Merge staging into closure-size

The most complex problems were from dealing with switches reverted in
the meantime (gcc5, gmp6, ncurses6).
It's likely that darwin is (still) broken nontrivially.

69 files changed, 471 insertions, 316 deletions

diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index 7bdff59c5ae8d..24083060e5460 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, xar, gzip, cpio, CF }:
+{ stdenv, fetchurl, xar, gzip, cpio, pkgs }:
 
 let
   # sadly needs to be exported because security_tool needs it
@@ -34,7 +34,7 @@ let
       cd Library/Frameworks/QuartzCore.framework/Versions/A/Headers
       for file in CI*.h; do
         rm $file
-        ln -s ../Frameworks/CoreImage.framework/Versions/A/Headers/$file
+        ln -s ../Frameworks/CoreImage.framework/Headers/$file
       done
     '';
 
@@ -50,17 +50,23 @@ let
 
     phases = [ "installPhase" "fixupPhase" ];
 
+    # because we copy files from the system
+    preferLocalBuild = true;
+
     installPhase = ''
       linkFramework() {
         local path="$1"
         local dest="$out/Library/Frameworks/$path"
         local name="$(basename "$path" .framework)"
         local current="$(readlink "/System/Library/Frameworks/$path/Versions/Current")"
+        if [ -z "$current" ]; then
+          current=A
+        fi
 
         mkdir -p "$dest"
         pushd "$dest" >/dev/null
 
-        ln -s "${sdk}/Library/Frameworks/$path/Versions/$current/Headers"
+        cp -R "${sdk}/Library/Frameworks/$path/Versions/$current/Headers" .
         ln -s -L "/System/Library/Frameworks/$path/Versions/$current/$name"
         ln -s -L "/System/Library/Frameworks/$path/Versions/$current/Resources"
 
@@ -120,7 +126,7 @@ in rec {
       __propagatedImpureHostDeps = [ "/usr/lib/libXplugin.1.dylib" ];
 
       propagatedBuildInputs = with frameworks; [
-        OpenGL ApplicationServices Carbon IOKit CF CoreGraphics CoreServices CoreText
+        OpenGL ApplicationServices Carbon IOKit pkgs.darwin.CF CoreGraphics CoreServices CoreText
       ];
 
       installPhase = ''
@@ -152,9 +158,16 @@ in rec {
           --replace "QuartzCore/../Frameworks/CoreImage.framework/Headers" "CoreImage"
       '';
     });
+
+    Security = stdenv.lib.overrideDerivation super.Security (drv: {
+      setupHook = ./security-setup-hook.sh;
+    });
   };
 
-  bareFrameworks = stdenv.lib.mapAttrs framework (import ./frameworks.nix { inherit frameworks libs CF; });
+  bareFrameworks = stdenv.lib.mapAttrs framework (import ./frameworks.nix {
+    inherit frameworks libs;
+    inherit (pkgs.darwin) CF cf-private libobjc;
+  });
 
   frameworks = bareFrameworks // overrides bareFrameworks;
 
diff --git a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
index 3889ba211a468..750adfe3cbf4c 100644
--- a/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/frameworks.nix
@@ -2,7 +2,7 @@
 # Epic weird knot-tying happening here.
 # TODO: clean up the process for generating this and include it
 
-{ frameworks, libs, CF }:
+{ frameworks, libs, CF, libobjc, cf-private }:
 
 with frameworks; with libs; {
   AGL                     = [ Carbon OpenGL ];
@@ -10,7 +10,7 @@ with frameworks; with libs; {
   AVKit                   = [];
   Accounts                = [];
   AddressBook             = [ Carbon CF ];
-  AppKit                  = [ AudioToolbox QuartzCore ];
+  AppKit                  = [ AudioToolbox Foundation QuartzCore ];
   AppKitScripting         = [];
   AppleScriptKit          = [];
   AppleScriptObjC         = [];
@@ -21,7 +21,7 @@ with frameworks; with libs; {
   Automator               = [];
   CFNetwork               = [ CF ];
   CalendarStore           = [];
-  Cocoa                   = [];
+  Cocoa                   = [ AppKit ];
   Collaboration           = [];
   CoreAudio               = [ CF IOKit ];
   CoreAudioKit            = [ AudioUnit ];
@@ -32,7 +32,7 @@ with frameworks; with libs; {
   CoreMIDIServer          = [];
   CoreMedia               = [ ApplicationServices AudioToolbox CoreAudio CF CoreGraphics CoreVideo ];
   CoreMediaIO             = [ CF CoreMedia ];
-  CoreText                = [ CF CoreGraphics ];
+  CoreText                = [ CF CoreGraphics cf-private ];
   CoreVideo               = [ ApplicationServices CF CoreGraphics IOSurface OpenGL ];
   CoreWLAN                = [ SecurityFoundation ];
   DVComponentGlue         = [ CoreServices QuickTime ];
@@ -46,7 +46,7 @@ with frameworks; with libs; {
   ExceptionHandling       = [];
   FWAUserLib              = [];
   ForceFeedback           = [ CF IOKit ];
-  Foundation              = [ CF Security ApplicationServices AppKit SystemConfiguration ];
+  Foundation              = [ CF libobjc Security ApplicationServices SystemConfiguration ];
   GLKit                   = [ CF ];
   GLUT                    = [ GL OpenGL ];
   GSS                     = [];
@@ -108,7 +108,7 @@ with frameworks; with libs; {
   # Umbrellas
   Accelerate          = [ CoreWLAN IOBluetooth ];
   ApplicationServices = [ CF CoreServices CoreText ImageIO ];
-  Carbon              = [ ApplicationServices CF CoreServices IOKit Security QuartzCore ];
+  Carbon              = [ ApplicationServices CF CoreServices Foundation IOKit Security QuartzCore ];
   CoreBluetooth       = [];
   CoreServices        = [ CFNetwork CoreAudio CoreData CF DiskArbitration Security NetFS OpenDirectory ServiceManagement ];
   IOBluetooth         = [ IOKit ];
diff --git a/pkgs/os-specific/darwin/apple-sdk/impure-deps.nix b/pkgs/os-specific/darwin/apple-sdk/impure-deps.nix
index 13bc3fbb69093..94152d1628d89 100644
--- a/pkgs/os-specific/darwin/apple-sdk/impure-deps.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/impure-deps.nix
@@ -4,6 +4,12 @@ rec {
     "/usr/lib/libsqlite3.dylib"
     "/usr/lib/libxml2.2.dylib"
   ];
+  ForceFeedback = [
+    "/System/Library/Frameworks/ForceFeedback.framework"
+  ];
+  AGL = [
+    "/System/Library/Frameworks/AGL.framework"
+  ];
   IOKit = [
     "/System/Library/Frameworks/IOKit.framework"
   ];
@@ -246,4 +252,7 @@ rec {
   SecurityFoundation = [
     "/System/Library/Frameworks/SecurityFoundation.framework"
   ];
+  Kernel = [
+    "/System/Library/Frameworks/Kernel.framework"
+  ];
 }
diff --git a/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
new file mode 100644
index 0000000000000..f31adaa0d7441
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk/security-setup-hook.sh
@@ -0,0 +1,10 @@
+noDeprecatedDeclarations() {
+  # Security.framework has about 2000 deprecated constants, all of which the user will be
+  # warned about at compilation time
+  flag="-Wno-deprecated-declarations"
+  if [[ "$NIX_CFLAGS_COMPILE" != *$flag* ]]; then
+    NIX_CFLAGS_COMPILE+=" $flag"
+  fi
+}
+
+envHooks+=(noDeprecatedDeclarations)
diff --git a/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix b/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
index ba97aa4a1fc76..55c8279340b70 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/CF/default.nix
@@ -8,7 +8,6 @@ appleDerivation {
 
   patches = [ ./add-cf-initialize.patch ./add-cfmachport.patch ./cf-bridging.patch ];
 
-  # CFAttributedString.h is in the SDK only, not on opensource.apple.com or github
   __propagatedImpureHostDeps = [
     "/System/Library/Frameworks/CoreFoundation.framework"
     "/usr/lib/libc++.1.dylib"
@@ -30,6 +29,10 @@ appleDerivation {
       --replace 'chown -RH -f root:wheel $(DSTBASE)/CoreFoundation.framework' "" \
       --replace 'chmod -RH' 'chmod -R'
 
+    # with this file present, CoreFoundation gets a _main symbol defined, which can
+    # interfere with linking other programs
+    rm plconvert.c
+
     replacement=''$'#define __PTK_FRAMEWORK_COREFOUNDATION_KEY5 55\n#define _pthread_getspecific_direct(key) pthread_getspecific((key))\n#define _pthread_setspecific_direct(key, val) pthread_setspecific((key), (val))'
 
     substituteInPlace CFPlatform.c --replace "#include <pthread/tsd_private.h>" "$replacement"
@@ -47,16 +50,6 @@ appleDerivation {
   '';
 
   postInstall = ''
-    # gross! convince apple to release these as part of CF
-    cp /System/Library/Frameworks/CoreFoundation.framework/Headers/{CFAttributedString,CFNotificationCenter}.h \
-      "$out/System/Library/Frameworks/CoreFoundation.framework/Headers"
-
-    cat >> $out/System/Library/Frameworks/CoreFoundation.framework/Headers/CoreFoundation.h <<EOF
-    /* extra private system files [IMPURE] */
-    #include <CoreFoundation/CFAttributedString.h>
-    #include <CoreFoundation/CFNotificationCenter.h>
-    EOF
-
     mv $out/System/* $out
     rmdir $out/System
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 108b430d7834f..95c1ca73e5111 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -1,6 +1,6 @@
 { stdenv, appleDerivation, cpio, bootstrap_cmds, xnu, Libc, Libm, libdispatch, cctools, Libinfo,
   dyld, Csu, architecture, libclosure, CarbonHeaders, ncurses, CommonCrypto, copyfile,
-  removefile, libresolv, Libnotify, libpthread, mDNSResponder, launchd, version }:
+  removefile, libresolv, Libnotify, libpthread, mDNSResponder, launchd, libutil, version }:
 
 appleDerivation rec {
   phases = [ "unpackPhase" "installPhase" ];
@@ -54,7 +54,7 @@ appleDerivation rec {
 
     for dep in ${Libc} ${Libm} ${Libinfo} ${dyld} ${architecture} ${libclosure} ${CarbonHeaders} \
                ${libdispatch} ${ncurses} ${CommonCrypto} ${copyfile} ${removefile} ${libresolv} \
-               ${Libnotify} ${mDNSResponder} ${launchd}; do
+               ${Libnotify} ${mDNSResponder} ${launchd} ${libutil}; do
       (cd $dep/include && find . -name '*.h' | cpio -pdm $out/include)
     done
 
@@ -120,7 +120,7 @@ appleDerivation rec {
           (map (l: "-reexport_library /usr/lib/system/lib${l}.dylib") systemlibs)}
 
     # Set up links to pretend we work like a conventional unix (Apple's design, not mine!)
-    for name in c dbm dl info m mx poll proc pthread rpcsvc gcc_s.10.4 gcc_s.10.5; do
+    for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.10.4 gcc_s.10.5; do
       ln -s libSystem.dylib $out/lib/lib$name.dylib
     done
 
@@ -136,8 +136,6 @@ appleDerivation rec {
       -delete_rpath ${libresolv}/lib \
       $out/lib/libresolv.9.dylib
     ln -s libresolv.9.dylib $out/lib/libresolv.dylib
-
-    otool -L $out/lib/libresolv.dylib
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 43698629a46f3..906e0ad2d5442 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -76,7 +76,7 @@ let
     libpthread      = applePackage "libpthread"        "105.1.4"     "09vwwahcvmxvx2xl0890gkp91n61dld29j73y2pa597bqkag2qpg" {};
     libresolv       = applePackage "libresolv"         "54"          "028mp2smd744ryxwl8cqz4njv8h540sdw3an1yl7yxqcs04r0p4b" {};
     Libsystem       = applePackage "Libsystem"         "1197.1.1"    "1yfj2qdrf9vrzs7p9m4wlb7zzxcrim1gw43x4lvz4qydpp5kg2rh" {};
-    #libutil         = applePackage "libutil"           "38"          "12gsvmj342n5d81kqwba68bmz3zf2757442g1sz2y5xmcapa3g5f" {};
+    libutil         = applePackage "libutil"           "38"          "12gsvmj342n5d81kqwba68bmz3zf2757442g1sz2y5xmcapa3g5f" {};
     libunwind       = applePackage "libunwind"         "35.3"        "0miffaa41cv0lzf8az5k1j1ng8jvqvxcr4qrlkf3xyj479arbk1b" {};
     mDNSResponder   = applePackage "mDNSResponder"     "522.92.1"    "1cp87qda1s7brriv413i71yggm8yqfwv64vknrnqv24fcb8hzbmy" {};
     objc4           = applePackage "objc4"             "551.1"       "1jrdb6yyb5jwwj27c1r0nr2y2ihqjln8ynj61mpkvp144c1cm5bg" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
index 56c00557d43fb..fe65e29071701 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libdispatch/default.nix
@@ -8,6 +8,6 @@ appleDerivation {
 
     cp -r dispatch/*.h $out/include/dispatch
     cp -r private/*.h  $out/include/dispatch
-    cp -r os/object.h  $out/include/os
+    cp -r os/object*.h  $out/include/os
   '';
 }
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
index add46454cbe7e..04b1e2f21fe19 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_apple_csp/default.nix
@@ -19,7 +19,7 @@ appleDerivation {
     for file in lib/castContext.h lib/gladmanContext.h lib/desContext.h lib/rc4Context.h; do
       substituteInPlace ''$file --replace \
         '/usr/local/include/CommonCrypto/CommonCryptorSPI.h' \
-        '${osx_private_sdk}/usr/include/CommonCrypto/CommonCryptorSPI.h'
+        '${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/include/CommonCrypto/CommonCryptorSPI.h'
     done
     
     substituteInPlace lib/opensshWrap.cpp --replace RSA_DSA_Keys.h RSA_DSA_keys.h
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
index 86cc2a390db64..0234cbc62792c 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_filedb/default.nix
@@ -6,7 +6,7 @@ appleDerivation {
     libsecurity_cdsa_plugin
   ];
   patchPhase = ''
-    cp ${osx_private_sdk}/usr/local/include/sandbox_private.h .
+    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/sandbox_private.h .
     substituteInPlace sandbox_private.h --replace '<sandbox.h>' '"${apple_sdk.sdk}/include/sandbox.h"'
     substituteInPlace lib/AtomicFile.cpp --replace '<sandbox.h>' '"sandbox_private.h"'
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
index a94b9b455ef92..4a739032e2ae5 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_generic/default.nix
@@ -10,7 +10,7 @@ name: version: sha256: args: let
 
       patchPhase = ''
         # allows including <Security/some-private-header.h>
-        ln -s ${pkgs.darwin.osx_private_sdk}/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
+        ln -s ${pkgs.darwin.osx_private_sdk}/PrivateSDK10.9.sparse.sdk/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
 
         grep -Rl MacErrors.h . | while read file; do
           substituteInPlace "''$file" --replace \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
index de97950b765e8..34a2a49ea0e4f 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_keychain/default.nix
@@ -15,25 +15,25 @@ appleDerivation {
   ];
   patchPhase = ''
     substituteInPlace lib/Keychains.cpp --replace DLDbListCFPref.h DLDBListCFPref.h
-    
+
     substituteInPlace lib/SecCertificate.cpp --replace '#include <Security/SecCertificatePriv.h>' ""
-    
-    cp ${osx_private_sdk}/usr/include/xpc/private.h xpc
+
+    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/include/xpc/private.h xpc
     cp ${apple_sdk.sdk}/include/xpc/*.h xpc
-    cp ${osx_private_sdk}/usr/local/include/sandbox_private.h lib/sandbox.h
-    
+    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/sandbox_private.h lib/sandbox.h
+
     substituteInPlace lib/SecItemPriv.h \
       --replace "extern CFTypeRef kSecAttrAccessGroup" "extern const CFTypeRef kSecAttrAccessGroup" \
       --replace "extern CFTypeRef kSecAttrIsSensitive" "extern const CFTypeRef kSecAttrIsSensitive" \
       --replace "extern CFTypeRef kSecAttrIsExtractable" "extern const CFTypeRef kSecAttrIsExtractable"
-    
+
     substituteInPlace lib/Keychains.cpp --replace \
       '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
       '"${apple_sdk.sdk}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers/MacErrors.h"'
-    
+
     substituteInPlace lib/CertificateValues.cpp --replace \
       '#include <Security/SecCertificatePriv.h>' ""
-    
+
     substituteInPlace lib/DLDBListCFPref.cpp --replace \
       'dispatch_once_t AppSandboxChecked;' ''$'namespace Security {\ndispatch_once_t AppSandboxChecked;' \
       --replace 'return mLoginDLDbIdentifier;' 'return mLoginDLDbIdentifier; }' \
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
index 8cc74e2210f9d..23ac246b4afad 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libsecurity_utilities/default.nix
@@ -14,9 +14,9 @@ appleDerivation {
     substituteInPlace lib/debugging.cpp --replace PATH_MAX 1024
     substituteInPlace lib/superblob.h --replace 'result->at' 'result->template at'
     substituteInPlace lib/ccaudit.cpp --replace '<bsm/libbsm.h>' '"bsm/libbsm.h"'
-    
-    cp ${osx_private_sdk}/usr/include/security_utilities/utilities_dtrace.h lib
-    cp -R ${osx_private_sdk}/usr/local/include/bsm lib
+
+    cp ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/include/security_utilities/utilities_dtrace.h lib
+    cp -R ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/usr/local/include/bsm lib
   '' + stdenv.lib.optionalString (!stdenv.cc.nativeLibc) ''
     substituteInPlace lib/vproc++.cpp --replace /usr/local/include/vproc_priv.h ${stdenv.libc}/include/vproc_priv.h
   '';
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix
index 32c8d6717f0be..81a45d99a86e8 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/libunwind/default.nix
@@ -1,24 +1,11 @@
-{ stdenv, appleDerivation, dyld }:
+{ stdenv, appleDerivation, dyld, osx_private_sdk }:
 
 appleDerivation {
-  phases = [ "unpackPhase" "buildPhase" "installPhase" ];
-
-  buildInputs = [ dyld ];
-
-  buildPhase = ''
-    # cd src
-    # cc -I$PWD/../include -c libuwind.cxx
-    # cc -I$PWD/../include -c Registers.s
-    # cc -I$PWD/../include -c unw_getcontext.s
-    # cc -I$PWD/../include -c UnwindLevel1.c
-    # cc -I$PWD/../include -c UnwindLevel1-gcc-ext.c
-    # cc -I$PWD/../include -c Unwind-sjlj.c
-  '';
+  phases = [ "unpackPhase" "installPhase" ];
 
   installPhase = ''
-    mkdir -p $out
-
-    cp -r include $out
+    mkdir -p $out/lib
+    cp -R include $out/include
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
new file mode 100644
index 0000000000000..c943c2068e6df
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/libutil/default.nix
@@ -0,0 +1,17 @@
+{ stdenv, appleDerivation }:
+
+# all symbols are located in libSystem
+appleDerivation {
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mkdir -p $out/include
+    cp *.h $out/include
+  '';
+
+  meta = with stdenv.lib; {
+    maintainers = with maintainers; [ copumpkin ];
+    platforms   = platforms.darwin;
+    license     = licenses.apsl20;
+  };
+}
diff --git a/pkgs/os-specific/darwin/cf-private/default.nix b/pkgs/os-specific/darwin/cf-private/default.nix
new file mode 100644
index 0000000000000..48860504f73c4
--- /dev/null
+++ b/pkgs/os-specific/darwin/cf-private/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, osx_private_sdk, CF }:
+
+let
+  headers = [
+    "CFAvailability.h"
+    "CFAttributedString.h"
+    "CFFileDescriptor.h"
+    "CFFileSecurity.h"
+    "CFNotificationCenter.h"
+    "CFStringTokenizer.h"
+    "CFURLEnumerator.h"
+    "CFURL.h"
+    "CoreFoundation.h"
+  ];
+
+in stdenv.mkDerivation {
+  name = "${CF.name}-private";
+  phases = [ "installPhase" "fixupPhase" ];
+  installPhase = ''
+    dest=$out/Library/Frameworks/CoreFoundation.framework/Headers
+    mkdir -p $dest
+    pushd $dest
+    for file in ${CF}/Library/Frameworks/CoreFoundation.framework/Headers/*; do
+      ln -s $file
+    done
+    popd
+
+    install -m 0644 ${osx_private_sdk}/PrivateSDK10.10.sparse.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/{${stdenv.lib.concatStringsSep "," headers}} $dest
+  '';
+
+  setupHook = ./setup-hook.sh;
+}
diff --git a/pkgs/os-specific/darwin/cf-private/setup-hook.sh b/pkgs/os-specific/darwin/cf-private/setup-hook.sh
new file mode 100644
index 0000000000000..a83a1323bf83c
--- /dev/null
+++ b/pkgs/os-specific/darwin/cf-private/setup-hook.sh
@@ -0,0 +1,12 @@
+prependSearchPath() {
+  NIX_CFLAGS_COMPILE="-F@out@/Library/Frameworks ${NIX_CFLAGS_COMPILE/"-F@out@/Library/Frameworks"/}"
+}
+
+linkWithRealCF() {
+  # gross! many symbols (such as _OBJC_CLASS_$_NSArray) are defined in system CF, but not
+  # in the opensource release
+  # if the package needs private headers, we assume they also want to link with system CF
+  NIX_LDFLAGS+=" /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation"
+}
+
+preConfigureHooks+=(prependSearchPath linkWithRealCF)
diff --git a/pkgs/os-specific/darwin/derez/default.nix b/pkgs/os-specific/darwin/derez/default.nix
deleted file mode 100644
index f64f05aadf099..0000000000000
--- a/pkgs/os-specific/darwin/derez/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ stdenv }:
-
-# this tool only exists on darwin
-assert stdenv.isDarwin;
-
-stdenv.mkDerivation {
-  name = "derez";
-
-  src = "/usr/bin/DeRez";
-
-  unpackPhase = "true";
-  configurePhase = "true";
-  buildPhase = "true";
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    ln -s $src "$out/bin"
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Decompiles resources";
-    homepage    = "https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/DeRez.1.html";
-    maintainers = [ maintainers.lnl7 ];
-    platforms   = platforms.darwin;
-
-    longDescription = ''
-      The DeRez tool decompiles the resource fork of resourceFile according to the type declarations
-      supplied by the type declaration files. The resource description produced by this decompilation
-      contains the resource definitions (resource and data statements) associated with these type
-      declarations. If for some reason it cannot reproduce the appropriate resource statements, DeRez
-      generates hexadecimal data statements instead.
-    '';
-  };
-}
diff --git a/pkgs/os-specific/darwin/htop/default.nix b/pkgs/os-specific/darwin/htop/default.nix
index 65e8b09db3480..3f076b838d42a 100644
--- a/pkgs/os-specific/darwin/htop/default.nix
+++ b/pkgs/os-specific/darwin/htop/default.nix
@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, ncurses, autoconf, automake }:
+{ fetchurl, stdenv, ncurses, autoconf, automake, IOKit }:
 
 stdenv.mkDerivation rec {
   name = "htop-0.8.2.2";
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0qxibadn2lfqn10a5jmkv8r5ljfs0vaaa4j6psd7ppxa2w6bx5li";
   };
 
-  buildInputs = [ autoconf automake ncurses ];
+  buildInputs = [ autoconf automake ncurses IOKit ];
 
   preConfigure = "./autogen.sh";
 
diff --git a/pkgs/os-specific/darwin/osx-private-sdk/default.nix b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
index febcb6b5d0cd8..1b8f37fdb8d17 100644
--- a/pkgs/os-specific/darwin/osx-private-sdk/default.nix
+++ b/pkgs/os-specific/darwin/osx-private-sdk/default.nix
@@ -1,16 +1,7 @@
-{ stdenv, fetchzip }:
+{ stdenv, fetchgit }:
 
-let full = stdenv.lib.overrideDerivation (fetchzip {
-  url = "https://github.com/samdmarshall/OSXPrivateSDK/tarball/69bf3c7f7140ed6ab2b6684b427bd457209858fe";
-  name = "osx-private-sdk-10.9";
-  sha256 = "1agl4kyry6m7yz3sql5mrbvmd1xkmb4nbq976phcpk19inans1zm";
-}) (drv: {
-  postFetch = ''
-    unpackFile() {
-      tar xzf "$1"
-    }
-  '' + drv.postFetch;
-}); in {
-  outPath = "${full}/PrivateSDK10.9";
-  passthru.sdk10 = "${full}/PrivateSDK10.10";
+fetchgit {
+  url = "https://github.com/samdmarshall/OSXPrivateSDK.git";
+  rev = "f4d52b60e86b496abfaffa119a7d299562d99783";
+  sha256 = "0v1l11fqpqnzd5l2vq5c63jm1vrba56r06zpqnag87j5p1gic8lp";
 }
diff --git a/pkgs/os-specific/darwin/rez/default.nix b/pkgs/os-specific/darwin/rez/default.nix
deleted file mode 100644
index 847dfc6e6f344..0000000000000
--- a/pkgs/os-specific/darwin/rez/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ stdenv }:
-
-# this tool only exists on darwin
-assert stdenv.isDarwin;
-
-stdenv.mkDerivation {
-  name = "rez";
-
-  src = "/usr/bin/Rez";
-
-  unpackPhase = "true";
-  configurePhase = "true";
-  buildPhase = "true";
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    ln -s $src "$out/bin"
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Compiles resources";
-    homepage    = "https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/Rez.1.html";
-    maintainers = [ maintainers.lnl7 ];
-    platforms   = platforms.darwin;
-
-    longDescription = ''
-      The Rez tool compiles the resource fork of a file according to the textual description contained in
-      the resource description files. These resource description files must contain both the type
-      declarations and the resource definitions needed to compile the resources. This data can come
-      directly from the resource description files.
-    '';
-  };
-}
diff --git a/pkgs/os-specific/darwin/security-tool/default.nix b/pkgs/os-specific/darwin/security-tool/default.nix
index 7cff4fc3eef42..f0877aa3404e6 100644
--- a/pkgs/os-specific/darwin/security-tool/default.nix
+++ b/pkgs/os-specific/darwin/security-tool/default.nix
@@ -1,4 +1,10 @@
-{ CoreServices, Foundation, PCSC, Security, GSS, Kerberos, makeWrapper, apple_sdk, fetchurl, gnustep-make, libobjc, libsecurity_apple_csp, libsecurity_apple_cspdl, libsecurity_apple_file_dl, libsecurity_apple_x509_cl, libsecurity_apple_x509_tp, libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin, libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_cssm, libsecurity_filedb, libsecurity_keychain, libsecurity_mds, libsecurity_pkcs12, libsecurity_sd_cspdl, libsecurity_utilities, libsecurityd, osx_private_sdk, stdenv }:
+{ CoreServices, Foundation, PCSC, Security, GSS, Kerberos, makeWrapper, apple_sdk,
+fetchurl, gnustep-make, libobjc, libsecurity_apple_csp, libsecurity_apple_cspdl,
+libsecurity_apple_file_dl, libsecurity_apple_x509_cl, libsecurity_apple_x509_tp,
+libsecurity_asn1, libsecurity_cdsa_client, libsecurity_cdsa_plugin,
+libsecurity_cdsa_utilities, libsecurity_cdsa_utils, libsecurity_cssm, libsecurity_filedb,
+libsecurity_keychain, libsecurity_mds, libsecurity_pkcs12, libsecurity_sd_cspdl,
+libsecurity_utilities, libsecurityd, osx_private_sdk, Security-framework, stdenv }:
 
 stdenv.mkDerivation rec {
   version = "55115";
@@ -11,7 +17,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''
     # copied from libsecurity_generic
-    ln -s ${osx_private_sdk}/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
+    ln -s ${osx_private_sdk}/PrivateSDK10.9.sparse.sdk/System/Library/Frameworks/Security.framework/Versions/A/PrivateHeaders Security
 
     substituteInPlace cmsutil.c --replace \
       '<CoreServices/../Frameworks/CarbonCore.framework/Headers/MacErrors.h>' \
@@ -39,7 +45,7 @@ stdenv.mkDerivation rec {
     "security_INSTALL_DIR=\$(out)/bin"
   ];
 
-  propagatedBuildInputs = [ GSS Kerberos Security PCSC Foundation ];
+  propagatedBuildInputs = [ GSS Kerberos Security-framework PCSC Foundation ];
 
   __propagatedImpureHostDeps = [ "/System/Library/Keychains" ];
 
diff --git a/pkgs/os-specific/darwin/setfile/default.nix b/pkgs/os-specific/darwin/setfile/default.nix
deleted file mode 100644
index 98dd6b3e2e721..0000000000000
--- a/pkgs/os-specific/darwin/setfile/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ stdenv }:
-
-# this tool only exists on darwin
-assert stdenv.isDarwin;
-
-stdenv.mkDerivation {
-  name = "setfile";
-
-  src = "/usr/bin/SetFile";
-
-  unpackPhase = "true";
-  configurePhase = "true";
-  buildPhase = "true";
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    ln -s $src "$out/bin"
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Set attributes of files and directories";
-    homepage    = "http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man1/setfile.1.html";
-    maintainers = with maintainers; [ lovek323 ];
-    platforms   = platforms.darwin;
-
-    longDescription = ''
-      SetFile is a tool to set the file attributes on files in an HFS+
-      directory. It attempts to be similar to the setfile command in MPW. It can
-      apply rules to more than one file with the options apply- ing to all files
-      listed.
-    '';
-  };
-}
diff --git a/pkgs/os-specific/darwin/stubs/default.nix b/pkgs/os-specific/darwin/stubs/default.nix
new file mode 100644
index 0000000000000..ec8f948a00b15
--- /dev/null
+++ b/pkgs/os-specific/darwin/stubs/default.nix
@@ -0,0 +1,15 @@
+{ stdenv, writeScriptBin }:
+
+let fake = name: stdenv.lib.overrideDerivation (writeScriptBin name ''
+  #!${stdenv.shell}
+  echo >&2 "Faking call to ${name} with arguments:"
+  echo >&2 "$@"
+'') (drv: {
+  name = "${name}-stub";
+}); in
+
+{
+  setfile = fake "SetFile";
+  rez = fake "Rez";
+  derez = fake "DeRez";
+}
diff --git a/pkgs/os-specific/linux/alsa-tools/default.nix b/pkgs/os-specific/linux/alsa-tools/default.nix
new file mode 100644
index 0000000000000..a2e49f465e469
--- /dev/null
+++ b/pkgs/os-specific/linux/alsa-tools/default.nix
@@ -0,0 +1,53 @@
+{ stdenv, fetchurl, alsaLib, pkgconfig, gtk, gtk3, fltk13 }:
+
+stdenv.mkDerivation rec {
+  name = "alsa-tools-${version}";
+  version = "1.0.29";
+
+  src = fetchurl {
+    urls = [
+      "ftp://ftp.alsa-project.org/pub/tools/${name}.tar.bz2"
+      "http://alsa.cybermirror.org/tools/${name}.tar.bz2"
+    ];
+    sha256 = "1lgvyb81md25s9ciswpdsbibmx9s030kvyylf0673w3kbamz1awl";
+  };
+
+  buildInputs = [ alsaLib pkgconfig gtk gtk3 fltk13 ];
+
+  patchPhase = ''
+    export tools="as10k1 hda-verb hdspmixer echomixer hdajackretask hdspconf hwmixvolume mixartloader rmedigicontrol sscape_ctl vxloader envy24control hdajacksensetest hdsploader ld10k1 pcxhrloader sb16_csp us428control"
+    # export tools="as10k1 hda-verb hdspmixer qlo10k1 seq usx2yloader echomixer hdajackretask hdspconf hwmixvolume mixartloader rmedigicontrol sscape_ctl vxloader envy24control hdajacksensetest hdsploader ld10k1 pcxhrloader sb16_csp us428control"
+  '';
+
+  configurePhase = ''
+    for tool in $tools; do
+      echo "Tool: $tool:"
+      cd "$tool"; ./configure --prefix="$out"; cd -
+    done
+  '';
+
+  buildPhase = ''
+    for tool in $tools; do
+      cd "$tool"; make; cd -
+    done
+  '';
+
+  installPhase = ''
+    for tool in $tools; do
+      cd "$tool"; make install; cd -
+    done
+  '';
+
+  meta = {
+    homepage = http://www.alsa-project.org/;
+    description = "ALSA, the Advanced Linux Sound Architecture tools";
+
+    longDescription = ''
+      The Advanced Linux Sound Architecture (ALSA) provides audio and
+      MIDI functionality to the Linux-based operating system.
+    '';
+
+    platforms = stdenv.lib.platforms.linux;
+    maintainers = [ stdenv.lib.maintainers.fps ];
+  };
+}
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index 3f763e917e342..efc0e7bedb576 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchgit }:
 
 stdenv.mkDerivation {
-  name = "android-udev-rules-20150821";
+  name = "android-udev-rules-20151108";
 
   src = fetchgit {
     url = "https://github.com/M0Rf30/android-udev-rules";
-    rev = "07ccded2a89c2bb6da984e596c015c5e9546e497";
-    sha256 = "953fc10bd0de46afef999dc1c1b20801b3d6e289af48d18fa96b1cac3ac54518";
+    rev = "3d21377820694cf8412e1fd09be5caaad3a5eef8";
+    sha256 = "2f90bc5822144df916d11ff5312c3179f1b905a7b003aa86056aa24ba433c99b";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/bluez/bluez5.nix b/pkgs/os-specific/linux/bluez/bluez5.nix
index ce30b553253e2..96c5af74db3c0 100644
--- a/pkgs/os-specific/linux/bluez/bluez5.nix
+++ b/pkgs/os-specific/linux/bluez/bluez5.nix
@@ -5,11 +5,11 @@
 assert stdenv.isLinux;
 
 stdenv.mkDerivation rec {
-  name = "bluez-5.35";
+  name = "bluez-5.36";
    
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${name}.tar.xz";
-    sha256 = "1qphz25hganfnd5ipfscbj7s70anv5favmwqmi9ig2saciaf1zhs";
+    sha256 = "1wkqwmi5krr37mxcqqlp5m2xnw7vw70v3ww7j09vvlskxcdflhx3";
   };
 
   pythonPath = with pythonPackages;
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 2a96f4b46b399..fa6591701a698 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -46,6 +46,8 @@ stdenv.mkDerivation rec {
     CONFIG_PREFIX "$out"
     CONFIG_INSTALL_NO_USR y
 
+    CONFIG_LFS y
+
     ${stdenv.lib.optionalString enableStatic ''
       CONFIG_STATIC y
     ''}
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index 4e3ede284b452..3222ddbd7d9eb 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -5,11 +5,11 @@
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
-  name = "cryptsetup-1.6.7";
+  name = "cryptsetup-1.7.0";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/cryptsetup/v1.6/${name}.tar.xz";
-    sha256 = "0878vwblazms1dac2ds7vyz8pgi1aac8870ccnl2s0v2sv428g62";
+    url = "mirror://kernel/linux/utils/cryptsetup/v1.7/${name}.tar.xz";
+    sha256 = "0j6iwf64pdrl4nm5ypc2r33b3k0aflb939wz2496vcqdrjkj8m87";
   };
 
   configureFlags = [ "--enable-cryptsetup-reencrypt" "--with-crypto_backend=openssl" ]
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
index 1db5967aab54a..e9fcf5d8c4d3e 100644
--- a/pkgs/os-specific/linux/eudev/default.nix
+++ b/pkgs/os-specific/linux/eudev/default.nix
@@ -3,10 +3,10 @@ let
   s = # Generated upstream information
   rec {
     baseName="eudev";
-    version = "3.1.2";
+    version = "3.1.5";
     name="${baseName}-${version}";
     url="http://dev.gentoo.org/~blueness/eudev/eudev-${version}.tar.gz";
-    sha256 = "0wq2w67ip957l5bi21jj3w2rv7s7klcrnlg6zpg1g0fxjfgbd4s3";
+    sha256 = "0akg9gcc3c2p56xbhlvbybqavcprly5q0bvk655zwl6d62j8an7p";
   };
   buildInputs = [
     glib pkgconfig gperf utillinux
diff --git a/pkgs/os-specific/linux/fatrace/default.nix b/pkgs/os-specific/linux/fatrace/default.nix
index b8fc6e5f6cee0..c620a0056c179 100644
--- a/pkgs/os-specific/linux/fatrace/default.nix
+++ b/pkgs/os-specific/linux/fatrace/default.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, python3, which }:
 
-let version = "0.10"; in
+let version = "0.11"; in
 stdenv.mkDerivation rec {
   name = "fatrace-${version}";
 
   src = fetchurl {
     url = "http://launchpad.net/fatrace/trunk/${version}/+download/${name}.tar.bz2";
-    sha256 = "0q0cv2bsgf76wypz18v2acgj1crcdqhrhlsij3r53glsyv86xyra";
+    sha256 = "1f77v222nlfbf8fv7d28cnpm7x8xz0mhxavgz19c2jc51pjlv84s";
   };
 
   buildInputs = [ python3 which ];
@@ -27,11 +27,10 @@ stdenv.mkDerivation rec {
       fatrace reports file access events from all running processes.
       Its main purpose is to find processes which keep waking up the disk
       unnecessarily and thus prevent some power saving.
-
       Requires a Linux kernel with the FANOTIFY configuration option enabled.
       Enabling X86_MSR is also recommended for power-usage-report on x86.
     '';
     maintainers = with maintainers; [ nckx ];
-    platforms = with platforms; linux;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 9c4e0f3990c21..455088d8f5e90 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "firmware-linux-nonfree-${version}";
-  version = "2015-09-07";
+  version = "2015-10-18";
 
   # This repo is built by merging the latest versions of
   # http://git.kernel.org/cgit/linux/kernel/git/firmware/linux-firmware.git/
@@ -14,8 +14,8 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "wkennington";
     repo = "linux-firmware";
-    rev = "0c3ac7434235f57967df4046ceafc0e4a08bb139";
-    sha256 = "1jhcgf0anjfi2998nzplr9l1q0b1yi306a2w1k2r4civsmfgm08r";
+    rev = "f7694d34655a7f688033d0582f306b3f287b785d";
+    sha256 = "0pb6pq48hfcny34l3anln9g4dy1f4n8gzmfib9pk4l64648sylnl";
   };
 
   preInstall = ''
diff --git a/pkgs/os-specific/linux/gradm/default.nix b/pkgs/os-specific/linux/gradm/default.nix
index 97f4c1e93fa35..1500cf2f39491 100644
--- a/pkgs/os-specific/linux/gradm/default.nix
+++ b/pkgs/os-specific/linux/gradm/default.nix
@@ -47,6 +47,6 @@ stdenv.mkDerivation rec {
     homepage    = "https://grsecurity.net";
     license     = licenses.gpl2;
     platforms   = platforms.linux;
-    maintainers = with maintainers; [ thoughtpolice wizeman ];
+    maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 287b83b637f79..891d39d24dd8b 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "iproute2-4.2.0";
+  name = "iproute2-4.3.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/iproute2/${name}.tar.xz";
-    sha256 = "0c0gyf46ad3jlalm9a7c9iiwvpcrjr4gylrkyranp8qd7rs1w454";
+    sha256 = "159988vv3fd78bzhisfl1dl4dd7km3vjzs2d8899a0vcvn412fzh";
   };
 
   patches = lib.optionals enableFan [ ./ubuntu-fan.patch ];
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index 2db57ecef92a3..93a0f8a4c2909 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libmnl }:
 
 stdenv.mkDerivation rec {
-  name = "ipset-6.26";
+  name = "ipset-6.27";
 
   src = fetchurl {
     url = "http://ipset.netfilter.org/${name}.tar.bz2";
-    sha256 = "0lbsg1fbiw9m959lgqziyivmx32z3vbnp3jhgnprkq31ia7a29kn";
+    sha256 = "0ddj66wr0xh9v6ks430l8r80lj2s9qc44d9c2ik48lwm0fl9fj3j";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index 5ca3a6a0a5c76..9bce875570efb 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -24,9 +24,6 @@ stdenv.mkDerivation rec {
 
   buildFlags = "man all ninfod";
 
-  # Stdenv doesn't handle symlinks well for that
-  dontGzipMan = true;
-
   installPhase =
     ''
       mkdir -p $out/sbin $out/bin
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 218532a695e0a..19731eccc90b0 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -41,6 +41,9 @@ with stdenv.lib;
     PM_RUNTIME y
   ''}
   PM_ADVANCED_DEBUG y
+  ${optionalString (versionAtLeast version "3.11") ''
+    X86_INTEL_LPSS y
+  ''}
   ${optionalString (versionAtLeast version "3.10") ''
     X86_INTEL_PSTATE y
   ''}
@@ -316,6 +319,9 @@ with stdenv.lib;
   MOUSE_PS2_ELANTECH y # Elantech PS/2 protocol extension
   MTRR_SANITIZER y
   NET_FC y # Fibre Channel driver support
+  ${optionalString (versionAtLeast version "3.11") ''
+    PINCTRL_BAYTRAIL y # GPIO on Intel Bay Trail, for some Chromebook internal eMMC disks
+  ''}
   PPP_MULTILINK y # PPP multilink support
   PPP_FILTER y
   REGULATOR y # Voltage and Current Regulator Support
@@ -478,11 +484,19 @@ with stdenv.lib;
   ''}
   ZRAM m
 
-  # Enable firmware loading via udev (legacy).
-  ${optionalString (versionAtLeast version "3.17") ''
-    FW_LOADER_USER_HELPER_FALLBACK y
+  # Enable PCIe and USB for the brcmfmac driver
+  BRCMFMAC_USB? y
+  BRCMFMAC_PCIE? y
+
+  # Support x2APIC (which requires IRQ remapping).
+  ${optionalString (stdenv.system == "x86_64-linux") ''
+    X86_X2APIC y
+    IRQ_REMAP y
   ''}
 
+  # Disable the firmware helper fallback, udev doesn't implement it any more
+  FW_LOADER_USER_HELPER_FALLBACK? n
+
   ${kernelPlatform.kernelExtraConfig or ""}
   ${extraConfig}
 ''
diff --git a/pkgs/os-specific/linux/kernel/linux-3.10.nix b/pkgs/os-specific/linux/kernel/linux-3.10.nix
deleted file mode 100644
index a66397f689bfc..0000000000000
--- a/pkgs/os-specific/linux/kernel/linux-3.10.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ stdenv, fetchurl, perl, buildLinux, ... } @ args:
-
-import ./generic.nix (args // rec {
-  version = "3.10.89";
-  extraMeta.branch = "3.10";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "13697akpdkv7xyyprysb4017q7j1ccynppb6wwllmhz1g2ichpii";
-  };
-
-  features.iwlwifi = true;
-  features.efiBootStub = true;
-  features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
-  features.netfilterRPFilter = true;
-})
diff --git a/pkgs/os-specific/linux/kernel/linux-3.12.nix b/pkgs/os-specific/linux/kernel/linux-3.12.nix
deleted file mode 100644
index da520d13a0219..0000000000000
--- a/pkgs/os-specific/linux/kernel/linux-3.12.nix
+++ /dev/null
@@ -1,17 +0,0 @@
-{ stdenv, fetchurl, perl, buildLinux, ... } @ args:
-
-import ./generic.nix (args // rec {
-  version = "3.12.48";
-  extraMeta.branch = "3.12";
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "1mvvpi2s8avg629y72miak8mdbv0mwb5dz0m7b48aah6dg866hiz";
-  };
-
-  features.iwlwifi = true;
-  features.efiBootStub = true;
-  features.needsCifsUtils = true;
-  features.canDisableNetfilterConntrackHelpers = true;
-  features.netfilterRPFilter = true;
-})
diff --git a/pkgs/os-specific/linux/kernel/linux-3.18.nix b/pkgs/os-specific/linux/kernel/linux-3.18.nix
index c1171cecab54d..544cd4e897f72 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.18.nix
@@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.18.21";
+  version = "3.18.24";
   extraMeta.branch = "3.18";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0y54kh55grgbyw4k8fa9vx8b426bq9lz12bpvwvzfjs7vimachyw";
+    sha256 = "06wcgzhbiddzrabfd3z0zsb9qwa2phva5cq7gg0mzff67a6cym7d";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.1.nix b/pkgs/os-specific/linux/kernel/linux-4.1.nix
index 51844f1e0684e..b1878846eb8df 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.1.nix
@@ -1,13 +1,12 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.1.9";
-  # Remember to update grsecurity!
+  version = "4.1.13";
   extraMeta.branch = "4.1";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "141s028bpci5fwn190rgcivhk0066nkc2h6y49yqdjdanx47i1sr";
+    sha256 = "04xhkqjpb1rfqkq6hxzfma5cr039p1fad2fgims5ns09nvalq6dr";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.2.nix b/pkgs/os-specific/linux/kernel/linux-4.2.nix
index 56914ae9cdec4..6d2deead3a2ac 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.2.nix
@@ -1,12 +1,13 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.2.2";
+  version = "4.2.6";
+  # Remember to update grsecurity!
   extraMeta.branch = "4.2";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0k5nda60jla02n7ghhma7klkfklh008d1cpf684fp82cywbp5g1f";
+    sha256 = "0p7v6v3v9kn7w5iragi5hx0dylhis0jy6xmk77gka486q1ynpnqp";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-3.14.nix b/pkgs/os-specific/linux/kernel/linux-4.3.nix
index 4a18072d75341..7248641a5b85d 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.3.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "3.14.54";
-  # Remember to update grsecurity!
-  extraMeta.branch = "3.14";
+  version = "4.3";
+  modDirVersion = "4.3.0";
+  extraMeta.branch = "4.3";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v3.x/linux-${version}.tar.xz";
-    sha256 = "0jjl7xx2mkkhy3yg3mza2h7ysz48qcn0z475jldfw4fh87ajlfig";
+    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
+    sha256 = "1bpkr45i4yzp32p0vpnz8mlv9lk4q2q9awf1kg9khg4a9g42qqja";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index d13357825a577..bbfed5d29e67d 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchurl, perl, buildLinux, ... } @ args:
 
 import ./generic.nix (args // rec {
-  version = "4.3-rc2";
-  modDirVersion = "4.3.0-rc2";
+  version = "4.3-rc7";
+  modDirVersion = "4.3.0-rc7";
   extraMeta.branch = "4.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/testing/linux-${version}.tar.xz";
-    sha256 = "1mgm3r0vz0jbfbqxcjfw0wv5ix6qhwymjz1chh543lvb0729ayb4";
+    sha256 = "01ip9w3yv8x8i0mbz0gi64rd4jjc8vcalgrx656kq33kvab7s1ys";
   };
 
   features.iwlwifi = true;
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 091855a165259..49b93b1a10ea8 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -76,7 +76,7 @@ let
         (isModular || (config.isDisabled "FIRMWARE_IN_KERNEL"));
     in (optionalAttrs isModular { outputs = [ "out" "dev" ]; propagatedOutputs = ""; }) // {
       passthru = {
-        inherit version modDirVersion config kernelPatches;
+        inherit version modDirVersion config kernelPatches configfile;
       };
 
       inherit src;
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index de1b16347e16e..cd34819a84890 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -87,10 +87,10 @@ rec {
     };
 
   grsecurity_unstable = grsecPatch
-    { kversion  = "4.1.7";
-      revision  = "201509131604";
+    { kversion  = "4.2.3";
+      revision  = "201510130858";
       branch    = "test";
-      sha256    = "1frfyi1pkiqc3awri3sr7xv41qxc8m2kb1yhfvj6xkrwb9li2bki";
+      sha256    = "0ndzcx9i94c065dlyvgykmin5bfkbydrv0kxxq52a4c9is6nlsrb";
     };
 
   grsec_fix_path =
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
index 2dcdcdc4a91d6..1e5c64ccb8a8a 100644
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ b/pkgs/os-specific/linux/kernel/perf.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto
 , docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
-, withGtk ? false, gtk ? null }:
+, zlib, withGtk ? false, gtk ? null }:
 
 with lib;
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   # perf refers both to newt and slang
   # binutils is required for libbfd.
   nativeBuildInputs = [ asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt flex bison ];
-  buildInputs = [ python perl newt slang pkgconfig libunwind binutils ] ++
+  buildInputs = [ python perl newt slang pkgconfig libunwind binutils zlib ] ++
     stdenv.lib.optional withGtk gtk;
 
   # Note: we don't add elfutils to buildInputs, since it provides a
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexectools/default.nix
index 483cdef079deb..aefb6dbaaca3d 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexectools/default.nix
@@ -1,12 +1,15 @@
 { stdenv, fetchurl, zlib }:
 
-let version = "2.0.10"; in
+let version = "2.0.11"; in
 stdenv.mkDerivation rec {
   name = "kexec-tools-${version}";
 
   src = fetchurl {
-    url = "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz";
-    sha256 = "18x134nj37j1rshn5hxbyhdcv9kk5sfshs72alkip1icf54l2gp2";
+    urls = [
+      "mirror://kernel/linux/utils/kernel/kexec/${name}.tar.xz"
+      "http://horms.net/projects/kexec/kexec-tools/${name}.tar.xz"
+    ];
+    sha256 = "1qrfka9xvy77k0rg3k0cf7xai0f9vpgsbs4l3bs8r4nvzy37j2di";
   };
 
   buildInputs = [ zlib ];
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index 72707bb7a8aad..c35b6bb90e891 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, perl, docbook2x
+{ stdenv, fetchurl, autoreconfHook, pkgconfig, perl, docbook2x
 , docbook_xml_dtd_45, python3Packages
 
 # Optional Dependencies
@@ -11,13 +11,12 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "lxc-1.1.3";
+  name = "lxc-${version}";
+  version = "1.1.4";
 
-  src = fetchFromGitHub {
-    owner = "lxc";
-    repo = "lxc";
-    rev = name;
-    sha256 = "109vpkxzkhixfvwfs6qphfbxb7pbk2qx22qc4zbk52d6gl78ygsb";
+  src = fetchurl {
+    url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz";
+    sha256 = "1p75ff4lnkm7hq26zq09nqbdypl508csk0ix024l7j8v02i2w1wg";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
new file mode 100644
index 0000000000000..f4e7ad1f23445
--- /dev/null
+++ b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
@@ -0,0 +1,26 @@
+{ stdenv, fetchurl, xz }:
+
+stdenv.mkDerivation rec {
+  name = "mkinitcpio-nfs-utils-0.3";
+
+  src = fetchurl {
+    url = "https://sources.archlinux.org/other/mkinitcpio/${name}.tar.xz";
+    sha256 = "0fc93sfk41ycpa33083kyd7i4y00ykpbhj5qlw611bjghj4x946j";
+    # ugh, upstream...
+    name = "${name}.tar.gz";
+  };
+
+  makeFlags = [ "DESTDIR=$(out)" "bindir=/bin" ];
+
+  postInstall = ''
+    rm -rf $out/usr
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://archlinux.org/;
+    description = "ipconfig and nfsmount tools for root on NFS, ported from klibc";
+    license = licenses.gpl2;
+    platforms  = platforms.linux;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 4390d5bdf3cd1..d0ef19503c374 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -12,7 +12,7 @@ assert (!libsOnly) -> kernel != null;
 
 let
 
-  versionNumber = "352.41";
+  versionNumber = "352.55";
 
   # Policy: use the highest stable version as the default (on our master).
   inherit (stdenv.lib) makeLibraryPath;
@@ -28,12 +28,12 @@ stdenv.mkDerivation {
     if stdenv.system == "i686-linux" then
       fetchurl {
         url = "http://us.download.nvidia.com/XFree86/Linux-x86/${versionNumber}/NVIDIA-Linux-x86-${versionNumber}.run";
-        sha256 = "1qzn6dhkrpkx015f7y9adafn7fmz7zbxbczzf9930li8pgvmmz5k";
+        sha256 = "0hfqklyij4hnsp3w89i8ai8rfpigc71sb1l70qplkq4511xj6bqx";
       }
     else if stdenv.system == "x86_64-linux" then
       fetchurl {
         url = "http://us.download.nvidia.com/XFree86/Linux-x86_64/${versionNumber}/NVIDIA-Linux-x86_64-${versionNumber}-no-compat32.run";
-        sha256 = "1k9hmmn5x9snzyggx23km64kjdqjh2kva090ha6mlayyyxrclz56";
+        sha256 = "00bawsxzwwaasfbmzkw301fsm2g1k0p3rfxyx6qpj0pgac3lrhhj";
       }
     else throw "nvidia-x11 does not support platform ${stdenv.system}";
 
diff --git a/pkgs/os-specific/linux/open-iscsi/default.nix b/pkgs/os-specific/linux/open-iscsi/default.nix
index c4e39e45cade0..e6682aec6c648 100644
--- a/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -1,8 +1,11 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, nukeReferences }:
 let
   pname = "open-iscsi-2.0-873";
 in stdenv.mkDerivation {
   name = "${pname}";
+  outputs = [ "out" "iscsistart" ];
+
+  buildInputs = [ nukeReferences ];
   
   src = fetchurl {
     url = "http://www.open-iscsi.org/bits/${pname}.tar.gz";
@@ -15,6 +18,12 @@ in stdenv.mkDerivation {
     sed -i 's|/usr/|/|' Makefile
   '';
   
+  postInstall = ''
+    mkdir -pv $iscsistart/bin/
+    cp -v usr/iscsistart $iscsistart/bin/
+    nuke-refs $iscsistart/bin/iscsistart
+  '';
+
   meta = {
     description = "A high performance, transport independent, multi-platform implementation of RFC3720";
     license = stdenv.lib.licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/pam_pgsql/default.nix b/pkgs/os-specific/linux/pam_pgsql/default.nix
new file mode 100644
index 0000000000000..8e34028e07832
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_pgsql/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkgconfig, postgresql, libgcrypt, pam }:
+
+stdenv.mkDerivation rec {
+  version = "0.7.3.2";
+  name = "pam_pgsql-${version}";
+
+  src = fetchFromGitHub {
+    owner = "pam-pgsql";
+    repo = "pam-pgsql";
+    rev = "release-${version}";
+    sha256 = "1a68krq5m07zspdxwl1wmkr5j98zr9bdg4776kvplrsdcg97h4jk";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ libgcrypt pam postgresql ];
+
+  meta = with stdenv.lib; {
+    description = "Support to authenticate against PostgreSQL for PAM-enabled appliations";
+    homepage = https://github.com/pam-pgsql/pam-pgsql;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
diff --git a/pkgs/os-specific/linux/pax-utils/default.nix b/pkgs/os-specific/linux/pax-utils/default.nix
index fe517a7102193..a35b8181544fa 100644
--- a/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/pkgs/os-specific/linux/pax-utils/default.nix
@@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
     homepage    = "http://dev.gentoo.org/~vapier/dist/";
     license     = licenses.gpl2;
     platforms   = platforms.linux;
-    maintainers = with maintainers; [ thoughtpolice wizeman ];
+    maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/os-specific/linux/paxctl/default.nix b/pkgs/os-specific/linux/paxctl/default.nix
index 8402b952ff778..afb342768c337 100644
--- a/pkgs/os-specific/linux/paxctl/default.nix
+++ b/pkgs/os-specific/linux/paxctl/default.nix
@@ -25,6 +25,6 @@ stdenv.mkDerivation rec {
     homepage    = "https://pax.grsecurity.net";
     license     = licenses.gpl2;
     platforms   = platforms.linux;
-    maintainers = with maintainers; [ thoughtpolice wizeman ];
+    maintainers = with maintainers; [ thoughtpolice ];
   };
 }
diff --git a/pkgs/os-specific/linux/pommed/default.nix b/pkgs/os-specific/linux/pommed/default.nix
index b4b4569def4b6..6318654742ee6 100644
--- a/pkgs/os-specific/linux/pommed/default.nix
+++ b/pkgs/os-specific/linux/pommed/default.nix
@@ -75,5 +75,6 @@ stdenv.mkDerivation rec {
     description = "A tool to handle hotkeys on Apple laptop keyboards";
     homepage = http://www.technologeek.org/projects/pommed/index.html;
     license = stdenv.lib.licenses.gpl2;
+    broken = true; # hash changed, and it's quite suspicious
   };
 }
diff --git a/pkgs/os-specific/linux/powertop/auto-tune.patch b/pkgs/os-specific/linux/powertop/auto-tune.patch
new file mode 100644
index 0000000000000..c9095336e8dca
--- /dev/null
+++ b/pkgs/os-specific/linux/powertop/auto-tune.patch
@@ -0,0 +1,11 @@
+diff --git a/src/devices/devfreq.cpp b/src/devices/devfreq.cpp
+index d2e56e3..4de5c9b 100644
+--- a/src/devices/devfreq.cpp
++++ b/src/devices/devfreq.cpp
+@@ -247,6 +247,7 @@ void create_all_devfreq_devices(void)
+ 		fprintf(stderr, "Devfreq not enabled\n");
+ 		is_enabled = false;
+ 		closedir(dir);
++		dir = NULL;
+ 		return;
+ 	}
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 9e32cd70cfb73..82ca746d6a477 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -10,7 +10,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gettext libnl ncurses pciutils pkgconfig zlib ];
 
-  patchPhase = ''
+  # Fix --auto-tune bug:
+  # https://lists.01.org/pipermail/powertop/2014-December/001727.html
+  patches = [ ./auto-tune.patch ];
+
+  postPatch = ''
     substituteInPlace src/main.cpp --replace "/sbin/modprobe" "modprobe"
   '';
 
diff --git a/pkgs/os-specific/linux/spl/default.nix b/pkgs/os-specific/linux/spl/default.nix
index 57eaa55b2354d..b8aad109c5a8c 100644
--- a/pkgs/os-specific/linux/spl/default.nix
+++ b/pkgs/os-specific/linux/spl/default.nix
@@ -17,13 +17,13 @@ assert buildKernel -> kernel != null;
 stdenv.mkDerivation rec {
   name = "spl-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
-  version = "0.6.5";
+  version = "0.6.5.3";
 
   src = fetchFromGitHub {
     owner = "zfsonlinux";
     repo = "spl";
     rev = "spl-${version}";
-    sha256 = "0ryw2vh3px0q38skm53g83p46011ndrdxi3y2kqvd1pjqgfbjdmj";
+    sha256 = "0lj57apwsy8cfwsvg9z62k71r3qms2p87lgcdk54g7352cwziqps";
   };
 
   patches = [ ./const.patch ./install_prefix.patch ];
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 93e5d591a9d9a..5ebcef39e4735 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -1,25 +1,30 @@
-{ stdenv, fetchurl, nasm, perl, libuuid }:
+{ stdenv, fetchFromGitHub, nasm, perl, python, libuuid }:
 
 stdenv.mkDerivation rec {
-  name = "syslinux-6.03";
+  name = "syslinux-2015-11-09";
 
-  src = fetchurl {
-    url = "mirror://kernel/linux/utils/boot/syslinux/${name}.tar.xz";
-    sha256 = "03l5iifwlg1wyb4yh98i0b7pd4j55a1c9y74q1frs47a5dnrilr6";
+  src = fetchFromGitHub {
+    owner = "geneC";
+    repo = "syslinux";
+    rev = "0cc9a99e560a2f52bcf052fd85b1efae35ee812f";
+    sha256 = "0wk3r5ki4lc334f9jpml07wpl8d0bnxi9h1l4h4fyf9a0d7n4kmw";
   };
 
   patches = [ ./perl-deps.patch ];
 
-  buildInputs = [ nasm perl libuuid ];
+  nativeBuildInputs = [ nasm perl python ];
+  buildInputs = [ libuuid ];
 
-  enableParallelBuilding = true;
+  enableParallelBuilding = false; # Fails very rarely with 'No rule to make target: ...'
 
   preBuild = ''
     substituteInPlace Makefile --replace /bin/pwd $(type -P pwd)
     substituteInPlace gpxe/src/Makefile.housekeeping --replace /bin/echo $(type -P echo)
-    substituteInPlace gpxe/src/Makefile --replace /usr/bin/perl $(type -P perl)
+    substituteInPlace utils/ppmtolss16 gpxe/src/Makefile --replace /usr/bin/perl $(type -P perl)
   '';
 
+  stripDebugList = "bin sbin share/syslinux/com32";
+
   makeFlags = [
     "BINDIR=$(out)/bin"
     "SBINDIR=$(out)/sbin"
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index aa15f397f8ac7..780b906729749 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -12,20 +12,20 @@ assert stdenv.isLinux;
 assert pythonSupport -> pythonPackages != null;
 
 stdenv.mkDerivation rec {
-  version = "226";
+  version = "227";
   name = "systemd-${version}";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "systemd";
-    rev = "16d61e9657b643cc25ff0538688eb870ce2dd4a5";
-    sha256 = "07sc1x43j60d5jnps0d7bfka10fihnpgkdrfrh9iskgmc9qangjb";
+    rev = "7d94d27801d20278103d8c146633fe81e06697d6";
+    sha256 = "0cvzsrazqgbia3zajb0z4ik8myfil4bdy2c29qs6w93d6yvrjfkj";
   };
 
   patches = [ ./hwdb-location.diff ];
 
   /* gave up for now!
-  outputs = [ "out" "libudev" "doc" ]; # TODO: "dev"
+  outputs = [ "out" "libudev" "doc" ]; # maybe: "dev"
   # note: there are many references to ${systemd}/...
   outputDev = "out";
   propagatedOutputs = "libudev";
@@ -168,8 +168,6 @@ stdenv.mkDerivation rec {
 
       rm $out/lib/*.la
 
-      rm -rf $out/share/doc
-
       # "kernel-install" shouldn't be used on NixOS.
       find $out -name "*kernel-install*" -exec rm {} \;
     ''; # */
diff --git a/pkgs/os-specific/linux/trinity/default.nix b/pkgs/os-specific/linux/trinity/default.nix
index 9b7e2a6876ada..a60175900cd77 100644
--- a/pkgs/os-specific/linux/trinity/default.nix
+++ b/pkgs/os-specific/linux/trinity/default.nix
@@ -1,20 +1,21 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, linuxHeaders }:
 
 stdenv.mkDerivation rec {
   name = "trinity-${version}";
-  version = "1.5";
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "kernelslacker";
     repo = "trinity";
     rev = "v${version}";
-    sha256 = "0diwkda6n7yw8plfanivncwangk2kv1acxv0kyk3ly5jhlajwc0s";
+    sha256 = "1jwgsjjbngn2dsnkflyigy3ajd0szksl30dlaiy02jc6mqi3nr0p";
   };
 
   patchPhase = ''
     patchShebangs ./configure.sh
     patchShebangs ./scripts/
     substituteInPlace Makefile --replace '/usr/bin/wc' 'wc'
+    substituteInPlace configure.sh --replace '/usr/include/linux' '${linuxHeaders}/include/linux'
   '';
 
   configurePhase = "./configure.sh";
diff --git a/pkgs/os-specific/linux/udev/182.nix b/pkgs/os-specific/linux/udev/182.nix
new file mode 100644
index 0000000000000..fcf06e3e8990d
--- /dev/null
+++ b/pkgs/os-specific/linux/udev/182.nix
@@ -0,0 +1,34 @@
+{ stdenv, fetchurl, pkgconfig
+, pciutils, utillinux, kmod, usbutils, gperf
+}:
+
+assert stdenv ? glibc;
+
+stdenv.mkDerivation rec {
+  name = "udev-182";
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/utils/kernel/hotplug/${name}.tar.bz2";
+    sha256 = "143qvm0kij26j2l5icnch4x38fajys6li7j0c5mpwi6kqmc8hqx0";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [ utillinux kmod usbutils #glib gobjectIntrospection
+                  gperf
+                ];
+
+  configureFlags = [ "--with-pci-ids-path=${pciutils}/share/pci.ids"
+                     "--disable-gudev"
+                     "--disable-introspection"
+                   ];
+
+  NIX_LDFLAGS = [ "-lrt" ];
+
+  meta = with stdenv.lib; {
+    homepage = http://www.kernel.org/pub/linux/utils/kernel/hotplug/udev.html;
+    description = "Udev manages the /dev filesystem";
+    platforms = platforms.linux;
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/os-specific/linux/udisks/1-default.nix b/pkgs/os-specific/linux/udisks/1-default.nix
index b3df300e519ea..a0596abb2695e 100644
--- a/pkgs/os-specific/linux/udisks/1-default.nix
+++ b/pkgs/os-specific/linux/udisks/1-default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchurl, pkgconfig, sg3_utils, udev, glib, dbus, dbus_glib
 , polkit, parted, lvm2, libatasmart, intltool, libuuid, mdadm
-, libxslt, docbook_xsl, utillinux }:
+, libxslt, docbook_xsl, utillinux, libgudev }:
 
 stdenv.mkDerivation rec {
   name = "udisks-1.0.5";
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     '';
 
   buildInputs =
-    [ sg3_utils udev glib dbus dbus_glib polkit parted
+    [ sg3_utils udev glib dbus dbus_glib polkit parted libgudev
       lvm2 libatasmart intltool libuuid libxslt docbook_xsl
     ];
 
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 66f67dbed6163..ec5c77699ecbb 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, zlib, ncurses ? null, perl ? null, pam }:
 
 stdenv.mkDerivation rec {
-  name = "util-linux-2.26.2";
+  name = "util-linux-2.27.1";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/util-linux/v2.26/${name}.tar.xz";
-    sha256 = "0rlnzmiqdannzf81fbh41541lrck63v9zhskm6h4i2jj8ahvsa8f";
+    url = "mirror://kernel/linux/utils/util-linux/v2.27/${name}.tar.xz";
+    sha256 = "1452hz5zx56a3mad8yrg5wb0vy5zi19mpjp6zx1yr6p9xp6qz08a";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
index 92cb07d43834e..68970c655f150 100644
--- a/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
+++ b/pkgs/os-specific/linux/util-linux/rtcwake-search-PATH-for-shutdown.patch
@@ -4,10 +4,10 @@ distros anyway).
 
   -- nckx <tobias.geerinckx.rice@gmail.com>
 
-diff -Naur a/include/pathnames.h b/include/pathnames.h
---- a/include/pathnames.h	2014-09-16 14:37:06.138551680 +0200
-+++ b/include/pathnames.h	2015-01-01 20:41:02.510948314 +0100
-@@ -43,7 +43,7 @@
+diff -ru util-linux-2.27-orig/include/pathnames.h util-linux-2.27/include/pathnames.h
+--- util-linux-2.27-orig/include/pathnames.h	2015-06-29 13:13:14.669847478 +0200
++++ util-linux-2.27/include/pathnames.h	2015-10-07 20:09:17.401022602 +0200
+@@ -54,7 +54,7 @@
  #define _PATH_INITTAB		"/etc/inittab"
  #define _PATH_RC		"/etc/rc"
  #define _PATH_REBOOT		"/sbin/reboot"
@@ -16,15 +16,15 @@ diff -Naur a/include/pathnames.h b/include/pathnames.h
  #define _PATH_SINGLE		"/etc/singleboot"
  #define _PATH_SHUTDOWN_CONF	"/etc/shutdown.conf"
  
-diff -Naur a/sys-utils/rtcwake.c b/sys-utils/rtcwake.c
---- a/sys-utils/rtcwake.c	2014-10-24 11:21:20.447389309 +0200
-+++ b/sys-utils/rtcwake.c	2015-01-01 20:57:59.398911209 +0100
-@@ -582,7 +582,7 @@
+diff -ru util-linux-2.27-orig/sys-utils/rtcwake.c util-linux-2.27/sys-utils/rtcwake.c
+--- util-linux-2.27-orig/sys-utils/rtcwake.c	2015-08-05 11:32:44.453821232 +0200
++++ util-linux-2.27/sys-utils/rtcwake.c	2015-10-07 20:09:37.834032536 +0200
+@@ -576,7 +576,7 @@
+ 		arg[i++] = "now";
  		arg[i]   = NULL;
- 
- 		if (!dryrun) {
+ 		if (!ctl.dryrun) {
 -			execv(arg[0], arg);
 +			execvp(arg[0], arg);
- 
  			warn(_("failed to execute %s"), _PATH_SHUTDOWN);
  			rc = EXIT_FAILURE;
+ 		}
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 88e100c7a4db2..d75410d74d502 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
   # TODO: Patch epoll so that the dbus actually responds
   # TODO: Figure out how to get privsep working, currently getting SIGBUS
   extraConfig = ''
+    CONFIG_AP=y
     CONFIG_LIBNL32=y
     CONFIG_EAP_FAST=y
     CONFIG_EAP_PWD=y
diff --git a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
new file mode 100644
index 0000000000000..cca9dc09e93e9
--- /dev/null
+++ b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
@@ -0,0 +1,25 @@
+{ stdenv, kernel }:
+
+stdenv.mkDerivation {
+  name = "x86_energy_perf_policy-${kernel.version}";
+
+  src = kernel.src;
+
+  postPatch = ''
+    cd tools/power/x86/x86_energy_perf_policy
+    sed -i 's,/usr,,g' Makefile
+  '';
+
+  preInstall = ''
+    mkdir -p $out/bin $out/share/man/man8
+  '';
+
+  makeFlags = [ "DESTDIR=$(out)" ];
+
+  meta = with stdenv.lib; {
+    description = "Set the energy versus performance policy preference bias on recent X86 processors";
+    homepage = https://www.kernel.org.org/;
+    license = licenses.gpl2;
+    platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
+  };
+}
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index d068a4e910d6c..28fc35efbd461 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -20,13 +20,13 @@ assert buildKernel -> kernel != null && spl != null;
 stdenv.mkDerivation rec {
   name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
 
-  version = "0.6.5.1";
+  version = "0.6.5.3";
 
   src = fetchFromGitHub {
     owner = "zfsonlinux";
     repo = "zfs";
     rev = "zfs-${version}";
-    sha256 = "0lbii5kc3b68zj8mvvznl05czwdkr0ld3a2javbkngfvrcn09rz2";
+    sha256 = "1hq65kq50hzhd1zqgyzqq2whg1fckigq8jmhhdsnbwrwmx5y76lh";
   };
 
   patches = [ ./nix-build.patch ];