summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/darwin/DarwinTools/default.nix31
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/frameworks.nix1
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix4
-rw-r--r--pkgs/os-specific/darwin/ghc-standalone-archive/default.nix14
-rw-r--r--pkgs/os-specific/darwin/ios-cross/default.nix10
-rw-r--r--pkgs/os-specific/darwin/khd/default.nix42
-rw-r--r--pkgs/os-specific/darwin/khd/org.nixos.khd.plist33
-rw-r--r--pkgs/os-specific/darwin/kwm/default.nix34
-rw-r--r--pkgs/os-specific/darwin/kwm/org.nixos.kwm.plist26
-rw-r--r--pkgs/os-specific/gnu/default.nix21
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix4
-rw-r--r--pkgs/os-specific/linux/conntrack-tools/default.nix14
-rw-r--r--pkgs/os-specific/linux/eudev/default.nix8
-rw-r--r--pkgs/os-specific/linux/eventstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/fnotifystat/default.nix4
-rw-r--r--pkgs/os-specific/linux/forkstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch4
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix14
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.10.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.12.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/linux-3.18.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.1.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.8.nix19
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix3
-rw-r--r--pkgs/os-specific/linux/kernel/linux-grsecurity.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/linux-mptcp.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix14
-rw-r--r--pkgs/os-specific/linux/libnl/default.nix6
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix7
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder.sh6
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/legacy304.nix6
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/legacy340.nix6
-rw-r--r--pkgs/os-specific/linux/powerstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/radeontop/default.nix6
-rw-r--r--pkgs/os-specific/linux/smemstat/default.nix7
-rw-r--r--pkgs/os-specific/linux/spl/default.nix4
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix11
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix28
-rw-r--r--pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch14
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix4
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix25
47 files changed, 328 insertions, 157 deletions
diff --git a/pkgs/os-specific/darwin/DarwinTools/default.nix b/pkgs/os-specific/darwin/DarwinTools/default.nix
new file mode 100644
index 000000000000..174f9478633c
--- /dev/null
+++ b/pkgs/os-specific/darwin/DarwinTools/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "DarwinTools-1";
+
+  src = fetchurl {
+    url = "https://opensource.apple.com/tarballs/DarwinTools/${name}.tar.gz";
+    sha256 = "0hh4jl590jv3v830p77r3jcrnpndy7p2b8ajai3ldpnx2913jfhp";
+  };
+
+  patchPhase = ''
+    substituteInPlace Makefile \
+      --replace gcc cc
+  '';
+
+  configurePhase = ''
+    export SRCROOT=.
+    export SYMROOT=.
+    export DSTROOT=$out
+  '';
+
+  postInstall = ''
+    mv $out/usr/* $out
+    rmdir $out/usr
+  '';
+
+  meta = {
+    maintainers = [ stdenv.lib.maintainers.matthewbauer ];
+    platforms = stdenv.lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
index 3ecb35114220..9a3c3c556e3b 100644
--- a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@@ -104,6 +104,7 @@ with frameworks; with libs; {
   VideoDecodeAcceleration = [ CF CoreVideo ];
   VideoToolbox            = [ CF CoreMedia CoreVideo ];
   WebKit                  = [ ApplicationServices Carbon JavaScriptCore OpenGL ];
+  X11                     = []; # used by Tk, should this exist?
 
   # Umbrellas
   Accelerate          = [ CoreWLAN IOBluetooth ];
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 4108bc60c270..29a0658d4388 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -196,7 +196,7 @@ let
     Csu             = applePackage "Csu"               "osx-10.11.6"     "0yh5mslyx28xzpv8qww14infkylvc1ssi57imhi471fs91sisagj" {};
     dtrace          = applePackage "dtrace"            "osx-10.11.6"     "0pp5x8dgvzmg9vvg32hpy2brm17dpmbwrcr4prsmdmfvd4767wc0" {};
     dyld            = applePackage "dyld"              "osx-10.11.6"     "0qkjmjazm2zpgvwqizhandybr9cm3gz9pckx8rmf0py03faafc08" {};
-    eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "15bbgjhi8l7hbib41gqcldzbf3hf6105jbwc745hp1gmrscw4zch" {};
+    eap8021x        = applePackage "eap8021x"          "osx-10.11.6"     "0iw0qdib59hihyx2275rwq507bq2a06gaj8db4a8z1rkaj1frskh" {};
     IOKit           = applePackage "IOKit"             "osx-10.11.6"     "0kcbrlyxcyirvg5p95hjd9k8a01k161zg0bsfgfhkb90kh2s8x00" { inherit IOKitSrcs; };
     launchd         = applePackage "launchd"           "osx-10.9.5"      "0w30hvwqq8j5n90s3qyp0fccxflvrmmjnicjri4i1vd2g196jdgj" {};
     libauto         = applePackage "libauto"           "osx-10.9.5"      "17z27yq5d7zfkwr49r7f0vn9pxvj95884sd2k6lq6rfaz9gxqhy3" {};
@@ -212,7 +212,7 @@ let
     libiconv        = applePackage "libiconv"          "osx-10.11.6"     "11h6lfajydri4widis62q8scyz7z8l6msqyx40ly4ahsdlbl0981" {};
     Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "0qjgkd4y8sjvwjzv5wwyzkb61pg8wwg95bkp721dgzv119dqhr8x" {};
     Libm            = applePackage "Libm"              "osx-10.7.4"      "02sd82ig2jvvyyfschmb4gpz6psnizri8sh6i982v341x6y4ysl7" {};
-    Libnotify       = applePackage "Libnotify"         "osx-10.11.6"     "14rhhfzb75r9jf3kyj8fzd01n09n7km1fsdj3dzl3lkkp1sir78m" {};
+    Libnotify       = applePackage "Libnotify"         "osx-10.11.6"     "0zbcyxlcfhf91jxczhd5bq9qfgvg494gwwp3l7q5ayb2qdihzr8b" {};
     libpthread      = applePackage "libpthread"        "osx-10.11.6"     "1kbw738cmr9pa7pz1igmajs307clfq7gv2vm1sqdzhcnnjxbl28w" {};
     libresolv       = applePackage "libresolv"         "osx-10.11.6"     "09flfdi3dlzq0yap32sxidacpc4nn4va7z12a6viip21ix2xb2gf" {};
     Libsystem       = applePackage "Libsystem"         "osx-10.11.6"     "1nfkmbqml587v2s1d1y2s2v8nmr577jvk51y6vqrfvsrhdhc2w94" {};
diff --git a/pkgs/os-specific/darwin/ghc-standalone-archive/default.nix b/pkgs/os-specific/darwin/ghc-standalone-archive/default.nix
new file mode 100644
index 000000000000..d23328d362e0
--- /dev/null
+++ b/pkgs/os-specific/darwin/ghc-standalone-archive/default.nix
@@ -0,0 +1,14 @@
+{ runCommand, cctools }:
+{ haskellPackages, src, deps ? p : [], name }: let
+  inherit (haskellPackages) ghc ghcWithPackages;
+  with-env = ghcWithPackages deps;
+  crossPrefix = if (ghc.cross or null) != null then "${ghc.cross.config}-" else "";
+  ghcName = "${crossPrefix}ghc";
+in runCommand name { buildInputs = [ with-env cctools ]; } ''
+  mkdir -p $out/lib
+  mkdir -p $out/include
+  ${ghcName} ${src} -staticlib -outputdir . -o $out/lib/${name}.a -stubdir $out/include
+  for file in ${ghc}/lib/${ghcName}-${ghc.version}/include/*; do
+    ln -sv $file $out/include
+  done
+''
diff --git a/pkgs/os-specific/darwin/ios-cross/default.nix b/pkgs/os-specific/darwin/ios-cross/default.nix
index 1d26a8b350be..7de7d291289f 100644
--- a/pkgs/os-specific/darwin/ios-cross/default.nix
+++ b/pkgs/os-specific/darwin/ios-cross/default.nix
@@ -18,7 +18,9 @@
 { prefix, arch, simulator ? false }: let
   sdkType = if simulator then "Simulator" else "OS";
 
-  sdk = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhone${sdkType}.platform/Developer/SDKs/iPhone${sdkType}10.0.sdk";
+  sdkVer = "10.2";
+
+  sdk = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhone${sdkType}.platform/Developer/SDKs/iPhone${sdkType}${sdkVer}.sdk";
 
   /* TODO: Properly integrate with gcc-cross-wrapper */
   wrapper = import ../../../build-support/cc-wrapper {
@@ -29,6 +31,10 @@
     libc = runCommand "empty-libc" {} "mkdir -p $out/{lib,include}";
     cc = clang;
     extraBuildCommands = ''
+      if ! [ -d ${sdk} ]; then
+          echo "You must have ${sdkVer} of the iPhone${sdkType} sdk installed at ${sdk}" >&2
+          exit 1
+      fi
       # ugh
       tr '\n' ' ' < $out/nix-support/cc-cflags > cc-cflags.tmp
       mv cc-cflags.tmp $out/nix-support/cc-cflags
@@ -39,7 +45,7 @@
     '';
   };
 in {
-  cc = runCommand "${prefix}-cc" {} ''
+  cc = runCommand "${prefix}-cc" { passthru = { inherit sdkType sdkVer sdk; }; } ''
     mkdir -p $out/bin
     ln -sv ${wrapper}/bin/clang $out/bin/${prefix}-cc
     mkdir -p $out/nix-support
diff --git a/pkgs/os-specific/darwin/khd/default.nix b/pkgs/os-specific/darwin/khd/default.nix
new file mode 100644
index 000000000000..f08073a8901e
--- /dev/null
+++ b/pkgs/os-specific/darwin/khd/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, fetchFromGitHub, Carbon, Cocoa }:
+
+stdenv.mkDerivation rec {
+  name = "khd-${version}";
+  version = "1.1.4";
+
+  src = fetchFromGitHub {
+    owner = "koekeishiya";
+    repo = "khd";
+    rev = "v${version}";
+    sha256 = "1klia3fywl0c88zbp5wdn6kxhdwdry1jwmkj27vpv8vzvdfzwfmy";
+  };
+
+  buildInputs = [ Carbon Cocoa ];
+
+  prePatch = ''
+    substituteInPlace makefile \
+      --replace g++ clang++
+  '';
+
+  buildPhase = ''
+    make install
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp bin/khd $out/bin/khd
+
+    mkdir -p $out/Library/LaunchDaemons
+    cp ${./org.nixos.khd.plist} $out/Library/LaunchDaemons/org.nixos.khd.plist
+    substituteInPlace $out/Library/LaunchDaemons/org.nixos.khd.plist --subst-var out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A simple modal hototkey daemon for OSX";
+    homepage = https://github.com/koekeishiya/khd;
+    downloadPage = https://github.com/koekeishiya/khd/releases;
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [ lnl7 ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/os-specific/darwin/khd/org.nixos.khd.plist b/pkgs/os-specific/darwin/khd/org.nixos.khd.plist
new file mode 100644
index 000000000000..3c0aaa81eb61
--- /dev/null
+++ b/pkgs/os-specific/darwin/khd/org.nixos.khd.plist
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>org.nixos.khd</string>
+  <key>ProgramArguments</key>
+  <array>
+  <string>@out@/bin/khd</string>
+  </array>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ProcessType</key>
+  <string>Interactive</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>@out@/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin</string>
+  </dict>
+  <key>Sockets</key>
+  <dict>
+    <key>Listeners</key>
+    <dict>
+      <key>SockServiceName</key>
+      <string>3021</string>
+      <key>SockType</key>
+      <string>dgram</string>
+      <key>SockFamily</key>
+      <string>IPv4</string>
+    </dict>
+  </dict>
+</dict>
+</plist>
diff --git a/pkgs/os-specific/darwin/kwm/default.nix b/pkgs/os-specific/darwin/kwm/default.nix
new file mode 100644
index 000000000000..ac231f2dfe3d
--- /dev/null
+++ b/pkgs/os-specific/darwin/kwm/default.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchzip }:
+
+stdenv.mkDerivation rec {
+  name = "kwm-${version}";
+  version = "4.0.4";
+
+  src = fetchzip {
+    stripRoot = false;
+    url = "https://github.com/koekeishiya/kwm/releases/download/v${version}/Kwm-${version}.zip";
+    sha256 = "07rf4ichq511w8qmvd6s602s7xcyjhjp73d5c615sj82cxvgirwc";
+  };
+
+  # TODO: Build this properly once we have swiftc.
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp kwmc $out/bin/kwmc
+    cp kwm overlaylib.dylib $out
+
+    mkdir -p $out/Library/LaunchDaemons
+    cp ${./org.nixos.kwm.plist} $out/Library/LaunchDaemons/org.nixos.kwm.plist
+    substituteInPlace $out/Library/LaunchDaemons/org.nixos.kwm.plist --subst-var out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Tiling window manager with focus follows mouse for OSX";
+    homepage = https://github.com/koekeishiya/kwm;
+    downloadPage = https://github.com/koekeishiya/kwm/releases;
+    platforms = platforms.darwin;
+    maintainers = with maintainers; [ lnl7 ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/os-specific/darwin/kwm/org.nixos.kwm.plist b/pkgs/os-specific/darwin/kwm/org.nixos.kwm.plist
new file mode 100644
index 000000000000..eafce2ab4a46
--- /dev/null
+++ b/pkgs/os-specific/darwin/kwm/org.nixos.kwm.plist
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>org.nixos.kwm</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>@out@/kwm</string>
+  </array>
+  <key>KeepAlive</key>
+  <true/>
+  <key>Sockets</key>
+  <dict>
+    <key>Listeners</key>
+    <dict>
+      <key>SockServiceName</key>
+      <string>3020</string>
+      <key>SockType</key>
+      <string>dgram</string>
+      <key>SockFamily</key>
+      <string>IPv4</string>
+  </dict>
+</dict>
+</dict>
+</plist>
diff --git a/pkgs/os-specific/gnu/default.nix b/pkgs/os-specific/gnu/default.nix
index 457b670319e0..247c73e468d0 100644
--- a/pkgs/os-specific/gnu/default.nix
+++ b/pkgs/os-specific/gnu/default.nix
@@ -3,7 +3,8 @@
 args@{ fetchgit, stdenv, autoconf, automake, automake111x, libtool
 , texinfo, glibcCross, hurdPartedCross, libuuid, samba
 , gccCrossStageStatic, gccCrossStageFinal
-, forceNativeDrv, forceSystem, newScope, platform, config, crossSystem
+, forcedNativePackages, forceSystem, newScope, platform, config
+, targetPlatform, buildPlatform
 , overrides ? {} }:
 
 with args;
@@ -12,25 +13,25 @@ let
   callPackage = newScope gnu;
 
   gnu = {
-    hurdCross = forceNativeDrv (callPackage ./hurd {
+    hurdCross = forcedNativePackages.callPackage ./hurd {
       inherit fetchgit stdenv autoconf libtool texinfo
         glibcCross hurdPartedCross;
       inherit (gnu) machHeaders mig;
       libuuid = libuuid.crossDrv;
       automake = automake111x;
       headersOnly = false;
-      cross = assert crossSystem != null; crossSystem;
+      cross = assert targetPlatform != buildPlatform; targetPlatform;
       gccCross = gccCrossStageFinal;
-    });
+    };
 
-    hurdCrossIntermediate = forceNativeDrv (callPackage ./hurd {
+    hurdCrossIntermediate = forcedNativePackages.callPackage ./hurd {
       inherit fetchgit stdenv autoconf libtool texinfo glibcCross;
       inherit (gnu) machHeaders mig;
       hurdPartedCross = null;
       libuuid = null;
       automake = automake111x;
       headersOnly = false;
-      cross = assert crossSystem != null; crossSystem;
+      cross = assert targetPlatform != buildPlatform; targetPlatform;
 
       # The "final" GCC needs glibc and the Hurd libraries (libpthread in
       # particular) so we first need an intermediate Hurd built with the
@@ -42,7 +43,7 @@ let
       # libshouldbeinlibc.
       buildTarget = "libihash libstore libshouldbeinlibc";
       installTarget = "libihash-install libstore-install libshouldbeinlibc-install";
-    });
+    };
 
     hurdHeaders = callPackage ./hurd {
       automake = automake111x;
@@ -58,13 +59,13 @@ let
       hurd = null;
     };
 
-    libpthreadCross = forceNativeDrv (callPackage ./libpthread {
+    libpthreadCross = forcedNativePackages.callPackage ./libpthread {
       inherit fetchgit stdenv autoconf automake libtool glibcCross;
       inherit (gnu) machHeaders hurdHeaders;
       hurd = gnu.hurdCrossIntermediate;
       gccCross = gccCrossStageStatic;
-      cross = assert crossSystem != null; crossSystem;
-    });
+      cross = assert targetPlatform != buildPlatform; targetPlatform;
+    };
 
     # In theory GNU Mach doesn't have to be cross-compiled.  However, since it
     # has to be built for i586 (it doesn't work on x86_64), one needs a cross
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index b3502d269b09..4956f13950dd 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -26,11 +26,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "busybox-1.26.1";
+  name = "busybox-1.26.2";
 
   src = fetchurl {
     url = "http://busybox.net/downloads/${name}.tar.bz2";
-    sha256 = "1wl1yy82am53srhgpi1w04hs5hbqjljrrxwwfic35k1mza3y9fqg";
+    sha256 = "05mg6rh5smkzfwqfcazkpwy6h6555llsazikqnvwkaf17y8l8gns";
   };
 
   hardeningDisable = [ "format" ] ++ lib.optional enableStatic [ "fortify" ];
diff --git a/pkgs/os-specific/linux/conntrack-tools/default.nix b/pkgs/os-specific/linux/conntrack-tools/default.nix
index f0988759bc41..ea09050fc60e 100644
--- a/pkgs/os-specific/linux/conntrack-tools/default.nix
+++ b/pkgs/os-specific/linux/conntrack-tools/default.nix
@@ -1,18 +1,20 @@
 { fetchurl, stdenv, flex, bison, pkgconfig, libmnl, libnfnetlink
 , libnetfilter_conntrack, libnetfilter_queue, libnetfilter_cttimeout
-, libnetfilter_cthelper }:
+, libnetfilter_cthelper, systemd }:
 
 stdenv.mkDerivation rec {
   name = "conntrack-tools-${version}";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchurl {
     url = "http://www.netfilter.org/projects/conntrack-tools/files/${name}.tar.bz2";
-    sha256 = "0mrzrzp6y41pmxc6ixc4fkgz6layrpwsmzb522adzzkc6mhcqg5g";
+    sha256 = "0v5spmlcw5n6va8z34f82vcpynadb0b54pnjazgpadf0qkyg9jmp";
   };
 
-  buildInputs = [ libmnl libnfnetlink libnetfilter_conntrack libnetfilter_queue
-    libnetfilter_cttimeout libnetfilter_cthelper ];
+  buildInputs = [
+    libmnl libnfnetlink libnetfilter_conntrack libnetfilter_queue
+    libnetfilter_cttimeout libnetfilter_cthelper systemd
+  ];
   nativeBuildInputs = [ flex bison pkgconfig ];
 
   meta = with stdenv.lib; {
@@ -20,6 +22,6 @@ stdenv.mkDerivation rec {
     description = "Connection tracking userspace tools";
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ nckx ];
+    maintainers = with maintainers; [ nckx fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
index 772e69ac390e..54ca7d9e324f 100644
--- a/pkgs/os-specific/linux/eudev/default.nix
+++ b/pkgs/os-specific/linux/eudev/default.nix
@@ -18,6 +18,14 @@ stdenv.mkDerivation {
   src = fetchurl {
     inherit (s) url sha256;
   };
+  patches = [
+    (fetchurl {
+       # for new gperf
+       url = "https://github.com/gentoo/eudev/commit/5bab4d8de0dcbb8e2e7d4d5125b4aea1652a0d60.patch";
+       sha256 = "097pjmgq243mz3vfxndwmm37prmacgq2f4r4gb47whfkbd6syqcw";
+    })
+  ];
+
   configureFlags = [
     "--localstatedir=/var"
     "--sysconfdir=/etc"
diff --git a/pkgs/os-specific/linux/eventstat/default.nix b/pkgs/os-specific/linux/eventstat/default.nix
index 49eab1fe2546..de27d7b0d838 100644
--- a/pkgs/os-specific/linux/eventstat/default.nix
+++ b/pkgs/os-specific/linux/eventstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "eventstat-${version}";
-  version = "0.03.02";
+  version = "0.03.03";
   src = fetchzip {
     url = "http://kernel.ubuntu.com/~cking/tarballs/eventstat/eventstat-${version}.tar.gz";
-    sha256 = "1bwv0m9pk9l0jfibvsfjggc5pp9lyyrsfr10h6jm6kf1v6r6hf5s";
+    sha256 = "02pg46f3x7v1c1vvqzfjqq0wjb2bzmfkd6a8xp06cg9zvidn6jpb";
   };
   buildInputs = [ ncurses ];
   installFlags = [ "DESTDIR=$(out)" ];
diff --git a/pkgs/os-specific/linux/fnotifystat/default.nix b/pkgs/os-specific/linux/fnotifystat/default.nix
index 5708ed7c4df2..35638e7dabd5 100644
--- a/pkgs/os-specific/linux/fnotifystat/default.nix
+++ b/pkgs/os-specific/linux/fnotifystat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "fnotifystat-${version}";
-  version = "0.01.14";
+  version = "0.01.16";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/fnotifystat/fnotifystat-${version}.tar.gz";
-    sha256 = "1cc3w94v8b4nfpkgr33gfzxpwaf43brqyc0fla9p70gk3hxjqzi5";
+    sha256 = "1k9nc7a4r7c2l7vrlcrfxj9rsdb04amiqcsnxm5kpshncry38nl5";
   };
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
diff --git a/pkgs/os-specific/linux/forkstat/default.nix b/pkgs/os-specific/linux/forkstat/default.nix
index a0478af912c8..f8d0eab835bd 100644
--- a/pkgs/os-specific/linux/forkstat/default.nix
+++ b/pkgs/os-specific/linux/forkstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "forkstat-${version}";
-  version = "0.01.14";
+  version = "0.01.16";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/forkstat/forkstat-${version}.tar.gz";
-    sha256 = "0yj3mhf9b2nm8fnz4vf2fqdd8417g30p2sgv3ilq3zwy4hbg9bav";
+    sha256 = "0g65basrs569y42zhgjq9sdyz62km8xy55yfilmyxa43ckb3xmlw";
   };
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
diff --git a/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch b/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
index e0c8278d488d..733a5122d136 100644
--- a/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
+++ b/pkgs/os-specific/linux/iproute/1000-ubuntu-poc-fan-driver.patch
@@ -6,10 +6,10 @@ Index: iproute2-4.1.1/include/linux/if_tunnel.h
 ===================================================================
 --- iproute2-4.1.1.orig/include/linux/if_tunnel.h
 +++ iproute2-4.1.1/include/linux/if_tunnel.h
-@@ -57,6 +57,9 @@ enum {
- 	IFLA_IPTUN_ENCAP_FLAGS,
+@@ -75,6 +75,9 @@ enum {
  	IFLA_IPTUN_ENCAP_SPORT,
  	IFLA_IPTUN_ENCAP_DPORT,
+	IFLA_IPTUN_COLLECT_METADATA,
 +
 +	IFLA_IPTUN_FAN_UNDERLAY = 32,
 +
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 8c815029661b..bbc63d31a13d 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,4 +1,5 @@
-{stdenv, fetchurl, bison, flex, libnetfilter_conntrack, libnftnl, libmnl}:
+{ stdenv, fetchurl, bison, flex
+, libnetfilter_conntrack, libnftnl, libmnl }:
 
 stdenv.mkDerivation rec {
   name = "iptables-${version}";
@@ -9,9 +10,9 @@ stdenv.mkDerivation rec {
     sha256 = "0q0w1x4aijid8wj7dg1ny9fqwll483f1sqw7kvkskd8q1c52mdsb";
   };
 
-  nativeBuildInputs = [bison flex];
+  nativeBuildInputs = [ bison flex ];
 
-  buildInputs = [libnetfilter_conntrack libnftnl libmnl];
+  buildInputs = [ libnetfilter_conntrack libnftnl libmnl ];
 
   preConfigure = ''
     export NIX_LDFLAGS="$NIX_LDFLAGS -lmnl -lnftnl"
@@ -22,10 +23,13 @@ stdenv.mkDerivation rec {
     --enable-shared
   '';
 
-  meta = {
+  outputs = [ "out" "dev" ];
+
+  meta = with stdenv.lib; {
     description = "A program to configure the Linux IP packet filtering ruleset";
     homepage = http://www.netfilter.org/projects/iptables/index.html;
-    platforms = stdenv.lib.platforms.linux;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ fpletz ];
     downloadPage = "http://www.netfilter.org/projects/iptables/files/";
     updateWalker = true;
     inherit version;
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index bd99a7979eeb..44e4ebe17485 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -142,6 +142,7 @@ with stdenv.lib;
   L2TP_IP m
   L2TP_ETH m
   BRIDGE_VLAN_FILTERING y
+  BONDING m
 
   # Wireless networking.
   CFG80211_WEXT? y # Without it, ipw2200 drivers don't build
@@ -186,6 +187,10 @@ with stdenv.lib;
   ${optionalString (versionAtLeast version "4.5" && (versionOlder version "4.9")) ''
     DRM_AMD_POWERPLAY y # necessary for amdgpu polaris support
   ''}
+  ${optionalString (versionAtLeast version "4.9") ''
+    DRM_AMDGPU_SI y # (experimental) amdgpu support for verde and newer chipsets
+    DRM_AMDGPU_CIK y # (stable) amdgpu support for bonaire and newer chipsets
+  ''}
 
   # Sound.
   SND_DYNAMIC_MINORS y
@@ -213,6 +218,7 @@ with stdenv.lib;
   # ACLs for all filesystems that support them.
   FANOTIFY y
   TMPFS y
+  TMPFS_POSIX_ACL y
   FS_ENCRYPTION? m
   EXT2_FS_XATTR y
   EXT2_FS_POSIX_ACL y
diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
index 3e6bd51cc475..42546b0262e6 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.10.nix
@@ -14,6 +14,5 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 })
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
index 95ca51a972e9..9a0f314c2465 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.12.nix
@@ -14,6 +14,5 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 })
diff --git a/pkgs/os-specific/linux/kernel/linux-3.18.nix b/pkgs/os-specific/linux/kernel/linux-3.18.nix
index 727126de388d..acfd08f2af3e 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.18.45";
+  version = "3.18.47";
   extraMeta.branch = "3.18";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1qwvqrlzpf57zvh57dsdk4c4swgbasf2ab75vcn2py8l7jl6rxf0";
+    sha256 = "1d9gcr08i6jlm4h6gxmhkq3hjm2ysd1587wffj10ky7y6428dpdi";
   };
 
   kernelPatches = args.kernelPatches;
@@ -14,6 +14,5 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.1.nix b/pkgs/os-specific/linux/kernel/linux-4.1.nix
index b7f988299313..9c7354024ada 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.1.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.1.36";
+  version = "4.1.38";
   extraMeta.branch = "4.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "140my5r39w795gsaglqxaw97hwpy8qf95c6hy2cr7a122bgnslp1";
+    sha256 = "0mmx11z1wlnlaw2nhpdw76xzmqmfr8q52dv0jvy0pjq8rcbk3hmq";
   };
 
   kernelPatches = args.kernelPatches;
@@ -14,6 +14,5 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index f3eceb5fe266..bec31549ae3c 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.4.41";
+  version = "4.4.44";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1z26frg7sx5n9bvkpg9pfspwhxxvlnnfnrnjr7aqhcgsbxzq8vca";
+    sha256 = "0j779p83w4i9vj7l23rx1ihymplgy44pjh53lf55napj0ckwzggs";
   };
 
   kernelPatches = args.kernelPatches;
@@ -14,6 +14,5 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.8.nix b/pkgs/os-specific/linux/kernel/linux-4.8.nix
deleted file mode 100644
index a5ce23ee3e47..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.8.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ stdenv, fetchurl, perl, buildLinux, ... } @ args:
-
-import ./generic.nix (args // rec {
-  version = "4.8.17";
-  extraMeta.branch = "4.8";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1zk0q6bvqgz2pk1axd5z0cx71vqk96314f1zn8apwa4raylf9fpa";
-  };
-
-  kernelPatches = args.kernelPatches;
-
-  features.iwlwifi = true;
-  features.efiBootStub = true;
-  features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
-  features.netfilterRPFilter = true;
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 29f0eba71755..dba02330380a 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.9.2";
+  version = "4.9.5";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0f2p12pkzgrh9k5c7g2wwjnv6gzqha8bgd7b0qgbzq3ss7nrmnld";
+    sha256 = "fcf5c43efcc9540815dae8f4d4f73c04dca9a6906c762cbee1242fdd908cf5a7";
   };
 
   kernelPatches = args.kernelPatches;
@@ -14,6 +14,5 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
index 72d7cd1fba0a..c8e189dcbfcb 100644
--- a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.14.nix
@@ -16,7 +16,6 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
   features.chromiumos = true;
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
index 4be81409ee1e..b80c9acd659e 100644
--- a/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-chromiumos-3.18.nix
@@ -16,9 +16,8 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
   features.chromiumos = true;
-  
+
   extraMeta.hydraPlatforms = [];
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-grsecurity.nix b/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
index 8a71a771c4fc..ebeb47397bca 100644
--- a/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
+++ b/pkgs/os-specific/linux/kernel/linux-grsecurity.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.8.16";
+  version = "4.8.17";
   extraMeta.branch = "4.8";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1aml6vhsfpvm8rsadraff7qj0ivgd9aw75k2q65drz4iby1pqb9h";
+    sha256 = "1zk0q6bvqgz2pk1axd5z0cx71vqk96314f1zn8apwa4raylf9fpa";
   };
 
   kernelPatches = args.kernelPatches;
@@ -14,6 +14,5 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-mptcp.nix b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
index a037343751ca..e533670014b3 100644
--- a/pkgs/os-specific/linux/kernel/linux-mptcp.nix
+++ b/pkgs/os-specific/linux/kernel/linux-mptcp.nix
@@ -46,6 +46,5 @@ import ./generic.nix (args // rec {
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index f41c53da5a68..e50a6c802326 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -17,7 +17,6 @@ stdenv.lib.overrideDerivation (import ./generic.nix (args // rec {
 
   features.iwlwifi = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 
   extraMeta.hydraPlatforms = [];
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index b547240eaf2a..1778f3439039 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,19 +1,18 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.10-rc2";
-  modDirVersion = "4.10.0-rc2";
+  version = "4.10-rc4";
+  modDirVersion = "4.10.0-rc4";
   extraMeta.branch = "4.10";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/testing/linux-${version}.tar.xz";
-    sha256 = "1r3w6mqvmjnsmqrk73xsrqybdvs1czjw5xl1x2wsi2w9nifb47zq";
+    sha256 = "0rsi9iw8ag3lcy4yjrr6ipf7zpm3f206anv5xzkn2mi1r4vfndvp";
   };
 
   features.iwlwifi = true;
   features.efiBootStub = true;
   features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
   features.netfilterRPFilter = true;
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index 42a6e0d037b9..4848057547eb 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -30,7 +30,7 @@ let
         # When updating versions/hashes, ALWAYS use the official
         # version; we use this mirror only because upstream removes
         # source files immediately upon releasing a new version ...
-        "https://raw.githubusercontent.com/slashbeast/grsecurity-scrape/master/${grbranch}/${name}.patch"
+        "https://raw.githubusercontent.com/slashbeast/grsecurity-scrape/master/${grbranch}/${kver}/${name}.patch"
       ];
       inherit sha256;
     };
@@ -95,9 +95,9 @@ rec {
   };
 
   grsecurity_testing = grsecPatch
-    { kver   = "4.8.16";
-      grrev  = "201701062021";
-      sha256 = "0ivl9dpbyf0f7ywgh8kbzdf0za10yrh6s8plqk9vnns3dhgcnvnq";
+    { kver   = "4.8.17";
+      grrev  = "201701151620";
+      sha256 = "10gavcdby8aiylbx8afc1x4j0vzbb16bhlw39a7ibnav45scsr0p";
     };
 
   # This patch relaxes grsec constraints on the location of usermode helpers,
@@ -175,12 +175,12 @@ rec {
       };
     };
 
-  p9_caching_4_4 = rec
+  p9_caching_4_9 = rec
     { name = "9p-caching.patch";
       patch = fetchpatch {
         inherit name;
-        url = https://github.com/edolstra/linux/commit/d522582553368b9564e2d88a8d7b1d469bf98c65.patch;
-        sha256 = "01h7461pdgavd6ghd6w9wg136hkaca0mrmmzhy6s3phksksimbc2";
+        url = https://github.com/edolstra/linux/commit/7e20254412c780a2102761fee92cb1d32ceeaefd.patch;
+        sha256 = "001kf1sdy6pirn8sqnfgbfahvwwkc7n7vr5i8fy2n74xph1kks5a";
       };
     };
 
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index 481d134b4610..22bae8a921b9 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub, autoreconfHook, bison, flex, pkgconfig }:
 
-let version = "3.2.28"; in
+let version = "3.2.29"; in
 stdenv.mkDerivation {
   name = "libnl-${version}";
 
   src = fetchFromGitHub {
-    sha256 = "02cm57z4h7rhjlxza07zhk02924acfz6m5gbmm5lbkkp6qh81328";
-    rev = "libnl3_2_28";
+    sha256 = "1078sbfgcb6ijal9af6lv26sy233wq14afyrc4bkdbnfl0zgsbwi";
+    rev = "libnl3_2_23";
     repo = "libnl";
     owner = "thom311";
   };
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index 3557c1f05af4..c06de7ea6f2c 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -2,11 +2,11 @@
 , flex, bison, libmnl, libnftnl, gmp, readline }:
 
 stdenv.mkDerivation rec {
-  name = "nftables-0.6";
+  name = "nftables-0.7";
 
   src = fetchurl {
     url = "http://netfilter.org/projects/nftables/files/${name}.tar.bz2";
-    sha256 = "0bbcrn9nz75daic8bq7rspvcw3ck7l82vqcvkyyg4mhwbxjn5pny";
+    sha256 = "0hzdqigdx4i6jbpxbdyq4zy4p4waqn8l6vvz7685ikh1v0wr4qzy";
   };
 
   configureFlags = [
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
 
   XML_CATALOG_FILES = "${docbook_xml_dtd_45}/xml/dtd/docbook/catalog.xml";
 
-  buildInputs = [ pkgconfig docbook2x flex bison libmnl libnftnl gmp readline ];
+  nativeBuildInputs = [ pkgconfig docbook2x flex bison ];
+  buildInputs = [ libmnl libnftnl gmp readline ];
 
   meta = with stdenv.lib; {
     description = "The project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 1f4671a76157..32502bb7b6c0 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -28,13 +28,15 @@ buildPhase() {
 
 installPhase() {
     # Install libGL and friends.
-    mkdir -p "$out/lib/vendors"
-    cp -p nvidia.icd $out/lib/vendors/
+    mkdir -p "$out/etc/OpenCL/vendors"
+    cp -p nvidia.icd $out/etc/OpenCL/vendors/
 
+    mkdir -p "$out/lib"
     cp -prd *.so.* tls "$out/lib/"
     rm "$out"/lib/lib{glx,nvidia-wfb}.so.* # handled separately
 
     rm $out/lib/libGL.so.1.* # GLVND
+    rm $out/lib/libOpenCL.so* # ocl-icd is used instead
 
     if test -z "$libsOnly"; then
         # Install the X drivers.
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy304.nix b/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
index 63da39e0c231..a6728f40cdac 100644
--- a/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/legacy304.nix
@@ -8,7 +8,7 @@
 
 with stdenv.lib;
 
-let versionNumber = "304.131"; in
+let versionNumber = "304.134"; in
 
 stdenv.mkDerivation {
   name = "nvidia-x11-${versionNumber}${optionalString (!libsOnly) "-${kernel.version}"}";
@@ -19,12 +19,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "1a1d0fsahgijcvs2p59vwhs0dpp7pp2wmvgcs1i7fzl6yyv4nmfj";
+        sha256 = "178wx0a2pmdnaypa9pq6jh0ii0i8ykz1sh1liad9zfriy4d8kxw4";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "0gpqzb5gvhrcgrp3kph1p0yjkndx9wfzgh5j88ysrlflkv3q4vig";
+        sha256 = "0hy4q1v4y7q2jq2j963mwpjhjksqhaiing3xcla861r8rmjkf8a2";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/os-specific/linux/nvidia-x11/legacy340.nix b/pkgs/os-specific/linux/nvidia-x11/legacy340.nix
index e34aaf3c908e..5707fc4a1eb4 100644
--- a/pkgs/os-specific/linux/nvidia-x11/legacy340.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/legacy340.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "340.96";
+  versionNumber = "340.101";
   /* This branch is needed for G8x, G9x, and GT2xx GPUs, and motherboard chipsets based on them.
     Ongoing support for new Linux kernels and X servers, as well as fixes for critical bugs,
     will be included in 340.* legacy releases through the end of 2019.
@@ -29,12 +29,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "13j739gg1igll88xpfsx46m7pan4fwpzx5hqdskkdc0srmw2f3n4";
+        sha256 = "0qmhkvxj6h63sayys9gldpafw5skpv8nsm2gxxb3pxcv7nfdlpjz";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "1i0lri76ghhr4c6fdlv5gwzd99n70hv3kw21w51anb55msr9s3r8";
+        sha256 = "0ln7fxm78zrzrjk3j5ychi5xxlgkzg2m7anw8nklr3d17c3jxxjy";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/os-specific/linux/powerstat/default.nix b/pkgs/os-specific/linux/powerstat/default.nix
index 9604a67ddd9a..69abdbec5d23 100644
--- a/pkgs/os-specific/linux/powerstat/default.nix
+++ b/pkgs/os-specific/linux/powerstat/default.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   name = "powerstat-${version}";
-  version = "0.02.10";
+  version = "0.02.11";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/powerstat/powerstat-${version}.tar.gz";
-    sha256 = "11n2k20h27j7m8j0l524w23xlkjhapsb3ml1qpx1si7gf0pkglcl";
+    sha256 = "0iid3b3284sf89pfp68i1k5mwmr31bqjzasb8clm2sa45ivafx52";
   };
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
diff --git a/pkgs/os-specific/linux/radeontop/default.nix b/pkgs/os-specific/linux/radeontop/default.nix
index adf02dfa9d71..cb720c206348 100644
--- a/pkgs/os-specific/linux/radeontop/default.nix
+++ b/pkgs/os-specific/linux/radeontop/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "radeontop-${version}";
-  version = "2016-07-04";
+  version = "2016-10-28";
 
   src = fetchFromGitHub {
-    sha256 = "07pj5c3shnxljwq0hkksw7qnp8kb3n5ngihdmi4fqbmyz8in2vm5";
-    rev = "bb3ed18aa8877f2816348ca9f016bb61d67e636f";
+    sha256 = "0y4rl8pm7p22s1ipyb75mlsk9qb6j4rd6nlqb3digmimnyxda1q3";
+    rev = "v1.0";
     repo = "radeontop";
     owner = "clbr";
   };
diff --git a/pkgs/os-specific/linux/smemstat/default.nix b/pkgs/os-specific/linux/smemstat/default.nix
index a38c819bc6ff..9a244c6ed8fb 100644
--- a/pkgs/os-specific/linux/smemstat/default.nix
+++ b/pkgs/os-specific/linux/smemstat/default.nix
@@ -1,12 +1,13 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchurl, ncurses }:
 
 stdenv.mkDerivation rec {
   name = "smemstat-${version}";
-  version = "0.01.14";
+  version = "0.01.16";
   src = fetchurl {
     url = "http://kernel.ubuntu.com/~cking/tarballs/smemstat/smemstat-${version}.tar.gz";
-    sha256 = "0qkpbg0n40d8m9jzf3ylpdp65zzs344zbjn8khha4plbwg00ijrw";
+    sha256 = "14n3s6ibm9bq58drvpiasqn11ci6mrwswfpcbpbsimx6fh2j4bi3";
   };
+  buildInputs = [ ncurses ];
   installFlags = [ "DESTDIR=$(out)" ];
   postInstall = ''
     mv $out/usr/* $out
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 06ad440c7754..f4f39451220c 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -66,7 +66,7 @@ in
       sha256 = "000yvaccqlkrq15sdz0734fp3lkmx58182cdcfpm4869i0q7rf0s";
     };
     splUnstable = common {
-      version = "0.7.0-rc2";
-      sha256 = "1y7jlyj8jwgrgnd6hiabms5h9430b6wjbnr3pwb16mv40wns1i65";
+      version = "0.7.0-rc3";
+      sha256 = "09v5gh7mqdl3bfq5an9iiw9fw3l1skprclxdz7r19bw3ids3lfja";
     };
   }
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 281ee101eac3..abe1388e9a54 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, fetchFromGitHub, cmake, luajit, kernel, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc}:
+{stdenv, fetchurl, fetchFromGitHub, cmake, luajit, kernel, zlib, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, fetchpatch}:
 let
   inherit (stdenv.lib) optional optionalString;
   baseName = "sysdig";
@@ -18,6 +18,15 @@ stdenv.mkDerivation {
 
   hardeningDisable = [ "pic" ];
 
+  patches = [
+    # patch for linux >= 4.9.1
+    # is included in the next release
+    (fetchpatch {
+      url = "https://github.com/draios/sysdig/commit/68823ffd3a76f88ad34c3d0d9f6fdf1ada0eae43.patch";
+      sha256 = "02vgyd70mwrk6mcdkacaahk49irm6vxzqb7dfickk6k32lh3m44k";
+    })
+  ];
+
   postPatch = ''
     sed '1i#include <cmath>' -i userspace/libsinsp/{cursesspectro,filterchecks}.cpp
   '';
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index e808eaf52162..1c4a7b798ce1 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,33 +1,25 @@
-{ lib, stdenv, fetchurl, pkgconfig, zlib, libseccomp, fetchpatch, autoreconfHook, ncurses ? null, perl ? null, pam, systemd, minimal ? false }:
+{ lib, stdenv, fetchurl, pkgconfig, zlib, fetchpatch, shadow
+, ncurses ? null, perl ? null, pam, systemd, minimal ? false }:
 
 stdenv.mkDerivation rec {
   name = "util-linux-${version}";
   version = lib.concatStringsSep "." ([ majorVersion ]
     ++ lib.optional (patchVersion != "") patchVersion);
-  majorVersion = "2.28";
-  patchVersion = "1";
+  majorVersion = "2.29";
+  patchVersion = "";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/util-linux/v${majorVersion}/${name}.tar.xz";
-    sha256 = "03xnaw3c7pavxvvh1vnimcr44hlhhf25whawiyv8dxsflfj4xkiy";
+    sha256 = "1rzrmdrz51p9sy7vlw5qmj8pmqazm7hgcch5yq242mkvrikyln9c";
   };
 
-  patches = [
-    ./rtcwake-search-PATH-for-shutdown.patch
-    (fetchpatch {
-      name = "CVE-2016-2779.diff";
-      url = https://github.com/karelzak/util-linux/commit/8e4925016875c6a4f2ab4f833ba66f0fc57396a2.patch;
-      sha256 = "0kmigkq4s1b1ijrq8vcg2a5cw4qnm065m7cb1jn1q1f4x99ycy60";
-  })];
+  patches = [ ./rtcwake-search-PATH-for-shutdown.patch ];
 
   outputs = [ "bin" "dev" "out" "man" ];
 
-  #FIXME: make it also work on non-nixos?
   postPatch = ''
-    # Substituting store paths would create a circular dependency on systemd
     substituteInPlace include/pathnames.h \
-      --replace "/bin/login" "/run/current-system/sw/bin/login" \
-      --replace "/sbin/shutdown" "/run/current-system/sw/bin/shutdown"
+      --replace "/bin/login" "${shadow}/bin/login"
   '';
 
   crossAttrs = {
@@ -54,11 +46,9 @@ stdenv.mkDerivation rec {
 
   makeFlags = "usrbin_execdir=$(bin)/bin usrsbin_execdir=$(bin)/sbin";
 
-  # autoreconfHook is required for CVE-2016-2779
-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
-  # libseccomp is required for CVE-2016-2779
+  nativeBuildInputs = [ pkgconfig ];
   buildInputs =
-    [ zlib pam libseccomp ]
+    [ zlib pam ]
     ++ lib.optional (ncurses != null) ncurses
     ++ lib.optional (systemd != null) systemd
     ++ lib.optional (perl != null) perl;
diff --git a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
index 3615984ed0cb..2dd3fcc4ebe9 100644
--- a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
+++ b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
@@ -3,21 +3,17 @@ which isn't valid on NixOS (and a compatibility link on most other modern
 distros anyway).
 
   -- nckx <tobias.geerinckx.rice@gmail.com>
-diff --git a/include/pathnames.h b/include/pathnames.h
-index de6a13c..0c1aeb9 100644
 --- a/include/pathnames.h
 +++ b/include/pathnames.h
-@@ -50,7 +50,7 @@
- #define	_PATH_VAR_NOLOGIN	"/var/run/nologin"
- 
+@@ -53,7 +53,7 @@
+ #ifndef _PATH_LOGIN
  #define _PATH_LOGIN		"/bin/login"
+ #endif
 -#define _PATH_SHUTDOWN		"/sbin/shutdown"
-+#define _PATH_SHUTDOWN		"shutdown"
- 
++#define _PATH_SHUTDOWN   "shutdown"
+
  #define _PATH_TERMCOLORS_DIRNAME "terminal-colors.d"
  #define _PATH_TERMCOLORS_DIR	"/etc/" _PATH_TERMCOLORS_DIRNAME
-diff --git a/sys-utils/rtcwake.c b/sys-utils/rtcwake.c
-index 7c748dc..9a99a7c 100644
 --- a/sys-utils/rtcwake.c
 +++ b/sys-utils/rtcwake.c
 @@ -575,7 +575,7 @@ int main(int argc, char **argv)
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index 489d6ac8bc61..12c5eedcb96a 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -6,11 +6,11 @@ assert kernel != null -> stdenv.lib.versionAtLeast kernel.version "3.18";
 let
   name = "wireguard-${version}";
 
-  version = "0.0.20170105";
+  version = "0.0.20170115";
 
   src = fetchurl {
     url    = "https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${version}.tar.xz";
-    sha256 = "15iqb1a85aygbf3myw6r79i5h3vpjam1rs6xrnf5kgvgmvp91n8v";
+    sha256 = "1s7zypgbwyf3mkh9any413p0awpny0dxix8d1plsrm52k539ypvy";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index bd2767a66b45..7fda9b884d81 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -13,11 +13,11 @@ let
   buildKernel = any (n: n == configFile) [ "kernel" "all" ];
   buildUser = any (n: n == configFile) [ "user" "all" ];
 
-  common = { version, sha256, extraPatches, spl, inkompatibleKernelVersion ? null } @ args:
+  common = { version, sha256, extraPatches, spl, incompatibleKernelVersion ? null } @ args:
     if buildKernel &&
-       (inkompatibleKernelVersion != null) &&
-       versionAtLeast kernel.version inkompatibleKernelVersion then
-      throw "linux v${kernel.version} is not yet supported by zfsonlinux v${version}"
+       (incompatibleKernelVersion != null) &&
+       versionAtLeast kernel.version incompatibleKernelVersion then
+      throw "Linux v${kernel.version} is not yet supported by zfsonlinux v${version}. Try zfsUnstable or set the NixOS option boot.zfs.enableUnstable."
     else stdenv.mkDerivation rec {
       name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
@@ -123,7 +123,7 @@ in
     # to be adapted
     zfsStable = common {
       # comment/uncomment if breaking kernel versions are known
-      inkompatibleKernelVersion = "4.9";
+      incompatibleKernelVersion = "4.9";
 
       version = "0.6.5.8";
 
@@ -139,21 +139,16 @@ in
     };
     zfsUnstable = common {
       # comment/uncomment if breaking kernel versions are known
-      inkompatibleKernelVersion = "4.10";
+      incompatibleKernelVersion = null;
 
-      version = "0.7.0-rc2";
+      version = "0.7.0-rc3";
 
       # this package should point to a version / git revision compatible with the latest kernel release
-      sha256 = "197y2jyav9h1ksri9kzqvrwmzpb58mlgw27vfvgd4bvxpwfxq53s";
+      sha256 = "0js3lazqq8wb4nklqxd6sgbvwqgwnjgz3xi3mm33xf4284gia6pc";
       extraPatches = [
         (fetchpatch {
-          url = "https://github.com/Mic92/zfs/compare/zfs-0.7.0-rc2...nixos-zfs-0.7.0-rc2.patch";
-          sha256 = "1p33bwd6p5r5phbqb657x8h9x3bd012k2mdmbzgnb09drh9v0r82";
-        })
-        (fetchpatch {
-          name = "Kernel_4.9_zfs_aio_fsync_removal.patch";
-          url = "https://github.com/zfsonlinux/zfs/commit/99ca173929cb693012dabe98bcee4f12ec7e6e92.patch";
-          sha256 = "10npvpj52rpq88vdsn7zkdhx2lphzvqypsd9abdadjbqkwxld9la";
+          url = "https://github.com/Mic92/zfs/compare/zfs-0.7.0-rc3...nixos-zfs-0.7.0-rc3.patch";
+          sha256 = "1vlw98v8xvi8qapzl1jwm69qmfslwnbg3ry1lmacndaxnyckkvhh";
         })
       ];
       spl = splUnstable;