extraMeta.branch = "5.4";
 
   # modDirVersion needs to be x.y.z, will always add .0
   modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "1128jb1y4gia5icv614ycp3c5mkvrb2l2wn20765b3si256g68n4";
+    sha256 = "1ii3klfb9yi0wbql2zss3pbhn4bb6ij6zk3mq5lip1yl8pwsj8wd";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 257aec751429..d206910732c2 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -94,7 +94,9 @@ let
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
-        ++ optional (stdenv.lib.versionAtLeast version "4.13") ./randstruct-provide-seed.patch;
+        ++ optional (stdenv.lib.versionAtLeast version "4.13") ./randstruct-provide-seed.patch
+        # Fixes determinism by normalizing metadata for the archive of kheaders
+        ++ optional (stdenv.lib.versionAtLeast version "5.2" && stdenv.lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
 
       prePatch = ''
         for mf in $(find -name Makefile -o -name Makefile.include -o -name install.sh); do
@@ -177,7 +179,7 @@ let
       '' else "") + (if isModular then ''
         mkdir -p $dev
         cp vmlinux $dev/
-        if [ -z "$dontStrip" ]; then
+        if [ -z "''${dontStrip-}" ]; then
           installFlagsArray+=("INSTALL_MOD_STRIP=1")
         fi
         make modules_install $makeFlags "''${makeFlagsArray[@]}" \
@@ -190,7 +192,6 @@ let
         # To save space, exclude a bunch of unneeded stuff when copying.
         (cd .. && rsync --archive --prune-empty-dirs \
             --exclude='/build/' \
-            --exclude='/Documentation/' \
             * $dev/lib/modules/${modDirVersion}/source/)
 
         cd $dev/lib/modules/${modDirVersion}/source
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index b80320db282e..fa5b168389bc 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -59,8 +59,14 @@
   };
 
   export_kernel_fpu_functions = {
-    name = "export_kernel_fpu_functions";
-    patch = ./export_kernel_fpu_functions.patch;
+    "4.14" = {
+      name = "export_kernel_fpu_functions";
+      patch = ./export_kernel_fpu_functions_4_14.patch;
+    };
+    "5.3" = {
+      name = "export_kernel_fpu_functions";
+      patch = ./export_kernel_fpu_functions_5_3.patch;
+    };
   };
 
   # patches from https://lkml.org/lkml/2019/7/15/1748
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index 3d3215e6b4bf..4e9007c73625 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPackages, fetchurl, zlib }:
+{ stdenv, buildPackages, fetchurl, zlib, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
@@ -18,6 +18,16 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ zlib ];
 
+  patches = [
+    # fix build on i686
+    # See: https://src.fedoraproject.org/rpms/kexec-tools/c/cb1e5463b5298b064e9b6c86ad6fe3505fec9298
+    (fetchpatch {
+      name = "kexec-tools-2.0.20-fix-broken-multiboot2-buliding-for-i386.patch";
+      url = "https://src.fedoraproject.org/rpms/kexec-tools/raw/cb1e5463b5298b064e9b6c86ad6fe3505fec9298/f/kexec-tools-2.0.20-fix-broken-multiboot2-buliding-for-i386.patch";
+      sha256 = "1kzmcsbhwfdgxlc5s88ir0n494phww1j16yk0z42x09qlkxxkg0l";
+    })
+  ];
+
   meta = with stdenv.lib; {
     homepage = http://horms.net/projects/kexec/kexec-tools;
     description = "Tools related to the kexec Linux feature";
diff --git a/pkgs/os-specific/linux/kmod/aggregator.nix b/pkgs/os-specific/linux/kmod/aggregator.nix
index 4da87a557cbe..cd138f1d7f55 100644
--- a/pkgs/os-specific/linux/kmod/aggregator.nix
+++ b/pkgs/os-specific/linux/kmod/aggregator.nix
@@ -29,7 +29,7 @@ buildEnv {
       # kernel version number, otherwise depmod will use `uname -r'.
       if test -w $out/lib/modules/$kernelVersion; then
           rm -f $out/lib/modules/$kernelVersion/modules.!(builtin*|order*)
-          ${kmod}/bin/depmod -b $out -a $kernelVersion
+          ${kmod}/bin/depmod -b $out -C $out/etc/depmod.d -a $kernelVersion
       fi
     '';
 }
diff --git a/pkgs/os-specific/linux/ledger-udev-rules/default.nix b/pkgs/os-specific/linux/ledger-udev-rules/default.nix
index 96c60f6ea56e..e61bac510e69 100644
--- a/pkgs/os-specific/linux/ledger-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/ledger-udev-rules/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "ledger-udev-rules";
-  version = "unstable-2019-02-13";
+  version = "unstable-2019-05-30";
 
   src = fetchFromGitHub {
     owner = "LedgerHQ";
     repo = "udev-rules";
-    rev = "20cc1651eb551c4855aaa56628c77eaeb3031c22";
-    sha256 = "0riydkc4in10pv4qlrvbg3w78qsvxly5caa3zwyqcmsm5fmprqky";
+    rev = "765b7fdf57b20fd9326cedf48ee52e905024ab4f";
+    sha256 = "10a42al020zpkx918y6b1l9az45vk3921b2l1mx87w3m0ad9qvif";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index 0789d53b4344..b3ccda3b50d8 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -1,25 +1,19 @@
-{ stdenv, file, lib, fetchFromGitHub, fetchpatch, autoreconfHook, bison, flex, pkgconfig
+{ stdenv, file, lib, fetchFromGitHub, autoreconfHook, bison, flex, pkgconfig
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform, swig ? null, python}:
 
 stdenv.mkDerivation rec {
   pname = "libnl";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     repo = "libnl";
     owner = "thom311";
     rev = "libnl${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "1bqf1f5glwf285sa98k5pkj9gg79lliixk1jk85j63v5510fbagp";
+    sha256 = "1ak30jcx52gl5yz1691qq0b76ldbcp2z6vsvdr2mrrwqiplqbcs2";
   };
 
   outputs = [ "bin" "dev" "out" "man" ] ++ lib.optional pythonSupport "py";
 
-  patches = stdenv.lib.optional stdenv.hostPlatform.isMusl
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/gentoo/musl/48d2a28710ae40877fd3e178ead1fb1bb0baa62c/dev-libs/libnl/files/libnl-3.3.0_rc1-musl.patch";
-      sha256 = "0dd7xxikib201i99k2if066hh7gwf2i4ffckrjplq6lr206jn00r";
-    });
-
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ autoreconfHook bison flex pkgconfig file ]
diff --git a/pkgs/os-specific/linux/libratbag/default.nix b/pkgs/os-specific/linux/libratbag/default.nix
index a09bb2a6ceb4..f2bf5c949704 100644
--- a/pkgs/os-specific/linux/libratbag/default.nix
+++ b/pkgs/os-specific/linux/libratbag/default.nix
@@ -1,15 +1,16 @@
 { stdenv, fetchFromGitHub, meson, ninja, pkgconfig
-, glib, systemd, udev, libevdev, gitMinimal, check, valgrind, swig, python3 }:
+, glib, systemd, udev, libevdev, gitMinimal, check, valgrind, swig, python3
+, json-glib, libunistring }:
 
 stdenv.mkDerivation rec {
   pname = "libratbag";
-  version = "0.9.905";
+  version = "0.10";
 
   src = fetchFromGitHub {
     owner  = "libratbag";
     repo   = "libratbag";
     rev    = "v${version}";
-    sha256 = "0bh1nf9sv7wka0vh5bz9krf2cfxz0rr64hrpdm7imsb6cn39k01y";
+    sha256 = "10hahpv2n48b5z35d2draka7cz1a9vw53rvwfmpp5dibwnmi81jb";
   };
 
   nativeBuildInputs = [
@@ -17,7 +18,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    glib systemd udev libevdev
+    glib systemd udev libevdev json-glib libunistring
     (python3.withPackages (ps: with ps; [ evdev pygobject3 ]))
   ];
 
diff --git a/pkgs/os-specific/linux/lm-sensors/default.nix b/pkgs/os-specific/linux/lm-sensors/default.nix
index b9e58cb5a4c7..82ac626d7c91 100644
--- a/pkgs/os-specific/linux/lm-sensors/default.nix
+++ b/pkgs/os-specific/linux/lm-sensors/default.nix
@@ -6,26 +6,26 @@ assert sensord -> rrdtool != null;
 
 stdenv.mkDerivation rec {
   pname = "lm-sensors";
-  version = "3.5.0";
+  version = "3.6.0";
+  dashedVersion = stdenv.lib.replaceStrings ["."] ["-"] version;
 
   src = fetchzip {
-    url = "https://github.com/lm-sensors/lm-sensors/archive/V${stdenv.lib.replaceStrings ["."] ["-"] version}.tar.gz";
-    sha256 = "1mdrnb9r01z1xfdm6dpkywvf9yy9a4yzb59paih9sijwmigv19fj";
+    url = "https://github.com/lm-sensors/lm-sensors/archive/V${dashedVersion}.tar.gz";
+    sha256 = "1ipf6wjx037sqyhy0r5jh4983h216anq9l68ckn2x5c3qc4wfmzn";
   };
 
   nativeBuildInputs = [ bison flex which ];
   buildInputs = [ perl ]
    ++ stdenv.lib.optional sensord rrdtool;
 
-  preBuild = ''
-    makeFlagsArray=(PREFIX=$out ETCDIR=$out/etc
-    ${stdenv.lib.optionalString sensord "PROG_EXTRA=sensord"})
-  '';
+  makeFlags = [ "PREFIX=${placeholder "out"}" "ETCDIR=${placeholder "out"}/etc" ]
+    ++ stdenv.lib.optional sensord "PROG_EXTRA=sensord";
 
   meta = with stdenv.lib; {
-    homepage = https://hwmon.wiki.kernel.org/lm_sensors;
+    homepage = "https://hwmon.wiki.kernel.org/lm_sensors";
+    changelog = "https://raw.githubusercontent.com/lm-sensors/lm-sensors/V${dashedVersion}/CHANGES";
     description = "Tools for reading hardware sensors";
-    license = with licenses; [ gpl2Plus lgpl21Plus ];
+    license = with licenses; [ lgpl21Plus gpl2Plus ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
index 9944250bf307..9c48caaa2430 100644
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ b/pkgs/os-specific/linux/lvm2/default.nix
@@ -21,7 +21,6 @@ stdenv.mkDerivation {
     "--enable-udev_rules"
     "--enable-udev_sync"
     "--enable-pkgconfig"
-    "--enable-applib"
     "--enable-cmdlib"
   ] ++ stdenv.lib.optional enable_dmeventd " --enable-dmeventd"
   ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
@@ -34,17 +33,17 @@ stdenv.mkDerivation {
 
   preConfigure =
     ''
-      substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
-        --replace /usr/bin/udevadm ${systemd}/bin/udevadm
-
       sed -i /DEFAULT_SYS_DIR/d Makefile.in
       sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
+    '' + stdenv.lib.optionalString (systemd != null) ''
+      substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
+        --replace /usr/bin/udevadm ${systemd}/bin/udevadm
     '';
 
+  # https://github.com/NixOS/nixpkgs/pull/52597
   # gcc: error: ../../device_mapper/libdevice-mapper.a: No such file or directory
   enableParallelBuilding = false;
 
-  #patches = [ ./purity.patch ];
   patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
       name = "fix-stdio-usage.patch";
@@ -75,7 +74,7 @@ stdenv.mkDerivation {
     ''
       substituteInPlace $out/lib/udev/rules.d/13-dm-disk.rules \
         --replace $out/sbin/blkid ${utillinux}/sbin/blkid
-
+    '' + stdenv.lib.optionalString (systemd != null) ''
       # Systemd stuff
       mkdir -p $out/etc/systemd/system $out/lib/systemd/system-generators
       cp scripts/blk_availability_systemd_red_hat.service $out/etc/systemd/system
diff --git a/pkgs/os-specific/linux/lvm2/purity.patch b/pkgs/os-specific/linux/lvm2/purity.patch
deleted file mode 100644
index d6990dd9caa5..000000000000
--- a/pkgs/os-specific/linux/lvm2/purity.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff -ru LVM2.2.02.95-orig/udev/10-dm.rules.in LVM2.2.02.95/udev/10-dm.rules.in
---- LVM2.2.02.95-orig/udev/10-dm.rules.in	2011-08-11 19:55:29.000000000 +0200
-+++ LVM2.2.02.95/udev/10-dm.rules.in	2012-03-19 20:12:35.000000000 +0100
-@@ -19,9 +19,8 @@
- SUBSYSTEM!="block", GOTO="dm_end"
- KERNEL!="dm-[0-9]*", GOTO="dm_end"
- 
--# Set proper sbin path, /sbin has higher priority than /usr/sbin.
--ENV{DM_SBIN_PATH}="/sbin"
--TEST!="$env{DM_SBIN_PATH}/dmsetup", ENV{DM_SBIN_PATH}="/usr/sbin"
-+# Set proper sbin path. Exit if dmsetup is not present.
-+ENV{DM_SBIN_PATH}="(sbindir)"
- TEST!="$env{DM_SBIN_PATH}/dmsetup", GOTO="dm_end"
- 
- # Device created, major and minor number assigned - "add" event generated.
-diff -ru LVM2.2.02.95-orig/udev/Makefile.in LVM2.2.02.95/udev/Makefile.in
---- LVM2.2.02.95-orig/udev/Makefile.in	2012-02-24 10:53:12.000000000 +0100
-+++ LVM2.2.02.95/udev/Makefile.in	2012-03-19 20:16:09.000000000 +0100
-@@ -12,6 +12,7 @@
- # Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- 
- srcdir = @srcdir@
-+sbindir = @sbindir@
- top_srcdir = @top_srcdir@
- top_builddir = @top_builddir@
- 
-@@ -26,7 +27,7 @@
- ifeq ("@UDEV_HAS_BUILTIN_BLKID@", "yes")
- 	BLKID_RULE=IMPORT{builtin}=\"blkid\"
- else
--	BLKID_RULE=IMPORT{program}=\"\$$env{DM_SBIN_PATH}\/blkid -o udev -p \$$tempnode\"
-+	BLKID_RULE=IMPORT{program}=\"\/sbin\/blkid -o udev -p \$$tempnode\"
- endif
- 
- CLEAN_TARGETS = 10-dm.rules 13-dm-disk.rules
-@@ -36,7 +37,7 @@
- vpath %.rules $(srcdir)
- 
- %.rules: %.rules.in
--	$(SED) -e "s/(DM_DIR)/$(DM_DIR)/" -e "s/(BLKID_RULE)/$(BLKID_RULE)/" $< >$@
-+	$(SED) -e "s/(DM_DIR)/$(DM_DIR)/" -e "s/(BLKID_RULE)/$(BLKID_RULE)/" -e "s|(sbindir)|$(sbindir)|" $< >$@
- 
- %_install: %.rules
- 	$(INSTALL_DATA) -D $< $(udevdir)/$(<F)
diff --git a/pkgs/os-specific/linux/mbpfan/default.nix b/pkgs/os-specific/linux/mbpfan/default.nix
index 8b62ce76409e..1061653949f1 100644
--- a/pkgs/os-specific/linux/mbpfan/default.nix
+++ b/pkgs/os-specific/linux/mbpfan/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "mbpfan";
-  version = "2.1.1";
+  version = "2.2.0";
   src = fetchFromGitHub {
     owner = "dgraziotin";
     repo = "mbpfan";
     rev = "v${version}";
-    sha256 = "0aijyxrqh01x0s80yr4cgxgd001iiqqph65pxvby7f0wz8lnxnqj";
+    sha256 = "0qcrxw4dx2fnq5hswzid2wi97zpn0k7kimprkl35nmsgz348xspr";
   };
   installPhase = ''
     mkdir -p $out/bin $out/etc
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index a58bfc321d3c..2f0736318044 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mcelog";
-  version = "164";
+  version = "165";
 
   src = fetchFromGitHub {
     owner  = "andikleen";
     repo   = "mcelog";
     rev    = "v${version}";
-    sha256 = "1i0f0zvxlzkfp0bvghm1z8z8bb8a5x97h56bwd7fdkrm00ivfw2k";
+    sha256 = "1g242qz3jj7amgar497bbd8krljspwy89g1r32wz3fdpkn9m1w8s";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index 5aa9e9b43da6..8638ac9f7983 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     sed -e 's@/lib/udev@''${out}/lib/udev@' \
         -e 's@ -Werror @ @' \
-        -e 's@/usr/sbin/sendmail@${system-sendmail}@' -i Makefile
+        -e 's@/usr/sbin/sendmail@${system-sendmail}/bin/sendmail@' -i Makefile
     sed -i \
         -e 's@/usr/bin/basename@${coreutils}/bin/basename@g' \
         -e 's@BINDIR/blkid@${utillinux}/bin/blkid@g' \
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index 07d6dcb4a5f7..4ada201263f8 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20190618";
+  version = "20191113";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "0fdhrpxvsq0rm5mzj82gvmfb3lm7mhc9hwvimv7dl1jaidbp6lvs";
+    sha256 = "04138j9n14197ybkh2vxfjy21wcgvbd183ya4b6k262y9nzjmvsa";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/os-specific/linux/molly-guard/default.nix b/pkgs/os-specific/linux/molly-guard/default.nix
index 766c01eed3fc..9b412d9d7ed4 100644
--- a/pkgs/os-specific/linux/molly-guard/default.nix
+++ b/pkgs/os-specific/linux/molly-guard/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "molly-guard";
-  version = "0.6.3";
+  version = "0.7.2";
 
   src = fetchurl {
-    url = "https://launchpad.net/ubuntu/+source/molly-guard/${version}/+build/8892607/+files/molly-guard_${version}_all.deb";
-    sha256 = "1d1x60m6kh9wfh9lc22g5s0j40aivwgsczykk27ymwl1pvk58dxn";
+    url = "https://launchpad.net/ubuntu/+archive/primary/+files/molly-guard_${version}_all.deb";
+    sha256 = "1k6b1hn8lc4rj9n036imsl7s9lqj6ny3acdhnbnamsdkkndmxrw7";
   };
 
   buildInputs = [ dpkg ];
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Attempts to prevent you from accidentally shutting down or rebooting machines";
-    homepage    = https://anonscm.debian.org/git/collab-maint/molly-guard.git/;
+    homepage    = https://salsa.debian.org/debian/molly-guard;
     license     = licenses.artistic2;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ DerTim1 ];
diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix
index afe07a5c4dbe..628b14b6a483 100644
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "multipath-tools";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchurl {
     name = "${pname}-${version}.tar.gz";
     url = "https://git.opensvc.com/gitweb.cgi?p=multipath-tools/.git;a=snapshot;h=refs/tags/${version};sf=tgz";
-    sha256 = "0x6cjlb9mjrmpaqk5v6v47qz6n9zyqmw13i7pq5x6ppwyqdxhn5s";
+    sha256 = "1mgjylklh1cx8px8ffgl12kyc0ln3445vbabd2sy8chq31rpiiq8";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index 91e1ae36f709..93e9ba614f88 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "musl";
-  version = "1.1.22";
+  version = "1.1.24";
 
   src = fetchurl {
     url    = "https://www.musl-libc.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "1qr9xqdzziy5bsyyqlh6k8yz056ll55d5yvc0gbhz61ginj422cb";
+    sha256 = "18r2a00k82hz0mqdvgm7crzc7305l36109c0j9yjmkxj2alcjw0k";
   };
 
   enableParallelBuilding = true;
@@ -110,11 +110,11 @@ stdenv.mkDerivation rec {
 
   passthru.linuxHeaders = linuxHeaders;
 
-  meta = {
+  meta = with lib; {
     description = "An efficient, small, quality libc implementation";
     homepage    = "http://www.musl-libc.org";
-    license     = lib.licenses.mit;
-    platforms   = lib.platforms.linux;
-    maintainers = [ lib.maintainers.thoughtpolice ];
+    license     = licenses.mit;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ thoughtpolice dtzWill ];
   };
 }
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 9b4f2f1c544a..c9f9a512ad8f 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -1,6 +1,9 @@
-{ stdenv, fetchurl, pkgconfig, bison, flex
+{ stdenv, fetchurl, pkgconfig, bison, file, flex
+, asciidoc, libxslt, findXMLCatalogs, docbook_xml_dtd_45, docbook_xsl
 , libmnl, libnftnl, libpcap
 , gmp, jansson, readline
+, withDebugSymbols ? false
+, withPython ? false , python3
 , withXtables ? false , iptables
 }:
 
@@ -15,17 +18,27 @@ stdenv.mkDerivation rec {
     sha256 = "1x8kalbggjq44j4916i6vyv1rb20dlh1dcsf9xvzqsry2j063djw";
   };
 
-  configureFlags = [
-    "--disable-man-doc"
-    "--with-json"
-  ] ++ optional withXtables "--with-xtables";
-
-  nativeBuildInputs = [ pkgconfig bison flex ];
+  nativeBuildInputs = [
+    pkgconfig bison file flex
+    asciidoc docbook_xml_dtd_45 docbook_xsl findXMLCatalogs libxslt 
+  ];
 
   buildInputs = [
     libmnl libnftnl libpcap
-    gmp readline jansson
-  ] ++ optional withXtables iptables;
+    gmp jansson readline
+  ] ++ optional withXtables iptables
+    ++ optional withPython python3;
+
+  preConfigure = ''
+    substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file
+  '';
+
+  configureFlags = [
+    "--with-json"
+  ] ++ optional (!withDebugSymbols) "--disable-debug"
+    ++ optional (!withPython) "--disable-python"
+    ++ optional withPython "--enable-python"
+    ++ optional withXtables "--with-xtables";
 
   meta = {
     description = "The project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
diff --git a/pkgs/os-specific/linux/nmon/default.nix b/pkgs/os-specific/linux/nmon/default.nix
index cb6dd4ab946c..9de18401d7b2 100644
--- a/pkgs/os-specific/linux/nmon/default.nix
+++ b/pkgs/os-specific/linux/nmon/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nmon";
-  version = "16k";
+  version = "16m";
 
   src = fetchurl {
     url = "mirror://sourceforge/nmon/lmon${version}.c";
-    sha256 = "17nbxrnl7kqiaaxn2hwyi65gphbl3wybbyp9vri2q5ifdis3ssib";
+    sha256 = "1hazgrq3m01dzv05639yis1mypcp0jf167n9gqwd3wgxzm2lvv9b";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 2b1b37db344d..b4c6952d44d3 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -59,15 +59,24 @@ installPhase() {
         mv $i/lib/libvdpau* $i/lib/vdpau
 
         # Install ICDs, make absolute paths.
+        # Be careful not to modify any original files because this runs twice.
+
+        # OpenCL
         sed -E "s#(libnvidia-opencl)#$i/lib/\\1#" nvidia.icd > nvidia.icd.fixed
         install -Dm644 nvidia.icd.fixed $i/etc/OpenCL/vendors/nvidia.icd
-        if [ -e nvidia_icd.json.template ]; then
-            # template patching for version < 435
-            sed "s#__NV_VK_ICD__#$i/lib/libGLX_nvidia.so#" nvidia_icd.json.template > nvidia_icd.json
-        fi
-        if [ -e nvidia_icd.json ]; then
-            install -Dm644 nvidia_icd.json $i/share/vulkan/icd.d/nvidia.json
+
+        # Vulkan
+        if [ -e nvidia_icd.json.template ] || [ -e nvidia_icd.json ]; then
+            if [ -e nvidia_icd.json.template ]; then
+                # template patching for version < 435
+                sed "s#__NV_VK_ICD__#$i/lib/libGLX_nvidia.so#" nvidia_icd.json.template > nvidia_icd.json.fixed
+            else
+                sed -E "s#(libGLX_nvidia)#$i/lib/\\1#" nvidia_icd.json > nvidia_icd.json.fixed
+            fi
+            install -Dm644 nvidia_icd.json.fixed $i/share/vulkan/icd.d/nvidia.json
         fi
+
+        # EGL
         if [ "$useGLVND" = "1" ]; then
             sed -E "s#(libEGL_nvidia)#$i/lib/\\1#" 10_nvidia.json > 10_nvidia.json.fixed
             install -Dm644 10_nvidia.json.fixed $i/share/glvnd/egl_vendor.d/nvidia.json
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index c41ce5994a1b..e3affca1220c 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -39,18 +39,6 @@ rec {
     sha256_64bit = "0h0jcckqpd63vaj95lvdgj2sbbn9y1ri1xx7r2snxfx0plhwz46n";
     settingsSha256 = "1w5nkxs7a40mq0qf97nhfazdqhfn1bvr54v50s8p0ggixb6vdm3l";
     persistencedSha256 = "02v76202qcnh8hvg4y9wmk9swdlv7z39ppfd1c850nlv158vn5nf";
-
-    patches = [
-      (fetchurl {
-        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/kernel-4.16.patch?h=2ad07241ea525a6b6b555b6cb96a97634a4b2cb0";
-        sha256 = "11b3dp0na496rn13v5q4k66bf61174800g36rcwj42r0xj9cfak2";
-      })
-
-      (fetchurl {
-        url = "https://git.archlinux.org/svntogit/packages.git/plain/trunk/kernel-5.1.patch?h=42d50ef8d6048608d18bdf2c296dd335260c5a1a";
-        sha256 = "03v46ym2bcckg9q2xrilkg21hfiwypr6gl4jmly2q3m4yza9ja6r";
-      })
-    ];
   };
 
   legacy_340 = generic {
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index 4040d70260c5..789668cb89e5 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -1,8 +1,16 @@
 { stdenv, fetchurl, autoreconfHook, pkgconfig
 , dpdk, libconfig, libpcap, numactl, openssl
-}:
+}: let
 
-stdenv.mkDerivation rec {
+  dpdk_17_11 = dpdk.overrideAttrs (old: rec {
+    version = "17.11.9";
+    src = fetchurl {
+      url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
+      sha256 = "0vrcc9mdjs5fk69lh7bigsk9208dfmjsz3jxaddkjlvk2hds1id6";
+    };
+  });
+
+in stdenv.mkDerivation rec {
   pname = "odp-dpdk";
   version = "1.19.0.0_DPDK_17.11";
 
@@ -12,16 +20,16 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig ];
-  buildInputs = [ dpdk libconfig libpcap numactl openssl ];
+  buildInputs = [ dpdk_17_11 libconfig libpcap numactl openssl ];
 
-  RTE_SDK = "${dpdk}/share/dpdk";
+  RTE_SDK = "${dpdk_17_11}/share/dpdk";
   RTE_TARGET = "x86_64-native-linuxapp-gcc";
 
   dontDisableStatic = true;
 
   configureFlags = [
     "--disable-shared"
-    "--with-dpdk-path=${dpdk}"
+    "--with-dpdk-path=${dpdk_17_11}"
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/open-iscsi/default.nix b/pkgs/os-specific/linux/open-iscsi/default.nix
index 274e960a89b0..090b9d7183d7 100644
--- a/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "open-iscsi";
-  version = "2.0.877";
+  version = "2.0.878";
 
   nativeBuildInputs = [ autoconf automake gettext libtool perl pkgconf ];
   buildInputs = [ kmod openisns.lib openssl systemd utillinux ];
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "open-iscsi";
     repo = "open-iscsi";
     rev = version;
-    sha256 = "0v3dsrl34pdx0yl5jsanrpgg3vw466rl8k81hkshgq3a5mq5qhf6";
+    sha256 = "0hkprlni0z1zdkrmhd897knyfws0l95bz67fgp0vvf63ag08b5ly";
   };
 
   DESTDIR = "$(out)";
diff --git a/pkgs/os-specific/linux/pagemon/default.nix b/pkgs/os-specific/linux/pagemon/default.nix
index 5d7357cb8380..772ef56cde2e 100644
--- a/pkgs/os-specific/linux/pagemon/default.nix
+++ b/pkgs/os-specific/linux/pagemon/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "pagemon";
-  version = "0.01.16";
+  version = "0.01.17";
 
   src = fetchFromGitHub {
-    sha256 = "0fpxjw6sg6r9r7yy03brri37wmmc32rhzayzlmwgmzay8rifmm7i";
+    sha256 = "11r84nwjvnjyxc3jqhbvlgb89ajfj7v8212mz61dq5ilq5k7xa3d";
     rev = "V${version}";
     repo = "pagemon";
     owner = "ColinIanKing";
diff --git a/pkgs/os-specific/linux/pam_ccreds/default.nix b/pkgs/os-specific/linux/pam_ccreds/default.nix
index 8293ac0a830a..012750c22adc 100644
--- a/pkgs/os-specific/linux/pam_ccreds/default.nix
+++ b/pkgs/os-specific/linux/pam_ccreds/default.nix
@@ -1,10 +1,10 @@
 {stdenv, fetchurl, pam, openssl, db}:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   name = "pam_ccreds-10";
 
   src = fetchurl {
-    url = "http://www.padl.com/download/pam_ccreds.tgz";
+    url = "https://www.padl.com/download/${name}.tar.gz";
     sha256 = "1h7zyg1b1h69civyvrj95w22dg0y7lgw3hq4gqkdcg35w1y76fhz";
   };
   patchPhase = ''
@@ -14,7 +14,7 @@ stdenv.mkDerivation {
   buildInputs = [ pam openssl db ];
 
   meta = with stdenv.lib; {
-    homepage = http://www.padl.com/OSS/pam_ccreds.html;
+    homepage = https://www.padl.com/OSS/pam_ccreds.html;
     description = "PAM module to locally authenticate using an enterprise identity when the network is unavailable";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/pam_ldap/default.nix b/pkgs/os-specific/linux/pam_ldap/default.nix
index 5b34a8bc82b5..2b3a300eccaa 100644
--- a/pkgs/os-specific/linux/pam_ldap/default.nix
+++ b/pkgs/os-specific/linux/pam_ldap/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "pam_ldap-186";
 
   src = fetchurl {
-    url = "http://www.padl.com/download/${name}.tar.gz";
+    url = "https://www.padl.com/download/${name}.tar.gz";
     sha256 = "0lv4f7hc02jrd2l3gqxd247qq62z11sp3fafn8lgb8ymb7aj5zn8";
   };
 
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ pam openldap ];
 
   meta = {
-    homepage = http://www.padl.com/OSS/pam_ldap.html;
+    homepage = https://www.padl.com/OSS/pam_ldap.html;
     description = "LDAP backend for PAM";
     longDescription = ''
       The pam_ldap module provides the means for Solaris and Linux servers and
diff --git a/pkgs/os-specific/linux/piper/default.nix b/pkgs/os-specific/linux/piper/default.nix
index e177b284bbda..1229c442fa22 100644
--- a/pkgs/os-specific/linux/piper/default.nix
+++ b/pkgs/os-specific/linux/piper/default.nix
@@ -4,7 +4,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "piper";
-  version = "0.2.903";
+  version = "0.3";
 
   format = "other";
 
@@ -12,12 +12,16 @@ python3.pkgs.buildPythonApplication rec {
     owner  = "libratbag";
     repo   = "piper";
     rev    =  version;
-    sha256 = "0zh4lm074x5gwvx663bapdyv8lf84yjwfg8cpf77rszyja1hx13a";
+    sha256 = "1vz7blhx6qsfrk5znwr0fj1k8vahnlaz6rn7ifcgxmq398mmz8z7";
   };
 
   nativeBuildInputs = [ meson ninja gettext pkgconfig wrapGAppsHook desktop-file-utils appstream-glib gobject-introspection ];
-  buildInputs = [ gtk3 glib gnome3.adwaita-icon-theme python3 ];
-  propagatedBuildInputs = with python3.pkgs; [ lxml evdev pygobject3 ];
+  buildInputs = [
+    gtk3 glib gnome3.adwaita-icon-theme python3
+  ];
+  propagatedBuildInputs = with python3.pkgs; [ lxml evdev pygobject3 ] ++ [
+    gobject-introspection # fixes https://github.com/NixOS/nixpkgs/issues/56943 for now
+  ];
 
   postPatch = ''
     chmod +x meson_install.sh # patchShebangs requires executable file
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 0d92c7c69098..157bd02a06c6 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -1,33 +1,23 @@
 { stdenv, lib, fetchurl, pkgconfig
-, dpdk, libpcap, numactl, utillinux
-, gtk2, withGtk ? false
+, dpdk, libpcap, lua5_3, numactl, utillinux
+, gtk2, which, withGtk ? false
 }:
 
 let
 
-  # pktgen needs a specific version of lua to apply its patch (see lib/lua/Makefile).
-  lua = rec {
-    name = "lua-5.3.4";
-    basename = name + ".tar.gz";
-    src = fetchurl {
-      url = "https://www.lua.org/ftp/${basename}";
-      sha256 = "0320a8dg3aci4hxla380dx1ifkw8gj4gbw5c4dz41g1kh98sm0gn";
-    };
-  };
-
 in stdenv.mkDerivation rec {
   pname = "pktgen";
-  version = "3.5.0";
+  version = "3.7.2";
 
   src = fetchurl {
-    url = "http://dpdk.org/browse/apps/pktgen-dpdk/snapshot/pktgen-${version}.tar.xz";
-    sha256 = "1gy99jr9dbwzi9pd3w5k673h3pfnbkz6rbzmrkwcyis72pnphy5z";
+    url = "http://dpdk.org/browse/apps/pktgen-dpdk/snapshot/${pname}-${version}.tar.xz";
+    sha256 = "03k7h4j2lsrh6b7477hgn87ljrjh2673ncffx9v261bx1ns54y7w";
   };
 
-  nativeBuildInputs = stdenv.lib.optionals withGtk [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig ];
 
   buildInputs =
-    [ dpdk libpcap numactl ]
+    [ dpdk libpcap lua5_3 numactl which ]
     ++ stdenv.lib.optionals withGtk [gtk2];
 
   RTE_SDK = "${dpdk}/share/dpdk";
@@ -37,19 +27,13 @@ in stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = [ "-msse3" ];
 
   postPatch = let dpdkMajor = lib.versions.major dpdk.version; in ''
-    substituteInPlace app/Makefile --replace 'yy :=' 'yy := ${dpdkMajor} #'
     substituteInPlace lib/common/lscpu.h --replace /usr/bin/lscpu ${utillinux}/bin/lscpu
-
-    ln -s ${lua.src} lib/lua/${lua.basename}
-    make -C lib/lua get_tarball # unpack and patch
-    substituteInPlace lib/lua/${lua.name}/src/luaconf.h --replace /usr/local $out
   '';
 
   installPhase = ''
     install -d $out/bin
     install -m 0755 app/${RTE_TARGET}/pktgen $out/bin
-    install -d $out/lib/lua/5.3
-    install -m 0644 Pktgen.lua $out/lib/lua/5.3
+    install -m 0644 Pktgen.lua $out/bin
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/ply/default.nix b/pkgs/os-specific/linux/ply/default.nix
index 24213cd2fb5a..42739e53fdac 100644
--- a/pkgs/os-specific/linux/ply/default.nix
+++ b/pkgs/os-specific/linux/ply/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, kernel, fetchFromGitHub, autoreconfHook, yacc, flex, p7zip }:
+{ stdenv, kernel, fetchFromGitHub, autoreconfHook, yacc, flex, p7zip, rsync }:
 
 assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "4.0";
 
@@ -7,7 +7,7 @@ let
 in stdenv.mkDerivation {
   pname = "ply";
   inherit version;
-  nativeBuildInputs = [ autoreconfHook flex yacc p7zip ];
+  nativeBuildInputs = [ autoreconfHook flex yacc p7zip rsync ];
 
   src = fetchFromGitHub {
     owner = "iovisor";
diff --git a/pkgs/os-specific/linux/power-calibrate/default.nix b/pkgs/os-specific/linux/power-calibrate/default.nix
new file mode 100644
index 000000000000..75c6f1716fc5
--- /dev/null
+++ b/pkgs/os-specific/linux/power-calibrate/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, lib, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "power-calibrate";
+  version = "0.01.28";
+
+  src = fetchurl {
+    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "1miyjs0vngzfdlsxhn5gndcalzkh28grg4m6faivvp1c6mjp794m";
+  };
+
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+  ];
+
+  meta = with lib; {
+    description = "Tool to calibrate power consumption";
+    homepage = "https://kernel.ubuntu.com/~cking/power-calibrate/";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 78aa5abdf308..b5e44a10947b 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -9,7 +9,7 @@ assert (!libsOnly) -> kernel != null;
 assert kernel != null -> stdenv.lib.versionOlder kernel.version "4.15";
 
 let xorgFullVer = lib.getVersion xorg.xorgserver;
-    xorgVer = lib.concatStringsSep "." (lib.take 2 (lib.splitString "." xorgFullVer));
+    xorgVer = lib.versions.majorMinor xorgFullVer;
     x64 = if stdenv.hostPlatform.system == "x86_64-linux" then true
           else if stdenv.hostPlatform.system == "i686-linux" then false
           else throw "Parallels Tools for Linux only support {x86-64,i686}-linux targets";
diff --git a/pkgs/os-specific/linux/r8168/default.nix b/pkgs/os-specific/linux/r8168/default.nix
index f2c87b97c4ff..b3d8965704fd 100644
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -6,7 +6,7 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 in stdenv.mkDerivation rec {
   name = "r8168-${kernel.version}-${version}";
   # on update please verify that the source matches the realtek version
-  version = "8.046.00";
+  version = "8.047.04";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     owner = "mtorromeo";
     repo = "r8168";
     rev = version;
-    sha256 = "0y8w3biw5mshn5bvl24b9rybfh67f1s9gfzkcv9p4m7s7nchj2dg";
+    sha256 = "1rni8jimwdhyx75603mdcylrdxgfwfpyprf1lf5x5cli2i4bbijg";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/radeontools/default.nix b/pkgs/os-specific/linux/radeontools/default.nix
index 81e5a2af9cdf..d2c3c11c9390 100644
--- a/pkgs/os-specific/linux/radeontools/default.nix
+++ b/pkgs/os-specific/linux/radeontools/default.nix
@@ -1,33 +1,25 @@
-{ stdenv, fetchurl, pciutils }:
+{ stdenv, fetchurl
+, autoreconfHook
+, pciutils
+, pkgconfig
+, xorg
+}:
 
-stdenv.mkDerivation {
-  name = "radeontool-1.5";
-
-  inherit pciutils;
-
-  # Don't know wether it's a good idea to hardcode the lspci path..
-  # But it will work on nix..
-  postUnpack = ''
-    cd $sourceRoot
-    sed -i "s%lspci%$pciutils/sbin/lspci%g" radeontool.c
-    cd ..
-  '';
+stdenv.mkDerivation rec {
+  pname = "radeontool";
+  version = "1.6.3";
 
   src = fetchurl {
-    url = http://fdd.com/software/radeon/radeontool-1.5.tar.gz;
-    sha256 = "0qbkawhhq0y0gqbbql7q04y0v0hims5c4jkjsbc1y03rf9kr10ar";
+    url = "https://people.freedesktop.org/~airlied/radeontool/${pname}-${version}.tar.gz";
+    sha256 = "0mjk9wr9rsb17yy92j6yi16hfpa6v5r1dbyiy60zp4r125wr63za";
   };
 
-  installPhase = ''
-    mkdir -p $out/bin
-    chmod +x lightwatch.pl
-    cp radeontool lightwatch.pl $out/bin
-  '';
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ xorg.libpciaccess ];
 
-  meta = {
-    description = "Control the backlight and external video output of ATI Radeon Mobility graphics cards";
-    homepage = http://fdd.com/software/radeon/;
-    license = stdenv.lib.licenses.zlib;
-    broken = true;
+  meta = with stdenv.lib; {
+    description = "Lowlevel tools to tweak register and dump state on radeon GPUs";
+    homepage = "https://airlied.livejournal.com/";
+    license = licenses.zlib;
   };
 }
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index ce0e8707ff57..da40321d6bcc 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -4,7 +4,7 @@
 } :
 
 let
-  version = "25.0";
+  version = "26.0";
 
 in stdenv.mkDerivation {
   pname = "rdma-core";
@@ -14,7 +14,7 @@ in stdenv.mkDerivation {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "1r1gfps1xckky06ib1rbf6lp58v2jqpy1ipkr45rf55gpaxf93cj";
+    sha256 = "0yvhc7xc3mxzjd7v2y408w333qi7hkf1f99gbsd3fv2qydp9gps3";
   };
 
   nativeBuildInputs = [ cmake pkgconfig pandoc docutils makeWrapper ];
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index f524bee35210..683645803464 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, kernel, bc }:
+{ stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
 
 stdenv.mkDerivation rec {
   name = "rtl8812au-${kernel.version}-${version}";
-  version = "5.2.20.2_28373.20180619";
+  version = "5.2.20.2_28373.20190903";
 
   src = fetchFromGitHub {
     owner = "zebulon2";
     repo = "rtl8812au-driver-5.2.20";
-    rev = "ac063a4b1a87855e10f6cd1f358aaccbeee9b9c1";
-    sha256 = "1cmsv22q4k6p2wzm73k60kxbjhcgx4hqr0x3djvqrlv4rzz75l92";
+    rev = "30d47a0a3f43ccb19e8fd59fe93d74a955147bf2";
+    sha256 = "1fy0f8ihxd0i5kr8gmky8v8xl0ns6bhxfdn64c97c5irzdvg37sr";
   };
 
-  nativeBuildInputs = [ bc ];
+  nativeBuildInputs = [ bc nukeReferences ];
   buildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
@@ -27,6 +27,10 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
+  postInstall = ''
+    nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
+  '';
+
   meta = with stdenv.lib; {
     description = "Driver for Realtek 802.11ac, rtl8812au, provides the 8812au mod";
     homepage = https://github.com/zebulon2/rtl8812au-driver-5.2.20;
diff --git a/pkgs/os-specific/linux/rtl8821au/default.nix b/pkgs/os-specific/linux/rtl8821au/default.nix
index ca63c5c6a8df..1829bd6763f0 100644
--- a/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, kernel, bc }:
+{ stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
 
 stdenv.mkDerivation rec {
   name = "rtl8821au-${kernel.version}-${version}";
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "1kmdxgbh0s0v9809kdsi39p0jbm5cf10ivy40h8qj9hn70g1gw8q";
   };
 
-  nativeBuildInputs = [ bc ];
+  nativeBuildInputs = [ bc nukeReferences ];
   buildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
@@ -30,6 +30,10 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
+  postInstall = ''
+    nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
+  '';
+
   meta = with stdenv.lib; {
     description = "rtl8821AU, rtl8812AU and rtl8811AU chipset driver with firmware";
     homepage = https://github.com/zebulon2/rtl8812au;
diff --git a/pkgs/os-specific/linux/rtlwifi_new/default.nix b/pkgs/os-specific/linux/rtlwifi_new/default.nix
index 447f9127d607..94ba31d59e1a 100644
--- a/pkgs/os-specific/linux/rtlwifi_new/default.nix
+++ b/pkgs/os-specific/linux/rtlwifi_new/default.nix
@@ -6,13 +6,13 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 
 in stdenv.mkDerivation rec {
   pname = "rtlwifi_new";
-  version = "2018-02-17";
+  version = "2019-08-21";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtlwifi_new";
-    rev = "0588ac0cc5f530e7764705416370b70d3c2afedc";
-    sha256 = "1vs8rfw19lcs04bapa97zlnl5x0kf02sdw5ik0hdm27wgk0z969m";
+    rev = "a108e3de87c2ed30b71c3c4595b79ab7a2f9e348";
+    sha256 = "15kjs9i9vvmn1cdzccd5cljf3m45r4ssm65klkj2fdkf3kljj38k";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/os-specific/linux/s6-linux-utils/default.nix b/pkgs/os-specific/linux/s6-linux-utils/default.nix
index bd6b84ea73cf..200e66cb4d89 100644
--- a/pkgs/os-specific/linux/s6-linux-utils/default.nix
+++ b/pkgs/os-specific/linux/s6-linux-utils/default.nix
@@ -4,8 +4,8 @@ with skawarePackages;
 
 buildPackage {
   pname = "s6-linux-utils";
-  version = "2.5.0.1";
-  sha256 = "0bpcaah3rbz4i013bkarr7wxmfvisjyxg0z78xg5zfbgajpgjxx1";
+  version = "2.5.1.1";
+  sha256 = "00nw2phd9prgv29hzqzwjnh4y0ivkzhx3srn6n1rlyr4ydhikxi5";
 
   description = "A set of minimalistic Linux-specific system utilities";
   platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index 1e82c4921595..138b54b02242 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, bison, flex, python3 , swig
+{ stdenv, fetchFromGitHub, python3
 , libsepol, libselinux, checkpolicy
 , withGraphics ? false
 }:
@@ -8,16 +8,16 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.2.0";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
     rev = version;
-    sha256 = "1bjwcvr6rjx79cdcvaxn68bdrnl4f2a8gnnqsngdxhkhwpddksjy";
+    sha256 = "18kklv26dwm2fdjjzfflvxsq83b2svnwf4g18xq7wsfsri121a90";
   };
 
-  nativeBuildInputs = [ bison flex swig ];
+  nativeBuildInputs = [ cython ];
   buildInputs = [ libsepol ];
   propagatedBuildInputs = [ enum34 libselinux networkx ]
     ++ optionals withGraphics [ pyqt5 ];
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index b4c5c0bac841..f810270a29e2 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt, libxml2
-, docbook_xml_dtd_45, docbook_xsl, gnome-doc-utils, flex, bison
+, docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison
 , pam ? null, glibcCross ? null
 }:
 
@@ -19,18 +19,18 @@ in
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.6";
+  version = "4.7";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = "shadow";
     rev = version;
-    sha256 = "1llcv77lvpc4h3rgww9ms736kbdisiylcr2z02863f41afxbwl82";
+    sha256 = "0a7g9k83igfid8pybqpk6fracmz2q021isn2by3994p4hhh3s327";
   };
 
   buildInputs = stdenv.lib.optional (pam != null && stdenv.isLinux) pam;
   nativeBuildInputs = [autoreconfHook libxslt libxml2
-    docbook_xml_dtd_45 docbook_xsl gnome-doc-utils flex bison
+    docbook_xml_dtd_45 docbook_xsl flex bison itstool
     ];
 
   patches =
@@ -38,12 +38,11 @@ stdenv.mkDerivation rec {
       # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
       ./respect-xml-catalog-files-var.patch
       dots_in_usernames
-
-      # Check for correct DocBook version during configure
-      # https://github.com/shadow-maint/shadow/pull/162
+      # Allow building with itstool
+      # https://github.com/shadow-maint/shadow/pull/184
       (fetchpatch {
-        url = "https://github.com/shadow-maint/shadow/commit/47797ca6654f79e3de854a6c69db2bdb0516db08.patch";
-        sha256 = "1zn8f6fd26gj5sh60099xqc7mjwgbbkkic5xfigvxa4b90vm8fd7";
+        url = https://github.com/shadow-maint/shadow/commit/6c6c8d3a33bba32277e1ed46f55df1e6dbc914b7.patch;
+        sha256 = "0xfr1mrfv5xsmri6l7ycbpz3qhs4vf3fyci4kwpffi3icsfjn557";
       })
     ];
 
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index e2adcd2cc2a0..ba6aff4e8bcf 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, gettext, bzip2 }:
 
 stdenv.mkDerivation rec {
-  name = "sysstat-12.1.5";
+  name = "sysstat-12.1.7";
 
   src = fetchurl {
-    url = "http://perso.orange.fr/sebastien.godard/${name}.tar.xz";
-    sha256 = "1i92jmrqcpzgy98r1f4fd0x7y2wvwc05ywsh19w3s2gmndmr75m4";
+    url = "http://pagesperso-orange.fr/sebastien.godard/${name}.tar.xz";
+    sha256 = "1i0qy44krl1gj82izgmqa0zdw82f2gmqzlslvdg5v270vl7i24g7";
   };
 
   buildInputs = [ gettext ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 90b33e183cef..d14985d07edf 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,9 +1,9 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
-, xz, pam, acl, libuuid, m4, utillinux, libffi
+{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap
+, curl, kmod, gnupg, gnutar, xz, pam, acl, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
 , audit, lz4, bzip2, libmicrohttpd, pcre2
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
-, iptables, gnu-efi
+, iptables, gnu-efi, bashInteractive
 , gettext, docbook_xsl, docbook_xml_dtd_42, docbook_xml_dtd_45
 , ninja, meson, python3Packages, glibcLocales
 , patchelf
@@ -15,9 +15,20 @@
 , withKexectools ? lib.any (lib.meta.platformMatch stdenv.hostPlatform) kexectools.meta.platforms, kexectools
 }:
 
-let
-  pythonLxmlEnv = buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]);
-
+let gnupg-minimal = gnupg.override {
+  enableMinimal = true;
+  guiSupport = false;
+  pcsclite = null;
+  sqlite = null;
+  pinentry = null;
+  adns = null;
+  gnutls = null;
+  libusb = null;
+  openldap = null;
+  readline = null;
+  zlib = null;
+  bzip2 = null;
+};
 in stdenv.mkDerivation {
   version = "243";
   pname = "systemd";
@@ -27,8 +38,8 @@ in stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "systemd";
-    rev = "7019836a26ebdc1ba20c03d06dbb3a613833bd0f";
-    sha256 = "0ywaq5jfy177k4q5hwr43v66sz62l1bqhgyxs2vk9m1d5kvrjwk6";
+    rev = "d25cf413c6bff1b5a9d216a8830e3a90c9cad1de";
+    sha256 = "0ilvrnh3m7g0yflxl16fk52gkb1z0fwwk9ba5gs4005nzpl0c7i0";
   };
 
   outputs = [ "out" "lib" "man" "dev" ];
@@ -44,7 +55,7 @@ in stdenv.mkDerivation {
       (buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]))
     ];
   buildInputs =
-    [ linuxHeaders libcap kmod xz pam acl
+    [ linuxHeaders libcap curl.dev kmod xz pam acl
       /* cryptsetup */ libuuid glib libgcrypt libgpgerror libidn2
       libmicrohttpd pcre2 ] ++
       stdenv.lib.optional withKexectools kexectools ++
@@ -56,7 +67,7 @@ in stdenv.mkDerivation {
   #dontAddPrefix = true;
 
   mesonFlags = [
-    "-Ddbuspolicydir=${placeholder "out"}/etc/dbus-1/system.d"
+    "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
     "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
     "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
     "-Dpamconfdir=${placeholder "out"}/etc/pam.d"
@@ -67,8 +78,10 @@ in stdenv.mkDerivation {
     "-Dloadkeys-path=${kbd}/bin/loadkeys"
     "-Dsetfont-path=${kbd}/bin/setfont"
     "-Dtty-gid=3" # tty in NixOS has gid 3
+    "-Ddebug-shell=${bashInteractive}/bin/bash"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
+    "-Dimportd=true"
     "-Dlz4=true"
     "-Dhostnamed=true"
     "-Dnetworkd=true"
@@ -79,15 +92,25 @@ in stdenv.mkDerivation {
     "-Dlocaled=true"
     "-Dresolve=true"
     "-Dsplit-usr=false"
-    "-Dlibcurl=false"
+    "-Dlibcurl=true"
     "-Dlibidn=false"
     "-Dlibidn2=true"
     "-Dquotacheck=false"
     "-Dldconfig=false"
     "-Dsmack=true"
     "-Db_pie=true"
-    "-Dsystem-uid-max=499" #TODO: debug why awking around in /etc/login.defs doesn't work
-    "-Dsystem-gid-max=499"
+    /*
+    As of now, systemd doesn't allow runtime configuration of these values. So
+    the settings in /etc/login.defs have no effect on it. Many people think this
+    should be supported however, see
+    - https://github.com/systemd/systemd/issues/3855
+    - https://github.com/systemd/systemd/issues/4850
+    - https://github.com/systemd/systemd/issues/9769
+    - https://github.com/systemd/systemd/issues/9843
+    - https://github.com/systemd/systemd/issues/10184
+    */
+    "-Dsystem-uid-max=999"
+    "-Dsystem-gid-max=999"
     # "-Dtime-epoch=1"
 
     (if !stdenv.hostPlatform.isEfi then "-Dgnu-efi=false" else "-Dgnu-efi=true")
@@ -117,7 +140,7 @@ in stdenv.mkDerivation {
     export LC_ALL="en_US.UTF-8";
     # FIXME: patch this in systemd properly (and send upstream).
     # already fixed in f00929ad622c978f8ad83590a15a765b4beecac9: (u)mount
-    for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.in src/journal/cat.c src/shutdown/shutdown.c src/nspawn/nspawn.c src/shared/generator.c; do
+    for i in src/remount-fs/remount-fs.c src/core/mount.c src/core/swap.c src/fsck/fsck.c units/emergency.service.in units/rescue.service.in src/journal/cat.c src/shutdown/shutdown.c src/nspawn/nspawn.c src/shared/generator.c units/systemd-logind.service.in units/systemd-nspawn@.service.in; do
       test -e $i
       substituteInPlace $i \
         --replace /usr/bin/getent ${getent}/bin/getent \
@@ -127,6 +150,7 @@ in stdenv.mkDerivation {
         --replace /bin/echo ${coreutils}/bin/echo \
         --replace /bin/cat ${coreutils}/bin/cat \
         --replace /sbin/sulogin ${lib.getBin utillinux}/sbin/sulogin \
+        --replace /sbin/modprobe ${lib.getBin kmod}/sbin/modprobe \
         --replace /usr/lib/systemd/systemd-fsck $out/lib/systemd/systemd-fsck \
         --replace /bin/plymouth /run/current-system/sw/bin/plymouth # To avoid dependency
     done
@@ -135,6 +159,14 @@ in stdenv.mkDerivation {
       patchShebangs $dir
     done
 
+    # absolute paths to gpg & tar
+    substituteInPlace src/import/pull-common.c \
+      --replace '"gpg"' '"${gnupg-minimal}/bin/gpg"'
+    for file in src/import/{{export,import,pull}-tar,import-common}.c; do
+      substituteInPlace $file \
+        --replace '"tar"' '"${gnutar}/bin/tar"'
+    done
+
     substituteInPlace src/journal/catalog.c \
       --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
   '';
@@ -223,7 +255,7 @@ in stdenv.mkDerivation {
   # in a backwards-incompatible way.  If the interface version of two
   # systemd builds is the same, then we can switch between them at
   # runtime; otherwise we can't and we need to reboot.
-  passthru.interfaceVersion = 3;
+  passthru.interfaceVersion = 2;
 
   meta = with stdenv.lib; {
     homepage = http://www.freedesktop.org/wiki/Software/systemd;
@@ -231,6 +263,6 @@ in stdenv.mkDerivation {
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     priority = 10;
-    maintainers = with maintainers; [ eelco andir ];
+    maintainers = with maintainers; [ eelco andir mic92 ];
   };
 }
diff --git a/pkgs/os-specific/linux/sysvinit/default.nix b/pkgs/os-specific/linux/sysvinit/default.nix
index a29c6152aaa6..e3a8baa7da35 100644
--- a/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/pkgs/os-specific/linux/sysvinit/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, withoutInitTools ? false }:
 
-let version = "2.95"; in
+let version = "2.96"; in
 
 stdenv.mkDerivation {
   name = (if withoutInitTools then "sysvtools" else "sysvinit") + "-" + version;
 
   src = fetchurl {
     url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.xz";
-    sha256 = "1j46dydib9yd2a46w43is9b61lplwrsry46fw7cbmfrn7ywrq0n9";
+    sha256 = "11xmcamvjmrw874zp0vc37hrqc4hz02i0iy8n4xa4dd25avjcbia";
   };
 
   prePatch = ''
diff --git a/pkgs/os-specific/linux/targetcli/default.nix b/pkgs/os-specific/linux/targetcli/default.nix
index b8990484cb98..aa670aba7271 100644
--- a/pkgs/os-specific/linux/targetcli/default.nix
+++ b/pkgs/os-specific/linux/targetcli/default.nix
@@ -2,17 +2,22 @@
 
 python.pkgs.buildPythonApplication rec {
   pname = "targetcli";
-  version = "2.1.fb49";
+  version = "2.1.51";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "${pname}-fb";
     rev = "v${version}";
-    sha256 = "093dmwc5g6yz4cdgpbfszmc97i7nd286w4x447dvg22hvwvjwqhh";
+    sha256 = "07i9kyr525hlk32amzgycirwgwykdbjy5fmw6ji0nnhvk2jh4arn";
   };
 
   propagatedBuildInputs = with python.pkgs; [ configshell rtslib ];
 
+  postInstall = ''
+    install -D targetcli.8 -t $out/share/man/man8/
+    install -D targetclid.8 -t $out/share/man/man8/
+  '';
+
   meta = with stdenv.lib; {
     description = "A command shell for managing the Linux LIO kernel target";
     homepage = https://github.com/open-iscsi/targetcli-fb;
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index 567dcd1068c5..47adcf938c5b 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchgit, asciidoc, docbook_xsl, libxslt }:
 stdenv.mkDerivation {
   pname = "trace-cmd";
-  version = "2.8.3";
+  version = "2.9-dev";
 
   src = fetchgit (import ./src.nix);
 
@@ -17,19 +17,15 @@ stdenv.mkDerivation {
 
   buildPhase = "make trace-cmd libs doc";
 
-  installTargets = [ "install_cmd" "install_libs" "install_man" ];
+  installTargets = [ "install_cmd" "install_libs" "install_doc" ];
   installFlags = [
     "bindir=${placeholder "out"}/bin"
     "man_dir=${placeholder "man"}/share/man"
     "libdir=${placeholder "lib"}/lib"
-    "includedir=${placeholder "dev"}/include/trace-cmd"
+    "includedir=${placeholder "dev"}/include"
     "BASH_COMPLETE_DIR=${placeholder "out"}/etc/bash_completion.d"
   ];
 
-  postInstall = ''
-    mv $dev/include/trace-cmd/traceevent $dev/include/traceevent
-  '';
-
   meta = with stdenv.lib; {
     description = "User-space tools for the Linux kernel ftrace subsystem";
     homepage    = http://kernelshark.org/;
diff --git a/pkgs/os-specific/linux/trace-cmd/fix-Makefiles.patch b/pkgs/os-specific/linux/trace-cmd/fix-Makefiles.patch
index 0d6f5c5d8bfe..db194e16fdb6 100644
--- a/pkgs/os-specific/linux/trace-cmd/fix-Makefiles.patch
+++ b/pkgs/os-specific/linux/trace-cmd/fix-Makefiles.patch
@@ -1,52 +1,35 @@
-diff --git a/Documentation/Makefile b/Documentation/Makefile
-index 21e42fd..826361d 100644
---- a/Documentation/Makefile
-+++ b/Documentation/Makefile
-@@ -108,7 +108,11 @@ $(IMGS_INSTALL): %.png.install : %.png force
- 
- GUI_INSTALL = $(HTML_INSTALL) $(IMGS_INSTALL)
- 
--install: $(MAN1_INSTALL) $(MAN5_INSTALL) $(GUI_INSTALL)
-+install_man: $(MAN1_INSTALL) $(MAN5_INSTALL)
-+
-+install_gui: $(GUI_INSTALL)
-+
-+install: install_man install_gui
- 
- clean:
- 	(cd $(obj); \
 diff --git a/Makefile b/Makefile
-index 2bcc383..107ead0 100644
+index bbdf15e..deb8ef7 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -289,7 +289,7 @@ libtraceevent.a: $(LIBTRACEEVENT_STATIC)
+@@ -288,7 +288,7 @@ libtraceevent.a: $(LIBTRACEEVENT_STATIC)
  libtracecmd.a: $(LIBTRACECMD_STATIC)
  libtracecmd.so: $(LIBTRACECMD_SHARED)
  
 -libs: $(LIBTRACECMD_SHARED) $(LIBTRACEEVENT_SHARED)
 +libs: $(LIBTRACECMD_SHARED) $(LIBTRACEEVENT_SHARED) $(LIBTRACECMD_STATIC) $(LIBTRACEEVENT_STATIC)
  
- plugins: force $(obj)/plugins/trace_plugin_dir $(obj)/plugins/trace_python_dir
- 	$(Q)$(MAKE) -C $(src)/plugins
-@@ -345,6 +345,8 @@ install_gui: install_cmd gui
+ plugins: force $(obj)/lib/traceevent/plugins/traceevent_plugin_dir $(obj)/lib/traceevent/plugins/trace_python_dir
+ 	$(Q)$(MAKE) -C $(src)/lib/traceevent/plugins
+@@ -344,6 +344,8 @@ install_gui: install_cmd gui
  install_libs: libs
- 	$(Q)$(call do_install,$(LIBTRACECMD_SHARED),$(libdir_SQ))
- 	$(Q)$(call do_install,$(LIBTRACEEVENT_SHARED),$(libdir_SQ))
-+	$(Q)$(call do_install,$(LIBTRACECMD_STATIC),$(libdir_SQ))
-+	$(Q)$(call do_install,$(LIBTRACEEVENT_STATIC),$(libdir_SQ))
+ 	$(Q)$(call do_install,$(LIBTRACECMD_SHARED),$(libdir_SQ)/trace-cmd)
+ 	$(Q)$(call do_install,$(LIBTRACEEVENT_SHARED),$(libdir_SQ)/traceevent)
++	$(Q)$(call do_install,$(LIBTRACECMD_STATIC),$(libdir_SQ)/trace-cmd)
++	$(Q)$(call do_install,$(LIBTRACEEVENT_STATIC),$(libdir_SQ)/traceevent)
  	$(Q)$(call do_install,$(src)/include/traceevent/event-parse.h,$(includedir_SQ)/traceevent)
  	$(Q)$(call do_install,$(src)/include/traceevent/trace-seq.h,$(includedir_SQ)/traceevent)
- 	$(Q)$(call do_install,$(src)/include/trace-cmd/trace-cmd.h,$(includedir_SQ))
-@@ -356,6 +358,12 @@ doc:
- doc_clean:
- 	$(MAKE) -C $(src)/Documentation clean
+ 	$(Q)$(call do_install,$(src)/include/trace-cmd/trace-cmd.h,$(includedir_SQ)/trace-cmd)
+diff --git a/kernel-shark/src/CMakeLists.txt b/kernel-shark/src/CMakeLists.txt
+index e20a030..7fce165 100644
+--- a/kernel-shark/src/CMakeLists.txt
++++ b/kernel-shark/src/CMakeLists.txt
+@@ -93,7 +93,7 @@ if (Qt5Widgets_FOUND AND Qt5Network_FOUND)
+             DESTINATION ${_INSTALL_PREFIX}/share/icons/${KS_APP_NAME})
  
-+install_man:
-+	$(MAKE) -C $(src)/Documentation install_man
-+
-+install_gui_docs:
-+	$(MAKE) -C $(src)/Documentation install_gui
-+
- install_doc:
- 	$(MAKE) -C $(src)/Documentation install
+     install(FILES "${KS_DIR}/org.freedesktop.kshark-record.policy"
+-            DESTINATION /usr/share/polkit-1/actions/)
++            DESTINATION ${_INSTALL_PREFIX}/share/polkit-1/actions/)
  
+     install(PROGRAMS "${KS_DIR}/bin/kshark-su-record"
+             DESTINATION ${_INSTALL_PREFIX}/bin/)
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index b73de3193d22..5e355ac7c9a7 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -1,7 +1,7 @@
-{ stdenv, mkDerivation, fetchgit, qtbase, cmake, json_c, mesa_glu, freeglut, trace-cmd, pkg-config }:
+{ stdenv, mkDerivation, fetchgit, qtbase, cmake, asciidoc, docbook_xsl, json_c, mesa_glu, freeglut, trace-cmd, pkg-config }:
 mkDerivation {
   pname = "kernelshark";
-  version = "0.9.8";
+  version = "1.1.0";
 
   src = fetchgit (import ./src.nix);
 
@@ -11,27 +11,28 @@ mkDerivation {
 
   preConfigure = "pushd kernel-shark";
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ pkg-config cmake asciidoc ];
 
-  buildInputs = [ qtbase json_c mesa_glu freeglut pkg-config ];
+  buildInputs = [ qtbase json_c mesa_glu freeglut ];
 
   cmakeFlags = [
     "-D_INSTALL_PREFIX=${placeholder "out"}"
     "-DTRACECMD_BIN_DIR=${trace-cmd}/bin"
     "-DTRACECMD_INCLUDE_DIR=${trace-cmd.dev}/include"
-    "-DTRACECMD_LIBRARY=${trace-cmd.lib}/lib/libtracecmd.a"
-    "-DTRACEEVENT_LIBRARY=${trace-cmd.lib}/lib/libtraceevent.a"
+    "-DTRACECMD_LIBRARY=${trace-cmd.lib}/lib/trace-cmd/libtracecmd.a"
+    "-DTRACEEVENT_LIBRARY=${trace-cmd.lib}/lib/traceevent/libtraceevent.a"
   ];
 
   preInstall = ''
     popd
-    make install_gui_docs prefix=$doc
+    make install_doc_gui prefix=$doc \
+      FIND_MANPAGE_DOCBOOK_XSL=${docbook_xsl}/share/xml/docbook-xsl-nons/manpages/docbook.xsl
     pushd kernel-shark/build
   '';
 
   meta = with stdenv.lib; {
     description = "GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem";
-    homepage    = http://kernelshark.org/;
+    homepage    = https://kernelshark.org/;
     license     = licenses.gpl2;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ basvandijk ];
diff --git a/pkgs/os-specific/linux/trace-cmd/src.nix b/pkgs/os-specific/linux/trace-cmd/src.nix
index 836e71b1851e..47c1b82fdd46 100644
--- a/pkgs/os-specific/linux/trace-cmd/src.nix
+++ b/pkgs/os-specific/linux/trace-cmd/src.nix
@@ -1,5 +1,5 @@
 {
   url    = "git://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
-  rev    = "138c70106835ee0f05879e7f2f46bca8dae7ca99"; # branch: trace-cmd-stable-v2.8
-  sha256 = "1grpip7lywf98nsm7ql1d6bgc0ky0672savr8jz3a8hf9ny265nx";
+  rev    = "ab370b78b9278fe16657742d46cb95c0a65b47d5"; # branch: kernelshark-v1.1
+  sha256 = "0qngwc4qgadrkwlwpz73f12prdkx94kl0bg7g9hib95ipvsdmk1c";
 }
diff --git a/pkgs/os-specific/linux/trezor-udev-rules/default.nix b/pkgs/os-specific/linux/trezor-udev-rules/default.nix
new file mode 100644
index 000000000000..c2be81373768
--- /dev/null
+++ b/pkgs/os-specific/linux/trezor-udev-rules/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "trezor-udev-rules";
+  version = "unstable-2019-07-17";
+
+  udevRules = fetchurl {
+    # let's pin the latest commit in the repo which touched the udev rules file
+    url = "https://raw.githubusercontent.com/trezor/trezor-firmware/68a3094b0a8e36b588b1bcb58c34a2c9eafc0dca/common/udev/51-trezor.rules";
+    sha256 = "0vlxif89nsqpbnbz1vwfgpl1zayzmq87gw1snskn0qns6x2rpczk";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    cp ${udevRules} 51-trezor.rules
+    mkdir -p $out/lib/udev/rules.d
+    # we use trezord group, not plugdev
+    # we don't need the udev-acl tag
+    substituteInPlace 51-trezor.rules \
+      --replace 'GROUP="plugdev"' 'GROUP="trezord"' \
+      --replace ', TAG+="udev-acl"' ""
+    cp 51-trezor.rules $out/lib/udev/rules.d/51-trezor.rules
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Udev rules for Trezor";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ prusnak ];
+    platforms = platforms.linux;
+    homepage = "https://github.com/trezor/trezor-firmware/tree/master/common/udev";
+  };
+}
diff --git a/pkgs/os-specific/linux/turbostat/default.nix b/pkgs/os-specific/linux/turbostat/default.nix
new file mode 100644
index 000000000000..10074f490b80
--- /dev/null
+++ b/pkgs/os-specific/linux/turbostat/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, kernel }:
+
+stdenv.mkDerivation {
+  pname = "turbostat";
+  inherit (kernel) src version;
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  postPatch = ''
+    cd tools/power/x86/turbostat
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Report processor frequency and idle statistics";
+    homepage = https://www.kernel.org/;
+    license = licenses.gpl2;
+    platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
+  };
+}
+
diff --git a/pkgs/os-specific/linux/uclibc/default.nix b/pkgs/os-specific/linux/uclibc/default.nix
index c07e063caa71..5f4014110747 100644
--- a/pkgs/os-specific/linux/uclibc/default.nix
+++ b/pkgs/os-specific/linux/uclibc/default.nix
@@ -48,7 +48,7 @@ let
     UCLIBC_HAS_FPU n
   '';
 
-  version = "1.0.31";
+  version = "1.0.32";
 in
 
 stdenv.mkDerivation {
@@ -58,7 +58,7 @@ stdenv.mkDerivation {
   src = fetchurl {
     url = "https://downloads.uclibc-ng.org/releases/${version}/uClibc-ng-${version}.tar.bz2";
     # from "${url}.sha256";
-    sha256 = "0ba9yh7ir1jamrgc9x9v7zw0sw144f78q4vidiz6ynpr4dwbd5qm";
+    sha256 = "0cp4xf3k0ib76xaz6n6i7yybw7s92s607ak8svq1kakwk0d1jjbv";
   };
 
   # 'ftw' needed to build acl, a coreutils dependency
@@ -109,6 +109,6 @@ stdenv.mkDerivation {
     description = "A small implementation of the C library";
     maintainers = with maintainers; [ rasendubi ];
     license = licenses.lgpl2;
-    platforms = platforms.linux;
+    platforms = intersectLists platforms.linux platforms.x86; # fails to build on ARM
   };
 }
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index e99e9e37d823..1d967b38eb96 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     sha256 = "01wx2x8xyal595dhdih7rva2bz7gqzgwdp56gi0ikjdzayx17wcf";
   };
 
-  outputs = [ "out" "man" "dev" "devdoc" ];
+  outputs = [ "out" "man" "dev" ] ++ stdenv.lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "devdoc";
 
   patches = [
     (substituteAll {
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
   preConfigure = "NOCONFIGURE=1 ./autogen.sh";
 
   configureFlags = [
-    "--enable-gtk-doc"
+    (stdenv.lib.enableFeature (stdenv.buildPlatform == stdenv.hostPlatform) "gtk-doc")
     "--localstatedir=/var"
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     "--with-udevdir=$(out)/lib/udev"
diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index a688f60492a8..73db222d390c 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -19,14 +19,14 @@ in stdenv.mkDerivation rec {
     sha256 = "1ng0x3wj3a1ckfd00yxa4za43xms92gdp7rdag060b7p39z7m4gf";
   };
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" ] ++ lib.optional withUtils "lib" ++ [ "dev" ];
 
-  configureFlags =
-    if withUtils then [
-      "--with-udevdir=${placeholder "out"}/lib/udev"
-    ] else [
-      "--disable-v4l-utils"
-    ];
+  configureFlags = (if withUtils then [
+    "--with-localedir=${placeholder "lib"}/share/locale"
+    "--with-udevdir=${placeholder "out"}/lib/udev"
+  ] else [
+    "--disable-v4l-utils"
+  ]);
 
   postFixup = ''
     # Create symlink for V4l1 compatibility
@@ -39,10 +39,8 @@ in stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ libjpeg ];
 
-  NIX_CFLAGS_COMPILE = lib.optional withQt "-std=c++11";
-
   postPatch = ''
-    patchShebangs .
+    patchShebangs utils/cec-ctl/msg2ctl.pl
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 2e22b99a95f3..ab1413efd801 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "v4l2loopback-${version}-${kernel.version}";
-  version = "0.12.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "umlaeute";
     repo = "v4l2loopback";
     rev = "v${version}";
-    sha256 = "1rf8dvabksxb2sj14j32h7n7pw7byqfnpqs4m4afj3398y9y23c4";
+    sha256 = "1bcypfz5nlfmdm2a00yl7rgl0jh0g2nmwndxlsrblqclznhjilg2";
   };
 
   hardeningDisable = [ "format" "pic" ];
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 69525c92ede9..dc5b4289a451 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "05qzak1mssnxcgdrafifxh9w86a4ha69qabkg4bsigk499xyxggw";
   };
 
+  patches = [
+    (fetchurl {
+      name = "CVE-2019-16275.patch";
+      url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
+      sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
+    })
+  ];
+
   # TODO: Patch epoll so that the dbus actually responds
   # TODO: Figure out how to get privsep working, currently getting SIGBUS
   extraConfig = ''
@@ -85,17 +93,19 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/man/man5 $out/share/man/man8
     cp -v "doc/docbook/"*.5 $out/share/man/man5/
     cp -v "doc/docbook/"*.8 $out/share/man/man8/
-    mkdir -p $out/etc/dbus-1/system.d $out/share/dbus-1/system-services $out/etc/systemd/system
+
+    mkdir -p $out/share/dbus-1/system.d $out/share/dbus-1/system-services $out/etc/systemd/system
     cp -v "dbus/"*service $out/share/dbus-1/system-services
     sed -e "s@/sbin/wpa_supplicant@$out&@" -i "$out/share/dbus-1/system-services/"*
-    cp -v dbus/dbus-wpa_supplicant.conf $out/etc/dbus-1/system.d
+    cp -v dbus/dbus-wpa_supplicant.conf $out/share/dbus-1/system.d
     cp -v "systemd/"*.service $out/etc/systemd/system
+
     rm $out/share/man/man8/wpa_priv.8
     install -Dm444 wpa_supplicant.conf $out/share/doc/wpa_supplicant/wpa_supplicant.conf.example
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://hostap.epitest.fi/wpa_supplicant/;
+    homepage = https://hostap.epitest.fi/wpa_supplicant/;
     description = "A tool for connecting to WPA and WPA2-protected wireless networks";
     license = licenses.bsd3;
     maintainers = with maintainers; [ marcweber ];
diff --git a/pkgs/os-specific/linux/wpa_supplicant/gui.nix b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
index 7c6f595bfafd..d02901e0cc1c 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/gui.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
@@ -25,7 +25,7 @@ mkDerivation {
 
   meta = with stdenv.lib; {
     description = "Qt-based GUI for wpa_supplicant";
-    homepage = http://hostap.epitest.fi/wpa_supplicant/;
+    homepage = https://hostap.epitest.fi/wpa_supplicant/;
     license = licenses.bsd3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/xf86-input-cmt/default.nix b/pkgs/os-specific/linux/xf86-input-cmt/default.nix
index 2422b70b0685..9f9b278d6f77 100644
--- a/pkgs/os-specific/linux/xf86-input-cmt/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-cmt/default.nix
@@ -2,7 +2,7 @@
   utilmacros, libgestures, libevdevc }:
 
 stdenv.mkDerivation rec {
-  name = "xf86-input-cmt-${version}";
+  pname = "xf86-input-cmt";
   version = "2.0.2";
   src = fetchFromGitHub {
     owner = "hugegreenbug";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     description = "Chromebook touchpad driver.";
     license = licenses.bsd3;
     platforms = platforms.linux;
-    homepage = "www.github.com/hugegreenbug/xf86-input-cmt";
+    homepage = "https://www.github.com/hugegreenbug/xf86-input-cmt";
     maintainers = with maintainers; [ kcalvinalvin ];
   };
 }
diff --git a/pkgs/os-specific/linux/zfs/build-fixes-unstable.patch b/pkgs/os-specific/linux/zfs/build-fixes-unstable.patch
deleted file mode 100644
index ff2c6e2e1503..000000000000
--- a/pkgs/os-specific/linux/zfs/build-fixes-unstable.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From b323e7a7ebb2327943851fa3fd139399eb24d3dd Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Mon, 13 Aug 2018 22:58:21 +0200
-Subject: [PATCH] build fixes needed for nixos
-
----
- module/Makefile.in | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/module/Makefile.in b/module/Makefile.in
-index 935bd2663..afb08df81 100644
---- a/module/Makefile.in
-+++ b/module/Makefile.in
-@@ -44,15 +44,15 @@ clean:
- modules_install:
- 	@# Install the kernel modules
- 	$(MAKE) -C @LINUX_OBJ@ M=`pwd` $@ \
--		INSTALL_MOD_PATH=$(DESTDIR)$(INSTALL_MOD_PATH) \
-+		INSTALL_MOD_PATH=@prefix@/$(INSTALL_MOD_PATH) \
- 		INSTALL_MOD_DIR=$(INSTALL_MOD_DIR) \
- 		KERNELRELEASE=@LINUX_VERSION@
- 	@# Remove extraneous build products when packaging
--	kmoddir=$(DESTDIR)$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
--	if [ -n "$(DESTDIR)" ]; then \
-+	kmoddir=@prefix@$(INSTALL_MOD_PATH)/lib/modules/@LINUX_VERSION@; \
-+	if [ -n "@prefix@" ]; then \
- 		find $$kmoddir -name 'modules.*' | xargs $(RM); \
- 	fi
--	sysmap=$(DESTDIR)$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
-+	sysmap=@prefix@$(INSTALL_MOD_PATH)/boot/System.map-@LINUX_VERSION@; \
- 	if [ -f $$sysmap ]; then \
- 		depmod -ae -F $$sysmap @LINUX_VERSION@; \
- 	fi
--- 
-2.19.2
-
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index 1b9b5a3ba515..ae72aad6c077 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -7,6 +7,7 @@
 , libtirpc
 , nfs-utils
 , gawk, gnugrep, gnused, systemd
+, smartmontools, sysstat, sudo
 
 # Kernel dependencies
 , kernel ? null
@@ -19,7 +20,7 @@ let
 
   common = { version
     , sha256
-    , extraPatches
+    , extraPatches ? []
     , rev ? "zfs-${version}"
     , isUnstable ? false
     , incompatibleKernelVersion ? null }:
@@ -103,6 +104,7 @@ let
       installFlags = [
         "sysconfdir=\${out}/etc"
         "DEFAULT_INITCONF_DIR=\${out}/default"
+        "INSTALL_MOD_PATH=\${out}"
       ];
 
       postInstall = optionalString buildKernel ''
@@ -130,6 +132,13 @@ let
         (cd $out/share/bash-completion/completions; ln -s zfs zpool)
       '';
 
+      postFixup = ''
+        path="PATH=${makeBinPath [ coreutils gawk gnused gnugrep utillinux smartmontools sysstat sudo ]}"
+        for i in $out/libexec/zfs/zpool.d/*; do
+          sed -i "2i$path" $i
+        done
+      '';
+
       outputs = [ "out" ] ++ optionals buildUser [ "lib" "dev" ];
 
       meta = {
@@ -139,7 +148,7 @@ let
           Copy-On-Write filesystem with data integrity detection and repair,
           snapshotting, cloning, block devices, deduplication, and more.
         '';
-        homepage = http://zfsonlinux.org/;
+        homepage = https://zfsonlinux.org/;
         license = licenses.cddl;
         platforms = platforms.linux;
         maintainers = with maintainers; [ jcumming wizeman fpletz globin ];
@@ -154,13 +163,9 @@ in {
     # incompatibleKernelVersion = "4.20";
 
     # this package should point to the latest release.
-    version = "0.8.1";
+    version = "0.8.2";
 
-    sha256 = "0wlbziijx08a9bmbyq4gfz4by9l5jrx44g18i99qnfm78k2q8a84";
-
-    extraPatches = [
-      ./build-fixes-unstable.patch
-    ];
+    sha256 = "0miax0h2wg4b2kn8n93804faajy2n1sh25knyy2hg3k77nlr4pni";
   };
 
   zfsUnstable = common {
@@ -168,13 +173,9 @@ in {
     # incompatibleKernelVersion = "4.19";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "0.8.1";
+    version = "0.8.2";
 
-    sha256 = "0wlbziijx08a9bmbyq4gfz4by9l5jrx44g18i99qnfm78k2q8a84";
+    sha256 = "0miax0h2wg4b2kn8n93804faajy2n1sh25knyy2hg3k77nlr4pni";
     isUnstable = true;
-
-    extraPatches = [
-      ./build-fixes-unstable.patch
-    ];
   };
 }
diff --git a/pkgs/os-specific/windows/wxMSW-2.8/default.nix b/pkgs/os-specific/windows/wxMSW-2.8/default.nix
index 65690af98697..2764c4232c16 100644
--- a/pkgs/os-specific/windows/wxMSW-2.8/default.nix
+++ b/pkgs/os-specific/windows/wxMSW-2.8/default.nix
@@ -31,5 +31,7 @@ stdenv.mkDerivation {
 
   meta = {
     platforms = stdenv.lib.platforms.windows;
+
+    broken = true;
   };
 }