Merge remote-tracking branch 'upstream/master' into HEAD

34 files changed, 804 insertions, 596 deletions

diff --git a/pkgs/applications/kde/gwenview.nix b/pkgs/applications/kde/gwenview.nix
index 233566c1bdaf..3d03d1dea3e7 100644
--- a/pkgs/applications/kde/gwenview.nix
+++ b/pkgs/applications/kde/gwenview.nix
@@ -3,7 +3,7 @@
   extra-cmake-modules, kdoctools,
   exiv2, lcms2,
   baloo, kactivities, kdelibs4support, kio, kipi-plugins, libkdcraw, libkipi,
-  phonon, qtimageformats, qtsvg, qtx11extras
+  phonon, qtimageformats, qtsvg, qtx11extras, kinit
 }:
 
 mkDerivation {
@@ -17,5 +17,5 @@ mkDerivation {
     baloo exiv2 kactivities kdelibs4support kio libkdcraw lcms2 libkipi phonon
     qtimageformats qtsvg qtx11extras
   ];
-  propagatedUserEnvPkgs = [ kipi-plugins ];
+  propagatedUserEnvPkgs = [ kipi-plugins libkipi (lib.getBin kinit) ];
 }
diff --git a/pkgs/applications/kde/k3b.nix b/pkgs/applications/kde/k3b.nix
index 79806dc93fbc..cfe7327ac72a 100644
--- a/pkgs/applications/kde/k3b.nix
+++ b/pkgs/applications/kde/k3b.nix
@@ -5,7 +5,7 @@
 , flac, lame, libmad, libmpcdec, libvorbis
 , libsamplerate, libsndfile, taglib
 , cdparanoia, cdrdao, cdrtools, dvdplusrwtools, libburn, libdvdcss, libdvdread, vcdimager
-, ffmpeg, libmusicbrainz2, normalize, sox, transcode, shared_mime_info
+, ffmpeg, libmusicbrainz2, normalize, sox, transcode, shared_mime_info, kinit
 }:
 
 mkDerivation {
@@ -30,6 +30,7 @@ mkDerivation {
     # others
     ffmpeg libmusicbrainz2 shared_mime_info
   ];
+  propagatedUserEnvPkgs = [ (lib.getBin kinit) ];
   postFixup =
     let k3bPath = lib.makeBinPath [
           cdrdao cdrtools dvdplusrwtools libburn normalize sox transcode
diff --git a/pkgs/applications/kde/konsole.nix b/pkgs/applications/kde/konsole.nix
index bd026c6f0395..d2d60adda2c5 100644
--- a/pkgs/applications/kde/konsole.nix
+++ b/pkgs/applications/kde/konsole.nix
@@ -20,4 +20,5 @@ mkDerivation {
     kguiaddons kiconthemes kinit kio knotifications knotifyconfig kparts kpty
     kservice ktextwidgets kwidgetsaddons kwindowsystem kxmlgui qtscript
   ];
+  propagatedUserEnvPkgs = [ (lib.getBin kinit) ];
 }
diff --git a/pkgs/applications/kde/spectacle.nix b/pkgs/applications/kde/spectacle.nix
index db1bf2aee659..1be07fe6fe86 100644
--- a/pkgs/applications/kde/spectacle.nix
+++ b/pkgs/applications/kde/spectacle.nix
@@ -16,5 +16,5 @@ mkDerivation {
     kconfig kcoreaddons kdbusaddons kdeclarative kio knotifications
     kscreen kwidgetsaddons kwindowsystem kxmlgui libkipi qtx11extras
   ];
-  propagatedUserEnvPkgs = [ kipi-plugins ];
+  propagatedUserEnvPkgs = [ kipi-plugins libkipi ];
 }
diff --git a/pkgs/applications/misc/k3b/wrapper.nix b/pkgs/applications/misc/k3b/wrapper.nix
deleted file mode 100644
index 486d3fb7ddf7..000000000000
--- a/pkgs/applications/misc/k3b/wrapper.nix
+++ /dev/null
@@ -1,15 +0,0 @@
-{ lib, symlinkJoin, k3b-original, cdrtools, makeWrapper }:
-
-let
-  binPath = lib.makeBinPath [ cdrtools ];
-in symlinkJoin {
-  name = "k3b-${k3b-original.version}";
-
-  paths = [ k3b-original ];
-  buildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/k3b \
-      --prefix PATH ':' ${binPath}
-  '';
-}
diff --git a/pkgs/desktops/mate/caja/default.nix b/pkgs/desktops/mate/caja/default.nix
index d068f432ee95..07c7d0662a97 100644
--- a/pkgs/desktops/mate/caja/default.nix
+++ b/pkgs/desktops/mate/caja/default.nix
@@ -4,11 +4,11 @@ stdenv.mkDerivation rec {
   name = "caja-${version}";
   version = "${major-ver}.${minor-ver}";
   major-ver = "1.18";
-  minor-ver = "0";
+  minor-ver = "3";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/${major-ver}/${name}.tar.xz";
-    sha256 = "1fc7dxj9hw8fffrcnwxbj8pq7gl08il68rkpk92rv3qm7siv1606";
+    sha256 = "0mljqcx7k8p27854zm7qzzn8ca6hs7hva9p43hp4p507z52caqmm";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix b/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix
index ddc6d81499da..05edfc1dd6d4 100644
--- a/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix
+++ b/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix
@@ -4,11 +4,11 @@ stdenv.mkDerivation rec {
   name = "mate-icon-theme-faenza-${version}";
   version = "${major-ver}.${minor-ver}";
   major-ver = "1.18";
-  minor-ver = "0";
+  minor-ver = "1";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/${major-ver}/${name}.tar.xz";
-    sha256 = "1crfv6s3ljbc7a7m229bvs3qbjzlp8cgvyhqmdaa9npd5lxmk88v";
+    sha256 = "0vc3wg9l5yrxm0xmligz4lw2g3nqj1dz8fwv90xvym8pbjds2849";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/desktops/mate/mate-icon-theme/default.nix b/pkgs/desktops/mate/mate-icon-theme/default.nix
index 3a2de515ba9a..239a01c759af 100644
--- a/pkgs/desktops/mate/mate-icon-theme/default.nix
+++ b/pkgs/desktops/mate/mate-icon-theme/default.nix
@@ -4,11 +4,11 @@ stdenv.mkDerivation rec {
   name = "mate-icon-theme-${version}";
   version = "${major-ver}.${minor-ver}";
   major-ver = "1.18";
-  minor-ver = "1";
+  minor-ver = "2";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/${major-ver}/${name}.tar.xz";
-    sha256 = "1217nza3ilmy6x3b9i1b75lpq7lpvhs18s0c2n3j6zhxdqy61nlm";
+    sha256 = "0si3li3kza7s45zhasjvqn5f85zpkn0x8i4kq1dlnqvjjqzkg4ch";
   };
 
   nativeBuildInputs = [ pkgconfig intltool iconnamingutils ];
diff --git a/pkgs/desktops/mate/mate-terminal/default.nix b/pkgs/desktops/mate/mate-terminal/default.nix
index 532e50c45495..9d620b283018 100644
--- a/pkgs/desktops/mate/mate-terminal/default.nix
+++ b/pkgs/desktops/mate/mate-terminal/default.nix
@@ -4,11 +4,11 @@ stdenv.mkDerivation rec {
   name = "mate-terminal-${version}";
   version = "${major-ver}.${minor-ver}";
   major-ver = "1.18";
-  minor-ver = "0";
+  minor-ver = "1";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/${major-ver}/${name}.tar.xz";
-    sha256 = "07z8g8zkc8k6d7xqdlg18cjnwg7zzv5hbgwma5y9mh8zx9xsqz92";
+    sha256 = "1zihm609d2d9cw53ry385whshjl1dnkifpk41g1ddm9f58hv4da1";
   };
 
   buildInputs = [
diff --git a/pkgs/desktops/mate/mate-themes/default.nix b/pkgs/desktops/mate/mate-themes/default.nix
index 793c68e688a5..45be1d8710d7 100644
--- a/pkgs/desktops/mate/mate-themes/default.nix
+++ b/pkgs/desktops/mate/mate-themes/default.nix
@@ -6,15 +6,15 @@ stdenv.mkDerivation rec {
   version = "${major-ver}.${minor-ver}";
   major-ver = gnome3.version;
   minor-ver = {
-    "3.20" = "19";
-    "3.22" = "10";
+    "3.20" = "22";
+    "3.22" = "13";
   }."${major-ver}";
 
   src = fetchurl {
     url = "http://pub.mate-desktop.org/releases/themes/${major-ver}/${name}.tar.xz";
     sha256 = {
-      "3.20" = "11b8g374dkjhbs7x7khpriabvkip4dmfkma5myzfv6m54qlj3b8g";
-      "3.22" = "03ficjfxa4qpx4vcshhk2zxryivckxpw7wcjgbn8xqnjk3lgzjcb";
+      "3.20" = "1yjj5w7zvyjyg0k21nwk438jjsnj0qklsf0z5pmmp1jff1vxyck4";
+      "3.22" = "1p7w63an8qs15hkj79nppy7471glv0rm1b0himn3c4w69q8qdc9i";
     }."${major-ver}";
   };
 
diff --git a/pkgs/desktops/xfce/core/xfce4-light-locker.patch b/pkgs/desktops/xfce/core/xfce4-light-locker.patch
new file mode 100644
index 000000000000..4e1dcc1efa71
--- /dev/null
+++ b/pkgs/desktops/xfce/core/xfce4-light-locker.patch
@@ -0,0 +1,16 @@
+--- ./scripts/xflock4.orig	2017-08-06 23:05:53.807688995 +0100
++++ ./scripts/xflock4	2017-08-06 23:09:06.171789989 +0100
+@@ -24,10 +24,11 @@
+ PATH=/bin:/usr/bin
+ export PATH
+
+-# Lock by xscreensaver or gnome-screensaver, if a respective daemon is running
++# Lock by xscreensaver, gnome-screensaver or light-locker, if a respective daemon is running
+ for lock_cmd in \
+     "xscreensaver-command -lock" \
+-    "gnome-screensaver-command --lock"
++    "gnome-screensaver-command --lock" \
++    "light-locker-command -l"
+ do
+     $lock_cmd >/dev/null 2>&1 && exit
+ done
diff --git a/pkgs/desktops/xfce/core/xfce4-session.nix b/pkgs/desktops/xfce/core/xfce4-session.nix
index a0568b0dd395..edc810d38972 100644
--- a/pkgs/desktops/xfce/core/xfce4-session.nix
+++ b/pkgs/desktops/xfce/core/xfce4-session.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
     sha256 = "97d7f2a2d0af7f3623b68d1f04091e02913b28f9555dab8b0d26c8a1299d08fd";
   };
 
+  patches = [
+    # Fix "lock screen" not working for light-locker
+    ./xfce4-light-locker.patch
+  ];
+
   buildInputs =
     [ pkgconfig intltool gtk libxfce4util libxfce4ui libwnck dbus_glib
       xfconf xfce4panel libglade xorg.iceauth xorg.libSM
diff --git a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
index fec038199adc..2a00cf5f2d29 100644
--- a/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk-linux-base.nix
@@ -27,7 +27,8 @@
 , mesa_noglu
 , freetype
 , fontconfig
-, gnome2
+, gtk2
+, pango
 , cairo
 , alsaLib
 , atk
@@ -196,7 +197,7 @@ let result = stdenv.mkDerivation rec {
    * libXt is only needed on amd64
    */
   libraries =
-    [stdenv.cc.libc glib libxml2 libav_0_8 ffmpeg libxslt mesa_noglu xorg.libXxf86vm alsaLib fontconfig freetype gnome2.pango gnome2.gtk cairo gdk_pixbuf atk] ++
+    [stdenv.cc.libc glib libxml2 libav_0_8 ffmpeg libxslt mesa_noglu xorg.libXxf86vm alsaLib fontconfig freetype pango gtk2 cairo gdk_pixbuf atk] ++
     (if swingSupport then [xorg.libX11 xorg.libXext xorg.libXtst xorg.libXi xorg.libXp xorg.libXt xorg.libXrender stdenv.cc.cc] else []);
 
   rpath = stdenv.lib.strings.makeLibraryPath libraries;
diff --git a/pkgs/development/compilers/polyml/5.6.nix b/pkgs/development/compilers/polyml/5.6.nix
new file mode 100644
index 000000000000..8b5d14e7f5fb
--- /dev/null
+++ b/pkgs/development/compilers/polyml/5.6.nix
@@ -0,0 +1,33 @@
+{stdenv, fetchurl, autoreconfHook}:
+
+let
+  version = "5.6";
+in
+
+stdenv.mkDerivation {
+  name = "polyml-${version}";
+
+  prePatch = stdenv.lib.optionalString stdenv.isDarwin ''
+    substituteInPlace configure.ac --replace stdc++ c++
+  '';
+
+  buildInputs = stdenv.lib.optional stdenv.isDarwin autoreconfHook;
+
+  src = fetchurl {
+    url = "mirror://sourceforge/polyml/polyml.${version}.tar.gz";
+    sha256 = "05d6l2a5m9jf32a8kahwg2p2ph4x9rjf1nsl83331q3gwn5bkmr0";
+  };
+
+  meta = {
+    description = "Standard ML compiler and interpreter";
+    longDescription = ''
+      Poly/ML is a full implementation of Standard ML.
+    '';
+    homepage = http://www.polyml.org/;
+    license = stdenv.lib.licenses.lgpl21;
+    platforms = with stdenv.lib.platforms; linux;
+    maintainers = [ #Add your name here!
+      stdenv.lib.maintainers.z77z
+    ];
+  };
+}
diff --git a/pkgs/development/compilers/ponyc/default.nix b/pkgs/development/compilers/ponyc/default.nix
index c3d9d9882074..ab7881a21514 100644
--- a/pkgs/development/compilers/ponyc/default.nix
+++ b/pkgs/development/compilers/ponyc/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation ( rec {
   name = "ponyc-${version}";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = "ponyc";
     rev = version;
-    sha256 = "175yivc5vjwfdcqcpkdqmdfy72pn4k62n4j3qagfbwya7frq2car";
+    sha256 = "06g811x7vc275ypn3laqcsq7lmp2w8al6ipkpknhpq9c6lf7dvcp";
   };
 
   buildInputs = [ llvm makeWrapper which ];
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 196e8f01d4d7..77e57ed7324b 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -64,8 +64,19 @@ self: super: builtins.intersectAttrs super {
       "--extra-include-dirs=${pkgs.cudatoolkit}/include"
     ];
     preConfigure = ''
-      unset CC          # unconfuse the haskell-cuda configure script
-      sed -i -e 's|/usr/local/cuda|${pkgs.cudatoolkit}|g' configure
+      export CUDA_PATH=${pkgs.cudatoolkit}
+    '';
+  });
+
+  nvvm = overrideCabal super.nvvm (drv: {
+    preConfigure = ''
+      export CUDA_PATH=${pkgs.cudatoolkit}
+    '';
+  });
+
+  cufft = overrideCabal super.cufft (drv: {
+    preConfigure = ''
+      export CUDA_PATH=${pkgs.cudatoolkit}
     '';
   });
 
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 1fdfe4ca61dd..897f84f94ada 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -1,5 +1,5 @@
 { pkgs, stdenv, fetchurl, fetchFromGitHub, makeWrapper, gawk, gnum4, gnused
-, libxml2, libxslt, ncurses, openssl, perl, gcc, autoreconfHook
+, libxml2, libxslt, ncurses, openssl, perl, autoreconfHook
 , openjdk ? null # javacSupport
 , unixODBC ? null # odbcSupport
 , mesa ? null, wxGTK ? null, wxmac ? null, xorg ? null # wxSupport
@@ -47,9 +47,9 @@ in stdenv.mkDerivation ({
 
   inherit src version;
 
-  buildInputs =
-   [ perl gnum4 ncurses openssl autoreconfHook libxslt libxml2 makeWrapper gcc
-   ]
+  nativeBuildInputs = [ autoreconfHook makeWrapper perl ];
+
+  buildInputs = [ gnum4 ncurses openssl autoreconfHook libxslt libxml2 ]
     ++ optionals wxSupport wxPackages2
     ++ optionals odbcSupport odbcPackages
     ++ optionals javacSupport javacPackages
diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index 4a02c034cf38..c0c9cfa2749f 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -231,11 +231,11 @@ assert nvenc -> nvidia-video-sdk != null && nonfreeLicensing;
 
 stdenv.mkDerivation rec {
   name = "ffmpeg-full-${version}";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchurl {
     url = "https://www.ffmpeg.org/releases/ffmpeg-${version}.tar.xz";
-    sha256 = "11974vcfsy8w0i6f4lfwqmg80xkfybqw7vw6zzrcn5i6ncddx60r";
+    sha256 = "07is8msrhxr1dk6vgwa192k2pl2a0in1h9w8f9cknlvbvhn01afj";
   };
 
   patchPhase = ''patchShebangs .
diff --git a/pkgs/development/libraries/ffmpeg/3.3.nix b/pkgs/development/libraries/ffmpeg/3.3.nix
index 342137553135..bf414e0865d1 100644
--- a/pkgs/development/libraries/ffmpeg/3.3.nix
+++ b/pkgs/development/libraries/ffmpeg/3.3.nix
@@ -6,7 +6,7 @@
 
 callPackage ./generic.nix (args // rec {
   version = "${branch}";
-  branch = "3.3.2";
-  sha256 = "0slf12dxk6wq1ns09kqqqrzwylxcy0isvc3niyxig45gq3ah0s91";
+  branch = "3.3.3";
+  sha256 = "0wx421d7vp4nz8kgp0kg16sswikj8ff1pd18x9mmcbpmqy7sqs8h";
   darwinFrameworks = [ Cocoa CoreMedia ];
 })
diff --git a/pkgs/development/libraries/leatherman/default.nix b/pkgs/development/libraries/leatherman/default.nix
index d45a616606d9..a9c7a9b70bb4 100644
--- a/pkgs/development/libraries/leatherman/default.nix
+++ b/pkgs/development/libraries/leatherman/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "leatherman-${version}";
-  version = "0.11.2";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
-    sha256 = "1rnk204mvzc44i69b8gfb1fjj5r4qby7ymal782rdplnlbm065r8";
+    sha256 = "15kg6vdr1iav5x3pzwvrdsi54lbl8zh2xwqlp03gaq4n3kg5wj3y";
     rev = version;
     repo = "leatherman";
     owner = "puppetlabs";
diff --git a/pkgs/development/libraries/libgcrypt/default.nix b/pkgs/development/libraries/libgcrypt/default.nix
index ed742bee8741..5bcb8c5fe98a 100644
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libgpgerror, enableCapabilities ? false, libcap }:
+{ stdenv, fetchurl, libgpgerror, enableCapabilities ? false, libcap }:
 
 assert enableCapabilities -> stdenv.isLinux;
 
@@ -14,9 +14,13 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "dev" "info" ];
   outputBin = "dev";
 
-  buildInputs =
-    [ libgpgerror ]
-    ++ lib.optional enableCapabilities libcap;
+  # The CPU Jitter random number generator must not be compiled with
+  # optimizations and the optimize -O0 pragma only works for gcc.
+  # The build enables -O2 by default for everything else.
+  hardeningDisable = stdenv.lib.optional stdenv.cc.isClang "fortify";
+
+  buildInputs = [ libgpgerror ]
+    ++ stdenv.lib.optional enableCapabilities libcap;
 
   # Make sure libraries are correct for .pc and .la files
   # Also make sure includes are fixed for callers who don't use libgpgcrypt-config
diff --git a/pkgs/development/python-modules/feedgen/default.nix b/pkgs/development/python-modules/feedgen/default.nix
new file mode 100644
index 000000000000..9ad28e52baac
--- /dev/null
+++ b/pkgs/development/python-modules/feedgen/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, buildPythonPackage, fetchPypi, fetchurl, dateutil, lxml }:
+
+buildPythonPackage rec {
+  pname = "feedgen";
+  version = "0.5.1";
+  name = "${pname}-${version}";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "3a344b5e3662e9012d095a081a7f216f188dccf3a8f44ad7882960fef05e6787";
+  };
+
+  propagatedBuildInputs = [ dateutil lxml ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "Python module to generate ATOM feeds, RSS feeds and Podcasts.";
+    downloadPage = https://github.com/lkiesow/python-feedgen/releases;
+    homepage = https://github.com/lkiesow/python-feedgen;
+    license = with licenses; [ bsd2 lgpl3 ];
+    maintainers = with maintainers; [ casey ];
+  };
+}
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 49fd080df454..45a4d8a8358b 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -52,12 +52,12 @@ rec {
   };
 
   gradle_latest = gradleGen rec {
-    name = "gradle-4.0.2";
+    name = "gradle-4.1";
     nativeVersion = "0.14";
 
     src = fetchurl {
       url = "http://services.gradle.org/distributions/${name}-bin.zip";
-      sha256 = "08ns3p1w258cbfk6yg3yy2mmy7wwma5riq04yjjgc4dx889l5b3r";
+      sha256 = "0hzdz5cy5dmyqz73qy80q74aiy87jl5vnxcy3imahgaszffglpfm";
     };
   };
 
diff --git a/pkgs/misc/themes/adapta/default.nix b/pkgs/misc/themes/adapta/default.nix
index e62707afb7ca..acce5ccac21e 100644
--- a/pkgs/misc/themes/adapta/default.nix
+++ b/pkgs/misc/themes/adapta/default.nix
@@ -1,31 +1,49 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, parallel, sassc, inkscape, libxml2, glib, gdk_pixbuf, librsvg, gtk-engine-murrine }:
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, parallel, sassc, inkscape, libxml2, glib, gdk_pixbuf, librsvg, gtk-engine-murrine, gnome3 }:
 
 stdenv.mkDerivation rec {
   name = "adapta-gtk-theme-${version}";
-  version = "3.90.0.125";
-
-  meta = with stdenv.lib; {
-    description = "An adaptive GTK+ theme based on Material Design";
-    homepage = https://github.com/tista500/Adapta;
-    license = with licenses; [ gpl2 cc-by-sa-30 ];
-    platforms = platforms.linux;
-    maintainers = [ maintainers.romildo ];
-  };
+  version = "3.91.1.47";
 
   src = fetchFromGitHub {
     owner = "tista500";
     repo = "Adapta";
     rev = version;
-    sha256 = "0abww5rcbn478w2kdhjlf68bfj8yf8i02nlmrjpp7j1v14r32xr0";
+    sha256 = "1w41xwhb93p999g0835cmlax55a5fyz9j4m5nn6nss2d6g6nrxap";
   };
 
   preferLocalBuild = true;
 
-  nativeBuildInputs = [ autoreconfHook pkgconfig parallel sassc inkscape libxml2 glib.dev ];
-
-  buildInputs = [ gdk_pixbuf librsvg gtk-engine-murrine ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+    parallel
+    sassc
+    inkscape
+    libxml2
+    glib.dev
+    gnome3.gnome_shell
+  ];
+
+  buildInputs = [
+    gdk_pixbuf
+    librsvg
+    gtk-engine-murrine
+  ];
 
   postPatch = "patchShebangs .";
 
-  configureFlags = "--disable-unity";
+  configureFlags = [
+    "--disable-gtk_legacy"
+    "--disable-gtk_next"
+    "--disable-unity"
+    "--disable-parallel" # parallel build is not finishing
+  ];
+
+  meta = with stdenv.lib; {
+    description = "An adaptive Gtk+ theme based on Material Design";
+    homepage = https://github.com/tista500/Adapta;
+    license = with licenses; [ gpl2 cc-by-sa-30 ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.romildo ];
+  };
 }
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index df18c60130df..deb1d81775b3 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -3,14 +3,11 @@
   WARNING/NOTE: whenever you want to add an option here you need to
   either
 
-  * make sure it works for all the versions in nixpkgs,
+  * mark it as an optional one with `?` suffix,
+  * or make sure it works for all the versions in nixpkgs,
   * or check for which kernel versions it will work (using kernel
     changelog, google or whatever) and mark it with `versionOlder` or
-    `versionAtLeast`
-
-  This file has a fairly obvious structure, follow it!
-  Do not duplicate predicates, sort options alphabetically, comment if
-  the option's functionality is non-obvious.
+    `versionAtLeast`.
 
   Then do test your change by building all the kernels (or at least
   their configs) in Nixpkgs or else you will guarantee lots and lots
@@ -24,635 +21,704 @@
 with stdenv.lib;
 
 ''
-# Globally applicable
+  # Compress kernel modules for a sizable disk space savings.
+  ${optionalString (versionAtLeast version "3.18") ''
+    MODULE_COMPRESS y
+    MODULE_COMPRESS_XZ y
+  ''}
 
-  8139TOO_8129 y
-  8139TOO_PIO n # PIO is slower
-  9P_FS_POSIX_ACL y
-  9P_FSCACHE y
-  ACCESSIBILITY y # Accessibility support
-  AIC79XX_DEBUG_ENABLE n
-  AIC7XXX_DEBUG_ENABLE n
-  AIC94XX_DEBUG n
-  ASYNC_RAID6_TEST n
-  ATH9K_AHB y # Ditto, AHB bus
-  ATH9K_PCI y # Detect Atheros AR9xxx cards on PCI(e) bus
-  ATOMIC64_SELFTEST n
-  AUXDISPLAY y # Auxiliary Display support
-  B43_PHY_HT y
-  BACKTRACE_SELF_TEST n
+  KERNEL_XZ y
+
+  # Debugging.
+  DEBUG_KERNEL y
+  DYNAMIC_DEBUG y
   BACKTRACE_SELF_TEST n
-  BCMA_HOST_PCI y
-  BINFMT_MISC y
-  BINFMT_SCRIPT y # Our initrd init uses shebang scripts, so can't be modular.
-  BLK_CGROUP y # required by CFQ
-  BLK_DEV_INITRD y # Enable initrd support
-  BLK_DEV_INTEGRITY y
-  BLK_DEV_RAM y # Enable initrd support
-  BLK_DEV_THROTTLING y
-  BONDING m
-  BRCMFMAC_USB y
-  BRIDGE_VLAN_FILTERING y
-  BSD_PROCESS_ACCT_V3 y
-  BT_HCIUART_BCSP y
-  BT_HCIUART_H4 y # UART (H4) protocol support
-  BT_HCIUART_LL y
-  BT_RFCOMM_TTY y # RFCOMM TTY support
-  BTRFS_FS_POSIX_ACL y
-  CC_OPTIMIZE_FOR_SIZE n # Optimize with -O2
-  CFG80211_WEXT y # Without it, ipw2200 drivers don't build
-  CFQ_GROUP_IOSCHED y
-  CGROUP_DEVICE y
-  CGROUPS y # used by systemd
-  CIFS_ACL y
-  CIFS_DFS_UPCALL y
-  CIFS_FSCACHE y
-  CIFS_POSIX y
-  CIFS_STATS y
-  CIFS_UPCALL y
-  CIFS_WEAK_PW_HASH y
-  CIFS_XATTR y
-  CLEANCACHE y
-  CLS_U32_MARK y
-  CLS_U32_PERF y
-  CONNECTOR y # PROC_EVENTS requires that the netlink connector is not built as a module
-  CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
-  CRASH_DUMP n
-  CRC32_SELFTEST n
-  CRYPTO_TEST n
   DEBUG_DEVRES n
-  DEBUG_KERNEL y
   DEBUG_STACK_USAGE n
   DEBUG_STACKOVERFLOW n
-  DEFAULT_SECURITY_APPARMOR y
+  SCHEDSTATS n
   DETECT_HUNG_TASK y
-  DEVTMPFS y
+
+  ${optionalString (versionOlder version "4.4") ''
+    CPU_NOTIFIER_ERROR_INJECT? n
+  ''}
+
+  ${optionalString (versionOlder version "4.11") ''
+    TIMER_STATS y
+    DEBUG_NX_TEST n
+  ''}
+
+  # Bump the maximum number of CPUs to support systems like EC2 x1.*
+  # instances and Xeon Phi.
+  ${optionalString (stdenv.system == "x86_64-linux" || stdenv.system == "aarch64-linux") ''
+    NR_CPUS 384
+  ''}
+
+  # Unix domain sockets.
+  UNIX y
+
+  # Power management.
+  ${optionalString (versionOlder version "3.19") ''
+    PM_RUNTIME y
+  ''}
+  PM_ADVANCED_DEBUG y
+  ${optionalString (versionAtLeast version "3.11") ''
+    X86_INTEL_LPSS y
+  ''}
+  ${optionalString (versionAtLeast version "3.10") ''
+    X86_INTEL_PSTATE y
+  ''}
+  INTEL_IDLE y
+  CPU_FREQ_DEFAULT_GOV_PERFORMANCE y
+  ${optionalString (versionOlder version "3.10") ''
+    USB_SUSPEND y
+  ''}
+  PM_WAKELOCKS y
+
+  # Support drivers that need external firmware.
+  STANDALONE n
+
+  # Make /proc/config.gz available.
+  IKCONFIG y
+  IKCONFIG_PROC y
+
+  # Optimize with -O2, not -Os.
+  CC_OPTIMIZE_FOR_SIZE n
+
+  # Enable the kernel's built-in memory tester.
+  MEMTEST y
+
+  # Include the CFQ I/O scheduler in the kernel, rather than as a
+  # module, so that the initrd gets a good I/O scheduler.
+  IOSCHED_CFQ y
+  BLK_CGROUP y # required by CFQ
+  IOSCHED_DEADLINE y
+  ${optionalString (versionAtLeast version "4.11") ''
+    MQ_IOSCHED_DEADLINE y
+  ''}
+  ${optionalString (versionAtLeast version "4.12") ''
+    BFQ_GROUP_IOSCHED y
+    MQ_IOSCHED_KYBER y
+    IOSCHED_BFQ m
+  ''}
+
+  # Enable NUMA.
+  NUMA? y
+
+  # Disable some expensive (?) features.
+  PM_TRACE_RTC n
+
+  # Enable initrd support.
+  BLK_DEV_RAM y
+  BLK_DEV_INITRD y
+
+  # Enable various subsystems.
+  ACCESSIBILITY y # Accessibility support
+  AUXDISPLAY y # Auxiliary Display support
   DONGLE y # Serial dongle support
-  DRM_GMA3600 y
-  DRM_GMA600 y
-  DRM_LOAD_EDID_FIRMWARE y
-  DVB_DYNAMIC_MINORS y # we use udev
-  EFI_STUB y # EFI bootloader in the bzImage itself
-  EXT2_FS_POSIX_ACL y
-  EXT2_FS_SECURITY y
-  EXT2_FS_XATTR y
-  EXT3_FS_POSIX_ACL y
-  EXT3_FS_SECURITY y
-  EXT4_FS_POSIX_ACL y
-  EXT4_FS_SECURITY y
-  F2FS_FS m
-  FANOTIFY y
+  HIPPI y
+  MTD_COMPLEX_MAPPINGS y # needed for many devices
+  SCSI_LOWLEVEL y # enable lots of SCSI devices
+  SCSI_LOWLEVEL_PCMCIA y
+  SCSI_SAS_ATA y  # added to enable detection of hard drive
+  SPI y # needed for many devices
+  SPI_MASTER y
+  WAN y
+
+  # Networking options.
+  NET y
+  IP_PNP n
+  ${optionalString (versionOlder version "3.13") ''
+    IPV6_PRIVACY y
+  ''}
+  NETFILTER y
+  NETFILTER_ADVANCED y
+  IP_ROUTE_VERBOSE y
+  IP_MROUTE_MULTIPLE_TABLES y
+  IP_VS_PROTO_TCP y
+  IP_VS_PROTO_UDP y
+  IP_VS_PROTO_ESP y
+  IP_VS_PROTO_AH y
+  IP_DCCP_CCID3 n # experimental
+  IP_MULTICAST y
+  IPV6_ROUTER_PREF y
+  IPV6_ROUTE_INFO y
+  IPV6_OPTIMISTIC_DAD y
+  IPV6_MULTIPLE_TABLES y
+  IPV6_SUBTREES y
+  IPV6_MROUTE y
+  IPV6_MROUTE_MULTIPLE_TABLES y
+  IPV6_PIMSM_V2 y
+  ${optionalString (versionAtLeast version "4.7") ''
+    IPV6_FOU_TUNNEL m
+  ''}
+  CLS_U32_PERF y
+  CLS_U32_MARK y
+  ${optionalString (stdenv.system == "x86_64-linux") ''
+    BPF_JIT y
+  ''}
+  ${optionalString (versionAtLeast version "4.4") ''
+    NET_CLS_BPF m
+    NET_ACT_BPF m
+  ''}
+  L2TP_V3 y
+  L2TP_IP m
+  L2TP_ETH m
+  BRIDGE_VLAN_FILTERING y
+  BONDING m
+  NET_L3_MASTER_DEV? y
+  NET_FOU_IP_TUNNELS? y
+  IP_NF_TARGET_REDIRECT m
+
+  # Wireless networking.
+  CFG80211_WEXT? y # Without it, ipw2200 drivers don't build
+  IPW2100_MONITOR? y # support promiscuous mode
+  IPW2200_MONITOR? y # support promiscuous mode
+  HOSTAP_FIRMWARE? y # Support downloading firmware images with Host AP driver
+  HOSTAP_FIRMWARE_NVRAM? y
+  ATH9K_PCI? y # Detect Atheros AR9xxx cards on PCI(e) bus
+  ATH9K_AHB? y # Ditto, AHB bus
+  B43_PHY_HT? y
+  BCMA_HOST_PCI? y
+
+  # Enable various FB devices.
   FB y
-  FB_3DFX_ACCEL y
-  FB_ATY_CT y # Mach64 CT/VT/GT/LT (incl. 3D RAGE) support
-  FB_ATY_GX y # Mach64 GX support
   FB_EFI y
   FB_NVIDIA_I2C y # Enable DDC Support
   FB_RIVA_I2C y
-  FB_SAVAGE_ACCEL y
+  FB_ATY_CT y # Mach64 CT/VT/GT/LT (incl. 3D RAGE) support
+  FB_ATY_GX y # Mach64 GX support
   FB_SAVAGE_I2C y
+  FB_SAVAGE_ACCEL y
   FB_SIS_300 y
   FB_SIS_315 y
+  FB_3DFX_ACCEL y
   FB_VESA y
-  FHANDLE y # used by systemd
   FRAMEBUFFER_CONSOLE y
   FRAMEBUFFER_CONSOLE_ROTATION y
-  FRONTSWAP y
-  FUSION y # Fusion MPT device support
-  HIPPI y
-  HOSTAP_FIRMWARE_NVRAM y
-  HOSTAP_FIRMWARE y # Support downloading firmware images with Host AP driver
-  HWMON y
-  HYPERVISOR_GUEST y
-  IDE n # deprecated IDE supportIRDA_ULTRA y # Ultra (connectionless) protocol
-  IKCONFIG y # Make /proc/config.gz available
-  IKCONFIG_PROC y # Make /proc/config.gz available
-  INTEL_IDLE y
-  INTERVAL_TREE_TEST n
-  IOSCHED_CFQ y # Include the CFQ I/O scheduler in the kernel, rather than as a module, so that the initrd gets a good I/O scheduler
-  IOSCHED_DEADLINE y
-  IP_DCCP_CCID3 n # experimental
-  IP_MROUTE_MULTIPLE_TABLES y
-  IP_MULTICAST y
-  IP_NF_TARGET_REDIRECT m
-  IP_PNP n
-  IP_ROUTE_VERBOSE y
-  IP_VS_PROTO_AH y
-  IP_VS_PROTO_ESP y
-  IP_VS_PROTO_TCP y
-  IP_VS_PROTO_UDP y
-  IPV6_MROUTE y
-  IPV6_MROUTE_MULTIPLE_TABLES y
-  IPV6_MULTIPLE_TABLES y
-  IPV6_OPTIMISTIC_DAD y
-  IPV6_PIMSM_V2 y
-  IPV6_ROUTE_INFO y
-  IPV6_ROUTER_PREF y
-  IPV6_SUBTREES y
-  IPW2100_MONITOR y # support promiscuous mode
-  IPW2200_MONITOR y # support promiscuous mode
-  JFS_POSIX_ACL y
-  JFS_SECURITY y
-  JOYSTICK_IFORCE_232 y # I-Force Serial joysticks and wheels
-  JOYSTICK_IFORCE_USB y # I-Force USB joysticks and wheels
-  JOYSTICK_XPAD_FF y # X-Box gamepad rumble support
-  JOYSTICK_XPAD_LEDS y # LED Support for Xbox360 controller 'BigX' LED
-  KERNEL_XZ y
-  KEXEC_JUMP y
-  KPROBES y
-  KSM y
-  KVM_ASYNC_PF y
-  KVM_GUEST y
-  KVM_MMIO y
-  L2TP_ETH m
-  L2TP_IP m
-  L2TP_V3 y
-  LDM_PARTITION y # Windows Logical Disk Manager (Dynamic Disk) support
-  LOGIRUMBLEPAD2_FF y # Logitech Rumblepad 2 force feedback
-  LOGO n # not needed
-  MEDIA_ATTACH y
-  MEDIA_CAMERA_SUPPORT y
-  MEDIA_DIGITAL_TV_SUPPORT y
-  MEDIA_RC_SUPPORT y
-  MEDIA_USB_SUPPORT y
-  MEGARAID_NEWGEN y
-  MEMCG y
-  MEMCG_SWAP y
-  MEMTEST y # Enable the kernel's built-in memory tester
-  MICROCODE y
-  MICROCODE_AMD y
-  MICROCODE_INTEL y
-  MMC_BLOCK_MINORS 32 # 8 is default. Modern gpt tables on eMMC may go far beyond 8.
-  MOUSE_PS2_ELANTECH y # Elantech PS/2 protocol extension
-  MTD_COMPLEX_MAPPINGS y # needed for many devices
-  MTD_TESTS n
-  MTRR_SANITIZER y
-  NAMESPACES y #  Required by 'unshare' used by 'nixos-install'
-  NET y
-  NET_FC y # Fibre Channel driver support
-  NETFILTER y
-  NETFILTER_ADVANCED y
-  NFS_FSCACHE y
-  NFS_SWAP y
-  NFS_V3_ACL y
-  NFSD_V2_ACL y
-  NFSD_V3 y
-  NFSD_V3_ACL y
-  NFSD_V4 y
-  NLS y
-  NLS_CODEPAGE_437 m # VFAT default for the codepage= mount option
-  NLS_DEFAULT utf8
-  NLS_ISO8859_1 m    # VFAT default for the iocharset= mount option
-  NLS_UTF8 m
-  NOTIFIER_ERROR_INJECTION n
-  NUMA y
-  OCFS2_DEBUG_MASKLOG n
-  PARAVIRT_SPINLOCKS y
-  PARAVIRT y
-  PM_ADVANCED_DEBUG y
-  PM_TRACE_RTC n # Disable some expensive () features
-  PM_WAKELOCKS y
-  POSIX_MQUEUE y
-  PPP_FILTER y
-  PPP_MULTILINK y # PPP multilink support
-  PROC_EVENTS y
-  RBTREE_TEST n
-  RC_DEVICES y # Enable IR devices
-  RCU_TORTURE_TEST n
-  REGULATOR y # Voltage and Current Regulator Support
-  REISERFS_FS_POSIX_ACL y
-  REISERFS_FS_SECURITY y
-  REISERFS_FS_XATTR y
-  RT_GROUP_SCHED n
-  RT2800USB_RT55XX y
-  SCHED_AUTOGROUP y
-  SCHEDSTATS n
-  SCSI_LOGGING y # SCSI logging facility
-  SCSI_LOWLEVEL y # enable lots of SCSI devices
-  SCSI_LOWLEVEL_PCMCIA y
-  SCSI_SAS_ATA y  # added to enable detection of hard drive
-  SECCOMP y # used by systemd >= 231
-  SECCOMP_FILTER y # ditto
-  SECURITY_APPARMOR y
-  SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
-  SERIAL_8250 y # 8250/16550 and compatible serial support
-  SLIP_COMPRESSED y # CSLIP compressed headers
-  SLIP_SMART y
-  SND_AC97_POWER_SAVE y # AC97 Power-Saving Mode
+  ${optionalString (stdenv.system == "i686-linux") ''
+    FB_GEODE y
+  ''}
+
+  # Video configuration.
+  # Enable KMS for devices whose X.org driver supports it.
+  ${optionalString (versionOlder version "4.3" && !(features.chromiumos or false)) ''
+    DRM_I915_KMS y
+  ''}
+  # Allow specifying custom EDID on the kernel command line
+  DRM_LOAD_EDID_FIRMWARE y
+  VGA_SWITCHEROO y # Hybrid graphics support
+  DRM_GMA600 y
+  DRM_GMA3600 y
+  ${optionalString (versionAtLeast version "4.5" && (versionOlder version "4.9")) ''
+    DRM_AMD_POWERPLAY y # necessary for amdgpu polaris support
+  ''}
+  ${optionalString (versionAtLeast version "4.9") ''
+    DRM_AMDGPU_SI y # (experimental) amdgpu support for verde and newer chipsets
+    DRM_AMDGPU_CIK y # (stable) amdgpu support for bonaire and newer chipsets
+  ''}
+
+  # Sound.
   SND_DYNAMIC_MINORS y
+  SND_AC97_POWER_SAVE y # AC97 Power-Saving Mode
   SND_HDA_INPUT_BEEP y # Support digital beep via input layer
-  SND_HDA_PATCH_LOADER y # Support configuring jack functions via fw mechanism at boot
   SND_HDA_RECONFIG y # Support reconfiguration of jack functions
+  SND_HDA_PATCH_LOADER y # Support configuring jack functions via fw mechanism at boot
   SND_USB_CAIAQ_INPUT y
-  SPI y # needed for many devices
-  SPI_MASTER y
-  SQUASHFS_LZO y
-  SQUASHFS_XATTR y
-  SQUASHFS_XZ y
-  SQUASHFS_ZLIB y
-  STAGING y
-  STANDALONE n # Support drivers that need external firmware.
-  STRICT_DEVMEM y # Filter access to /dev/mem
-  TEST_KSTRTOX n
-  TEST_LIST_SORT n
-  TEST_STRING_HELPERS n
-  THERMAL_HWMON y # Hardware monitoring support
-  TMPFS y
-  TMPFS_POSIX_ACL y
-  TRANSPARENT_HUGEPAGE_ALWAYS n
-  TRANSPARENT_HUGEPAGE_MADVISE y
-  TRANSPARENT_HUGEPAGE y
-  UBIFS_FS_ADVANCED_COMPR y
-  UDF_FS m
-  UNIX y
-  USB_EHCI_ROOT_HUB_TT y # Root Hub Transaction Translators
-  USB_EHCI_TT_NEWSCHED y # Improved transaction translator scheduling
+  ${optionalString (versionOlder version "4.12") ''
+    PSS_MIXER y # Enable PSS mixer (Beethoven ADSP-16 and other compatible)
+  ''}
+
+  # USB serial devices.
   USB_SERIAL_GENERIC y # USB Generic Serial Driver
   USB_SERIAL_KEYSPAN_MPR y # include firmware for various USB serial devices
-  USB_SERIAL_KEYSPAN_USA18X y
-  USB_SERIAL_KEYSPAN_USA19 y
-  USB_SERIAL_KEYSPAN_USA19QI y
-  USB_SERIAL_KEYSPAN_USA19QW y
-  USB_SERIAL_KEYSPAN_USA19W y
   USB_SERIAL_KEYSPAN_USA28 y
   USB_SERIAL_KEYSPAN_USA28X y
   USB_SERIAL_KEYSPAN_USA28XA y
   USB_SERIAL_KEYSPAN_USA28XB y
+  USB_SERIAL_KEYSPAN_USA19 y
+  USB_SERIAL_KEYSPAN_USA18X y
+  USB_SERIAL_KEYSPAN_USA19W y
+  USB_SERIAL_KEYSPAN_USA19QW y
+  USB_SERIAL_KEYSPAN_USA19QI y
   USB_SERIAL_KEYSPAN_USA49W y
   USB_SERIAL_KEYSPAN_USA49WLC y
-  VGA_SWITCHEROO y # Hybrid graphics support
-  VIRT_DRIVERS y
-  WAN y
-  X86_CHECK_BIOS_CORRUPTION y
-  X86_MCE y
-  XFS_POSIX_ACL y
-  XFS_QUOTA y
-  XFS_RT y # XFS Realtime subvolume support
-  XZ_DEC_TEST n
-  ZRAM m
-
-# Architecture dependent
 
-  ${optionalString (stdenv.isx86_64 || stdenv.isi686) ''
-    XEN y
-    XEN_DOM0 y
-    ${optionalString ((versionAtLeast version "3.18") && (features.xen_dom0 or false))  ''
-      HVC_XEN_FRONTEND y
-      HVC_XEN y
-      PCI_XEN y
-      SWIOTLB_XEN y
-      XEN_BACKEND y
-      XEN_BALLOON_MEMORY_HOTPLUG y
-      XEN_BALLOON y
-      XEN_EFI y
-      XEN_HAVE_PVMMU y
-      XEN_MCE_LOG y
-      XEN_PVH y
-      XEN_PVHVM y
-      XEN_SAVE_RESTORE y
-      XEN_SCRUB_PAGES y
-      XEN_SELFBALLOONING y
-      XEN_STUB y
-      XEN_SYS_HYPERVISOR y
-      XEN_TMEM y
-    ''}
-  ''}
-
-  ${optionalString (!stdenv.is64bit) ''
-    HIGHMEM64G y # We need 64 GB (PAE) support for Xen guest support.
-  ''}
-
-  ${optionalString (stdenv.is64bit) ''
-    IRQ_REMAP y
-    VFIO_PCI_VGA y
-    X86_X2APIC y
-  ''}
-
-  ${optionalString (stdenv.system == "i686-linux") ''
-    FB_GEODE y
-  ''}
-
-  ${optionalString (stdenv.system == "x86_64-linux") ''
-    BPF_JIT y
-  ''}
-
-  ${optionalString (stdenv.system == "x86_64-linux" || stdenv.system == "aarch64-linux") ''
-    NR_CPUS 384
+  # Filesystem options - in particular, enable extended attributes and
+  # ACLs for all filesystems that support them.
+  FANOTIFY y
+  TMPFS y
+  TMPFS_POSIX_ACL y
+  ${optionalString (versionAtLeast version "4.9") ''
+    FS_ENCRYPTION? m
   ''}
-
-# Kernel version dependent
-
-  ${optionalString (versionAtLeast version "3.3" && versionOlder version "3.13") ''
-    AUDIT_LOGINUID_IMMUTABLE y
+  EXT2_FS_XATTR y
+  EXT2_FS_POSIX_ACL y
+  EXT2_FS_SECURITY y
+  ${optionalString (versionOlder version "4.0") ''
+    EXT2_FS_XIP y # Ext2 execute in place support
   ''}
-
-  ${optionalString (versionOlder version "3.10") ''
-    ARM_KPROBES_TEST n
-    CPU_NOTIFIER_ERROR_INJECT n
-    EFI_TEST n
-    RCU_PERF_TEST n
-    TEST_ASYNC_DRIVER_PROBE n
-    TEST_BITMAP n
-    TEST_HASH n
-    TEST_UUID n
-    USB_SUSPEND y
+  EXT3_FS_POSIX_ACL y
+  EXT3_FS_SECURITY y
+  EXT4_FS_POSIX_ACL y
+  EXT4_ENCRYPTION? ${if versionOlder version "4.8" then "m" else "y"}
+  EXT4_FS_SECURITY y
+  REISERFS_FS_XATTR? y
+  REISERFS_FS_POSIX_ACL? y
+  REISERFS_FS_SECURITY? y
+  JFS_POSIX_ACL? y
+  JFS_SECURITY? y
+  XFS_QUOTA? y
+  XFS_POSIX_ACL? y
+  XFS_RT? y # XFS Realtime subvolume support
+  OCFS2_DEBUG_MASKLOG? n
+  BTRFS_FS_POSIX_ACL y
+  UBIFS_FS_ADVANCED_COMPR? y
+  F2FS_FS m
+  F2FS_FS_SECURITY? y
+  F2FS_FS_ENCRYPTION? y
+  UDF_FS m
+  ${optionalString (versionAtLeast version "4.0" && versionOlder version "4.6") ''
+    NFSD_PNFS y
   ''}
-
-  ${optionalString (versionAtLeast version "3.10") ''
-    X86_INTEL_PSTATE y
+  NFSD_V2_ACL y
+  NFSD_V3 y
+  NFSD_V3_ACL y
+  NFSD_V4 y
+  ${optionalString (versionAtLeast version "3.11") ''
+    NFSD_V4_SECURITY_LABEL y
   ''}
-
+  NFS_FSCACHE y
+  NFS_SWAP y
+  NFS_V3_ACL y
   ${optionalString (versionAtLeast version "3.11") ''
     NFS_V4_1 y  # NFSv4.1 client support
     NFS_V4_2 y
     NFS_V4_SECURITY_LABEL y
-    NFSD_V4_SECURITY_LABEL y
-    PINCTRL_BAYTRAIL y # GPIO on Intel Bay Trail, for some Chromebook internal eMMC disks
-    X86_INTEL_LPSS y
-
-    ${optionalString (versionOlder version "4.4") ''
-      MICROCODE_AMD_EARLY y
-      MICROCODE_EARLY y
-      MICROCODE_INTEL_EARLY y
-    ''}
   ''}
-
+  CIFS_XATTR y
+  CIFS_POSIX y
+  CIFS_FSCACHE y
+  CIFS_STATS y
+  CIFS_WEAK_PW_HASH y
+  CIFS_UPCALL y
+  CIFS_ACL y
+  CIFS_DFS_UPCALL y
+  ${optionalString (versionOlder version "4.13") ''
+    CIFS_SMB2 y
+  ''}
   ${optionalString (versionAtLeast version "3.12") ''
     CEPH_FSCACHE y
-    HOTPLUG_PCI_ACPI y # PCI hotplug using ACPI
-    HOTPLUG_PCI_PCIE y # PCI-Expresscard hotplug support
-    USER_NS y # Support for user namespaces
   ''}
-
-  ${optionalString (versionOlder version "3.13") ''
-    IPV6_PRIVACY y
+  ${optionalString (versionAtLeast version "3.14") ''
+    CEPH_FS_POSIX_ACL y
   ''}
-
   ${optionalString (versionAtLeast version "3.13") ''
-    KVM_VFIO y
-    SQUASHFS_DECOMP_MULTI_PERCPU y
     SQUASHFS_FILE_DIRECT y
+    SQUASHFS_DECOMP_MULTI_PERCPU y
   ''}
-
-  ${optionalString (versionOlder version "3.14") ''
-    CC_STACKPROTECTOR y # Detect buffer overflows on the stack
+  SQUASHFS_XATTR y
+  SQUASHFS_ZLIB y
+  SQUASHFS_LZO y
+  SQUASHFS_XZ y
+  ${optionalString (versionAtLeast version "3.19") ''
+    SQUASHFS_LZ4 y
   ''}
 
-  ${optionalString (versionAtLeast version "3.14") ''
-    CC_STACKPROTECTOR_REGULAR y # Detect buffer overflows on the stack
-    CEPH_FS_POSIX_ACL y
+  # Native Language Support modules, needed by some filesystems
+  NLS y
+  NLS_DEFAULT utf8
+  NLS_UTF8 m
+  NLS_CODEPAGE_437 m # VFAT default for the codepage= mount option
+  NLS_ISO8859_1 m    # VFAT default for the iocharset= mount option
+
+  # Runtime security tests
+  ${optionalString (versionOlder version "4.11") ''
+    DEBUG_SET_MODULE_RONX? y # Detect writes to read-only module pages
   ''}
 
-  ${optionalString (versionOlder version "3.15") ''
-    USB_DEBUG n
+  # Security related features.
+  RANDOMIZE_BASE? y
+  STRICT_DEVMEM y # Filter access to /dev/mem
+  SECURITY_SELINUX_BOOTPARAM_VALUE 0 # Disable SELinux by default
+  SECURITY_YAMA? y # Prevent processes from ptracing non-children processes
+  DEVKMEM n # Disable /dev/kmem
+  ${if versionOlder version "3.14" then ''
+    CC_STACKPROTECTOR? y # Detect buffer overflows on the stack
+  '' else ''
+    CC_STACKPROTECTOR_REGULAR? y
+  ''}
+  ${optionalString (versionAtLeast version "3.12") ''
+    USER_NS y # Support for user namespaces
   ''}
 
-  ${optionalString (versionAtLeast version "3.15") ''
-    UEVENT_HELPER n
+  # AppArmor support
+  SECURITY_APPARMOR y
+  DEFAULT_SECURITY_APPARMOR y
 
-    ${optionalString (versionOlder version "4.8") ''
-      MLX4_EN_VXLAN y
-    ''}
+  # Microcode loading support
+  MICROCODE y
+  MICROCODE_INTEL y
+  MICROCODE_AMD y
+  ${optionalString (versionAtLeast version "3.11" && versionOlder version "4.4") ''
+    MICROCODE_EARLY y
+    MICROCODE_INTEL_EARLY y
+    MICROCODE_AMD_EARLY y
   ''}
 
-  ${optionalString (versionOlder version "3.18") ''
-    ZSMALLOC y
+  # Misc. options.
+  8139TOO_8129 y
+  8139TOO_PIO n # PIO is slower
+  AIC79XX_DEBUG_ENABLE n
+  AIC7XXX_DEBUG_ENABLE n
+  AIC94XX_DEBUG n
+  ${optionalString (versionAtLeast version "3.3" && versionOlder version "3.13") ''
+    AUDIT_LOGINUID_IMMUTABLE y
   ''}
-
-  ${optionalString (versionAtLeast version "3.18") ''
-    MODULE_COMPRESS y # Compress kernel modules for a sizable disk space savings
-    MODULE_COMPRESS_XZ y
-    ZSMALLOC m
+  ${optionalString (versionOlder version "4.4") ''
+    B43_PCMCIA? y
   ''}
-
-  ${optionalString (versionOlder version "3.19") ''
-    PM_RUNTIME y # Power management
+  BLK_DEV_INITRD y
+  BLK_DEV_INTEGRITY y
+  BSD_PROCESS_ACCT_V3 y
+  BT_HCIUART_BCSP? y
+  BT_HCIUART_H4? y # UART (H4) protocol support
+  BT_HCIUART_LL? y
+  BT_RFCOMM_TTY? y # RFCOMM TTY support
+  CLEANCACHE? y
+  CRASH_DUMP? n
+  DVB_DYNAMIC_MINORS? y # we use udev
+  EFI_STUB y # EFI bootloader in the bzImage itself
+  CGROUPS y # used by systemd
+  FHANDLE y # used by systemd
+  SECCOMP y # used by systemd >= 231
+  SECCOMP_FILTER y # ditto
+  POSIX_MQUEUE y
+  FRONTSWAP y
+  FUSION y # Fusion MPT device support
+  IDE n # deprecated IDE support
+  ${optionalString (versionAtLeast version "4.3") ''
+    IDLE_PAGE_TRACKING y
   ''}
-
-  ${optionalString (versionAtLeast version "3.19") ''
-    SQUASHFS_LZ4 y
+  IRDA_ULTRA y # Ultra (connectionless) protocol
+  JOYSTICK_IFORCE_232? y # I-Force Serial joysticks and wheels
+  JOYSTICK_IFORCE_USB? y # I-Force USB joysticks and wheels
+  JOYSTICK_XPAD_FF? y # X-Box gamepad rumble support
+  JOYSTICK_XPAD_LEDS? y # LED Support for Xbox360 controller 'BigX' LED
+  KEXEC_FILE? y
+  KEXEC_JUMP? y
+  LDM_PARTITION y # Windows Logical Disk Manager (Dynamic Disk) support
+  LOGIRUMBLEPAD2_FF y # Logitech Rumblepad 2 force feedback
+  LOGO n # not needed
+  MEDIA_ATTACH y
+  MEGARAID_NEWGEN y
+  ${optionalString (versionAtLeast version "3.15" && versionOlder version "4.8") ''
+    MLX4_EN_VXLAN y
   ''}
-
-  ${optionalString (versionOlder version "4.0") ''
-    EXT2_FS_XIP y # Ext2 execute in place support
+  ${optionalString (versionOlder version "4.9") ''
+    MODVERSIONS y
   ''}
-
-  ${optionalString (versionAtLeast version "4.0") ''
-    KVM_GENERIC_DIRTYLOG_READ_PROTECT y
-
-    ${optionalString (versionOlder version "4.6") ''
-      NFSD_PNFS y
-    ''}
-
-    ${optionalString (versionOlder version "4.12") ''
-      KVM_COMPAT y
-    ''}
+  MOUSE_PS2_ELANTECH y # Elantech PS/2 protocol extension
+  MTRR_SANITIZER y
+  NET_FC y # Fibre Channel driver support
+  ${optionalString (versionAtLeast version "3.11") ''
+    PINCTRL_BAYTRAIL y # GPIO on Intel Bay Trail, for some Chromebook internal eMMC disks
+  ''}
+  MMC_BLOCK_MINORS 32 # 8 is default. Modern gpt tables on eMMC may go far beyond 8.
+  PPP_MULTILINK y # PPP multilink support
+  PPP_FILTER y
+  REGULATOR y # Voltage and Current Regulator Support
+  RC_DEVICES? y # Enable IR devices
+  RT2800USB_RT55XX y
+  SCHED_AUTOGROUP y
+  SCSI_LOGGING y # SCSI logging facility
+  SERIAL_8250 y # 8250/16550 and compatible serial support
+  SLIP_COMPRESSED y # CSLIP compressed headers
+  SLIP_SMART y
+  HWMON y
+  THERMAL_HWMON y # Hardware monitoring support
+  ${optionalString (versionAtLeast version "3.15") ''
+    UEVENT_HELPER n
+  ''}
+  ${optionalString (versionOlder version "3.15") ''
+    USB_DEBUG? n
   ''}
+  USB_EHCI_ROOT_HUB_TT y # Root Hub Transaction Translators
+  USB_EHCI_TT_NEWSCHED y # Improved transaction translator scheduling
+  ${optionalString (versionAtLeast version "4.3") ''
+    USERFAULTFD y
+  ''}
+  X86_CHECK_BIOS_CORRUPTION y
+  X86_MCE y
 
-  ${optionalString (versionOlder version "4.3" && !(features.chromiumos or false)) ''
-    DRM_I915_KMS y
+  ${optionalString (versionAtLeast version "3.12") ''
+    HOTPLUG_PCI_ACPI y # PCI hotplug using ACPI
+    HOTPLUG_PCI_PCIE y # PCI-Expresscard hotplug support
   ''}
 
+
+  # Linux containers.
+  NAMESPACES? y #  Required by 'unshare' used by 'nixos-install'
+  RT_GROUP_SCHED n
+  CGROUP_DEVICE? y
+  MEMCG y
+  MEMCG_SWAP y
+  ${optionalString (versionOlder version "4.7") "DEVPTS_MULTIPLE_INSTANCES y"}
+  BLK_DEV_THROTTLING y
+  CFQ_GROUP_IOSCHED y
   ${optionalString (versionAtLeast version "4.3") ''
     CGROUP_PIDS y
-    IDLE_PAGE_TRACKING y
-
-    ${optionalString (!features.grsecurity or false) ''
-      USERFAULTFD y
-    ''}
   ''}
 
-  ${optionalString (versionOlder version "4.4") ''
-    B43_PCMCIA y
-  ''}
+  # Enable staging drivers.  These are somewhat experimental, but
+  # they generally don't hurt.
+  STAGING y
 
-  ${optionalString (versionAtLeast version "4.4") ''
-    BPF_SYSCALL y
-    BRCMFMAC_PCIE y
-    F2FS_FS_ENCRYPTION y
-    F2FS_FS_SECURITY y
-    FW_LOADER_USER_HELPER_FALLBACK n
-    GLOB_SELFTEST n
-    KEXEC_FILE y
-    LNET_SELFTEST n
-    LOCK_TORTURE_TEST n
-    NET_ACT_BPF m
-    NET_CLS_BPF m
-    NET_FOU_IP_TUNNELS y
-    NET_L3_MASTER_DEV y
-    PERCPU_TEST n
-    TEST_BPF n
-    TEST_FIRMWARE n
-    TEST_HEXDUMP n
-    TEST_PRINTF n
-    TEST_RHASHTABLE n
-    TEST_STATIC_KEYS n
-    TEST_UDELAY n
-    TEST_USER_COPY n
-    ZBUD y
-    ZSWAP y
-
-    ${optionalString (versionOlder version "4.13") ''
-      TEST_LKM n
-    ''}
+  # PROC_EVENTS requires that the netlink connector is not built
+  # as a module.  This is required by libcgroup's cgrulesengd.
+  CONNECTOR y
+  PROC_EVENTS y
 
-    ${optionalString (!features.grsecurity or false) ''
-      BPF_EVENTS y
-      RANDOMIZE_BASE y
-    ''}
-  ''}
+  # Tracing.
+  FTRACE y
+  KPROBES y
+  FUNCTION_TRACER y
+  FTRACE_SYSCALLS y
+  SCHED_TRACER y
+  STACK_TRACER y
 
-  ${optionalString (versionAtLeast version "4.5" && (versionOlder version "4.9")) ''
-    DRM_AMD_POWERPLAY y # necessary for amdgpu polaris support
+  ${if versionOlder version "4.11" then ''
+    UPROBE_EVENT? y
+  '' else ''
+    UPROBE_EVENTS? y
   ''}
 
-  ${optionalString (versionOlder version "4.7") ''
-    DEVPTS_MULTIPLE_INSTANCES y # Linux containers
+  ${optionalString (versionAtLeast version "4.4") ''
+    BPF_SYSCALL y
+    BPF_EVENTS y
   ''}
+  FUNCTION_PROFILER y
+  RING_BUFFER_BENCHMARK n
 
-  ${optionalString (versionAtLeast version "4.7") ''
-    IPV6_FOU_TUNNEL m
-  ''}
+  # Devtmpfs support.
+  DEVTMPFS y
+
+  # Easier debugging of NFS issues.
+  SUNRPC_DEBUG y
 
+  # Virtualisation.
+  PARAVIRT? y
+  HYPERVISOR_GUEST y
+  PARAVIRT_SPINLOCKS? y
   ${optionalString (versionOlder version "4.8") ''
     KVM_APIC_ARCHITECTURE y
-
-    ${optionalString (versionAtLeast version "4.4") ''
-      EXT4_ENCRYPTION m
+  ''}
+  KVM_ASYNC_PF y
+  ${optionalString ((versionAtLeast version "4.0") && (versionOlder version "4.12")) ''
+    KVM_COMPAT? y
+  ''}
+  ${optionalString (versionOlder version "4.12") ''
+    KVM_DEVICE_ASSIGNMENT? y
+  ''}
+  ${optionalString (versionAtLeast version "4.0") ''
+    KVM_GENERIC_DIRTYLOG_READ_PROTECT y
+  ''}
+  KVM_GUEST y
+  KVM_MMIO y
+  ${optionalString (versionAtLeast version "3.13") ''
+    KVM_VFIO y
+  ''}
+  ${optionalString (stdenv.isx86_64 || stdenv.isi686) ''
+    XEN? y
+    XEN_DOM0? y
+    ${optionalString ((versionAtLeast version "3.18") && (features.xen_dom0 or false))  ''
+      PCI_XEN? y
+      HVC_XEN? y
+      HVC_XEN_FRONTEND? y
+      XEN_SYS_HYPERVISOR? y
+      SWIOTLB_XEN? y
+      XEN_BACKEND? y
+      XEN_BALLOON? y
+      XEN_BALLOON_MEMORY_HOTPLUG? y
+      XEN_EFI? y
+      XEN_HAVE_PVMMU? y
+      XEN_MCE_LOG? y
+      XEN_PVH? y
+      XEN_PVHVM? y
+      XEN_SAVE_RESTORE? y
+      XEN_SCRUB_PAGES? y
+      XEN_SELFBALLOONING? y
+      XEN_STUB? y
+      XEN_TMEM? y
     ''}
   ''}
-
-  ${optionalString (versionAtLeast version "4.8") ''
-    EXT4_ENCRYPTION y
+  KSM y
+  ${optionalString (!stdenv.is64bit) ''
+    HIGHMEM64G? y # We need 64 GB (PAE) support for Xen guest support.
   ''}
+  ${optionalString (stdenv.is64bit) ''
+    VFIO_PCI_VGA y
+  ''}
+  VIRT_DRIVERS y
 
-  ${optionalString (versionAtLeast version "4.9") ''
-    DRM_AMDGPU_CIK y # (stable) amdgpu support for bonaire and newer chipsets
-    DRM_AMDGPU_SI y # (experimental) amdgpu support for verde and newer chipsets
-    FS_ENCRYPTION m
-    MODVERSIONS y
+  # Media support.
+  MEDIA_DIGITAL_TV_SUPPORT y
+  MEDIA_CAMERA_SUPPORT y
+  MEDIA_RC_SUPPORT y
+  MEDIA_USB_SUPPORT y
+  ${optionalString (!(features.chromiumos or false)) ''
+    MEDIA_PCI_SUPPORT y
   ''}
 
-  ${optionalString (versionOlder version "4.11") ''
-    DEBUG_NX_TEST n
-    TIMER_STATS y
-    UPROBE_EVENT y
+  # Our initrd init uses shebang scripts, so can't be modular.
+  BINFMT_SCRIPT y
 
-    ${optionalString (!features.grsecurity or false) ''
-      DEBUG_SET_MODULE_RONX y # Detect writes to read-only module pages
-    ''}
-  ''}
+  # For systemd-binfmt
+  BINFMT_MISC? y
 
-  ${optionalString (versionAtLeast version "4.11") ''
-    DRM_DEBUG_MM_SELFTEST n
-    MQ_IOSCHED_DEADLINE y
-    TEST_PARMAN n
-    TEST_SORT n
-    UPROBE_EVENTS y
-    WW_MUTEX_SELFTEST n
-  ''}
+  # Enable the 9P cache to speed up NixOS VM tests.
+  9P_FSCACHE? y
+  9P_FS_POSIX_ACL? y
 
-  ${optionalString (versionOlder version "4.12") ''
-    KVM_DEVICE_ASSIGNMENT y
-    PSS_MIXER y # Enable PSS mixer (Beethoven ADSP-16 and other compatible)
-  ''}
+  # Enable transparent support for huge pages.
+  TRANSPARENT_HUGEPAGE? y
+  TRANSPARENT_HUGEPAGE_ALWAYS? n
+  TRANSPARENT_HUGEPAGE_MADVISE? y
 
-  ${optionalString (versionAtLeast version "4.12") ''
-    IOSCHED_BFQ m
-    MQ_IOSCHED_KYBER y
+  # zram support (e.g for in-memory compressed swap).
+  ZRAM m
+  ZSWAP? y
+  ZBUD? y
+  ${optionalString (versionOlder version "3.18") ''
+    ZSMALLOC y
   ''}
-
-  ${optionalString (versionOlder version "4.13") ''
-    CIFS_SMB2 y
+  ${optionalString (versionAtLeast version "3.18") ''
+    ZSMALLOC m
   ''}
 
-  ${optionalString (versionAtLeast version "4.13") ''
-    TEST_LKM m
+  # Enable PCIe and USB for the brcmfmac driver
+  BRCMFMAC_USB? y
+  BRCMFMAC_PCIE? y
+
+  # Support x2APIC (which requires IRQ remapping).
+  ${optionalString (stdenv.system == "x86_64-linux") ''
+    X86_X2APIC y
+    IRQ_REMAP y
   ''}
 
-# Feature dependent
+  # Disable the firmware helper fallback, udev doesn't implement it any more
+  FW_LOADER_USER_HELPER_FALLBACK? n
 
-  ${optionalString (!features.grsecurity or false) ''
-    DEVKMEM n # Disable /dev/kmem
-    DYNAMIC_DEBUG y
-    FTRACE y
-    FTRACE_SYSCALLS y
-    FUNCTION_PROFILER y
-    FUNCTION_TRACER y
-    RING_BUFFER_BENCHMARK n
-    SCHED_TRACER y
-    SECURITY_YAMA y # Prevent processes from ptracing non-children processes
-    STACK_TRACER y
-    SUNRPC_DEBUG y # Easier debugging of NFS issues
+  # Disable various self-test modules that have no use in a production system
+  ${optionalString (versionOlder version "4.4") ''
+    ARM_KPROBES_TEST? n
+  ''}
+
+  ASYNC_RAID6_TEST? n
+  ATOMIC64_SELFTEST? n
+  BACKTRACE_SELF_TEST? n
+  CRC32_SELFTEST? n
+  CRYPTO_TEST? n
+  GLOB_SELFTEST? n
+  INTERVAL_TREE_TEST? n
+  LNET_SELFTEST? n
+  LOCK_TORTURE_TEST? n
+  MTD_TESTS? n
+  NOTIFIER_ERROR_INJECTION? n
+  PERCPU_TEST? n
+  RBTREE_TEST? n
+  RCU_TORTURE_TEST? n
+  TEST_BPF? n
+  TEST_FIRMWARE? n
+  TEST_HEXDUMP? n
+  TEST_KSTRTOX? n
+  TEST_LIST_SORT? n
+  TEST_LKM? n
+  TEST_PRINTF? n
+  TEST_RHASHTABLE? n
+  TEST_STATIC_KEYS? n
+  TEST_STRING_HELPERS? n
+  TEST_UDELAY? n
+  TEST_USER_COPY? n
+  XZ_DEC_TEST? n
+
+  ${optionalString (versionOlder version "4.4") ''
+    EFI_TEST? n
+    RCU_PERF_TEST? n
+    TEST_ASYNC_DRIVER_PROBE? n
+    TEST_BITMAP? n
+    TEST_HASH? n
+    TEST_UUID? n
   ''}
 
-  ${optionalString (!(features.chromiumos or false)) ''
-    MEDIA_PCI_SUPPORT y
+  ${optionalString (versionAtLeast version "4.11") ''
+    DRM_DEBUG_MM_SELFTEST? n
+    TEST_PARMAN? n
+    TEST_SORT? n
+    WW_MUTEX_SELFTEST? n
   ''}
 
   # ChromiumOS support
   ${optionalString (features.chromiumos or false) ''
-    ANDROID_PARANOID_NETWORK n
-    BLK_DEV_DM y
-    CHARGER_CROS_USB_PD y
     CHROME_PLATFORMS y
-    CPU_FREQ_GOV_INTERACTIVE n
-    CPU_FREQ_STAT y
-    DM_BOOTCACHE n
-    DM_VERITY n
-    DRM_VGEM n
-    I2C y
-    INPUT_KEYRESET n
-    IPV6 y
-    IPV6_VTI n
-    MEDIA_SUBDRV_AUTOSELECT n
-    MFD_CROS_EC y
-    MFD_CROS_EC_DEV y
-    MFD_CROS_EC_LPC y
+    VGA_SWITCHEROO n
     MMC_SDHCI_PXAV2 n
     NET_IPVTI n
+    IPV6_VTI n
     REGULATOR_FIXED_VOLTAGE n
     TPS6105X n
-    UID_CPUTIME n
-    VGA_SWITCHEROO n
+    CPU_FREQ_STAT y
+    IPV6 y
+    MFD_CROS_EC y
+    MFD_CROS_EC_LPC y
+    MFD_CROS_EC_DEV y
+    CHARGER_CROS_USB_PD y
+    I2C y
+    MEDIA_SUBDRV_AUTOSELECT n
     VIDEO_IR_I2C n
+    BLK_DEV_DM y
+    ANDROID_PARANOID_NETWORK n
+    DM_VERITY n
+    DRM_VGEM n
+    CPU_FREQ_GOV_INTERACTIVE n
+    INPUT_KEYRESET n
+    DM_BOOTCACHE n
+    UID_CPUTIME n
 
     ${optionalString (versionAtLeast version "3.18") ''
-      BCMDHD n
-      CHROMEOS_OF_FIRMWARE y
       CPUFREQ_DT n
-      DRM_POWERVR_ROGUE n
       EXTCON_CROS_EC n
+      DRM_POWERVR_ROGUE n
+      CHROMEOS_OF_FIRMWARE y
       TEST_RHASHTABLE n
+      BCMDHD n
       TRUSTY n
     ''}
 
     ${optionalString (versionOlder version "3.18") ''
+      MALI_MIDGARD n
+      DVB_USB_DIB0700 n
+      DVB_USB_DW2102 n
+      DVB_USB_PCTV452E n
+      DVB_USB_TTUSB2 n
       DVB_USB_AF9015 n
       DVB_USB_AF9035 n
       DVB_USB_ANYSEE n
       DVB_USB_AZ6007 n
-      DVB_USB_DIB0700 n
-      DVB_USB_DW2102 n
       DVB_USB_IT913X n
       DVB_USB_LME2510 n
-      DVB_USB_PCTV452E n
       DVB_USB_RTL28XXU n
-      DVB_USB_TTUSB2 n
-      MALI_MIDGARD n
-      SPEAKUP n
-      USB_DWC2 n
-      USB_GADGET n
-      USB_GSPCA n
       USB_S2255 n
       VIDEO_EM28XX n
       VIDEO_TM6000 n
+      USB_DWC2 n
+      USB_GSPCA n
+      SPEAKUP n
       XO15_EBOOK n
+      USB_GADGET n
     ''}
   ''}
 
-# Extra configuration
-
   ${kernelPlatform.kernelExtraConfig or ""}
   ${extraConfig}
 ''
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index d421633553a2..16699dcdf439 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.79";
+  version = "4.4.80";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1a5wprjimsnx49sdg05ndmnx84m24fl48s64jvdpz58i3sss7g8d";
+    sha256 = "1hs07k49sbpi8yw2mdwn1967i82x4wn6kg0lbjvv5l1pv3alky1l";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 4ad4a5dfef77..fb7440a04ae2 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.9.40";
+  version = "4.9.41";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "16rdcvqkgb8hfzkkzbkhznnab22z43prm56jbrxnqr9acprnfmq2";
+    sha256 = "11y6q0mmi3z6pg4h0prv67pr1a78rvrzw75ygg6720dz0jzvnnmd";
   };
 
   kernelPatches = args.kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 5106aacbe612..281cc7186b67 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, hostPlatform, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.13-rc3";
-  modDirVersion = "4.13.0-rc3";
+  version = "4.13-rc4";
+  modDirVersion = "4.13.0-rc4";
   extraMeta.branch = "4.13";
 
   src = fetchurl {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "07cxqf57hgs3wnbvkqixiwhjrwdf433pjwmh0hv1id0bk8wdrjjl";
+    sha256 = "00yiihmgifvl4bas861p87166nb1mf59b6nm5jsfk2zr27pszlyx";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/tools/misc/geekbench/default.nix b/pkgs/tools/misc/geekbench/default.nix
new file mode 100644
index 000000000000..9172c13636a6
--- /dev/null
+++ b/pkgs/tools/misc/geekbench/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, fetchurl, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "geekbench-${version}";
+  version = "4.1.1";
+
+  src = fetchurl {
+    url = "http://cdn.primatelabs.com/Geekbench-${version}-Linux.tar.gz";
+    sha256 = "1n9jyzf0a0w37hb30ip76hz73bvim76jd2fgd6131hh0shp1s4v6";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -r dist/Geekbench-${version}-Linux/. $out/bin
+    rm $out/bin/geekbench_x86_32
+
+    for f in geekbench4 geekbench_x86_64 ; do
+      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) $out/bin/$f
+      wrapProgram $out/bin/$f --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ stdenv.cc.cc.lib ]}"
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Cross-platform benchmark";
+    homepage = http://geekbench.com/;
+    license = licenses.unfree;
+    maintainers = [ maintainers.michalrus ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/tools/misc/pick/default.nix b/pkgs/tools/misc/pick/default.nix
index 075949f47e1a..5fda26bacad1 100644
--- a/pkgs/tools/misc/pick/default.nix
+++ b/pkgs/tools/misc/pick/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "pick-${version}";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
-    owner = "thoughtbot";
+    owner = "calleerlandsson";
     repo = "pick";
     rev = "v${version}";
-    sha256 = "0iw3yqwg8j0pg56xx52xwn7n95vxlqbqh71zrc934v4mq971qlhd";
+    sha256 = "1x7ql530rj4yj50dzp8526mz92g4hhqxnig1qgiq3h3k815p31qb";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/tools/misc/zabbix-cli/default.nix b/pkgs/tools/misc/zabbix-cli/default.nix
index 77c06ea1911d..f56f680c9ebb 100644
--- a/pkgs/tools/misc/zabbix-cli/default.nix
+++ b/pkgs/tools/misc/zabbix-cli/default.nix
@@ -4,15 +4,20 @@ let
 
 in pythonPackages.buildPythonApplication rec {
   name = "zabbix-cli-${version}";
-  version = "1.6.1";
+  version = "1.7.0";
 
-  propagatedBuildInputs = with pythonPackages; [ argparse requests ];
+  propagatedBuildInputs = with pythonPackages; [ ipaddr requests ];
+
+  # argparse is part of the standardlib
+  prePatch = ''
+    substituteInPlace setup.py --replace "'argparse'," ""
+  '';
 
   src = fetchFromGitHub {
     owner = "usit-gd";
     repo = "zabbix-cli";
     rev = version;
-    sha256 = "17ip3s8ifgj264zwxrr857wk02xmzmlsjrr613mdhkgdwizqbcs3";
+    sha256 = "0z33mv8xk0h72rn0iz1qrrkyz63w6cln8d5hqqddcvkxwnq0z6kx";
   };
 
   meta = with lib; {
diff --git a/pkgs/tools/system/facter/default.nix b/pkgs/tools/system/facter/default.nix
index 55bf93608e8b..56ac33ba23c6 100644
--- a/pkgs/tools/system/facter/default.nix
+++ b/pkgs/tools/system/facter/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "facter-${version}";
-  version = "3.6.6";
+  version = "3.7.1";
 
   src = fetchFromGitHub {
-    sha256 = "07jphvwfmvrq28f8k15k16kz090zvb11nn6bd895fz5axag01ins";
+    sha256 = "0v5g7qlqqixgvc2hf9440a8sfh8jvgzynwk5ipcb505hi00ddq7a";
     rev = version;
     repo = "facter";
     owner = "puppetlabs";
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
 
   CXXFLAGS = "-fpermissive";
   NIX_CFLAGS_COMPILE = "-Wno-error";
+  NIX_LDFLAGS = "-lblkid";
 
   cmakeFlags = [ "-DFACTER_RUBY=${ruby}/lib/libruby.so" ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 65f29bc73032..7b94bfd904db 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1004,9 +1004,7 @@ with pkgs;
 
   facedetect = callPackage ../tools/graphics/facedetect { };
 
-  facter = callPackage ../tools/system/facter {
-    boost = boost160;
-  };
+  facter = callPackage ../tools/system/facter { };
 
   fasd = callPackage ../tools/misc/fasd { };
 
@@ -1046,6 +1044,8 @@ with pkgs;
 
   go-dependency-manager = callPackage ../development/tools/gdm { };
 
+  geekbench = callPackage ../tools/misc/geekbench { };
+
   gencfsm = callPackage ../tools/security/gencfsm { };
 
   genromfs = callPackage ../tools/filesystems/genromfs { };
@@ -2945,9 +2945,7 @@ with pkgs;
 
   leafpad = callPackage ../applications/editors/leafpad { };
 
-  leatherman = callPackage ../development/libraries/leatherman {
-    boost = boost160;
-  };
+  leatherman = callPackage ../development/libraries/leatherman { };
 
   leela = callPackage ../tools/graphics/leela { };
 
@@ -6317,6 +6315,7 @@ with pkgs;
   pltScheme = racket; # just to be sure
 
   polyml = callPackage ../development/compilers/polyml { };
+  polyml56 = callPackage ../development/compilers/polyml/5.6.nix { };
 
   pure = callPackage ../development/interpreters/pure {
     llvm = llvm_35;
@@ -11592,7 +11591,7 @@ with pkgs;
 
   tt-rss = callPackage ../servers/tt-rss { };
 
-  searx = callPackages ../servers/web-apps/searx { };
+  searx = callPackage ../servers/web-apps/searx { };
 
   selfoss = callPackage ../servers/web-apps/selfoss { };
 
@@ -18201,6 +18200,7 @@ with pkgs;
   tini = callPackage ../applications/virtualization/tini {};
 
   isabelle = callPackage ../applications/science/logic/isabelle {
+    polyml = polyml56;
     java = if stdenv.isLinux then jre else jdk;
   };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index bb5aef27f135..6df0af982957 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9795,6 +9795,8 @@ in {
     };
   };
 
+  feedgen = callPackage ../development/python-modules/feedgen { };
+
   feedgenerator = callPackage ../development/python-modules/feedgenerator {
     inherit (pkgs) glibcLocales;
   };