summary refs log tree commit diff
path: root/pkgs/os-specific/linux
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific/linux')
-rw-r--r--pkgs/os-specific/linux/915resolution/default.nix5
-rw-r--r--pkgs/os-specific/linux/9ptls/default.nix28
-rw-r--r--pkgs/os-specific/linux/acpi-call/default.nix6
-rw-r--r--pkgs/os-specific/linux/acpid/default.nix15
-rw-r--r--pkgs/os-specific/linux/acpitool/default.nix5
-rw-r--r--pkgs/os-specific/linux/adcli/default.nix70
-rw-r--r--pkgs/os-specific/linux/afuse/default.nix15
-rw-r--r--pkgs/os-specific/linux/akvcam/default.nix20
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-firmware/cross.patch347
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix40
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch232
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix47
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-oss/default.nix31
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix27
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-plugins/wrapper.nix10
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix54
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix36
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix36
-rw-r--r--pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix36
-rw-r--r--pkgs/os-specific/linux/amdctl/default.nix32
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/default.nix277
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/patches/0001-fix-warnings-for-Werror.patch71
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/patches/0002-fix-sketchy-int-ptr-warning.patch25
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/patches/0003-disable-firmware-copy.patch25
-rw-r--r--pkgs/os-specific/linux/amdgpu-pro/xreallocarray.c5
-rw-r--r--pkgs/os-specific/linux/anbox/0001-NixOS-Use-anbox-from-PATH-in-desktop-files.patch34
-rw-r--r--pkgs/os-specific/linux/anbox/default.nix72
-rw-r--r--pkgs/os-specific/linux/anbox/kmod.nix42
-rw-r--r--pkgs/os-specific/linux/anbox/postmarketos-image.nix19
-rw-r--r--pkgs/os-specific/linux/android-udev-rules/default.nix4
-rw-r--r--pkgs/os-specific/linux/apfs/default.nix24
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix156
-rw-r--r--pkgs/os-specific/linux/aseq2json/default.nix6
-rw-r--r--pkgs/os-specific/linux/asus-ec-sensors/default.nix35
-rw-r--r--pkgs/os-specific/linux/atop/default.nix33
-rw-r--r--pkgs/os-specific/linux/atop/default.upstream4
-rw-r--r--pkgs/os-specific/linux/audit/default.nix105
-rw-r--r--pkgs/os-specific/linux/audit/patches/weak-symbols.patch147
-rw-r--r--pkgs/os-specific/linux/autofs/default.nix23
-rw-r--r--pkgs/os-specific/linux/autosuspend/default.nix79
-rw-r--r--pkgs/os-specific/linux/ax99100/default.nix53
-rw-r--r--pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch14
-rw-r--r--pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch18
-rw-r--r--pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch11
-rw-r--r--pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch14
-rw-r--r--pkgs/os-specific/linux/batman-adv/alfred.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/batctl.nix2
-rw-r--r--pkgs/os-specific/linux/batman-adv/default.nix11
-rw-r--r--pkgs/os-specific/linux/batman-adv/version.nix8
-rw-r--r--pkgs/os-specific/linux/bbswitch/default.nix25
-rw-r--r--pkgs/os-specific/linux/bcc/absolute-ausyscall.patch43
-rw-r--r--pkgs/os-specific/linux/bcc/default.nix73
-rw-r--r--pkgs/os-specific/linux/below/default.nix48
-rw-r--r--pkgs/os-specific/linux/bionic-prebuilt/default.nix63
-rw-r--r--pkgs/os-specific/linux/blktrace/default.nix25
-rw-r--r--pkgs/os-specific/linux/bluez/default.nix39
-rw-r--r--pkgs/os-specific/linux/bolt/default.nix50
-rw-r--r--pkgs/os-specific/linux/bpfmon/default.nix36
-rw-r--r--pkgs/os-specific/linux/bpftools/default.nix25
-rw-r--r--pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch13
-rw-r--r--pkgs/os-specific/linux/bpftrace/default.nix78
-rw-r--r--pkgs/os-specific/linux/bpftrace/fix-kernel-include-dir.patch22
-rw-r--r--pkgs/os-specific/linux/bpftune/default.nix77
-rw-r--r--pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch11
-rw-r--r--pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch8
-rw-r--r--pkgs/os-specific/linux/bridge-utils/default.nix25
-rw-r--r--pkgs/os-specific/linux/brillo/default.nix5
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/default.nix11
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch4
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch4
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/linux-5.17.patch80
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/linux-5.18.patch71
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/linux-6.0.patch30
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/linux-6.1.patch83
-rw-r--r--pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch99
-rw-r--r--pkgs/os-specific/linux/busybox/default.nix34
-rw-r--r--pkgs/os-specific/linux/can-isotp/default.nix16
-rw-r--r--pkgs/os-specific/linux/can-utils/default.nix20
-rw-r--r--pkgs/os-specific/linux/cannelloni/default.nix30
-rw-r--r--pkgs/os-specific/linux/catfs/Cargo.lock651
-rw-r--r--pkgs/os-specific/linux/catfs/default.nix24
-rw-r--r--pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff13
-rw-r--r--pkgs/os-specific/linux/cfs-zen-tweaks/default.nix38
-rw-r--r--pkgs/os-specific/linux/ch9344/default.nix51
-rw-r--r--pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch22
-rw-r--r--pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types_6_3.patch13
-rw-r--r--pkgs/os-specific/linux/checkpolicy/default.nix8
-rw-r--r--pkgs/os-specific/linux/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch24
-rw-r--r--pkgs/os-specific/linux/checksec/0002-don-t-sanatize-the-environment.patch25
-rw-r--r--pkgs/os-specific/linux/checksec/default.nix112
-rw-r--r--pkgs/os-specific/linux/chromium-os/common-mk/0001-common-mk-don-t-leak-source-absolute-paths.patch207
-rw-r--r--pkgs/os-specific/linux/chromium-os/common-mk/0002-common-mk-.gn-don-t-hardcode-env-path.patch23
-rw-r--r--pkgs/os-specific/linux/chromium-os/common-mk/default.nix122
-rw-r--r--pkgs/os-specific/linux/chromium-os/crosvm/VIRTIO_NET_F_MAC.patch278
-rw-r--r--pkgs/os-specific/linux/chromium-os/crosvm/default-seccomp-policy-dir.diff15
-rw-r--r--pkgs/os-specific/linux/chromium-os/crosvm/default.nix85
-rw-r--r--pkgs/os-specific/linux/chromium-os/dbus-properties/default.nix9
-rw-r--r--pkgs/os-specific/linux/chromium-os/default.nix64
-rw-r--r--pkgs/os-specific/linux/chromium-os/libqmi/default.nix28
-rw-r--r--pkgs/os-specific/linux/chromium-os/minigbm/default.nix28
-rw-r--r--pkgs/os-specific/linux/chromium-os/modem-manager/default.nix33
-rw-r--r--pkgs/os-specific/linux/chromium-os/modem-manager/next.nix25
-rw-r--r--pkgs/os-specific/linux/chromium-os/modp_b64/default.nix23
-rw-r--r--pkgs/os-specific/linux/chromium-os/protofiles/default.nix34
-rw-r--r--pkgs/os-specific/linux/chromium-os/sommelier/0005-sommelier-don-t-leak-source-absolute-paths.patch25
-rw-r--r--pkgs/os-specific/linux/chromium-os/sommelier/0006-Revert-Revert-vm_tools-sommelier-Switch-to-the-stabl.patch1840
-rw-r--r--pkgs/os-specific/linux/chromium-os/sommelier/default.nix37
-rwxr-xr-xpkgs/os-specific/linux/chromium-os/update.py131
-rw-r--r--pkgs/os-specific/linux/chromium-os/upstream-info.json72
-rw-r--r--pkgs/os-specific/linux/chromium-os/vm_protos/0003-common-mk-add-goproto_library-source_relative-opt.patch48
-rw-r--r--pkgs/os-specific/linux/chromium-os/vm_protos/0004-vm_tools-proto-set-go_package-correctly.patch102
-rw-r--r--pkgs/os-specific/linux/chromium-os/vm_protos/default.nix41
-rw-r--r--pkgs/os-specific/linux/cifs-utils/default.nix4
-rw-r--r--pkgs/os-specific/linux/conky/default.nix29
-rw-r--r--pkgs/os-specific/linux/conntrack-tools/default.nix18
-rw-r--r--pkgs/os-specific/linux/consoletools/default.nix9
-rw-r--r--pkgs/os-specific/linux/conspy/default.nix43
-rw-r--r--pkgs/os-specific/linux/conspy/default.upstream5
-rw-r--r--pkgs/os-specific/linux/cpufrequtils/default.nix8
-rw-r--r--pkgs/os-specific/linux/cpuid/default.nix29
-rw-r--r--pkgs/os-specific/linux/cpupower-gui/default.nix103
-rw-r--r--pkgs/os-specific/linux/cpupower/default.nix2
-rw-r--r--pkgs/os-specific/linux/cpuset/default.nix1
-rw-r--r--pkgs/os-specific/linux/cpustat/default.nix15
-rw-r--r--pkgs/os-specific/linux/cramfsprogs/default.nix4
-rw-r--r--pkgs/os-specific/linux/cramfsswap/default.nix15
-rw-r--r--pkgs/os-specific/linux/cramfsswap/parallel-make.patch14
-rw-r--r--pkgs/os-specific/linux/crda/default.nix38
-rw-r--r--pkgs/os-specific/linux/criu/default.nix95
-rw-r--r--pkgs/os-specific/linux/cryptodev/default.nix15
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix72
-rw-r--r--pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch19
-rw-r--r--pkgs/os-specific/linux/cryptsetup/relative-token-path.patch50
-rw-r--r--pkgs/os-specific/linux/cshatag/default.nix21
-rw-r--r--pkgs/os-specific/linux/cshatag/deps.nix21
-rw-r--r--pkgs/os-specific/linux/dbus-broker/default.nix86
-rw-r--r--pkgs/os-specific/linux/dbus-broker/paths.patch27
-rw-r--r--pkgs/os-specific/linux/dcgm/default.nix139
-rw-r--r--pkgs/os-specific/linux/ddcci/default.nix11
-rw-r--r--pkgs/os-specific/linux/dddvb/default.nix49
-rw-r--r--pkgs/os-specific/linux/decklink/default.nix52
-rw-r--r--pkgs/os-specific/linux/device-tree/default.nix60
-rw-r--r--pkgs/os-specific/linux/device-tree/raspberrypi.nix3
-rw-r--r--pkgs/os-specific/linux/devmem2/default.nix3
-rw-r--r--pkgs/os-specific/linux/digimend/default.nix25
-rw-r--r--pkgs/os-specific/linux/directvnc/default.nix13
-rw-r--r--pkgs/os-specific/linux/disk-indicator/default.nix39
-rw-r--r--pkgs/os-specific/linux/displaylink/default.nix40
-rw-r--r--pkgs/os-specific/linux/dlm/default.nix26
-rw-r--r--pkgs/os-specific/linux/dmidecode/default.nix57
-rw-r--r--pkgs/os-specific/linux/dmraid/default.nix10
-rw-r--r--pkgs/os-specific/linux/dmtcp/default.nix12
-rw-r--r--pkgs/os-specific/linux/dpdk-kmods/default.nix21
-rw-r--r--pkgs/os-specific/linux/dpdk/default.nix68
-rw-r--r--pkgs/os-specific/linux/dracut/default.nix114
-rw-r--r--pkgs/os-specific/linux/drbd/default.nix134
-rw-r--r--pkgs/os-specific/linux/drbd/fix-glibc-compilation.patch24
-rw-r--r--pkgs/os-specific/linux/drbd/pass-force.patch15
-rw-r--r--pkgs/os-specific/linux/dropwatch/default.nix4
-rw-r--r--pkgs/os-specific/linux/earlyoom/default.nix10
-rw-r--r--pkgs/os-specific/linux/ebtables/default.nix2
-rw-r--r--pkgs/os-specific/linux/edac-utils/default.nix3
-rw-r--r--pkgs/os-specific/linux/ell/default.nix26
-rw-r--r--pkgs/os-specific/linux/ena/default.nix13
-rw-r--r--pkgs/os-specific/linux/erofs-utils/default.nix25
-rw-r--r--pkgs/os-specific/linux/error-inject/default.nix68
-rw-r--r--pkgs/os-specific/linux/esdm/default.nix129
-rw-r--r--pkgs/os-specific/linux/ethq/default.nix32
-rw-r--r--pkgs/os-specific/linux/eudev/default.nix60
-rw-r--r--pkgs/os-specific/linux/evdi/default.nix39
-rw-r--r--pkgs/os-specific/linux/eventstat/default.nix28
-rw-r--r--pkgs/os-specific/linux/exfat/default.nix12
-rw-r--r--pkgs/os-specific/linux/extrace/default.nix8
-rw-r--r--pkgs/os-specific/linux/facetimehd/default.nix30
-rw-r--r--pkgs/os-specific/linux/fan2go/default.nix31
-rw-r--r--pkgs/os-specific/linux/fanctl/default.nix23
-rw-r--r--pkgs/os-specific/linux/fanout/default.nix37
-rw-r--r--pkgs/os-specific/linux/fanout/remove_auto_mknod.patch13
-rw-r--r--pkgs/os-specific/linux/fatrace/default.nix4
-rw-r--r--pkgs/os-specific/linux/fbterm/default.nix126
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix8
-rw-r--r--pkgs/os-specific/linux/firejail/default.nix42
-rw-r--r--pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patch18
-rw-r--r--pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patch8
-rw-r--r--pkgs/os-specific/linux/firmware/ath9k/default.nix154
-rw-r--r--pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix26
-rw-r--r--pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix26
-rw-r--r--pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix10
-rw-r--r--pkgs/os-specific/linux/firmware/b43-firmware/5.1.138.nix11
-rw-r--r--pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix14
-rw-r--r--pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix7
-rw-r--r--pkgs/os-specific/linux/firmware/facetimehd-calibration/default.nix62
-rw-r--r--pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-manager/Cargo.lock4125
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-manager/default.nix56
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/default.nix42
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/deps.json1616
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock1079
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd-efi/default.nix56
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch183
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix547
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch13
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch8
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch37
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch53
-rw-r--r--pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix25
-rw-r--r--pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix79
-rw-r--r--pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix41
-rw-r--r--pkgs/os-specific/linux/firmware/libreelec-dvb-firmware/default.nix31
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/default.nix (renamed from pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix)33
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/source.nix6
-rwxr-xr-xpkgs/os-specific/linux/firmware/linux-firmware/update.sh47
-rw-r--r--pkgs/os-specific/linux/firmware/openelec-dvb-firmware/default.nix28
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix38
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix14
-rw-r--r--pkgs/os-specific/linux/firmware/raspberrypi/default.nix11
-rw-r--r--pkgs/os-specific/linux/firmware/rt5677/default.nix12
-rw-r--r--pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix9
-rw-r--r--pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix22
-rw-r--r--pkgs/os-specific/linux/firmware/rtl8761b-firmware/default.nix6
-rw-r--r--pkgs/os-specific/linux/firmware/rtw89-firmware/default.nix25
-rw-r--r--pkgs/os-specific/linux/firmware/sof-firmware/default.nix27
-rw-r--r--pkgs/os-specific/linux/firmware/system76-firmware/Cargo.lock1551
-rw-r--r--pkgs/os-specific/linux/firmware/system76-firmware/default.nix11
-rw-r--r--pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix34
-rw-r--r--pkgs/os-specific/linux/firmware/zd1211/default.nix26
-rw-r--r--pkgs/os-specific/linux/fnotifystat/default.nix34
-rw-r--r--pkgs/os-specific/linux/forkstat/default.nix27
-rw-r--r--pkgs/os-specific/linux/forktty/default.nix39
-rw-r--r--pkgs/os-specific/linux/forktty/default.upstream2
-rw-r--r--pkgs/os-specific/linux/freeipa/default.nix172
-rw-r--r--pkgs/os-specific/linux/freeipa/paths.py13
-rw-r--r--pkgs/os-specific/linux/fscrypt/default.nix10
-rw-r--r--pkgs/os-specific/linux/fscryptctl/default.nix2
-rw-r--r--pkgs/os-specific/linux/fscryptctl/legacy.nix51
-rw-r--r--pkgs/os-specific/linux/fsverity-utils/default.nix51
-rw-r--r--pkgs/os-specific/linux/fsverity-utils/remove-dynamic-libs.patch27
-rw-r--r--pkgs/os-specific/linux/fswebcam/default.nix5
-rw-r--r--pkgs/os-specific/linux/fuse/common.nix19
-rw-r--r--pkgs/os-specific/linux/fuse/default.nix6
-rw-r--r--pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch5
-rw-r--r--pkgs/os-specific/linux/fuse/fuse3-install.patch22
-rw-r--r--pkgs/os-specific/linux/fw-ectool/default.nix41
-rw-r--r--pkgs/os-specific/linux/fwts/default.nix26
-rw-r--r--pkgs/os-specific/linux/fwts/module.nix4
-rw-r--r--pkgs/os-specific/linux/fxload/default.nix49
-rw-r--r--pkgs/os-specific/linux/g15daemon/default.nix5
-rw-r--r--pkgs/os-specific/linux/game-devices-udev-rules/default.nix38
-rw-r--r--pkgs/os-specific/linux/gasket/default.nix35
-rw-r--r--pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix8
-rw-r--r--pkgs/os-specific/linux/gobi_loader/default.nix2
-rw-r--r--pkgs/os-specific/linux/gogoclient/config-paths.patch39
-rw-r--r--pkgs/os-specific/linux/gogoclient/default.nix44
-rw-r--r--pkgs/os-specific/linux/gogoclient/gcc46-include-fix.patch22
-rw-r--r--pkgs/os-specific/linux/google-authenticator/default.nix10
-rw-r--r--pkgs/os-specific/linux/greetd/default.nix51
-rw-r--r--pkgs/os-specific/linux/gt/default.nix32
-rw-r--r--pkgs/os-specific/linux/gtkgreet/default.nix50
-rw-r--r--pkgs/os-specific/linux/guvcview/default.nix6
-rw-r--r--pkgs/os-specific/linux/hd-idle/default.nix30
-rw-r--r--pkgs/os-specific/linux/hdapsd/default.nix6
-rw-r--r--pkgs/os-specific/linux/hdparm/default.nix4
-rw-r--r--pkgs/os-specific/linux/health-check/default.nix15
-rw-r--r--pkgs/os-specific/linux/hid-ite8291r3/default.nix35
-rw-r--r--pkgs/os-specific/linux/hid-nintendo/default.nix38
-rw-r--r--pkgs/os-specific/linux/hid-tmff2/default.nix36
-rw-r--r--pkgs/os-specific/linux/hostapd/default.nix95
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix13
-rw-r--r--pkgs/os-specific/linux/hyperv-daemons/default.nix6
-rw-r--r--pkgs/os-specific/linux/i2c-tools/default.nix13
-rw-r--r--pkgs/os-specific/linux/i7z/default.nix5
-rw-r--r--pkgs/os-specific/linux/i810switch/default.nix12
-rw-r--r--pkgs/os-specific/linux/ifmetric/default.nix1
-rw-r--r--pkgs/os-specific/linux/iio-sensor-proxy/default.nix63
-rw-r--r--pkgs/os-specific/linux/ima-evm-utils/default.nix35
-rw-r--r--pkgs/os-specific/linux/ima-evm-utils/xattr.patch73
-rw-r--r--pkgs/os-specific/linux/intel-cmt-cat/default.nix25
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix30
-rw-r--r--pkgs/os-specific/linux/intel-ocl/default.nix13
-rw-r--r--pkgs/os-specific/linux/intel-speed-select/default.nix1
-rw-r--r--pkgs/os-specific/linux/iomelt/default.nix2
-rw-r--r--pkgs/os-specific/linux/ioport/default.nix10
-rw-r--r--pkgs/os-specific/linux/iotop-c/default.nix4
-rw-r--r--pkgs/os-specific/linux/iotop/default.nix5
-rw-r--r--pkgs/os-specific/linux/ipp-usb/default.nix42
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix22
-rw-r--r--pkgs/os-specific/linux/iproute/mptcp.nix28
-rw-r--r--pkgs/os-specific/linux/ipsec-tools/CVE-2015-4047.patch16
-rw-r--r--pkgs/os-specific/linux/ipsec-tools/CVE-2016-10396.patch193
-rw-r--r--pkgs/os-specific/linux/ipsec-tools/default.nix48
-rw-r--r--pkgs/os-specific/linux/ipsec-tools/dont-create-localstatedir-during-install.patch13
-rw-r--r--pkgs/os-specific/linux/ipset/default.nix4
-rw-r--r--pkgs/os-specific/linux/iptables/default.nix40
-rw-r--r--pkgs/os-specific/linux/iptstate/default.nix4
-rw-r--r--pkgs/os-specific/linux/ipu6-drivers/default.nix53
-rw-r--r--pkgs/os-specific/linux/iputils/default.nix67
-rw-r--r--pkgs/os-specific/linux/ipvsadm/default.nix4
-rw-r--r--pkgs/os-specific/linux/irqbalance/default.nix9
-rw-r--r--pkgs/os-specific/linux/isgx/default.nix25
-rw-r--r--pkgs/os-specific/linux/it87/default.nix15
-rw-r--r--pkgs/os-specific/linux/ithc/default.nix35
-rw-r--r--pkgs/os-specific/linux/ivsc-driver/default.nix43
-rw-r--r--pkgs/os-specific/linux/iw/default.nix4
-rw-r--r--pkgs/os-specific/linux/iwd/default.nix17
-rw-r--r--pkgs/os-specific/linux/jfbview/default.nix73
-rw-r--r--pkgs/os-specific/linux/jool/cli.nix18
-rw-r--r--pkgs/os-specific/linux/jool/default.nix16
-rw-r--r--pkgs/os-specific/linux/jool/source.nix6
-rw-r--r--pkgs/os-specific/linux/jool/validate-config.patch193
-rw-r--r--pkgs/os-specific/linux/joycond/default.nix11
-rw-r--r--pkgs/os-specific/linux/jujuutils/default.nix7
-rw-r--r--pkgs/os-specific/linux/kbd/default.nix24
-rw-r--r--pkgs/os-specific/linux/kbd/search-paths.patch15
-rw-r--r--pkgs/os-specific/linux/kernel-headers/default.nix61
-rw-r--r--pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch31
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix541
-rw-r--r--pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.11.patch784
-rw-r--r--pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.4.patch407
-rw-r--r--pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.9.patch784
-rw-r--r--pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md21
-rw-r--r--pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/default.nix11
-rw-r--r--pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch86
-rw-r--r--pkgs/os-specific/linux/kernel/generate-config.pl2
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix70
-rw-r--r--pkgs/os-specific/linux/kernel/genksyms-fix-segfault.patch19
-rw-r--r--pkgs/os-specific/linux/kernel/gpio-utils.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix32
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json92
-rwxr-xr-xpkgs/os-specific/linux/kernel/hardened/update.py59
-rw-r--r--pkgs/os-specific/linux/kernel/htmldocs.nix56
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json38
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.14.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.19.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.4.nix14
-rw-r--r--pkgs/os-specific/linux/kernel/linux-4.9.nix14
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.10.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.12.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.13.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.4.nix20
-rw-r--r--pkgs/os-specific/linux/kernel/linux-cros.nix38
-rw-r--r--pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix33
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix15
-rw-r--r--pkgs/os-specific/linux/kernel/linux-lqx.nix26
-rw-r--r--pkgs/os-specific/linux/kernel/linux-mptcp-95.nix27
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rpi.nix21
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix9
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.15.nix (renamed from pkgs/os-specific/linux/kernel/linux-rt-5.11.nix)6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.4.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix45
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix41
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix22
-rw-r--r--pkgs/os-specific/linux/kernel/linux-xanmod.nix55
-rw-r--r--pkgs/os-specific/linux/kernel/linux-zen.nix30
-rw-r--r--pkgs/os-specific/linux/kernel/mac-nvme-t2.patch283
-rw-r--r--pkgs/os-specific/linux/kernel/mainline.nix27
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix218
-rw-r--r--pkgs/os-specific/linux/kernel/p9-fixes.patch85
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix63
-rw-r--r--pkgs/os-specific/linux/kernel/perf.nix83
-rw-r--r--pkgs/os-specific/linux/kernel/perf/default.nix166
-rw-r--r--pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch13
-rwxr-xr-xpkgs/os-specific/linux/kernel/update-mainline.py130
-rwxr-xr-xpkgs/os-specific/linux/kernel/update-rt.sh1
-rwxr-xr-xpkgs/os-specific/linux/kernel/update-zen.py122
-rwxr-xr-xpkgs/os-specific/linux/kernel/update.sh72
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix56
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix116
-rw-r--r--pkgs/os-specific/linux/kexec-tools/default.nix (renamed from pkgs/os-specific/linux/kexectools/default.nix)24
-rw-r--r--pkgs/os-specific/linux/keyutils/0001-Remove-unused-function-after_eq.patch28
-rw-r--r--pkgs/os-specific/linux/keyutils/default.nix22
-rw-r--r--pkgs/os-specific/linux/klibc/default.nix13
-rw-r--r--pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch15
-rw-r--r--pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix12
-rw-r--r--pkgs/os-specific/linux/kmod-debian-aliases/default.nix2
-rw-r--r--pkgs/os-specific/linux/kmod/darwin.patch135
-rw-r--r--pkgs/os-specific/linux/kmod/default.nix55
-rw-r--r--pkgs/os-specific/linux/kmod/no-name-field.patch24
-rw-r--r--pkgs/os-specific/linux/kmscon/default.nix38
-rw-r--r--pkgs/os-specific/linux/kmscube/default.nix14
-rw-r--r--pkgs/os-specific/linux/ksmbd-tools/0001-skip-installing-example-configuration.patch38
-rw-r--r--pkgs/os-specific/linux/ksmbd-tools/default.nix41
-rw-r--r--pkgs/os-specific/linux/kvdo/default.nix35
-rw-r--r--pkgs/os-specific/linux/kvmfr/default.nix10
-rw-r--r--pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch16
-rw-r--r--pkgs/os-specific/linux/latencytop/default.nix15
-rw-r--r--pkgs/os-specific/linux/ldm/default.nix5
-rw-r--r--pkgs/os-specific/linux/ledger-udev-rules/default.nix6
-rw-r--r--pkgs/os-specific/linux/lenovo-legion/app.nix55
-rw-r--r--pkgs/os-specific/linux/lenovo-legion/default.nix34
-rw-r--r--pkgs/os-specific/linux/libaio/default.nix6
-rw-r--r--pkgs/os-specific/linux/libatasmart/default.nix5
-rw-r--r--pkgs/os-specific/linux/libbpf/0.x.nix54
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix59
-rw-r--r--pkgs/os-specific/linux/libcap-ng/default.nix29
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix38
-rw-r--r--pkgs/os-specific/linux/libcgroup/default.nix11
-rw-r--r--pkgs/os-specific/linux/libevdevc/default.nix5
-rw-r--r--pkgs/os-specific/linux/libfabric/default.nix29
-rw-r--r--pkgs/os-specific/linux/libgestures/default.nix2
-rw-r--r--pkgs/os-specific/linux/libnl-tiny/default.nix28
-rw-r--r--pkgs/os-specific/linux/libnl/default.nix6
-rw-r--r--pkgs/os-specific/linux/libnss-mysql/default.nix30
-rw-r--r--pkgs/os-specific/linux/libnvme/default.nix81
-rw-r--r--pkgs/os-specific/linux/libpsm2/default.nix15
-rw-r--r--pkgs/os-specific/linux/libratbag/default.nix4
-rw-r--r--pkgs/os-specific/linux/libselinux/default.nix42
-rw-r--r--pkgs/os-specific/linux/libsemanage/default.nix19
-rw-r--r--pkgs/os-specific/linux/libsepol/default.nix18
-rw-r--r--pkgs/os-specific/linux/libsmbios/default.nix19
-rw-r--r--pkgs/os-specific/linux/libtraceevent/default.nix33
-rw-r--r--pkgs/os-specific/linux/libtracefs/default.nix63
-rw-r--r--pkgs/os-specific/linux/libvolume_id/default.nix8
-rw-r--r--pkgs/os-specific/linux/libzbc/default.nix38
-rw-r--r--pkgs/os-specific/linux/libzbd/default.nix40
-rw-r--r--pkgs/os-specific/linux/light/default.nix12
-rw-r--r--pkgs/os-specific/linux/lightum/default.nix16
-rw-r--r--pkgs/os-specific/linux/linux-wifi-hotspot/default.nix105
-rw-r--r--pkgs/os-specific/linux/linuxptp/default.nix6
-rw-r--r--pkgs/os-specific/linux/liquidtux/default.nix34
-rw-r--r--pkgs/os-specific/linux/lkrg/default.nix53
-rw-r--r--pkgs/os-specific/linux/lksctp-tools/default.nix7
-rw-r--r--pkgs/os-specific/linux/lm-sensors/default.nix45
-rw-r--r--pkgs/os-specific/linux/lockdep/default.nix8
-rw-r--r--pkgs/os-specific/linux/logitech-udev-rules/default.nix19
-rw-r--r--pkgs/os-specific/linux/lsb-release/lsb_release.sh2
-rw-r--r--pkgs/os-specific/linux/lsirec/default.nix38
-rw-r--r--pkgs/os-specific/linux/lsiutil/default.nix9
-rw-r--r--pkgs/os-specific/linux/lsscsi/default.nix7
-rw-r--r--pkgs/os-specific/linux/lttng-modules/default.nix25
-rw-r--r--pkgs/os-specific/linux/lvm2/2_03.nix4
-rw-r--r--pkgs/os-specific/linux/lvm2/common.nix161
-rw-r--r--pkgs/os-specific/linux/lvm2/default.nix128
-rw-r--r--pkgs/os-specific/linux/lvm2/fix-blkdeactivate.patch51
-rw-r--r--pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch66
-rw-r--r--pkgs/os-specific/linux/lvm2/no-shared.patch46
-rw-r--r--pkgs/os-specific/linux/lxc/default.nix15
-rw-r--r--pkgs/os-specific/linux/lxcfs/default.nix10
-rw-r--r--pkgs/os-specific/linux/macchanger/default.nix2
-rw-r--r--pkgs/os-specific/linux/mba6x_bl/default.nix9
-rw-r--r--pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix7
-rw-r--r--pkgs/os-specific/linux/mbpfan/default.nix6
-rw-r--r--pkgs/os-specific/linux/mceinject/default.nix38
-rw-r--r--pkgs/os-specific/linux/mcelog/default.nix6
-rw-r--r--pkgs/os-specific/linux/mdadm/default.nix12
-rw-r--r--pkgs/os-specific/linux/mdadm/no-self-references.patch30
-rw-r--r--pkgs/os-specific/linux/mdevctl/default.nix42
-rw-r--r--pkgs/os-specific/linux/mdevd/default.nix28
-rw-r--r--pkgs/os-specific/linux/microcode/amd.nix16
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix12
-rw-r--r--pkgs/os-specific/linux/microcode/iucode-tool.nix12
-rw-r--r--pkgs/os-specific/linux/mingetty/default.nix7
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/bash/2.nix157
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix117
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/bash/mksignames-flush.patch10
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix114
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/binutils/deterministic.patch12
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix55
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix117
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix74
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/default.nix229
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix71
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix75
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gawk/common.nix11
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix61
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gawk/mes.nix70
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gawk/no-stamp.patch10
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix140
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix145
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gcc/8.nix141
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix137
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gcc/no-system-headers.patch11
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix60
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnumake/0001-No-impure-bin-sh.patch35
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnumake/0002-remove-impure-dirs.patch40
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnumake/0003-tinycc-support.patch58
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix190
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix82
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix107
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnused/common.nix12
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix63
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnused/mes.nix59
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnutar/latest.nix71
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix65
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix70
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gzip/default.nix58
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom-devtools/default.nix97
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/cp-no-socket.patch84
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix130
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/disable-programs.patch43
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/dont-link-lm.patch44
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/langinfo.patch99
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/meslibc-support.patch322
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/musl.h53
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.c205
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.patch11
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/strcoll.patch73
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h64
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/sysconf.patch77
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/tcc-empty-ar.patch11
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/termios.patch141
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/utime.patch90
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/heirloom/vprintf.patch128
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix49
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix28
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c17
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix237
-rwxr-xr-xpkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh95
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix60
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix39
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix22
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix116
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/musl/always-flush.patch12
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix13
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix81
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix96
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix27
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix49
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix52
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix26
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix58
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix358
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem39
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix29
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem204
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix90
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix32
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix172
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix104
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-duplicate-symbols.patch13
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-static-inside-array.patch21
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix96
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix155
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/static-link.patch10
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/utils.nix60
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix70
-rw-r--r--pkgs/os-specific/linux/miraclecast/default.nix2
-rw-r--r--pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix7
-rw-r--r--pkgs/os-specific/linux/mmc-utils/default.nix30
-rw-r--r--pkgs/os-specific/linux/molly-guard/default.nix4
-rw-r--r--pkgs/os-specific/linux/msr/000-include-sysmacros.patch11
-rw-r--r--pkgs/os-specific/linux/msr/default.nix40
-rw-r--r--pkgs/os-specific/linux/mstflint_access/default.nix40
-rw-r--r--pkgs/os-specific/linux/multipath-tools/default.nix74
-rw-r--r--pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch21
-rw-r--r--pkgs/os-specific/linux/musl-obstack/default.nix4
-rw-r--r--pkgs/os-specific/linux/musl/default.nix51
-rw-r--r--pkgs/os-specific/linux/mwprocapture/default.nix25
-rw-r--r--pkgs/os-specific/linux/mxu11x0/default.nix23
-rw-r--r--pkgs/os-specific/linux/mxu11x0/srcs.nix18
-rw-r--r--pkgs/os-specific/linux/nct6687d/default.nix40
-rw-r--r--pkgs/os-specific/linux/net-tools/default.nix2
-rw-r--r--pkgs/os-specific/linux/net-tools/mptcp.nix21
-rw-r--r--pkgs/os-specific/linux/netatop/default.nix4
-rw-r--r--pkgs/os-specific/linux/new-lg4ff/default.nix36
-rw-r--r--pkgs/os-specific/linux/nfs-utils/default.nix14
-rw-r--r--pkgs/os-specific/linux/nftables/default.nix58
-rw-r--r--pkgs/os-specific/linux/nix-ld/default.nix56
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/_nixos-rebuild165
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/default.nix29
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8468
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh383
-rw-r--r--pkgs/os-specific/linux/nmon/default.nix14
-rw-r--r--pkgs/os-specific/linux/nsncd/default.nix35
-rw-r--r--pkgs/os-specific/linux/nss_ldap/default.nix7
-rw-r--r--pkgs/os-specific/linux/numactl/default.nix6
-rw-r--r--pkgs/os-specific/linux/numad/default.nix12
-rw-r--r--pkgs/os-specific/linux/numatop/default.nix35
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder.sh45
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix143
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix47
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/generic.nix125
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/open.nix46
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/persistenced.nix5
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/settings.nix62
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/vm_operations_struct-fault.patch31
-rw-r--r--pkgs/os-specific/linux/nvidiabl/default.nix3
-rw-r--r--pkgs/os-specific/linux/nvme-cli/default.nix38
-rw-r--r--pkgs/os-specific/linux/ocf-resource-agents/default.nix68
-rw-r--r--pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix6
-rw-r--r--pkgs/os-specific/linux/oddjob/default.nix60
-rw-r--r--pkgs/os-specific/linux/odp-dpdk/default.nix50
-rw-r--r--pkgs/os-specific/linux/open-iscsi/default.nix69
-rw-r--r--pkgs/os-specific/linux/open-isns/default.nix4
-rw-r--r--pkgs/os-specific/linux/opengl/xorg-sys/builder.sh1
-rw-r--r--pkgs/os-specific/linux/opengl/xorg-sys/default.nix3
-rw-r--r--pkgs/os-specific/linux/openrazer/driver.nix10
-rw-r--r--pkgs/os-specific/linux/opensnitch-ebpf/default.nix58
-rw-r--r--pkgs/os-specific/linux/openvswitch/default.nix67
-rw-r--r--pkgs/os-specific/linux/openvswitch/generic.nix126
-rw-r--r--pkgs/os-specific/linux/openvswitch/lts.nix83
-rw-r--r--pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch12
-rw-r--r--pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch274
-rw-r--r--pkgs/os-specific/linux/otpw/default.nix9
-rw-r--r--pkgs/os-specific/linux/oxtools/default.nix36
-rw-r--r--pkgs/os-specific/linux/pam/default.nix45
-rw-r--r--pkgs/os-specific/linux/pam/suid-wrapper-path.patch6
-rw-r--r--pkgs/os-specific/linux/pam_ccreds/default.nix5
-rw-r--r--pkgs/os-specific/linux/pam_dp9ik/default.nix29
-rw-r--r--pkgs/os-specific/linux/pam_gnupg/default.nix4
-rw-r--r--pkgs/os-specific/linux/pam_krb5/default.nix7
-rw-r--r--pkgs/os-specific/linux/pam_ldap/default.nix5
-rw-r--r--pkgs/os-specific/linux/pam_mktemp/default.nix48
-rw-r--r--pkgs/os-specific/linux/pam_mount/default.nix27
-rw-r--r--pkgs/os-specific/linux/pam_mysql/default.nix24
-rw-r--r--pkgs/os-specific/linux/pam_p11/default.nix16
-rw-r--r--pkgs/os-specific/linux/pam_pgsql/default.nix10
-rw-r--r--pkgs/os-specific/linux/pam_rssh/default.nix78
-rw-r--r--pkgs/os-specific/linux/pam_tmpdir/default.nix36
-rw-r--r--pkgs/os-specific/linux/pam_u2f/default.nix6
-rw-r--r--pkgs/os-specific/linux/pam_usb/default.nix17
-rw-r--r--pkgs/os-specific/linux/pam_ussh/default.nix65
-rw-r--r--pkgs/os-specific/linux/pam_ussh/go.mod15
-rw-r--r--pkgs/os-specific/linux/pam_ussh/go.sum22
-rw-r--r--pkgs/os-specific/linux/pax-utils/default.nix44
-rw-r--r--pkgs/os-specific/linux/pcm/default.nix12
-rw-r--r--pkgs/os-specific/linux/pcmciautils/default.nix9
-rw-r--r--pkgs/os-specific/linux/perf-tools/default.nix5
-rw-r--r--pkgs/os-specific/linux/pflask/default.nix37
-rw-r--r--pkgs/os-specific/linux/phc-intel/default.nix3
-rw-r--r--pkgs/os-specific/linux/picoprobe-udev-rules/default.nix32
-rw-r--r--pkgs/os-specific/linux/piper/default.nix17
-rw-r--r--pkgs/os-specific/linux/pipework/default.nix6
-rw-r--r--pkgs/os-specific/linux/pktgen/default.nix40
-rw-r--r--pkgs/os-specific/linux/ply/default.nix17
-rw-r--r--pkgs/os-specific/linux/plymouth/add-runtime-plugin-path.patch67
-rw-r--r--pkgs/os-specific/linux/plymouth/default.nix141
-rw-r--r--pkgs/os-specific/linux/plymouth/dont-create-broken-symlink.patch13
-rw-r--r--pkgs/os-specific/linux/pm-utils/default.nix5
-rw-r--r--pkgs/os-specific/linux/pmount/default.nix3
-rw-r--r--pkgs/os-specific/linux/policycoreutils/default.nix14
-rw-r--r--pkgs/os-specific/linux/pommed-light/default.nix16
-rw-r--r--pkgs/os-specific/linux/power-calibrate/default.nix15
-rw-r--r--pkgs/os-specific/linux/power-profiles-daemon/default.nix71
-rw-r--r--pkgs/os-specific/linux/powercap/default.nix15
-rw-r--r--pkgs/os-specific/linux/powerstat/default.nix25
-rw-r--r--pkgs/os-specific/linux/powertop/default.nix52
-rw-r--r--pkgs/os-specific/linux/pps-tools/default.nix11
-rw-r--r--pkgs/os-specific/linux/prl-tools/default.nix260
-rw-r--r--pkgs/os-specific/linux/procdump/default.nix18
-rw-r--r--pkgs/os-specific/linux/procps-ng/default.nix18
-rw-r--r--pkgs/os-specific/linux/procps-ng/v3-CVE-2023-4016.patch63
-rw-r--r--pkgs/os-specific/linux/projecteur/default.nix52
-rw-r--r--pkgs/os-specific/linux/pscircle/default.nix15
-rw-r--r--pkgs/os-specific/linux/psftools/default.nix4
-rw-r--r--pkgs/os-specific/linux/psmisc/default.nix13
-rw-r--r--pkgs/os-specific/linux/qc71_laptop/default.nix34
-rw-r--r--pkgs/os-specific/linux/qmk-udev-rules/default.nix33
-rw-r--r--pkgs/os-specific/linux/qperf/default.nix43
-rw-r--r--pkgs/os-specific/linux/r8125/default.nix4
-rw-r--r--pkgs/os-specific/linux/r8168/default.nix11
-rw-r--r--pkgs/os-specific/linux/radeontop/default.nix7
-rw-r--r--pkgs/os-specific/linux/rasdaemon/default.nix111
-rw-r--r--pkgs/os-specific/linux/raspberrypi-eeprom/default.nix36
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix57
-rw-r--r--pkgs/os-specific/linux/read-edid/default.nix13
-rw-r--r--pkgs/os-specific/linux/read-edid/fno-common.patch22
-rw-r--r--pkgs/os-specific/linux/reap/default.nix27
-rw-r--r--pkgs/os-specific/linux/reptyr/default.nix26
-rw-r--r--pkgs/os-specific/linux/restool/default.nix52
-rw-r--r--pkgs/os-specific/linux/rewritefs/default.nix10
-rw-r--r--pkgs/os-specific/linux/roccat-tools/default.nix18
-rw-r--r--pkgs/os-specific/linux/rt-tests/default.nix34
-rw-r--r--pkgs/os-specific/linux/rtkit/default.nix12
-rw-r--r--pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix23
-rw-r--r--pkgs/os-specific/linux/rtl8189es/default.nix45
-rw-r--r--pkgs/os-specific/linux/rtl8189fs/default.nix22
-rw-r--r--pkgs/os-specific/linux/rtl8192eu/default.nix8
-rw-r--r--pkgs/os-specific/linux/rtl8723bs/default.nix41
-rw-r--r--pkgs/os-specific/linux/rtl8723ds/default.nix44
-rw-r--r--pkgs/os-specific/linux/rtl8812au/default.nix32
-rw-r--r--pkgs/os-specific/linux/rtl8814au/default.nix14
-rw-r--r--pkgs/os-specific/linux/rtl8821au/default.nix28
-rw-r--r--pkgs/os-specific/linux/rtl8821ce/default.nix24
-rw-r--r--pkgs/os-specific/linux/rtl8821cu/default.nix15
-rw-r--r--pkgs/os-specific/linux/rtl88x2bu/default.nix23
-rw-r--r--pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix28
-rw-r--r--pkgs/os-specific/linux/rtw88/default.nix15
-rw-r--r--pkgs/os-specific/linux/rtw89/default.nix13
-rw-r--r--pkgs/os-specific/linux/ryzenadj/default.nix6
-rw-r--r--pkgs/os-specific/linux/s6-linux-init/default.nix39
-rw-r--r--pkgs/os-specific/linux/s6-linux-utils/default.nix32
-rw-r--r--pkgs/os-specific/linux/sasutils/default.nix28
-rw-r--r--pkgs/os-specific/linux/sch_cake/default.nix35
-rw-r--r--pkgs/os-specific/linux/sd-switch/default.nix17
-rw-r--r--pkgs/os-specific/linux/sdnotify-wrapper/default.nix37
-rw-r--r--pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c176
-rw-r--r--pkgs/os-specific/linux/sdparm/default.nix4
-rw-r--r--pkgs/os-specific/linux/selinux-python/default.nix20
-rw-r--r--pkgs/os-specific/linux/selinux-sandbox/default.nix8
-rw-r--r--pkgs/os-specific/linux/semodule-utils/default.nix10
-rw-r--r--pkgs/os-specific/linux/sepolgen/default.nix24
-rwxr-xr-xpkgs/os-specific/linux/service-wrapper/service-wrapper.sh70
-rw-r--r--pkgs/os-specific/linux/setools/default.nix16
-rw-r--r--pkgs/os-specific/linux/seturgent/default.nix30
-rw-r--r--pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix93
-rw-r--r--pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix27
-rw-r--r--pkgs/os-specific/linux/sgx/psw/default.nix172
-rw-r--r--pkgs/os-specific/linux/sgx/samples/default.nix109
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/default.nix285
-rw-r--r--pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix36
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/default.nix95
-rw-r--r--pkgs/os-specific/linux/sgx/ssl/intel-sgx-ssl-pr-111.patch99
-rw-r--r--pkgs/os-specific/linux/shadow/default.nix107
-rw-r--r--pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch28
-rw-r--r--pkgs/os-specific/linux/sinit/default.nix39
-rw-r--r--pkgs/os-specific/linux/smem/default.nix4
-rw-r--r--pkgs/os-specific/linux/smemstat/default.nix27
-rw-r--r--pkgs/os-specific/linux/spectrum/default.nix18
-rw-r--r--pkgs/os-specific/linux/spectrum/linux/vm.nix25
-rw-r--r--pkgs/os-specific/linux/spectrum/rootfs/default.nix58
-rw-r--r--pkgs/os-specific/linux/spectrum/rootfs/etc/group3
-rw-r--r--pkgs/os-specific/linux/spectrum/rootfs/etc/passwd3
-rw-r--r--pkgs/os-specific/linux/spectrum/rootfs/etc/wayfire/wf-shell-defaults.ini2
-rw-r--r--pkgs/os-specific/linux/spectrum/rootfs/rc-services.nix26
-rw-r--r--pkgs/os-specific/linux/spectrum/rootfs/services.nix28
-rw-r--r--pkgs/os-specific/linux/spectrum/rootfs/stage1.nix44
-rw-r--r--pkgs/os-specific/linux/spectrum/spectrum-vm/default.nix35
-rwxr-xr-xpkgs/os-specific/linux/spectrum/spectrum-vm/spectrum-vm.in71
-rw-r--r--pkgs/os-specific/linux/spectrum/testhost/default.nix212
-rw-r--r--pkgs/os-specific/linux/spectrum/vm/app/default.nix57
-rw-r--r--pkgs/os-specific/linux/spectrum/vm/comp/default.nix73
-rw-r--r--pkgs/os-specific/linux/spectrum/vm/default.nix9
-rw-r--r--pkgs/os-specific/linux/spectrum/vm/net/default.nix165
-rw-r--r--pkgs/os-specific/linux/speedometer/default.nix26
-rw-r--r--pkgs/os-specific/linux/sssd/default.nix77
-rw-r--r--pkgs/os-specific/linux/statifier/default.nix6
-rw-r--r--pkgs/os-specific/linux/switcheroo-control/default.nix4
-rw-r--r--pkgs/os-specific/linux/sydbox/default.nix77
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix118
-rw-r--r--pkgs/os-specific/linux/sysdig/default.upstream8
-rw-r--r--pkgs/os-specific/linux/sysfsutils/default.nix7
-rw-r--r--pkgs/os-specific/linux/sysklogd/default.nix20
-rw-r--r--pkgs/os-specific/linux/syslinux/default.nix112
-rw-r--r--pkgs/os-specific/linux/sysstat/default.nix19
-rw-r--r--pkgs/os-specific/linux/system76-acpi/default.nix6
-rw-r--r--pkgs/os-specific/linux/system76-io/default.nix4
-rw-r--r--pkgs/os-specific/linux/system76-power/default.nix10
-rw-r--r--pkgs/os-specific/linux/system76-scheduler/01-fix-pipewire-paths.kdl8
-rw-r--r--pkgs/os-specific/linux/system76-scheduler/default.nix43
-rw-r--r--pkgs/os-specific/linux/system76/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch19
-rw-r--r--pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch39
-rw-r--r--pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch17
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch (renamed from pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch)63
-rw-r--r--pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch25
-rw-r--r--pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch28
-rw-r--r--pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch31
-rw-r--r--pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch (renamed from pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch)49
-rw-r--r--pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch24
-rw-r--r--pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch (renamed from pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch)62
-rw-r--r--pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch32
-rw-r--r--pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch (renamed from pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch)11
-rw-r--r--pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch (renamed from pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch)17
-rw-r--r--pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch (renamed from pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch)19
-rw-r--r--pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch42
-rw-r--r--pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch23
-rw-r--r--pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch (renamed from pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch)12
-rw-r--r--pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch (renamed from pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch)11
-rw-r--r--pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch27
-rw-r--r--pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch (renamed from pkgs/os-specific/linux/systemd/0019-pkg-config-derive-prefix-from-prefix.patch)15
-rw-r--r--pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch39
-rw-r--r--pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch27
-rw-r--r--pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch33
-rw-r--r--pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch26
-rw-r--r--pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch41
-rw-r--r--pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch45
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix694
-rw-r--r--pkgs/os-specific/linux/sysvinit/default.nix13
-rw-r--r--pkgs/os-specific/linux/tailor-gui/default.nix60
-rw-r--r--pkgs/os-specific/linux/targetcli/default.nix10
-rw-r--r--pkgs/os-specific/linux/tbs/default.nix5
-rw-r--r--pkgs/os-specific/linux/teensy-udev-rules/default.nix34
-rw-r--r--pkgs/os-specific/linux/teensy-udev-rules/teensy.rules39
-rw-r--r--pkgs/os-specific/linux/tiptop/default.nix23
-rw-r--r--pkgs/os-specific/linux/tiscamera/0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch25
-rw-r--r--pkgs/os-specific/linux/tiscamera/0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch70
-rw-r--r--pkgs/os-specific/linux/tiscamera/0001-udev-rules-fix-install-location.patch25
-rw-r--r--pkgs/os-specific/linux/tiscamera/default.nix127
-rw-r--r--pkgs/os-specific/linux/tmon/default.nix3
-rw-r--r--pkgs/os-specific/linux/tomb/default.nix69
-rw-r--r--pkgs/os-specific/linux/tp_smapi/default.nix27
-rw-r--r--pkgs/os-specific/linux/tpacpi-bat/default.nix6
-rw-r--r--pkgs/os-specific/linux/trace-cmd/default.nix50
-rw-r--r--pkgs/os-specific/linux/trace-cmd/fix-Makefiles.patch35
-rw-r--r--pkgs/os-specific/linux/trace-cmd/kernelshark.nix39
-rw-r--r--pkgs/os-specific/linux/trelay/Makefile14
-rw-r--r--pkgs/os-specific/linux/trelay/default.nix46
-rw-r--r--pkgs/os-specific/linux/trinity/default.nix12
-rw-r--r--pkgs/os-specific/linux/tuigreet/default.nix26
-rw-r--r--pkgs/os-specific/linux/tunctl/default.nix10
-rw-r--r--pkgs/os-specific/linux/tuxedo-keyboard/default.nix44
-rw-r--r--pkgs/os-specific/linux/tuxedo-rs/default.nix47
-rw-r--r--pkgs/os-specific/linux/uclibc/default.nix114
-rw-r--r--pkgs/os-specific/linux/udisks-glue/default.nix25
-rw-r--r--pkgs/os-specific/linux/udisks/1-default.nix46
-rw-r--r--pkgs/os-specific/linux/udisks/2-default.nix37
-rw-r--r--pkgs/os-specific/linux/udisks/fix-paths.patch102
-rw-r--r--pkgs/os-specific/linux/udisks/force-path.patch14
-rw-r--r--pkgs/os-specific/linux/udisks/glibc.patch25
-rw-r--r--pkgs/os-specific/linux/udisks/no-pci-db.patch13
-rw-r--r--pkgs/os-specific/linux/udisks/purity.patch57
-rw-r--r--pkgs/os-specific/linux/uhk-agent/default.nix73
-rw-r--r--pkgs/os-specific/linux/uhk-udev-rules/default.nix20
-rw-r--r--pkgs/os-specific/linux/ulogd/default.nix78
-rw-r--r--pkgs/os-specific/linux/ultrablue-server/default.nix31
-rw-r--r--pkgs/os-specific/linux/unscd/0001-adjust-socket-paths-for-nixos.patch41
-rw-r--r--pkgs/os-specific/linux/unscd/default.nix76
-rw-r--r--pkgs/os-specific/linux/unstick/default.nix6
-rw-r--r--pkgs/os-specific/linux/upower/default.nix195
-rw-r--r--pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch12
-rw-r--r--pkgs/os-specific/linux/upower/installed-tests-path.patch56
-rw-r--r--pkgs/os-specific/linux/usb-blaster-udev-rules/default.nix26
-rw-r--r--pkgs/os-specific/linux/usb-blaster-udev-rules/usb-blaster.rules8
-rw-r--r--pkgs/os-specific/linux/usbguard-notifier/default.nix44
-rw-r--r--pkgs/os-specific/linux/usbguard/default.nix19
-rw-r--r--pkgs/os-specific/linux/usbip/default.nix6
-rw-r--r--pkgs/os-specific/linux/usbrelay/daemon.nix39
-rw-r--r--pkgs/os-specific/linux/usbrelay/default.nix38
-rw-r--r--pkgs/os-specific/linux/usbrelay/python.nix16
-rw-r--r--pkgs/os-specific/linux/usbrelay/test.nix64
-rw-r--r--pkgs/os-specific/linux/usbtop/default.nix2
-rw-r--r--pkgs/os-specific/linux/usbutils/default.nix10
-rw-r--r--pkgs/os-specific/linux/usermount/default.nix14
-rw-r--r--pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch277
-rw-r--r--pkgs/os-specific/linux/util-linux/default.nix112
-rw-r--r--pkgs/os-specific/linux/uvcdynctrl/default.nix2
-rw-r--r--pkgs/os-specific/linux/v4l-utils/default.nix18
-rw-r--r--pkgs/os-specific/linux/v4l2-relayd/default.nix47
-rw-r--r--pkgs/os-specific/linux/v4l2-relayd/upstream-v4l2loopback-compatibility.patch16
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/default.nix25
-rw-r--r--pkgs/os-specific/linux/v4l2loopback/revert-pr518.patch55
-rw-r--r--pkgs/os-specific/linux/v86d/default.nix25
-rw-r--r--pkgs/os-specific/linux/vdo/default.nix65
-rw-r--r--pkgs/os-specific/linux/veikk-linux-driver/default.nix6
-rw-r--r--pkgs/os-specific/linux/vendor-reset/default.nix19
-rw-r--r--pkgs/os-specific/linux/virtio_vmmci/default.nix37
-rw-r--r--pkgs/os-specific/linux/virtualbox/default.nix3
-rw-r--r--pkgs/os-specific/linux/vm-tools/default.nix16
-rw-r--r--pkgs/os-specific/linux/vmm_clock/default.nix38
-rw-r--r--pkgs/os-specific/linux/vmware/default.nix47
-rw-r--r--pkgs/os-specific/linux/waydroid/default.nix88
-rw-r--r--pkgs/os-specific/linux/wireguard/default.nix15
-rw-r--r--pkgs/os-specific/linux/wireless-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/wiringpi/default.nix84
-rw-r--r--pkgs/os-specific/linux/wlgreet/default.nix26
-rw-r--r--pkgs/os-specific/linux/wooting-udev-rules/default.nix6
-rw-r--r--pkgs/os-specific/linux/wooting-udev-rules/wooting.rules91
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/Use-unique-IDs-for-networks-and-credentials.patch32
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/default.nix118
-rw-r--r--pkgs/os-specific/linux/wpa_supplicant/gui.nix14
-rw-r--r--pkgs/os-specific/linux/x86_energy_perf_policy/default.nix3
-rw-r--r--pkgs/os-specific/linux/x86info/default.nix48
-rw-r--r--pkgs/os-specific/linux/xf86-input-wacom/default.nix8
-rw-r--r--pkgs/os-specific/linux/xf86-video-nested/default.nix9
-rw-r--r--pkgs/os-specific/linux/xmm7360-pci/default.nix28
-rw-r--r--pkgs/os-specific/linux/xone/default.nix48
-rw-r--r--pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix83
-rw-r--r--pkgs/os-specific/linux/xp-pen-drivers/g430/default.nix39
-rw-r--r--pkgs/os-specific/linux/xpadneo/default.nix32
-rw-r--r--pkgs/os-specific/linux/xsensors/default.nix2
-rw-r--r--pkgs/os-specific/linux/xsos/default.nix52
-rw-r--r--pkgs/os-specific/linux/zenmonitor/default.nix12
-rw-r--r--pkgs/os-specific/linux/zenpower/default.nix21
-rw-r--r--pkgs/os-specific/linux/zenstates/default.nix2
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix217
-rw-r--r--pkgs/os-specific/linux/zfs/generic.nix222
-rw-r--r--pkgs/os-specific/linux/zfs/stable.nix28
-rw-r--r--pkgs/os-specific/linux/zfs/unstable.nix32
-rw-r--r--pkgs/os-specific/linux/zsa-udev-rules/default.nix11
869 files changed, 35682 insertions, 16340 deletions
diff --git a/pkgs/os-specific/linux/915resolution/default.nix b/pkgs/os-specific/linux/915resolution/default.nix
index 57f8ba0d33b..b67d737034e 100644
--- a/pkgs/os-specific/linux/915resolution/default.nix
+++ b/pkgs/os-specific/linux/915resolution/default.nix
@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  name = "915resolution-0.5.3";
+  pname = "915resolution";
+  version = "0.5.3";
 
   src = fetchurl {
-    url = "http://915resolution.mango-lang.org/${name}.tar.gz";
+    url = "http://915resolution.mango-lang.org/915resolution-${version}.tar.gz";
     sha256 = "0hmmy4kkz3x6yigz6hk99416ybznd67dpjaxap50nhay9f1snk5n";
   };
 
diff --git a/pkgs/os-specific/linux/9ptls/default.nix b/pkgs/os-specific/linux/9ptls/default.nix
new file mode 100644
index 00000000000..20fa779ecf6
--- /dev/null
+++ b/pkgs/os-specific/linux/9ptls/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, stdenv
+, tlsclient
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  inherit (tlsclient) src version enableParallelBuilding;
+  pname = "9ptls";
+
+  strictDeps = true;
+
+  buildFlags = [ "mount.9ptls" ];
+  installFlags = [ "PREFIX=$(out)" "SBIN=$(out)/bin" ];
+  installTargets = "mount.9ptls.install";
+
+  meta = with lib; {
+    description = "mount.9ptls mount helper";
+    longDescription = ''
+      mount.9ptls wraps the v9fs mount type in a dp9ik authenticated
+      tls tunnel using tlsclient.
+    '';
+    homepage = "https://git.sr.ht/~moody/tlsclient";
+    license = licenses.mit;
+    maintainers = with maintainers; [ moody ];
+    mainProgram = "mount.9ptls";
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/os-specific/linux/acpi-call/default.nix b/pkgs/os-specific/linux/acpi-call/default.nix
index f986ed790a1..b84ecd21293 100644
--- a/pkgs/os-specific/linux/acpi-call/default.nix
+++ b/pkgs/os-specific/linux/acpi-call/default.nix
@@ -2,21 +2,21 @@
 
 stdenv.mkDerivation rec {
   pname = "acpi-call";
-  version = "1.2.1";
+  version = "1.2.2";
   name = "${pname}-${version}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "acpi_call";
     rev = "v${version}";
-    sha256 = "0mr4rjbv6fj4phf038addrgv32940bphghw2v9n1z4awvw7wzkbg";
+    sha256 = "1s7h9y3adyfhw7cjldlfmid79lrwz3vqlvziw9nwd6x5qdj4w9vp";
   };
 
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
diff --git a/pkgs/os-specific/linux/acpid/default.nix b/pkgs/os-specific/linux/acpid/default.nix
index d28ff447681..8f981ec401b 100644
--- a/pkgs/os-specific/linux/acpid/default.nix
+++ b/pkgs/os-specific/linux/acpid/default.nix
@@ -1,23 +1,16 @@
 { lib, stdenv, fetchurl, autoreconfHook }:
 
 stdenv.mkDerivation rec {
-  name = "acpid-2.0.32";
+  pname = "acpid";
+  version = "2.0.34";
 
   src = fetchurl {
-    url = "mirror://sourceforge/acpid2/${name}.tar.xz";
-    sha256 = "0zhmxnhnhg4v1viw82yjr22kram6k5k1ixznhayk8cnw7q5x7lpj";
+    url = "mirror://sourceforge/acpid2/acpid-${version}.tar.xz";
+    sha256 = "sha256-LQlcjPy8hHyux0bWLNyNC/8ewbxy73xnTHIeBNpqszM=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  # remove when https://sourceforge.net/p/acpid2/code/merge-requests/1/ is merged
-  postPatch = ''
-    substituteInPlace configure.ac \
-      --replace "AC_FUNC_MALLOC" "" \
-      --replace "AC_FUNC_REALLOC" "" \
-      --replace "strrchr strtol" "strrchr strtol malloc realloc"
-  '';
-
   meta = with lib; {
     homepage = "https://sourceforge.net/projects/acpid2/";
     description = "A daemon for delivering ACPI events to userspace programs";
diff --git a/pkgs/os-specific/linux/acpitool/default.nix b/pkgs/os-specific/linux/acpitool/default.nix
index 4a3d1a36bd7..d494e95e3db 100644
--- a/pkgs/os-specific/linux/acpitool/default.nix
+++ b/pkgs/os-specific/linux/acpitool/default.nix
@@ -7,10 +7,11 @@ let
    };
 
 in stdenv.mkDerivation rec {
-  name = "acpitool-0.5.1";
+  pname = "acpitool";
+  version = "0.5.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/acpitool/${name}.tar.bz2";
+    url = "mirror://sourceforge/acpitool/acpitool-${version}.tar.bz2";
     sha256 = "004fb6cd43102918b6302cf537a2db7ceadda04aef2e0906ddf230f820dad34f";
   };
 
diff --git a/pkgs/os-specific/linux/adcli/default.nix b/pkgs/os-specific/linux/adcli/default.nix
new file mode 100644
index 00000000000..66e017437f9
--- /dev/null
+++ b/pkgs/os-specific/linux/adcli/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, openldap
+, libkrb5
+, libxslt
+, autoreconfHook
+, pkg-config
+, cyrus_sasl
+, util-linux
+, xmlto
+, docbook_xsl
+, docbook_xml_dtd_43
+}:
+
+stdenv.mkDerivation rec {
+  pname = "adcli";
+  version = "0.9.2";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "realmd";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-dipNKlIdc1DpXLg/YJjUxZlNoMFy+rt8Y/+AfWFA4dE=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    docbook_xsl
+    util-linux
+    xmlto
+  ];
+
+  buildInputs = [
+    openldap
+    libkrb5
+    libxslt
+    cyrus_sasl
+  ];
+
+  configureFlags = [ "--disable-debug" ];
+
+  postPatch = ''
+    substituteInPlace tools/Makefile.am \
+      --replace 'sbin_PROGRAMS' 'bin_PROGRAMS'
+
+    substituteInPlace doc/Makefile.am \
+        --replace 'http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl' \
+                  '${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl'
+
+    function patch_docbook() {
+      substituteInPlace $1 \
+        --replace "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" \
+                  "${docbook_xml_dtd_43}/xml/dtd/docbook/docbookx.dtd"
+    }
+    patch_docbook doc/adcli.xml
+    patch_docbook doc/adcli-devel.xml
+    patch_docbook doc/adcli-docs.xml
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.freedesktop.org/software/realmd/adcli/adcli.html";
+    description = "A helper library and tools for Active Directory client operations.";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ SohamG anthonyroussel ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/afuse/default.nix b/pkgs/os-specific/linux/afuse/default.nix
index 75c44e11172..6d8bb81b99c 100644
--- a/pkgs/os-specific/linux/afuse/default.nix
+++ b/pkgs/os-specific/linux/afuse/default.nix
@@ -1,11 +1,14 @@
-{ lib, stdenv, fetchurl, pkg-config, autoreconfHook, fuse }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook, fuse }:
 
-stdenv.mkDerivation {
-  name = "afuse-0.4.1";
+stdenv.mkDerivation rec {
+  pname = "afuse";
+  version = "0.5.0";
 
-  src = fetchurl {
-    url = "https://github.com/pcarrier/afuse/archive/v0.4.1.tar.gz";
-    sha256 = "1sfhicmxppkvdd4z9klfn63snb71gr9hff6xij1gzk94xg6m0ycc";
+  src = fetchFromGitHub {
+    owner = "pcarrier";
+    repo = "afuse";
+    rev = "v${version}";
+    sha256 = "sha256-KpysJRvDx+12BSl9pIGRqbJAM4W1NbzxMgDycGCr2RM=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/os-specific/linux/akvcam/default.nix b/pkgs/os-specific/linux/akvcam/default.nix
index 815dc6a2ee3..d2b24855b0b 100644
--- a/pkgs/os-specific/linux/akvcam/default.nix
+++ b/pkgs/os-specific/linux/akvcam/default.nix
@@ -1,32 +1,34 @@
-{ lib, stdenv, fetchFromGitHub, kernel, qmake }:
+{ lib, stdenv, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
   pname = "akvcam";
-  version = "1.2.0";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "webcamoid";
     repo = "akvcam";
     rev = version;
-    sha256 = "0r5xg7pz0wl6pq5029rpzm9fn978vq0md31xjkp2amny7rrgxw72";
+    sha256 = "sha256-zvMPwgItp1bTq64DZcUbYls60XhgufOeEKaAoAFf64M=";
   };
+  sourceRoot = "${src.name}/src";
 
-  nativeBuildInputs = [ qmake ];
-  dontWrapQtApps = true;
-
-  qmakeFlags = [
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
   installPhase = ''
-    install -m644 -b -D src/akvcam.ko $out/lib/modules/${kernel.modDirVersion}/akvcam.ko
+    install -m644 -b -D akvcam.ko $out/lib/modules/${kernel.modDirVersion}/akvcam.ko
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Virtual camera driver for Linux";
     homepage = "https://github.com/webcamoid/akvcam";
     maintainers = with maintainers; [ freezeboy ];
     platforms = platforms.linux;
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
+    broken = kernel.kernelAtLeast "5.18";
   };
 }
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-firmware/cross.patch b/pkgs/os-specific/linux/alsa-project/alsa-firmware/cross.patch
deleted file mode 100644
index 989ccea2b98..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-firmware/cross.patch
+++ /dev/null
@@ -1,347 +0,0 @@
---- a/hdsploader/Makefile.am	2015-02-26 20:36:03.000000000 +0800
-+++ b/hdsploader/Makefile.am	2019-06-28 00:43:41.557803832 +0800
-@@ -32,5 +32,14 @@
- 	     tobin.c
- CLEANFILES = $(dsp_hex_files)
- 
--$(dsp_hex_files): tobin
--	./tobin
-+LINK_FOR_BUILD.c = $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $(TARGET_ARCH_FOR_BUILD)
-+
-+$(tobin_OBJECTS) : CC=$(CC_FOR_BUILD)
-+$(tobin_OBJECTS) : CFLAGS=$(CFLAGS_FOR_BUILD)
-+$(tobin_OBJECTS) : CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
-+
-+tobin$(BUILD_EXEEXT): $(tobin_OBJECTS)
-+	$(LINK_FOR_BUILD.c) $^ $(LOADLIBES_FOR_BUILD) $(LDLIBS_FOR_BUILD) -o $@
-+
-+$(dsp_hex_files): tobin$(BUILD_EXEEXT)
-+	./$<
---- a/m4/ax_prog_cc_for_build.m4	2019-06-27 15:50:02.274134717 +0800
-+++ b/m4/ax_prog_cc_for_build.m4	2019-06-28 01:32:45.088117432 +0800
-@@ -0,0 +1,125 @@
-+# ===========================================================================
-+#   https://www.gnu.org/software/autoconf-archive/ax_prog_cc_for_build.html
-+# ===========================================================================
-+#
-+# SYNOPSIS
-+#
-+#   AX_PROG_CC_FOR_BUILD
-+#
-+# DESCRIPTION
-+#
-+#   This macro searches for a C compiler that generates native executables,
-+#   that is a C compiler that surely is not a cross-compiler. This can be
-+#   useful if you have to generate source code at compile-time like for
-+#   example GCC does.
-+#
-+#   The macro sets the CC_FOR_BUILD and CPP_FOR_BUILD macros to anything
-+#   needed to compile or link (CC_FOR_BUILD) and preprocess (CPP_FOR_BUILD).
-+#   The value of these variables can be overridden by the user by specifying
-+#   a compiler with an environment variable (like you do for standard CC).
-+#
-+#   It also sets BUILD_EXEEXT and BUILD_OBJEXT to the executable and object
-+#   file extensions for the build platform, and GCC_FOR_BUILD to `yes' if
-+#   the compiler we found is GCC. All these variables but GCC_FOR_BUILD are
-+#   substituted in the Makefile.
-+#
-+# LICENSE
-+#
-+#   Copyright (c) 2008 Paolo Bonzini <bonzini@gnu.org>
-+#
-+#   Copying and distribution of this file, with or without modification, are
-+#   permitted in any medium without royalty provided the copyright notice
-+#   and this notice are preserved. This file is offered as-is, without any
-+#   warranty.
-+
-+#serial 9
-+
-+AU_ALIAS([AC_PROG_CC_FOR_BUILD], [AX_PROG_CC_FOR_BUILD])
-+AC_DEFUN([AX_PROG_CC_FOR_BUILD], [dnl
-+AC_REQUIRE([AC_PROG_CC])dnl
-+AC_REQUIRE([AC_PROG_CPP])dnl
-+AC_REQUIRE([AC_EXEEXT])dnl
-+AC_REQUIRE([AC_CANONICAL_HOST])dnl
-+
-+dnl Use the standard macros, but make them use other variable names
-+dnl
-+pushdef([ac_cv_prog_CPP], ac_cv_build_prog_CPP)dnl
-+pushdef([ac_cv_prog_gcc], ac_cv_build_prog_gcc)dnl
-+pushdef([ac_cv_prog_cc_works], ac_cv_build_prog_cc_works)dnl
-+pushdef([ac_cv_prog_cc_cross], ac_cv_build_prog_cc_cross)dnl
-+pushdef([ac_cv_prog_cc_g], ac_cv_build_prog_cc_g)dnl
-+pushdef([ac_cv_exeext], ac_cv_build_exeext)dnl
-+pushdef([ac_cv_objext], ac_cv_build_objext)dnl
-+pushdef([ac_exeext], ac_build_exeext)dnl
-+pushdef([ac_objext], ac_build_objext)dnl
-+pushdef([CC], CC_FOR_BUILD)dnl
-+pushdef([CPP], CPP_FOR_BUILD)dnl
-+pushdef([CFLAGS], CFLAGS_FOR_BUILD)dnl
-+pushdef([CPPFLAGS], CPPFLAGS_FOR_BUILD)dnl
-+pushdef([LDFLAGS], LDFLAGS_FOR_BUILD)dnl
-+pushdef([host], build)dnl
-+pushdef([host_alias], build_alias)dnl
-+pushdef([host_cpu], build_cpu)dnl
-+pushdef([host_vendor], build_vendor)dnl
-+pushdef([host_os], build_os)dnl
-+pushdef([ac_cv_host], ac_cv_build)dnl
-+pushdef([ac_cv_host_alias], ac_cv_build_alias)dnl
-+pushdef([ac_cv_host_cpu], ac_cv_build_cpu)dnl
-+pushdef([ac_cv_host_vendor], ac_cv_build_vendor)dnl
-+pushdef([ac_cv_host_os], ac_cv_build_os)dnl
-+pushdef([ac_cpp], ac_build_cpp)dnl
-+pushdef([ac_compile], ac_build_compile)dnl
-+pushdef([ac_link], ac_build_link)dnl
-+
-+save_cross_compiling=$cross_compiling
-+save_ac_tool_prefix=$ac_tool_prefix
-+cross_compiling=no
-+ac_tool_prefix=
-+
-+AC_PROG_CC
-+AC_PROG_CPP
-+AC_EXEEXT
-+
-+ac_tool_prefix=$save_ac_tool_prefix
-+cross_compiling=$save_cross_compiling
-+
-+dnl Restore the old definitions
-+dnl
-+popdef([ac_link])dnl
-+popdef([ac_compile])dnl
-+popdef([ac_cpp])dnl
-+popdef([ac_cv_host_os])dnl
-+popdef([ac_cv_host_vendor])dnl
-+popdef([ac_cv_host_cpu])dnl
-+popdef([ac_cv_host_alias])dnl
-+popdef([ac_cv_host])dnl
-+popdef([host_os])dnl
-+popdef([host_vendor])dnl
-+popdef([host_cpu])dnl
-+popdef([host_alias])dnl
-+popdef([host])dnl
-+popdef([LDFLAGS])dnl
-+popdef([CPPFLAGS])dnl
-+popdef([CFLAGS])dnl
-+popdef([CPP])dnl
-+popdef([CC])dnl
-+popdef([ac_objext])dnl
-+popdef([ac_exeext])dnl
-+popdef([ac_cv_objext])dnl
-+popdef([ac_cv_exeext])dnl
-+popdef([ac_cv_prog_cc_g])dnl
-+popdef([ac_cv_prog_cc_cross])dnl
-+popdef([ac_cv_prog_cc_works])dnl
-+popdef([ac_cv_prog_gcc])dnl
-+popdef([ac_cv_prog_CPP])dnl
-+
-+dnl Finally, set Makefile variables
-+dnl
-+BUILD_EXEEXT=$ac_build_exeext
-+BUILD_OBJEXT=$ac_build_objext
-+AC_SUBST(BUILD_EXEEXT)dnl
-+AC_SUBST(BUILD_OBJEXT)dnl
-+AC_SUBST([CFLAGS_FOR_BUILD])dnl
-+AC_SUBST([CPPFLAGS_FOR_BUILD])dnl
-+AC_SUBST([LDFLAGS_FOR_BUILD])dnl
-+])
---- a/configure.ac	2019-06-27 23:58:31.045413144 +0800
-+++ b/configure.ac	2019-06-28 01:45:36.511771656 +0800
-@@ -1,6 +1,8 @@
- AC_PREREQ(2.59)
- AC_INIT(alsa-firmware, 1.0.29)
-+AC_CONFIG_MACRO_DIR([m4])
- AC_PROG_CC
-+AC_PROG_CC_FOR_BUILD
- AC_PROG_INSTALL
- AC_PROG_LN_S
- AC_HEADER_STDC
---- a/vxloader/Makefile.am	2015-02-26 20:36:03.000000000 +0800
-+++ b/vxloader/Makefile.am	2019-06-28 01:55:19.525947146 +0800
-@@ -43,5 +43,14 @@
- hotplugfw_DATA = 
- endif
- 
--%.xlx: %.rbt toxlx
--	./toxlx < $< > $@
-+LINK_FOR_BUILD.c = $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $(TARGET_ARCH_FOR_BUILD)
-+
-+$(toxlx_OBJECTS) : CC=$(CC_FOR_BUILD)
-+$(toxlx_OBJECTS) : CFLAGS=$(CFLAGS_FOR_BUILD)
-+$(toxlx_OBJECTS) : CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
-+
-+toxlx$(BUILD_EXEEXT): $(toxlx_OBJECTS)
-+	$(LINK_FOR_BUILD.c) $^ $(LOADLIBES_FOR_BUILD) $(LDLIBS_FOR_BUILD) -o $@
-+
-+%.xlx: %.rbt toxlx$(BUILD_EXEEXT)
-+	./toxlx$(BUILD_EXEEXT) < $< > $@
---- a/echoaudio/Makefile.am	2015-02-26 20:36:03.000000000 +0800
-+++ b/echoaudio/Makefile.am	2019-06-28 02:00:00.579426080 +0800
-@@ -74,33 +74,42 @@
- hotplugfw_DATA = 
- endif
- 
--$(firmware_files): fw_writer
--	./fw_writer DSP/LoaderDSP.c loader_dsp.fw
--	./fw_writer DSP/Darla20DSP.c darla20_dsp.fw
--	./fw_writer DSP/Gina20DSP.c gina20_dsp.fw
--	./fw_writer DSP/Layla20DSP.c layla20_dsp.fw
--	./fw_writer ASIC/LaylaASIC.c layla20_asic.fw
--	./fw_writer DSP/Darla24DSP.c darla24_dsp.fw
--	./fw_writer DSP/Gina24DSP.c gina24_301_dsp.fw
--	./fw_writer ASIC/Gina24ASIC.c gina24_301_asic.fw
--	./fw_writer DSP/Gina24_361DSP.c gina24_361_dsp.fw
--	./fw_writer ASIC/Gina24ASIC_361.c gina24_361_asic.fw
--	./fw_writer DSP/Layla24DSP.c layla24_dsp.fw
--	./fw_writer ASIC/Layla24_1ASIC.c layla24_1_asic.fw
--	./fw_writer ASIC/Layla24_2A_ASIC.c layla24_2A_asic.fw
--	./fw_writer ASIC/Layla24_2S_ASIC.c layla24_2S_asic.fw
--	./fw_writer DSP/MonaDSP.c mona_301_dsp.fw
--	./fw_writer ASIC/Mona1ASIC48.c mona_301_1_asic_48.fw
--	./fw_writer ASIC/Mona1ASIC96.c mona_301_1_asic_96.fw
--	./fw_writer DSP/Mona361DSP.c mona_361_dsp.fw
--	./fw_writer ASIC/Mona1ASIC48_361.c mona_361_1_asic_48.fw
--	./fw_writer ASIC/Mona1ASIC96_361.c mona_361_1_asic_96.fw
--	./fw_writer ASIC/Mona2ASIC.c mona_2_asic.fw
--	./fw_writer DSP/MiaDSP.c mia_dsp.fw
--	./fw_writer DSP/Echo3gDSP.c echo3g_dsp.fw
--	./fw_writer ASIC/3G_ASIC.c 3g_asic.fw
--	./fw_writer DSP/IndigoDSP.c indigo_dsp.fw
--	./fw_writer DSP/IndigoIODSP.c indigo_io_dsp.fw
--	./fw_writer DSP/IndigoIOxDSP.c indigo_iox_dsp.fw
--	./fw_writer DSP/IndigoDJDSP.c indigo_dj_dsp.fw
--	./fw_writer DSP/IndigoDJxDSP.c indigo_djx_dsp.fw
-+LINK_FOR_BUILD.c = $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $(TARGET_ARCH_FOR_BUILD)
-+
-+$(fw_writer_OBJECTS) : CC=$(CC_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CFLAGS=$(CFLAGS_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
-+
-+fw_writer$(BUILD_EXEEXT): $(tobin_OBJECTS)
-+	$(LINK_FOR_BUILD.c) $^ $(LOADLIBES_FOR_BUILD) $(LDLIBS_FOR_BUILD) -o $@
-+
-+$(firmware_files): fw_writer$(BUILD_EXEEXT)
-+	./fw_writer$(BUILD_EXEEXT) DSP/LoaderDSP.c loader_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Darla20DSP.c darla20_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Gina20DSP.c gina20_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Layla20DSP.c layla20_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/LaylaASIC.c layla20_asic.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Darla24DSP.c darla24_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Gina24DSP.c gina24_301_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Gina24ASIC.c gina24_301_asic.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Gina24_361DSP.c gina24_361_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Gina24ASIC_361.c gina24_361_asic.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Layla24DSP.c layla24_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Layla24_1ASIC.c layla24_1_asic.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Layla24_2A_ASIC.c layla24_2A_asic.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Layla24_2S_ASIC.c layla24_2S_asic.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/MonaDSP.c mona_301_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Mona1ASIC48.c mona_301_1_asic_48.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Mona1ASIC96.c mona_301_1_asic_96.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Mona361DSP.c mona_361_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Mona1ASIC48_361.c mona_361_1_asic_48.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Mona1ASIC96_361.c mona_361_1_asic_96.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/Mona2ASIC.c mona_2_asic.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/MiaDSP.c mia_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/Echo3gDSP.c echo3g_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) ASIC/3G_ASIC.c 3g_asic.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/IndigoDSP.c indigo_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/IndigoIODSP.c indigo_io_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/IndigoIOxDSP.c indigo_iox_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/IndigoDJDSP.c indigo_dj_dsp.fw
-+	./fw_writer$(BUILD_EXEEXT) DSP/IndigoDJxDSP.c indigo_djx_dsp.fw
---- a/emu/Makefile.am	2015-02-26 20:36:03.000000000 +0800
-+++ b/emu/Makefile.am	2019-06-28 02:01:37.856710042 +0800
-@@ -22,5 +22,14 @@
- hotplugfw_DATA = 
- endif
- 
--$(firmware_files): fw_writer
--	./fw_writer
-+LINK_FOR_BUILD.c = $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $(TARGET_ARCH_FOR_BUILD)
-+
-+$(fw_writer_OBJECTS) : CC=$(CC_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CFLAGS=$(CFLAGS_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
-+
-+fw_writer$(BUILD_EXEEXT): $(tobin_OBJECTS)
-+	$(LINK_FOR_BUILD.c) $^ $(LOADLIBES_FOR_BUILD) $(LDLIBS_FOR_BUILD) -o $@
-+
-+$(firmware_files): fw_writer$(BUILD_EXEEXT)
-+	./fw_writer$(BUILD_EXEEXT)
---- a/maestro3/Makefile.am	2015-02-26 20:36:03.000000000 +0800
-+++ b/maestro3/Makefile.am	2019-06-28 02:03:13.704828106 +0800
-@@ -17,5 +17,14 @@
- hotplugfw_DATA =
- endif
- 
--$(firmware_files): fw_writer
--	./fw_writer
-+LINK_FOR_BUILD.c = $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $(TARGET_ARCH_FOR_BUILD)
-+
-+$(fw_writer_OBJECTS) : CC=$(CC_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CFLAGS=$(CFLAGS_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
-+
-+fw_writer$(BUILD_EXEEXT): $(tobin_OBJECTS)
-+	$(LINK_FOR_BUILD.c) $^ $(LOADLIBES_FOR_BUILD) $(LDLIBS_FOR_BUILD) -o $@
-+
-+$(firmware_files): fw_writer$(BUILD_EXEEXT)
-+	./fw_writer$(BUILD_EXEEXT)
---- a/sb16/Makefile.am	2015-02-26 20:36:03.000000000 +0800
-+++ b/sb16/Makefile.am	2019-06-28 02:04:37.121743871 +0800
-@@ -18,5 +18,14 @@
- hotplugfw_DATA =
- endif
- 
--$(firmware_files): fw_writer
--	./fw_writer
-+LINK_FOR_BUILD.c = $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $(TARGET_ARCH_FOR_BUILD)
-+
-+$(fw_writer_OBJECTS) : CC=$(CC_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CFLAGS=$(CFLAGS_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
-+
-+fw_writer$(BUILD_EXEEXT): $(tobin_OBJECTS)
-+	$(LINK_FOR_BUILD.c) $^ $(LOADLIBES_FOR_BUILD) $(LDLIBS_FOR_BUILD) -o $@
-+
-+$(firmware_files): fw_writer$(BUILD_EXEEXT)
-+	./fw_writer$(BUILD_EXEEXT)
---- a/wavefront/Makefile.am	2019-06-28 02:07:27.003727160 +0800
-+++ b/wavefront/Makefile.am	2019-06-28 02:07:46.477947626 +0800
-@@ -17,5 +17,14 @@
- hotplugfw_DATA =
- endif
- 
--$(firmware_files): fw_writer
--	./fw_writer
-+LINK_FOR_BUILD.c = $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $(TARGET_ARCH_FOR_BUILD)
-+
-+$(fw_writer_OBJECTS) : CC=$(CC_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CFLAGS=$(CFLAGS_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
-+
-+fw_writer$(BUILD_EXEEXT): $(tobin_OBJECTS)
-+	$(LINK_FOR_BUILD.c) $^ $(LOADLIBES_FOR_BUILD) $(LDLIBS_FOR_BUILD) -o $@
-+
-+$(firmware_files): fw_writer$(BUILD_EXEEXT)
-+	./fw_writer$(BUILD_EXEEXT)
---- a/ymfpci/Makefile.am	2015-02-26 20:36:03.000000000 +0800
-+++ b/ymfpci/Makefile.am	2019-06-28 02:09:02.487797826 +0800
-@@ -17,5 +17,14 @@
- hotplugfw_DATA =
- endif
- 
--$(firmware_files): fw_writer
--	./fw_writer
-+LINK_FOR_BUILD.c = $(CC_FOR_BUILD) $(CFLAGS_FOR_BUILD) $(CPPFLAGS_FOR_BUILD) $(LDFLAGS_FOR_BUILD) $(TARGET_ARCH_FOR_BUILD)
-+
-+$(fw_writer_OBJECTS) : CC=$(CC_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CFLAGS=$(CFLAGS_FOR_BUILD)
-+$(fw_writer_OBJECTS) : CPPFLAGS=$(CPPFLAGS_FOR_BUILD)
-+
-+fw_writer$(BUILD_EXEEXT): $(tobin_OBJECTS)
-+	$(LINK_FOR_BUILD.c) $^ $(LOADLIBES_FOR_BUILD) $(LDLIBS_FOR_BUILD) -o $@
-+
-+$(firmware_files): fw_writer$(BUILD_EXEEXT)
-+	./fw_writer$(BUILD_EXEEXT)
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix
deleted file mode 100644
index a627a7762a8..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-firmware/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ lib, stdenv, buildPackages, autoreconfHook, fetchurl, fetchpatch }:
-
-stdenv.mkDerivation rec {
-  name = "alsa-firmware-1.2.1";
-
-  src = fetchurl {
-    url = "mirror://alsa/firmware/${name}.tar.bz2";
-    sha256 = "1aq8z8ajpjvcx7bwhwp36bh5idzximyn77ygk3ifs0my3mbpr8mf";
-  };
-
-  patches = [ (fetchpatch {
-    url = "https://github.com/alsa-project/alsa-firmware/commit/a8a478485a999ff9e4a8d8098107d3b946b70288.patch";
-    sha256 = "0zd7vrgz00hn02va5bkv7qj2395a1rl6f8jq1mwbryxs7hiysb78";
-  }) ];
-
-  nativeBuildInputs = [ autoreconfHook buildPackages.stdenv.cc ];
-
-  configureFlags = [
-    "--with-hotplug-dir=$(out)/lib/firmware"
-  ];
-
-  dontStrip = true;
-
-  postInstall = ''
-    # These are lifted from the Arch PKGBUILD
-    # remove files which conflicts with linux-firmware
-    rm -rf $out/lib/firmware/{ct{efx,speq}.bin,ess,korg,sb16,yamaha}
-    # remove broken symlinks (broken upstream)
-    rm -rf $out/lib/firmware/turtlebeach
-    # remove empty dir
-    rm -rf $out/bin
-  '';
-
-  meta = {
-    homepage = "http://www.alsa-project.org/";
-    description = "Soundcard firmwares from the alsa project";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch b/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch
deleted file mode 100644
index b17df9a492e..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-lib/alsa-plugin-conf-multilib.patch
+++ /dev/null
@@ -1,232 +0,0 @@
-diff --git a/src/control/control.c b/src/control/control.c
-index d66ed75..42cecad 100644
---- a/src/control/control.c
-+++ b/src/control/control.c
-@@ -838,6 +838,10 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- #ifndef PIC
- 	extern void *snd_control_open_symbols(void);
- #endif
-+
-+	snd_config_t *libs = NULL;
-+	const char *libs_lib = NULL;
-+
- 	if (snd_config_get_type(ctl_conf) != SND_CONFIG_TYPE_COMPOUND) {
- 		if (name)
- 			SNDERR("Invalid type for CTL %s definition", name);
-@@ -879,6 +883,19 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 					SNDERR("Invalid type for %s", id);
- 					goto _err;
- 				}
-+
-+				continue;
-+			}
-+			// Handle an array of extra libs.
-+			if (strcmp(id, "libs") == 0) {
-+				if (snd_config_get_type(n) != SND_CONFIG_TYPE_COMPOUND) {
-+					SNDERR("Invalid type for libs definition in CTL %s definition",
-+						str);
-+					goto _err;
-+				}
-+
-+				libs = n;
-+
- 				continue;
- 			}
- 			if (strcmp(id, "open") == 0) {
-@@ -903,7 +920,62 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 		open_name = buf;
- 		sprintf(buf, "_snd_ctl_%s_open", str);
- 	}
--	if (!lib) {
-+
-+#ifndef PIC
-+	snd_control_open_symbols();
-+#endif
-+
-+	// Normal alsa behaviour when there is no libs array.
-+	if (!libs) {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 1);
-+		}
-+	}
-+	// Handle libs array.
-+	// Suppresses error messages if any function is loaded successfully.
-+	else {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 0);
-+		}
-+
-+		if (!open_func) {
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				err = snd_config_get_string(n, &libs_lib);
-+				if (err < 0) {
-+					SNDERR("Invalid entry in CTL %s libs definition", str);
-+					goto _err;
-+				}
-+
-+				if (!open_func) {
-+					open_func = snd_dlobj_cache_get(libs_lib, open_name,
-+						SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 0);
-+				}
-+			}
-+		}
-+
-+		// Print error messages.
-+		if (!open_func) {
-+			if (lib) {
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					lib, open_name);
-+			}
-+
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				snd_config_get_string(n, &libs_lib);
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					libs_lib, open_name);
-+			}
-+		}
-+	}
-+
-+	// Look in ALSA_PLUGIN_DIR iff we found nowhere else to look.
-+	if (!lib && (!libs || !libs_lib)) {
- 		const char *const *build_in = build_in_ctls;
- 		while (*build_in) {
- 			if (!strcmp(*build_in, str))
-@@ -919,12 +991,11 @@ static int snd_ctl_open_conf(snd_ctl_t **ctlp, const char *name,
- 			lib = buf1;
- 			sprintf(buf1, "%s/libasound_module_ctl_%s.so", ALSA_PLUGIN_DIR, str);
- 		}
--	}
--#ifndef PIC
--	snd_control_open_symbols();
--#endif
--	open_func = snd_dlobj_cache_get(lib, open_name,
-+
-+		open_func = snd_dlobj_cache_get(lib, open_name,
- 			SND_DLSYM_VERSION(SND_CONTROL_DLSYM_VERSION), 1);
-+	}
-+
- 	if (open_func) {
- 		err = open_func(ctlp, name, ctl_root, ctl_conf, mode);
- 		if (err >= 0) {
-diff --git a/src/pcm/pcm.c b/src/pcm/pcm.c
-index 2e24338..7f489f4 100644
---- a/src/pcm/pcm.c
-+++ b/src/pcm/pcm.c
-@@ -2116,6 +2116,10 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- #ifndef PIC
- 	extern void *snd_pcm_open_symbols(void);
- #endif
-+
-+	snd_config_t *libs = NULL;
-+	const char *libs_lib = NULL;
-+
- 	if (snd_config_get_type(pcm_conf) != SND_CONFIG_TYPE_COMPOUND) {
- 		char *val;
- 		id = NULL;
-@@ -2160,6 +2164,19 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 					SNDERR("Invalid type for %s", id);
- 					goto _err;
- 				}
-+
-+				continue;
-+			}
-+			// Handle an array of extra libs.
-+			if (strcmp(id, "libs") == 0) {
-+				if (snd_config_get_type(n) != SND_CONFIG_TYPE_COMPOUND) {
-+					SNDERR("Invalid type for libs definition in PCM %s definition",
-+						str);
-+					goto _err;
-+				}
-+
-+				libs = n;
-+
- 				continue;
- 			}
- 			if (strcmp(id, "open") == 0) {
-@@ -2184,7 +2201,62 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 		open_name = buf;
- 		sprintf(buf, "_snd_pcm_%s_open", str);
- 	}
--	if (!lib) {
-+
-+#ifndef PIC
-+	snd_pcm_open_symbols();	/* this call is for static linking only */
-+#endif
-+
-+	// Normal alsa behaviour when there is no libs array.
-+	if (!libs) {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 1);
-+		}
-+	}
-+	// Handle libs array.
-+	// Suppresses error messages if any function is loaded successfully.
-+	else {
-+		if (lib) {
-+			open_func = snd_dlobj_cache_get(lib, open_name,
-+				SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 0);
-+		}
-+
-+		if (!open_func) {
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				err = snd_config_get_string(n, &libs_lib);
-+				if (err < 0) {
-+					SNDERR("Invalid entry in PCM %s libs definition", str);
-+					goto _err;
-+				}
-+
-+				if (!open_func) {
-+					open_func = snd_dlobj_cache_get(libs_lib, open_name,
-+						SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 0);
-+				}
-+			}
-+		}
-+
-+		// Print error messages.
-+		if (!open_func) {
-+			if (lib) {
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					lib, open_name);
-+			}
-+
-+			snd_config_for_each(i, next, libs) {
-+				snd_config_t *n = snd_config_iterator_entry(i);
-+
-+				snd_config_get_string(n, &libs_lib);
-+				SNDERR("Either %s cannot be opened or %s was not defined inside",
-+					libs_lib, open_name);
-+			}
-+		}
-+	}
-+
-+	// Look in ALSA_PLUGIN_DIR iff we found nowhere else to look.
-+	if (!lib && (!libs || !libs_lib)) {
- 		const char *const *build_in = build_in_pcms;
- 		while (*build_in) {
- 			if (!strcmp(*build_in, str))
-@@ -2200,12 +2272,11 @@ static int snd_pcm_open_conf(snd_pcm_t **pcmp, const char *name,
- 			lib = buf1;
- 			sprintf(buf1, "%s/libasound_module_pcm_%s.so", ALSA_PLUGIN_DIR, str);
- 		}
--	}
--#ifndef PIC
--	snd_pcm_open_symbols();	/* this call is for static linking only */
--#endif
--	open_func = snd_dlobj_cache_get(lib, open_name,
-+
-+		open_func = snd_dlobj_cache_get(lib, open_name,
- 			SND_DLSYM_VERSION(SND_PCM_DLSYM_VERSION), 1);
-+	}
-+
- 	if (open_func) {
- 		err = open_func(pcmp, name, pcm_root, pcm_conf, stream, mode);
- 		if (err >= 0) {
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
deleted file mode 100644
index a2350271482..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-lib/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, alsa-topology-conf
-, alsa-ucm-conf
-}:
-
-stdenv.mkDerivation rec {
-  pname = "alsa-lib";
-  version = "1.2.5.1";
-
-  src = fetchurl {
-    url = "mirror://alsa/lib/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-YoQh2VDOyvI03j+JnVIMCmkjMTyWStdR/6wIHfMxQ44=";
-  };
-
-  patches = [
-    ./alsa-plugin-conf-multilib.patch
-  ];
-
-  enableParallelBuilding = true;
-
-  # Fix pcm.h file in order to prevent some compilation bugs
-  postPatch = ''
-    sed -i -e 's|//int snd_pcm_mixer_element(snd_pcm_t \*pcm, snd_mixer_t \*mixer, snd_mixer_elem_t \*\*elem);|/\*int snd_pcm_mixer_element(snd_pcm_t \*pcm, snd_mixer_t \*mixer, snd_mixer_elem_t \*\*elem);\*/|' include/pcm.h
-  '';
-
-  postInstall = ''
-    ln -s ${alsa-ucm-conf}/share/alsa/{ucm,ucm2} $out/share/alsa
-    ln -s ${alsa-topology-conf}/share/alsa/topology $out/share/alsa
-  '';
-
-  outputs = [ "out" "dev" ];
-
-  meta = with lib; {
-    homepage = "http://www.alsa-project.org/";
-    description = "ALSA, the Advanced Linux Sound Architecture libraries";
-
-    longDescription = ''
-      The Advanced Linux Sound Architecture (ALSA) provides audio and
-      MIDI functionality to the Linux-based operating system.
-    '';
-
-    license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-oss/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-oss/default.nix
deleted file mode 100644
index f600b52c5f3..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-oss/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{lib, stdenv, fetchurl, alsa-lib, gettext, ncurses, libsamplerate}:
-
-stdenv.mkDerivation rec {
-  pname = "alsa-oss";
-  version = "1.1.8";
-
-  src = fetchurl {
-    url = "mirror://alsa/oss-lib/${pname}-${version}.tar.bz2";
-    sha256 = "13nn6n6wpr2sj1hyqx4r9nb9bwxnhnzw8r2f08p8v13yjbswxbb4";
-  };
-
-  buildInputs = [ alsa-lib ncurses libsamplerate ];
-  nativeBuildInputs = [ gettext ];
-
-  configureFlags = [ "--disable-xmlto" ];
-
-  installFlags = [ "ASOUND_STATE_DIR=$(TMPDIR)/dummy" ];
-
-  meta = with lib; {
-    homepage = "http://www.alsa-project.org/";
-    description = "ALSA, the Advanced Linux Sound Architecture alsa-oss emulation";
-
-    longDescription = ''
-      The Advanced Linux Sound Architecture (ALSA) provides audio and
-      MIDI functionality to the Linux-based operating system.
-    '';
-
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix
deleted file mode 100644
index 747979b1037..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-plugins/default.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ stdenv, fetchurl, lib, pkg-config, alsa-lib, libogg, libpulseaudio ? null, libjack2 ? null }:
-
-stdenv.mkDerivation rec {
-  pname = "alsa-plugins";
-  version = "1.2.5";
-
-  src = fetchurl {
-    url = "mirror://alsa/plugins/${pname}-${version}.tar.bz2";
-    sha256 = "086z2g2f95570vfvp9d5bakib4k18fb4bszf3lgx3j6j6f2gkvj2";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-
-  # ToDo: a52, etc.?
-  buildInputs =
-    [ alsa-lib libogg ]
-    ++ lib.optional (libpulseaudio != null) libpulseaudio
-    ++ lib.optional (libjack2 != null) libjack2;
-
-  meta = with lib; {
-    description = "Various plugins for ALSA";
-    homepage = "http://alsa-project.org/";
-    license = licenses.lgpl21;
-    maintainers = [ maintainers.marcweber ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-plugins/wrapper.nix b/pkgs/os-specific/linux/alsa-project/alsa-plugins/wrapper.nix
deleted file mode 100644
index 992f4886e26..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-plugins/wrapper.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{ stdenv
-, alsa-plugins
-, writeShellScriptBin
-}:
-let
-  arch = if stdenv.hostPlatform.system == "i686-linux" then "32" else "64";
-in
-writeShellScriptBin "ap${arch}" ''
-  ALSA_PLUGIN_DIRS=${alsa-plugins}/lib/alsa-lib "$@"
-''
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix
deleted file mode 100644
index 8b9abb74036..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-tools/default.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{ lib, stdenv, fetchurl, alsa-lib, pkg-config, gtk2, gtk3, fltk13 }:
-# Comes from upstream as as bundle of several tools,
-# some use gtk2, some gtk3 (and some even fltk13).
-
-stdenv.mkDerivation rec {
-  pname = "alsa-tools";
-  version = "1.2.5";
-
-  src = fetchurl {
-    url = "mirror://alsa/tools/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-NacQJ6AfTX3kci4iNSDpQN5os8VwtsZxaRVnrij5iT4=";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ alsa-lib gtk2 gtk3 fltk13 ];
-
-  patchPhase = ''
-    export tools="as10k1 hda-verb hdspmixer echomixer hdajackretask hdspconf hwmixvolume mixartloader rmedigicontrol sscape_ctl vxloader envy24control hdajacksensetest hdsploader ld10k1 pcxhrloader sb16_csp us428control"
-    # export tools="as10k1 hda-verb hdspmixer qlo10k1 seq usx2yloader echomixer hdajackretask hdspconf hwmixvolume mixartloader rmedigicontrol sscape_ctl vxloader envy24control hdajacksensetest hdsploader ld10k1 pcxhrloader sb16_csp us428control"
-  '';
-
-  configurePhase = ''
-    for tool in $tools; do
-      echo "Tool: $tool:"
-      cd "$tool"; ./configure --prefix="$out"; cd -
-    done
-  '';
-
-  buildPhase = ''
-    for tool in $tools; do
-      cd "$tool"; make; cd -
-    done
-  '';
-
-  installPhase = ''
-    for tool in $tools; do
-      cd "$tool"; make install; cd -
-    done
-  '';
-
-  meta = with lib; {
-    homepage = "http://www.alsa-project.org/";
-    description = "ALSA, the Advanced Linux Sound Architecture tools";
-
-    longDescription = ''
-      The Advanced Linux Sound Architecture (ALSA) provides audio and
-      MIDI functionality to the Linux-based operating system.
-    '';
-
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.fps ];
-  };
-}
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix
deleted file mode 100644
index e0dfc879fbc..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-topology-conf/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "alsa-topology-conf-${version}";
-  version = "1.2.5.1";
-
-  src = fetchurl {
-    url = "mirror://alsa/lib/${name}.tar.bz2";
-    sha256 = "sha256-98W64VRavNc4JLyX9OcsNA4Rq+oYi6DxwG9eCtd2sXk=";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/alsa
-    cp -r topology $out/share/alsa
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.alsa-project.org/";
-    description = "ALSA topology configuration files";
-
-    longDescription = ''
-      The Advanced Linux Sound Architecture (ALSA) provides audio and
-      MIDI functionality to the Linux-based operating system.
-    '';
-
-    license = licenses.bsd3;
-    maintainers = [ maintainers.roastiek ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
deleted file mode 100644
index 0666f3f4793..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-ucm-conf/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  name = "alsa-ucm-conf-${version}";
-  version = "1.2.5.1";
-
-  src = fetchurl {
-    url = "mirror://alsa/lib/${name}.tar.bz2";
-    sha256 = "sha256-WEGkRBZty/R523UTA9vDVW9oUIWsfgDwyed1VnYZXZc=";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/alsa
-    cp -r ucm ucm2 $out/share/alsa
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.alsa-project.org/";
-    description = "ALSA Use Case Manager configuration";
-
-    longDescription = ''
-      The Advanced Linux Sound Architecture (ALSA) provides audio and
-      MIDI functionality to the Linux-based operating system.
-    '';
-
-    license = licenses.bsd3;
-    maintainers = [ maintainers.roastiek ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix b/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
deleted file mode 100644
index 782e6ffce8c..00000000000
--- a/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{lib, stdenv, fetchurl, alsa-lib, gettext, makeWrapper, ncurses, libsamplerate, pciutils, which, fftw}:
-
-stdenv.mkDerivation rec {
-  pname = "alsa-utils";
-  version = "1.2.5.1";
-
-  src = fetchurl {
-    url = "mirror://alsa/utils/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-nBaa43pJKV+bl7kqzncoA9r2tlEKGVdOC3j4flYhGNA=";
-  };
-
-  nativeBuildInputs = [ gettext makeWrapper ];
-  buildInputs = [ alsa-lib ncurses libsamplerate fftw ];
-
-  configureFlags = [ "--disable-xmlto" "--with-udev-rules-dir=$(out)/lib/udev/rules.d" ];
-
-  installFlags = [ "ASOUND_STATE_DIR=$(TMPDIR)/dummy" ];
-
-  postFixup = ''
-    mv $out/bin/alsa-info.sh $out/bin/alsa-info
-    wrapProgram $out/bin/alsa-info --prefix PATH : "${lib.makeBinPath [ which pciutils ]}"
-  '';
-
-  meta = with lib; {
-    homepage = "http://www.alsa-project.org/";
-    description = "ALSA, the Advanced Linux Sound Architecture utils";
-    longDescription = ''
-      The Advanced Linux Sound Architecture (ALSA) provides audio and
-      MIDI functionality to the Linux-based operating system.
-    '';
-
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.AndersonTorres ];
-  };
-}
diff --git a/pkgs/os-specific/linux/amdctl/default.nix b/pkgs/os-specific/linux/amdctl/default.nix
new file mode 100644
index 00000000000..1fcd8fc9340
--- /dev/null
+++ b/pkgs/os-specific/linux/amdctl/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "amdctl";
+  version = "0.11";
+
+  src = fetchFromGitHub {
+    owner = "kevinlekiller";
+    repo = "amdctl";
+    rev = "v${version}";
+    hash = "sha256-2wBk/9aAD7ARMGbcVxk+CzEvUf8U4RS4ZwTCj8cHNNo=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 amdctl $out/bin/amdctl
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Set P-State voltages and clock speeds on recent AMD CPUs on Linux.";
+    homepage = "https://github.com/kevinlekiller/amdctl";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ thiagokokada ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/amdgpu-pro/default.nix b/pkgs/os-specific/linux/amdgpu-pro/default.nix
index 13dd8302b18..241145a2484 100644
--- a/pkgs/os-specific/linux/amdgpu-pro/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-pro/default.nix
@@ -1,18 +1,25 @@
-{ lib, stdenv, fetchurl, elfutils
-, xorg, patchelf, openssl, libdrm, udev
-, libxcb, libxshmfence, epoxy, perl, zlib
-, ncurses
-, libsOnly ? false, kernel ? null
+{ lib
+, stdenv
+, fetchurl
+, elfutils
+, xorg
+, patchelf
+, libxcb
+, libxshmfence
+, perl
+, zlib
+, expat
+, libffi
+, libselinux
+, libdrm
+, udev
+, kernel ? null
 }:
 
-assert (!libsOnly) -> kernel != null;
-
 with lib;
 
 let
 
-  kernelDir = if libsOnly then null else kernel.dev;
-
   bitness = if stdenv.is64bit then "64" else "32";
 
   libArch =
@@ -20,151 +27,185 @@ let
       "i386-linux-gnu"
     else if stdenv.hostPlatform.system == "x86_64-linux" then
       "x86_64-linux-gnu"
-    else throw "amdgpu-pro is Linux only. Sorry. The build was stopped.";
-
-  libReplaceDir = "/usr/lib/${libArch}";
-
-  ncurses5 = ncurses.override { abiVersion = "5"; };
+    else throw "amdgpu-pro is Linux only. Sorry.";
 
 in stdenv.mkDerivation rec {
 
-  version = "17.40";
+  version = "21.30";
   pname = "amdgpu-pro";
-  build = "${version}-492261";
-
-  libCompatDir = "/run/lib/${libArch}";
-
-  name = pname + "-" + version + (optionalString (!libsOnly) "-${kernelDir.version}");
+  build = "${version}-1290604";
 
   src = fetchurl {
-    url =
-    "https://www2.ati.com/drivers/linux/ubuntu/amdgpu-pro-${build}.tar.xz";
-    sha256 = "1c073lp9cq1rc2mddky2r0j2dv9dd167qj02visz37vwaxbm2r5h";
-    curlOpts = "--referer http://support.amd.com/en-us/kb-articles/Pages/AMD-Radeon-GPU-PRO-Linux-Beta-Driver%e2%80%93Release-Notes.aspx";
+    url = "https://drivers.amd.com/drivers/linux/amdgpu-pro-${build}-ubuntu-20.04.tar.xz";
+    sha256 = "sha256-WECqxjo2WLP3kMWeVyJgYufkvHTzwGaj57yeMGXiQ4I=";
+    curlOpts = "--referer https://www.amd.com/en/support/kb/release-notes/rn-amdgpu-unified-linux-21-30";
   };
 
-  hardeningDisable = [ "pic" "format" ];
-
-  inherit libsOnly;
-
   postUnpack = ''
-    cd $sourceRoot
     mkdir root
-    cd root
-    for deb in ../*_all.deb ../*_i386.deb '' + optionalString stdenv.is64bit "../*_amd64.deb" + ''; do echo $deb; ar p $deb data.tar.xz | tar -xJ; done
-    sourceRoot=.
-  '';
-
-  modulePatches = optionals (!libsOnly) ([
-    ./patches/0001-fix-warnings-for-Werror.patch
-    ./patches/0002-fix-sketchy-int-ptr-warning.patch
-    ./patches/0003-disable-firmware-copy.patch
-  ]);
-
-  patchPhase = optionalString (!libsOnly) ''
-    pushd usr/src/amdgpu-${build}
-    for patch in $modulePatches
+    pushd $sourceRoot
+    for deb in *_all.deb *_${if stdenv.is64bit then "amd64" else "i386"}.deb
     do
-      echo $patch
-      patch -f -p1 < $patch || true
+      ar p $deb data.tar.xz | tar -C ../root -xJ
     done
     popd
+    # if we don't use a short sourceRoot, compilation can fail due to command
+    # line length
+    sourceRoot=root
   '';
 
-  xreallocarray = ./xreallocarray.c;
+  passthru = optionalAttrs (kernel != null) {
+    kmod = stdenv.mkDerivation rec {
+      inherit version src postUnpack;
+      name = "${pname}-${version}-kmod-${kernel.dev.version}";
 
-  preBuild = optionalString (!libsOnly) ''
-    pushd usr/src/amdgpu-${build}
-    makeFlags="$makeFlags M=$(pwd)"
-    patchShebangs pre-build.sh
-    ./pre-build.sh ${kernel.version}
-    popd
-    pushd lib
-    $CC -fPIC -shared -o libhack-xreallocarray.so $xreallocarray
-    strip libhack-xreallocarray.so
-    popd
-  '';
+      postPatch = ''
+        pushd usr/src/amdgpu-*
+        patchShebangs amd/dkms/*.sh
+        substituteInPlace amd/dkms/pre-build.sh --replace "./configure" "./configure --with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source --with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+        popd
+      '';
 
-  modules = [
-    "amd/amdgpu/amdgpu.ko"
-    "amd/amdkcl/amdkcl.ko"
-    "ttm/amdttm.ko"
-  ];
+      preConfigure = ''
+        pushd usr/src/amdgpu-*
+        makeFlags="$makeFlags M=$(pwd)"
+        amd/dkms/pre-build.sh ${kernel.version}
+        popd
+      '';
+
+      postBuild = ''
+        pushd usr/src/amdgpu-*
+        find -name \*.ko -exec xz {} \;
+        popd
+      '';
+
+      makeFlags = optionalString (kernel != null) "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build modules";
+
+      installPhase = ''
+        runHook preInstall
+
+        pushd usr/src/amdgpu-*
+        find -name \*.ko.xz -exec install -Dm444 {} $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/{} \;
+        popd
+
+        runHook postInstall
+      '';
 
-  postBuild = optionalString (!libsOnly)
-    (concatMapStrings (m: "xz usr/src/amdgpu-${build}/${m}\n") modules);
+      # without this we get a collision with the ttm module from linux
+      meta.priority = 4;
+    };
 
-  NIX_CFLAGS_COMPILE = "-Werror";
+    fw = stdenv.mkDerivation rec {
+      inherit version src postUnpack;
+      name = "${pname}-${version}-fw";
 
-  makeFlags = optionalString (!libsOnly)
-    "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build modules";
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p $out/lib
+        cp -r usr/src/amdgpu-*/firmware $out/lib/firmware
+
+        runHook postInstall
+      '';
+    };
+  };
+
+  outputs = [ "out" "vulkan" ];
 
   depLibPath = makeLibraryPath [
-    stdenv.cc.cc.lib xorg.libXext xorg.libX11 xorg.libXdamage xorg.libXfixes zlib
-    xorg.libXxf86vm libxcb libxshmfence epoxy openssl libdrm elfutils udev ncurses5
+    stdenv.cc.cc.lib
+    zlib
+    libxcb
+    libxshmfence
+    elfutils
+    expat
+    libffi
+    libselinux
+    # libudev is not listed in any dependencies, but is loaded dynamically
+    udev
+    xorg.libXext
+    xorg.libX11
+    xorg.libXfixes
+    xorg.libXdamage
+    xorg.libXxf86vm
   ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out
 
-    cp -r etc $out/etc
-    cp -r lib $out/lib
+    cp -r usr/lib/${libArch} $out/lib
+    cp -r usr/share $out/share
 
-    pushd usr
-    cp -r lib/${libArch}/* $out/lib
-  '' + optionalString (!libsOnly) ''
-    cp -r src/amdgpu-${build}/firmware $out/lib/firmware
-  '' + ''
-    cp -r share $out/share
+    mkdir -p $out/opt/amdgpu{,-pro}
+    cp -r opt/amdgpu-pro/lib/${libArch} $out/opt/amdgpu-pro/lib
+    cp -r opt/amdgpu/lib/${libArch} $out/opt/amdgpu/lib
+
+    pushd $out/lib
+    ln -s ../opt/amdgpu-pro/lib/libGL.so* .
+    ln -s ../opt/amdgpu-pro/lib/libEGL.so* .
     popd
 
-    pushd opt/amdgpu-pro
-  '' + optionalString (!libsOnly && stdenv.is64bit) ''
-    cp -r bin $out/bin
-  '' + ''
-    cp -r include $out/include
-    cp -r share/* $out/share
-    cp -r lib/${libArch}/* $out/lib
-  '' + optionalString (!libsOnly) ''
-    mv lib/xorg $out/lib/xorg
-  '' + ''
+    # short name to allow replacement below
+    ln -s lib/dri $out/dri
+
+  '' + optionalString (stdenv.is64bit) ''
+    mkdir -p $out/etc
+    pushd etc
+    cp -r modprobe.d udev amd $out/etc
     popd
 
-  '' + optionalString (!libsOnly)
-    (concatMapStrings (m:
-      "install -Dm444 usr/src/amdgpu-${build}/${m}.xz $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/${m}.xz\n") modules)
-  + ''
-    mv $out/etc/vulkan $out/share
-    interpreter="$(cat $NIX_CC/nix-support/dynamic-linker)"
-    libPath="$out/lib:$out/lib/gbm:$depLibPath"
-  '' + optionalString (!libsOnly && stdenv.is64bit) ''
-    for prog in clinfo modetest vbltest kms-universal-planes kms-steal-crtc modeprint amdgpu_test kmstest proptest; do
-      patchelf --interpreter "$interpreter" --set-rpath "$libPath" "$out/bin/$prog"
-    done
+    cp -r lib/udev/rules.d/* $out/etc/udev/rules.d
+    cp -r opt/amdgpu/lib/xorg $out/lib/xorg
+    cp -r opt/amdgpu-pro/lib/xorg/* $out/lib/xorg
+    cp -r opt/amdgpu/share $out/opt/amdgpu/share
   '' + ''
-    ln -s ${makeLibraryPath [ncurses5]}/libncursesw.so.5 $out/lib/libtinfo.so.5
+
+    mkdir -p $vulkan/share/vulkan/icd.d
+    install opt/amdgpu-pro/etc/vulkan/icd.d/amd_icd${bitness}.json $vulkan/share/vulkan/icd.d
+
+    runHook postInstall
   '';
 
-  # we'll just set the full rpath on everything to avoid having to track down dlopen problems
-  postFixup = assert (stringLength libReplaceDir == stringLength libCompatDir); ''
-    libPath="$out/lib:$out/lib/gbm:$depLibPath"
-    for lib in `find "$out/lib/" -name '*.so*' -type f`; do
-      patchelf --set-rpath "$libPath" "$lib"
-    done
-    for lib in libEGL.so.1 libGL.so.1.2 ${optionalString (!libsOnly) "xorg/modules/extensions/libglx.so"} dri/amdgpu_dri.so libamdocl${bitness}.so; do
-      perl -pi -e 's:${libReplaceDir}:${libCompatDir}:g' "$out/lib/$lib"
-    done
-    for lib in dri/amdgpu_dri.so libdrm_amdgpu.so.1.0.0 libgbm_amdgpu.so.1.0.0 libkms_amdgpu.so.1.0.0 libamdocl${bitness}.so; do
-      perl -pi -e 's:/opt/amdgpu-pro/:/run/amdgpu-pro/:g' "$out/lib/$lib"
-    done
-    substituteInPlace "$out/share/vulkan/icd.d/amd_icd${bitness}.json" --replace "/opt/amdgpu-pro/lib/${libArch}" "$out/lib"
-  '' + optionalString (!libsOnly) ''
-    for lib in drivers/modesetting_drv.so libglamoregl.so; do
-      patchelf --add-needed $out/lib/libhack-xreallocarray.so $out/lib/xorg/modules/$lib
-    done
+  preFixup = (if stdenv.is64bit
+    # this could also be done with LIBGL_DRIVERS_PATH, but it would need to be
+    # set in the user session and for Xorg
+    then ''
+      expr1='s:/opt/amdgpu/lib/x86_64-linux-gnu/dri\0:/run/opengl-driver/lib/dri\0\0\0\0\0\0\0\0\0\0\0:g'
+      expr2='s:/usr/lib/x86_64-linux-gnu/dri[\0\:]:/run/opengl-driver/lib/dri\0\0\0\0:g'
+      perl -pi -e "$expr2" $out/lib/xorg/modules/extensions/libglx.so
+    ''
+    else ''
+      expr1='s:/opt/amdgpu/lib/i386-linux-gnu/dri\0:/run/opengl-driver-32/lib/dri\0\0\0\0\0\0:g'
+      # we replace a different path on 32-bit because it's the only one long
+      # enough to fit the target path :(
+      expr2='s:/usr/lib/i386-linux-gnu/dri[\0\:]:/run/opengl-driver-32/dri\0\0\0:g'
+    '') + ''
+    perl -pi -e "$expr1" \
+      $out/opt/amdgpu/lib/libEGL.so.1.0.0 \
+      $out/opt/amdgpu/lib/libgbm.so.1.0.0 \
+      $out/opt/amdgpu/lib/libGL.so.1.2.0
+
+    perl -pi -e "$expr2" \
+      $out/opt/amdgpu-pro/lib/libEGL.so.1 \
+      $out/opt/amdgpu-pro/lib/libGL.so.1.2 \
+      $out/opt/amdgpu-pro/lib/libGLX_amd.so.0
+
+    find $out -type f -exec perl -pi -e 's:/opt/amdgpu-pro/:/run/amdgpu-pro/:g' {} \;
+    find $out -type f -exec perl -pi -e 's:/opt/amdgpu/:/run/amdgpu/:g' {} \;
+
+    substituteInPlace $vulkan/share/vulkan/icd.d/*.json --replace /opt/amdgpu-pro/lib/${libArch} "$out/opt/amdgpu-pro/lib"
+  '';
+
+  # doing this in post because shrinking breaks things that dynamically load
+  postFixup = ''
+    libPath="$out/opt/amdgpu/lib:$out/opt/amdgpu-pro/lib:$depLibPath"
+    find "$out" -name '*.so*' -type f -exec patchelf --set-rpath "$libPath" {} \;
   '';
 
   buildInputs = [
+    libdrm
     patchelf
     perl
   ];
@@ -173,11 +214,9 @@ in stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "AMDGPU-PRO drivers";
-    homepage =  "http://support.amd.com/en-us/kb-articles/Pages/AMDGPU-PRO-Beta-Driver-for-Vulkan-Release-Notes.aspx";
+    homepage =  "https://www.amd.com/en/support";
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = with maintainers; [ corngood ];
-    # Copied from the nvidia default.nix to prevent a store collision.
-    priority = 4;
   };
 }
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0001-fix-warnings-for-Werror.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0001-fix-warnings-for-Werror.patch
deleted file mode 100644
index ecde6401ac1..00000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/patches/0001-fix-warnings-for-Werror.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-From 9167d76c435a7c1df7954f0fbe5cc6d083f8ed2f Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Mon, 6 Feb 2017 22:13:49 -0400
-Subject: [PATCH 1/3] fix warnings for Werror
-
----
- amd/amdgpu/amdgpu_device.c         | 4 ++--
- amd/amdgpu/amdgpu_sa.c             | 2 +-
- amd/display/dc/bios/bios_parser2.c | 8 ++++----
- 3 files changed, 7 insertions(+), 7 deletions(-)
-
-diff --git a/amd/amdgpu/amdgpu_device.c b/amd/amdgpu/amdgpu_device.c
-index fc1c543..186e06d 100644
---- a/amd/amdgpu/amdgpu_device.c
-+++ b/amd/amdgpu/amdgpu_device.c
-@@ -3164,7 +3164,7 @@ void amdgpu_debugfs_cleanup(struct drm_minor *minor)
- 	struct drm_info_node *node, *tmp;
- 
- 	if (!&minor->debugfs_root)
--		return 0;
-+		return;
- 
- 	mutex_lock(&minor->debugfs_lock);
- 	list_for_each_entry_safe(node, tmp,
-@@ -3175,7 +3175,7 @@ void amdgpu_debugfs_cleanup(struct drm_minor *minor)
- 	}
- 	mutex_unlock(&minor->debugfs_lock);
- 
--	return 0;
-+	return;
- }
- #endif
- 
-diff --git a/amd/amdgpu/amdgpu_sa.c b/amd/amdgpu/amdgpu_sa.c
-index 7206b34..8b7123c 100644
---- a/amd/amdgpu/amdgpu_sa.c
-+++ b/amd/amdgpu/amdgpu_sa.c
-@@ -430,7 +430,7 @@ void amdgpu_sa_bo_dump_debug_info(struct amdgpu_sa_manager *sa_manager,
- 		if (i->fence)
- #if defined(BUILD_AS_DKMS)
- 			seq_printf(m, " protected by 0x%08x on context %d",
--					i->fence->seqno, i->fence->context);
-+					i->fence->seqno, (int)i->fence->context);
- #else
- 			seq_printf(m, " protected by 0x%08x on context %llu",
- 				   i->fence->seqno, i->fence->context);
-diff --git a/amd/display/dc/bios/bios_parser2.c b/amd/display/dc/bios/bios_parser2.c
-index 86fce5a..99681c5 100644
---- a/amd/display/dc/bios/bios_parser2.c
-+++ b/amd/display/dc/bios/bios_parser2.c
-@@ -1326,13 +1326,13 @@ static enum bp_result get_embedded_panel_info_v2_1(
- 	info->lcd_timing.misc_info.VERTICAL_CUT_OFF = 0;
- 
- 	info->lcd_timing.misc_info.H_REPLICATION_BY2 =
--		lvds->lcd_timing.miscinfo & ATOM_H_REPLICATIONBY2;
-+		(lvds->lcd_timing.miscinfo & ATOM_H_REPLICATIONBY2) != 0;
- 	info->lcd_timing.misc_info.V_REPLICATION_BY2 =
--		lvds->lcd_timing.miscinfo & ATOM_V_REPLICATIONBY2;
-+		(lvds->lcd_timing.miscinfo & ATOM_V_REPLICATIONBY2) != 0;
- 	info->lcd_timing.misc_info.COMPOSITE_SYNC =
--		lvds->lcd_timing.miscinfo & ATOM_COMPOSITESYNC;
-+		(lvds->lcd_timing.miscinfo & ATOM_COMPOSITESYNC) != 0;
- 	info->lcd_timing.misc_info.INTERLACE =
--		lvds->lcd_timing.miscinfo & ATOM_INTERLACE;
-+		(lvds->lcd_timing.miscinfo & ATOM_INTERLACE) != 0;
- 
- 	/* not provided by VBIOS*/
- 	info->lcd_timing.misc_info.DOUBLE_CLOCK = 0;
--- 
-2.15.1
-
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0002-fix-sketchy-int-ptr-warning.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0002-fix-sketchy-int-ptr-warning.patch
deleted file mode 100644
index 20f429757a5..00000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/patches/0002-fix-sketchy-int-ptr-warning.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From a07ee5dec35ca24a013a6638543ef5030b2bab40 Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Tue, 9 Jan 2018 21:45:33 -0400
-Subject: [PATCH 2/3] fix sketchy int->ptr warning
-
----
- amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/amd/display/amdgpu_dm/amdgpu_dm_helpers.c b/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
-index d0f091b..707815a 100644
---- a/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
-+++ b/amd/display/amdgpu_dm/amdgpu_dm_helpers.c
-@@ -236,7 +236,7 @@ bool dm_helpers_dp_mst_write_payload_allocation_table(
- 		pbn = drm_dp_calc_pbn_mode(clock, bpp);
- 
- 		slots = drm_dp_find_vcpi_slots(mst_mgr, pbn);
--		ret = drm_dp_mst_allocate_vcpi(mst_mgr, mst_port, pbn, slots);
-+		ret = drm_dp_mst_allocate_vcpi(mst_mgr, mst_port, pbn, &slots);
- 
- 		if (!ret)
- 			return false;
--- 
-2.15.1
-
diff --git a/pkgs/os-specific/linux/amdgpu-pro/patches/0003-disable-firmware-copy.patch b/pkgs/os-specific/linux/amdgpu-pro/patches/0003-disable-firmware-copy.patch
deleted file mode 100644
index 0091c471680..00000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/patches/0003-disable-firmware-copy.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 7a3062acbbabdb29239bbc8c984e62589a88576e Mon Sep 17 00:00:00 2001
-From: David McFarland <corngood@gmail.com>
-Date: Tue, 9 Jan 2018 21:49:55 -0400
-Subject: [PATCH 3/3] disable firmware copy
-
----
- pre-build.sh | 5 -----
- 1 file changed, 5 deletions(-)
-
-diff --git a/pre-build.sh b/pre-build.sh
-index e7b8a32..bad8f25 100755
---- a/pre-build.sh
-+++ b/pre-build.sh
-@@ -38,8 +38,3 @@ find ttm -name '*.c' -exec grep EXPORT_SYMBOL {} + \
-     | sort -u \
-     | awk -F'[()]' '{print "#define "$2" amd"$2" //"$0}'\
-     >> include/rename_symbol.h
--
--FW_DIR="/lib/firmware/$KERNELVER"
--mkdir -p $FW_DIR
--cp -ar /usr/src/amdgpu-17.40-492261/firmware/radeon $FW_DIR
--cp -ar /usr/src/amdgpu-17.40-492261/firmware/amdgpu $FW_DIR
--- 
-2.15.1
-
diff --git a/pkgs/os-specific/linux/amdgpu-pro/xreallocarray.c b/pkgs/os-specific/linux/amdgpu-pro/xreallocarray.c
deleted file mode 100644
index ab47bacb822..00000000000
--- a/pkgs/os-specific/linux/amdgpu-pro/xreallocarray.c
+++ /dev/null
@@ -1,5 +0,0 @@
-#include <malloc.h>
-
-void *xreallocarray(void *ptr, size_t nmemb, size_t size) {
-  return reallocarray(ptr, nmemb, size);
-}
diff --git a/pkgs/os-specific/linux/anbox/0001-NixOS-Use-anbox-from-PATH-in-desktop-files.patch b/pkgs/os-specific/linux/anbox/0001-NixOS-Use-anbox-from-PATH-in-desktop-files.patch
new file mode 100644
index 00000000000..1c3450238c7
--- /dev/null
+++ b/pkgs/os-specific/linux/anbox/0001-NixOS-Use-anbox-from-PATH-in-desktop-files.patch
@@ -0,0 +1,34 @@
+From cb61e856c4357d9787f7a2313bacb1c3b2133d36 Mon Sep 17 00:00:00 2001
+From: Samuel Dionne-Riel <samuel@dionne-riel.com>
+Date: Fri, 4 Jun 2021 19:05:53 -0400
+Subject: [PATCH] [NixOS] Use `anbox` from PATH in desktop files
+
+---
+ src/anbox/application/launcher_storage.cpp | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/src/anbox/application/launcher_storage.cpp b/src/anbox/application/launcher_storage.cpp
+index d5053cf..a4be719 100644
+--- a/src/anbox/application/launcher_storage.cpp
++++ b/src/anbox/application/launcher_storage.cpp
+@@ -69,9 +69,7 @@ void LauncherStorage::add_or_update(const Database::Item &item) {
+   auto package_name = item.package;
+   std::replace(package_name.begin(), package_name.end(), '.', '-');
+ 
+-  auto exe_path = utils::process_get_exe_path(getpid());
+-  if (utils::get_env_value("SNAP").length() > 0)
+-    exe_path = snap_exe_path;
++  auto exe_path = "anbox";
+ 
+   std::string exec = utils::string_format("%s launch ", exe_path);
+ 
+@@ -121,4 +119,4 @@ void LauncherStorage::remove(const Database::Item &item) {
+     fs::remove(item_icon_path);
+ }
+ 
+-}
+\ No newline at end of file
++}
+-- 
+2.29.2
+
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index d684e24db91..856664fed80 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -1,4 +1,6 @@
 { lib, stdenv, fetchFromGitHub, fetchurl
+, callPackage
+, fetchpatch
 , cmake, pkg-config, dbus, makeWrapper
 , boost
 , elfutils # for libdw
@@ -22,7 +24,8 @@
 , SDL2_image
 , systemd
 , writeText
-, writeScript
+, writeShellScript
+, nixosTests
 }:
 
 let
@@ -33,29 +36,21 @@ let
     Exec=@out@/libexec/anbox-session-manager
   '';
 
-  anbox-application-manager = writeScript "anbox-application-manager" ''
-    #!${runtimeShell}
-
-    ${systemd}/bin/busctl --user call \
-        org.freedesktop.DBus \
-        /org/freedesktop/DBus \
-        org.freedesktop.DBus \
-        StartServiceByName "su" org.anbox 0
-
-    @out@/bin/anbox launch --package=org.anbox.appmgr --component=org.anbox.appmgr.AppViewActivity
+  anbox-application-manager = writeShellScript "anbox-application-manager" ''
+    exec @out@/bin/anbox launch --package=org.anbox.appmgr --component=org.anbox.appmgr.AppViewActivity
   '';
 
 in
 
 stdenv.mkDerivation rec {
   pname = "anbox";
-  version = "unstable-2020-11-29";
+  version = "unstable-2023-02-03";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "6c10125a7f13908d2cbe56d2d9ab09872755f265";
-    sha256 = "00bqssh4zcs0jj6w07b91719xkrpdw75vpcplwrvlhwsvl55f901";
+    rev = "ddf4c57ebbe3a2e46099087570898ab5c1e1f279";
+    sha256 = "sha256-QXWhatewiUDQ93cH1UZsYgbjUxpgB1ajtGFYZnKmabc=";
     fetchSubmodules = true;
   };
 
@@ -85,7 +80,12 @@ stdenv.mkDerivation rec {
     systemd
   ];
 
-  patchPhase = ''
+  # Flag needed by GCC 12 but unrecognized by GCC 9 (aarch64-linux default now)
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (with stdenv; cc.isGNU && lib.versionAtLeast cc.version "12") [
+    "-Wno-error=mismatched-new-delete"
+  ]);
+
+  prePatch = ''
     patchShebangs scripts
 
     cat >cmake/FindGMock.cmake <<'EOF'
@@ -113,8 +113,30 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
+  patches = [
+    # Fixes compatibility with lxc 4
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/anbox/lxc4.patch?id=64243590a16aee8d4e72061886fc1b15256492c3";
+      sha256 = "1da5xyzyjza1g2q9nbxb4p3njj2sf3q71vkpvmmdphia5qnb0gk5";
+    })
+    # Wait 10× more time when starting
+    # Not *strictly* needed, but helps a lot on slower hardware
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/community/anbox/give-more-time-to-start.patch?id=058b56d4b332ef3379551b343bf31e0f2004321a";
+      sha256 = "0iiz3c7fgfgl0dvx8sf5hv7a961xqnihwpz6j8r0ib9v8piwxh9a";
+    })
+    # Ensures generated desktop files work on store path change
+    ./0001-NixOS-Use-anbox-from-PATH-in-desktop-files.patch
+    # Provide window icons
+    (fetchpatch {
+      url = "https://github.com/samueldr/anbox/commit/2387f4fcffc0e19e52e58fb6f8264fbe87aafe4d.patch";
+      sha256 = "12lmr0kxw1n68g3abh1ak5awmpczfh75c26f53jc8qpvdvv1ywha";
+    })
+  ];
+
   postInstall = ''
     wrapProgram $out/bin/anbox \
+      --set SDL_VIDEO_X11_WMCLASS "anbox" \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [libGL libglvnd]} \
       --prefix PATH : ${git}/bin
 
@@ -128,25 +150,11 @@ stdenv.mkDerivation rec {
 
     substitute ${anbox-application-manager} $out/bin/anbox-application-manager \
       --subst-var out
+    chmod +x $out/bin/anbox-application-manager
   '';
 
-  passthru.image = let
-    imgroot = "https://build.anbox.io/android-images";
-  in
-    {
-      armv7l-linux = fetchurl {
-        url = imgroot + "/2017/06/12/android_1_armhf.img";
-        sha256 = "1za4q6vnj8wgphcqpvyq1r8jg6khz7v6b7h6ws1qkd5ljangf1w5";
-      };
-      aarch64-linux = fetchurl {
-        url = imgroot + "/2017/08/04/android_1_arm64.img";
-        sha256 = "02yvgpx7n0w0ya64y5c7bdxilaiqj9z3s682l5s54vzfnm5a2bg5";
-      };
-      x86_64-linux = fetchurl {
-        url = imgroot + "/2018/07/19/android_amd64.img";
-        sha256 = "1jlcda4q20w30cm9ikm6bjq01p547nigik1dz7m4v0aps4rws13b";
-      };
-    }.${stdenv.system} or null;
+  passthru.tests = { inherit (nixosTests) anbox; };
+  passthru.image = callPackage ./postmarketos-image.nix { };
 
   meta = with lib; {
     homepage = "https://anbox.io";
diff --git a/pkgs/os-specific/linux/anbox/kmod.nix b/pkgs/os-specific/linux/anbox/kmod.nix
deleted file mode 100644
index 9ce65cd8726..00000000000
--- a/pkgs/os-specific/linux/anbox/kmod.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{ lib, stdenv, kernel, fetchFromGitHub }:
-
-stdenv.mkDerivation {
-  pname = "anbox-modules";
-  version = "2020-06-14-${kernel.version}";
-
-  src = fetchFromGitHub {
-    owner = "anbox";
-    repo = "anbox-modules";
-    rev = "98f0f3b3b1eeb5a6954ca15ec43e150b76369086";
-    sha256 = "sha256-6xDJQ4YItdbYqle/9VNfOc7D80yFGd9cFyF+CuABaF0=";
-  };
-
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  KERNEL_SRC="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-
-  buildPhase = ''
-    for d in ashmem binder;do
-      cd $d
-      make
-      cd -
-    done
-  '';
-
-  installPhase = ''
-    modDir=$out/lib/modules/${kernel.modDirVersion}/kernel/updates/
-    mkdir -p $modDir
-    for d in ashmem binder;do
-      mv $d/$d*.ko $modDir/.
-    done
-  '';
-
-  meta = with lib; {
-    description = "Anbox ashmem and binder drivers.";
-    homepage = "https://github.com/anbox/anbox-modules";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.4" || kernel.kernelAtLeast "5.5";
-    maintainers = with maintainers; [ edwtjo ];
-  };
-}
diff --git a/pkgs/os-specific/linux/anbox/postmarketos-image.nix b/pkgs/os-specific/linux/anbox/postmarketos-image.nix
new file mode 100644
index 00000000000..648a1a5ea9a
--- /dev/null
+++ b/pkgs/os-specific/linux/anbox/postmarketos-image.nix
@@ -0,0 +1,19 @@
+{ stdenv, fetchurl }:
+
+let
+  imgroot = "https://web.archive.org/web/20211027150924/https://anbox.postmarketos.org";
+in
+  {
+    armv7l-linux = fetchurl {
+      url = imgroot + "/android-7.1.2_r39.1-anbox_armv7a_neon-userdebug.img";
+      sha256 = "1bgzqw4yp52a2q40dr1jlay1nh73jl5mx6wqsxvpb09xghxsng0a";
+    };
+    aarch64-linux = fetchurl {
+      url = imgroot + "/android-7.1.2_r39-anbox_arm64-userdebug.img";
+      sha256 = "0dx8mhfcjbkak982zfh65bvy35slz5jk31yl4ara50ryrxsp32nx";
+    };
+    x86_64-linux = fetchurl {
+      url = imgroot + "/android-7.1.2_r39-anbox_x86_64-userdebug.img";
+      sha256 = "16vmiz5al2r19wjpd44nagvz7d901ljxdms8gjp2w4xz1d91vzpm";
+    };
+  }.${stdenv.system} or (throw "Unsupported platform ${stdenv.system}")
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index fbe02d69f1a..07cdbf6bdce 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20210501";
+  version = "20231030";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    sha256 = "sha256-rlTulWclPqMl9LdHdcAtLARXGItiSeF3RX+neZrjgV4=";
+    sha256 = "sha256-+h0FwvfIoluhldOi6cgVDvmNWe1Lvj1SV3pL8Zh+gRM=";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index e27272a6147..98487799aa8 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -2,34 +2,48 @@
 , stdenv
 , fetchFromGitHub
 , kernel
+, nixosTests
 }:
 
+let
+  tag = "0.3.5";
+in
 stdenv.mkDerivation {
   pname = "apfs";
-  version = "unstable-2021-06-25-${kernel.version}";
+  version = "${tag}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
-    rev = "2ce6d06dc73036d113da5166c59393233bf54229";
-    sha256 = "sha256-18HFtPr0qcTIZ8njwEtveiPYO+HGlj90bdUoL47UUY0=";
+    rev = "v${tag}";
+    hash = "sha256-rKz9a4Z+tx63rhknQIl/zu/WIMjxxM0+NGyaxnzxLk4=";
   };
 
   hardeningDisable = [ "pic" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELRELEASE=${kernel.modDirVersion}"
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "INSTALL_MOD_PATH=$(out)"
   ];
 
+  passthru.tests.apfs = nixosTests.apfs;
+
   meta = with lib; {
     description = "APFS module for linux";
+    longDescription = ''
+      The Apple File System (APFS) is the copy-on-write filesystem currently
+      used on all Apple devices. This module provides a degree of experimental
+      support on Linux.
+      If you make use of the write support, expect data corruption.
+      Read-only support is somewhat more complete, with sealed volumes,
+      snapshots, and all the missing compression algorithms recently added.
+      Encryption is still not in the works though.
+    '';
     homepage = "https://github.com/linux-apfs/linux-apfs-rw";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.19";
     maintainers = with maintainers; [ Luflosi ];
   };
 }
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 1b1fb415451..ed1e31cc40e 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -1,38 +1,42 @@
-{ stdenv, lib, fetchurl, fetchpatch, makeWrapper, autoreconfHook
+{ stdenv, lib, fetchFromGitLab, fetchpatch, makeWrapper, autoreconfHook
 , pkg-config, which
 , flex, bison
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
 , gawk
 , withPerl ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform perl, perl
-, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python, python
+, withPython ? stdenv.hostPlatform == stdenv.buildPlatform && lib.meta.availableOn stdenv.hostPlatform python3, python3
 , swig
 , ncurses
 , pam
 , libnotify
 , buildPackages
 , coreutils
+, bash
 , gnugrep
 , gnused
 , kmod
 , writeShellScript
 , closureInfo
 , runCommand
+, libxcrypt
 }:
 
 let
-  apparmor-version = "3.0.1";
+  apparmor-version = "3.1.6";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
     description = "A mandatory access control system - ${component}";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ joachifm julm phreedom thoughtpolice ];
+    license = with licenses; [ gpl2Only lgpl21Only ];
+    maintainers = with maintainers; [ julm thoughtpolice ajs124 ];
     platforms = platforms.linux;
   };
 
-  apparmor-sources = fetchurl {
-    url = "https://launchpad.net/apparmor/${lib.versions.majorMinor apparmor-version}/${apparmor-version}/+download/apparmor-${apparmor-version}.tar.gz";
-    sha256 = "096zbg3v7b51x7f1ly61mzd3iy9alad6sd4lam98j2d6v5ragbcg";
+  apparmor-sources = fetchFromGitLab {
+    owner = "apparmor";
+    repo = "apparmor";
+    rev = "v${apparmor-version}";
+    hash = "sha256-VPgRmmQv+kgLduc6RTu9gotyjT6OImUXsPeatgG7m9E=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
@@ -44,10 +48,12 @@ let
   prePatchCommon = ''
     chmod a+x ./common/list_capabilities.sh ./common/list_af_names.sh
     patchShebangs ./common/list_capabilities.sh ./common/list_af_names.sh
-    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man"
-    substituteInPlace ./common/Make.rules --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html"
-    substituteInPlace ./common/Make.rules --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
-    substituteInPlace ./common/Make.rules --replace "/usr/share/man" "share/man"
+    substituteInPlace ./common/Make.rules \
+      --replace "/usr/bin/pod2man" "${buildPackages.perl}/bin/pod2man" \
+      --replace "/usr/bin/pod2html" "${buildPackages.perl}/bin/pod2html" \
+      --replace "/usr/share/man" "share/man"
+    substituteInPlace ./utils/Makefile \
+      --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
   '';
 
   patches = lib.optionals stdenv.hostPlatform.isMusl [
@@ -56,7 +62,9 @@ let
       name = "0003-Added-missing-typedef-definitions-on-parser.patch";
       sha256 = "0yyaqz8jlmn1bm37arggprqz0njb4lhjni2d9c8qfqj0kll0bam0";
     })
-    ];
+  ];
+
+  python = python3.withPackages (ps: with ps; [ setuptools ]);
 
   # Set to `true` after the next FIXME gets fixed or this gets some
   # common derivation infra. Too much copy-paste to fix one by one.
@@ -65,9 +73,16 @@ let
   # FIXME: convert these to a single multiple-outputs package?
 
   libapparmor = stdenv.mkDerivation {
-    name = "libapparmor-${apparmor-version}";
+    pname = "libapparmor";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
+   # checking whether python bindings are enabled... yes
+   # checking for python3... no
+   # configure: error: python is required when enabling python bindings
+    strictDeps = false;
+
     nativeBuildInputs = [
       autoreconfHook
       bison
@@ -77,9 +92,9 @@ let
       ncurses
       which
       perl
-    ];
+    ] ++ lib.optional withPython python;
 
-    buildInputs = []
+    buildInputs = [ libxcrypt ]
       ++ lib.optional withPerl perl
       ++ lib.optional withPython python;
 
@@ -88,13 +103,13 @@ let
 
     prePatch = prePatchCommon + ''
       substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.am --replace install_vendor install_site
-      substituteInPlace ./libraries/libapparmor/swig/perl/Makefile.in --replace install_vendor install_site
-      substituteInPlace ./libraries/libapparmor/src/Makefile.am --replace "/usr/include/netinet/in.h" "${lib.getDev stdenv.cc.libc}/include/netinet/in.h"
-      substituteInPlace ./libraries/libapparmor/src/Makefile.in --replace "/usr/include/netinet/in.h" "${lib.getDev stdenv.cc.libc}/include/netinet/in.h"
     '';
     inherit patches;
 
-    postPatch = "cd ./libraries/libapparmor";
+    postPatch = ''
+      cd ./libraries/libapparmor
+    '';
+
     # https://gitlab.com/apparmor/apparmor/issues/1
     configureFlags = [
       (lib.withFeature withPerl "perl")
@@ -113,17 +128,31 @@ let
     meta = apparmor-meta "library";
   };
 
-  apparmor-utils = stdenv.mkDerivation {
-    name = "apparmor-utils-${apparmor-version}";
+  apparmor-utils = python.pkgs.buildPythonApplication {
+    pname = "apparmor-utils";
+    version = apparmor-version;
+    format = "other";
+
     src = apparmor-sources;
 
-    nativeBuildInputs = [ makeWrapper which ];
+    strictDeps = true;
+
+    nativeBuildInputs = [ makeWrapper which python ];
 
     buildInputs = [
+      bash
       perl
       python
       libapparmor
+      (libapparmor.python or null)
+    ];
+
+    propagatedBuildInputs = [
       libapparmor.python
+
+      # Used by aa-notify
+      python.pkgs.notify2
+      python.pkgs.psutil
     ];
 
     prePatch = prePatchCommon +
@@ -131,9 +160,12 @@ let
       lib.optionalString stdenv.hostPlatform.isMusl ''
         sed -i ./utils/Makefile -e "/\<vim\>/d"
       '' + ''
-      substituteInPlace ./utils/apparmor/easyprof.py --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
-      substituteInPlace ./utils/apparmor/aa.py --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
-      substituteInPlace ./utils/logprof.conf --replace "/sbin/apparmor_parser" "${apparmor-parser}/bin/apparmor_parser"
+      sed -i -E 's/^(DESTDIR|BINDIR|PYPREFIX)=.*//g' ./utils/Makefile
+
+      sed -i utils/aa-unconfined -e "/my_env\['PATH'\]/d"
+
+      substituteInPlace utils/aa-remove-unknown \
+       --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
     '';
     inherit patches;
     postPatch = "cd ./utils";
@@ -141,19 +173,8 @@ let
     installFlags = [ "DESTDIR=$(out)" "BINDIR=$(out)/bin" "VIM_INSTALL_PATH=$(out)/share" "PYPREFIX=" ];
 
     postInstall = ''
-      sed -i $out/bin/aa-unconfined -e "/my_env\['PATH'\]/d"
-      for prog in aa-audit aa-autodep aa-cleanprof aa-complain aa-disable aa-enforce aa-genprof aa-logprof aa-mergeprof aa-unconfined ; do
-        wrapProgram $out/bin/$prog --prefix PYTHONPATH : "$out/lib/${python.libPrefix}/site-packages:$PYTHONPATH"
-      done
-
-      substituteInPlace $out/bin/aa-notify \
-        --replace /usr/bin/notify-send ${libnotify}/bin/notify-send \
-        --replace /usr/bin/perl "${perl}/bin/perl -I ${libapparmor}/${perl.libPrefix}"
-
-      substituteInPlace $out/bin/aa-remove-unknown \
-       --replace "/lib/apparmor/rc.apparmor.functions" "${apparmor-parser}/lib/apparmor/rc.apparmor.functions"
       wrapProgram $out/bin/aa-remove-unknown \
-       --prefix PATH : ${lib.makeBinPath [gawk]}
+       --prefix PATH : ${lib.makeBinPath [ gawk ]}
 
       ln -s ${aa-teardown} $out/bin/aa-teardown
     '';
@@ -166,13 +187,14 @@ let
   };
 
   apparmor-bin-utils = stdenv.mkDerivation {
-    name = "apparmor-bin-utils-${apparmor-version}";
+    pname = "apparmor-bin-utils";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     nativeBuildInputs = [
       pkg-config
       libapparmor
-      gawk
       which
     ];
 
@@ -181,7 +203,9 @@ let
     ];
 
     prePatch = prePatchCommon;
-    postPatch = "cd ./binutils";
+    postPatch = ''
+      cd ./binutils
+    '';
     makeFlags = [ "LANGS=" "USE_SYSTEM=1" ];
     installFlags = [ "DESTDIR=$(out)" "BINDIR=$(out)/bin" "SBINDIR=$(out)/bin" ];
 
@@ -191,7 +215,9 @@ let
   };
 
   apparmor-parser = stdenv.mkDerivation {
-    name = "apparmor-parser-${apparmor-version}";
+    pname = "apparmor-parser";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     nativeBuildInputs = [ bison flex which ];
@@ -199,17 +225,20 @@ let
     buildInputs = [ libapparmor ];
 
     prePatch = prePatchCommon + ''
-      substituteInPlace ./parser/Makefile --replace "/usr/bin/bison" "${bison}/bin/bison"
-      substituteInPlace ./parser/Makefile --replace "/usr/bin/flex" "${flex}/bin/flex"
-      substituteInPlace ./parser/Makefile --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h"
       ## techdoc.pdf still doesn't build ...
-      substituteInPlace ./parser/Makefile --replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
+      substituteInPlace ./parser/Makefile \
+        --replace "/usr/bin/bison" "${bison}/bin/bison" \
+        --replace "/usr/bin/flex" "${flex}/bin/flex" \
+        --replace "/usr/include/linux/capability.h" "${linuxHeaders}/include/linux/capability.h" \
+        --replace "manpages htmlmanpages pdf" "manpages htmlmanpages"
       substituteInPlace parser/rc.apparmor.functions \
        --replace "/sbin/apparmor_parser" "$out/bin/apparmor_parser"
       sed -i parser/rc.apparmor.functions -e '2i . ${./fix-rc.apparmor.functions.sh}'
     '';
     inherit patches;
-    postPatch = "cd ./parser";
+    postPatch = ''
+      cd ./parser
+    '';
     makeFlags = [
       "LANGS=" "USE_SYSTEM=1" "INCLUDEDIR=${libapparmor}/include"
       "AR=${stdenv.cc.bintools.targetPrefix}ar"
@@ -222,14 +251,18 @@ let
   };
 
   apparmor-pam = stdenv.mkDerivation {
-    name = "apparmor-pam-${apparmor-version}";
+    pname = "apparmor-pam";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     nativeBuildInputs = [ pkg-config which ];
 
     buildInputs = [ libapparmor pam ];
 
-    postPatch = "cd ./changehat/pam_apparmor";
+    postPatch = ''
+      cd ./changehat/pam_apparmor
+    '';
     makeFlags = [ "USE_SYSTEM=1" ];
     installFlags = [ "DESTDIR=$(out)" ];
 
@@ -239,12 +272,17 @@ let
   };
 
   apparmor-profiles = stdenv.mkDerivation {
-    name = "apparmor-profiles-${apparmor-version}";
+    pname = "apparmor-profiles";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
     nativeBuildInputs = [ which ];
 
-    postPatch = "cd ./profiles";
+    postPatch = ''
+      cd ./profiles
+    '';
+
     installFlags = [ "DESTDIR=$(out)" "EXTRAS_DEST=$(out)/share/apparmor/extra-profiles" ];
 
     inherit doCheck;
@@ -253,10 +291,12 @@ let
   };
 
   apparmor-kernel-patches = stdenv.mkDerivation {
-    name = "apparmor-kernel-patches-${apparmor-version}";
+    pname = "apparmor-kernel-patches";
+    version = apparmor-version;
+
     src = apparmor-sources;
 
-    phases = "unpackPhase installPhase";
+    dontBuild = true;
 
     installPhase = ''
       mkdir "$out"
@@ -268,10 +308,10 @@ let
     meta = apparmor-meta "kernel patches";
   };
 
-  # Generate generic AppArmor rules in a file,
-  # from the closure of given rootPaths.
-  # To be included in an AppArmor profile like so:
-  # include "$(apparmorRulesFromClosure {} [pkgs.hello]}"
+  # Generate generic AppArmor rules in a file, from the closure of given
+  # rootPaths. To be included in an AppArmor profile like so:
+  #
+  #   include "${apparmorRulesFromClosure { } [ pkgs.hello ]}"
   apparmorRulesFromClosure =
     { # The store path of the derivation is given in $path
       additionalRules ? []
@@ -294,7 +334,7 @@ let
     touch $out
     while read -r path
     do printf >>$out "%s,\n" ${lib.concatMapStringsSep " " (x: "\"${x}\"") (baseRules ++ additionalRules)}
-    done <${closureInfo {inherit rootPaths;}}/store-paths
+    done <${closureInfo { inherit rootPaths; }}/store-paths
   '';
 in
 {
diff --git a/pkgs/os-specific/linux/aseq2json/default.nix b/pkgs/os-specific/linux/aseq2json/default.nix
index 646e9f7b7b9..ac1a8220d56 100644
--- a/pkgs/os-specific/linux/aseq2json/default.nix
+++ b/pkgs/os-specific/linux/aseq2json/default.nix
@@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, alsa-lib, glib, json-glib }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "aseq2json";
   version = "unstable-2018-04-28";
   src = fetchFromGitHub {
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
     rev = "8572e6313a0d7ec95492dcab04a46c5dd30ef33a";
     sha256 = "LQ9LLVumi3GN6c9tuMSOd1Bs2pgrwrLLQbs5XF+NZeA=";
   };
-  sourceRoot = "source/aseq2json";
+  sourceRoot = "${finalAttrs.src.name}/aseq2json";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ alsa-lib glib json-glib ];
@@ -25,4 +25,4 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.queezle ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/asus-ec-sensors/default.nix b/pkgs/os-specific/linux/asus-ec-sensors/default.nix
new file mode 100644
index 00000000000..c80f18a78ec
--- /dev/null
+++ b/pkgs/os-specific/linux/asus-ec-sensors/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  name = "asus-ec-sensors-${version}-${kernel.version}";
+  version = "unstable-2022-07-10";
+
+  src = fetchFromGitHub {
+    owner = "zeule";
+    repo = "asus-ec-sensors";
+    rev = "5fbdd1461dc88fc952e02717b8120438ce5558b3";
+    sha256 = "sha256-kBGl8i7HzdItMoM7L91OfX6y+bqDfd22WICRg0n25pI=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
+  ];
+
+  installPhase = ''
+    install asus-ec-sensors.ko -Dm444 -t ${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/hwmon
+  '';
+
+  meta = with lib; {
+    description = "Linux HWMON sensors driver for ASUS motherboards to read sensor data from the embedded controller";
+    homepage = "https://github.com/zeule/asus-ec-sensors";
+    license = licenses.gpl2;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ nickhu ];
+    broken = kernel.kernelOlder "5.11";
+  };
+}
diff --git a/pkgs/os-specific/linux/atop/default.nix b/pkgs/os-specific/linux/atop/default.nix
index b082c594acb..808d1bc4237 100644
--- a/pkgs/os-specific/linux/atop/default.nix
+++ b/pkgs/os-specific/linux/atop/default.nix
@@ -12,16 +12,27 @@
 
 stdenv.mkDerivation rec {
   pname = "atop";
-  version = "2.6.0";
+  version = "2.8.1";
 
   src = fetchurl {
     url = "https://www.atoptool.nl/download/atop-${version}.tar.gz";
-    sha256 = "nsLKOlcWkvfvqglfmaUQZDK8txzCLNbElZfvBIEFj3I=";
+    sha256 = "sha256-lwBYoZt5w0RPlx+FRXKg5jiR3C1fcDf/g3VwhUzg2h4=";
   };
 
-  nativeBuildInputs = lib.optionals withAtopgpu [ python3.pkgs.wrapPython ];
-  buildInputs = [ zlib ncurses ] ++ lib.optionals withAtopgpu [ python3 ];
-  pythonPath = lib.optionals withAtopgpu [ python3.pkgs.pynvml ];
+  nativeBuildInputs = lib.optionals withAtopgpu [
+    python3.pkgs.wrapPython
+  ];
+
+  buildInputs = [
+    zlib
+    ncurses
+  ] ++ lib.optionals withAtopgpu [
+    python3
+  ];
+
+  pythonPath = lib.optionals withAtopgpu [
+    python3.pkgs.pynvml
+  ];
 
   makeFlags = [
     "DESTDIR=$(out)"
@@ -53,12 +64,12 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace 'chmod 04711' 'chmod 0711'
   '';
 
-  installTargets = [ "systemdinstall" ];
   preInstall = ''
     mkdir -p $out/bin
   '';
+
   postInstall = ''
-    # remove extra files we don't need
+    # Remove extra files we don't need
     rm -r $out/{var,etc} $out/bin/atop{sar,}-${version}
   '' + (if withAtopgpu then ''
     wrapPythonPrograms
@@ -70,9 +81,13 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     maintainers = with maintainers; [ raskin ];
     description = "Console system performance monitor";
-
     longDescription = ''
-      Atop is an ASCII full-screen performance monitor that is capable of reporting the activity of all processes (even if processes have finished during the interval), daily logging of system and process activity for long-term analysis, highlighting overloaded system resources by using colors, etc. At regular intervals, it shows system-level activity related to the CPU, memory, swap, disks and network layers, and for every active process it shows the CPU utilization, memory growth, disk utilization, priority, username, state, and exit code.
+      Atop is an ASCII full-screen performance monitor that is capable of reporting the activity of
+      all processes (even if processes have finished during the interval), daily logging of system
+      and process activity for long-term analysis, highlighting overloaded system resources by using
+      colors, etc. At regular intervals, it shows system-level activity related to the CPU, memory,
+      swap, disks and network layers, and for every active process it shows the CPU utilization,
+      memory growth, disk utilization, priority, username, state, and exit code.
     '';
     license = licenses.gpl2Plus;
     downloadPage = "http://atoptool.nl/downloadatop.php";
diff --git a/pkgs/os-specific/linux/atop/default.upstream b/pkgs/os-specific/linux/atop/default.upstream
deleted file mode 100644
index 46099d9c959..00000000000
--- a/pkgs/os-specific/linux/atop/default.upstream
+++ /dev/null
@@ -1,4 +0,0 @@
-url http://atoptool.nl/downloadatop.php
-version_link '[.]tar[.]'
-version '[^0-9]*[-.]([0-9]([-0-9.]*[0-9])?)[.].*' '\1'
-minimize_overwrite
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index 30327fb1082..1e941a13767 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -1,74 +1,73 @@
-{
-  lib, stdenv, buildPackages, fetchurl, fetchpatch,
-  runCommand,
-  autoconf, automake, libtool,
-  enablePython ? false, python ? null,
-}:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, autoreconfHook
+, bash
+, buildPackages
+, libtool
+, linuxHeaders
+, python3
+, swig
 
-assert enablePython -> python != null;
+# Enabling python support while cross compiling would be possible, but the
+# configure script tries executing python to gather info instead of relying on
+# python3-config exclusively
+, enablePython ? stdenv.hostPlatform == stdenv.buildPlatform,
+}:
 
-stdenv.mkDerivation rec {
-  name = "audit-2.8.5"; # at the next release, remove the patches below!
+stdenv.mkDerivation (finalAttrs: {
+  pname = "audit";
+  version = "3.1.2";
 
   src = fetchurl {
-    url = "https://people.redhat.com/sgrubb/audit/${name}.tar.gz";
-    sha256 = "1dzcwb2q78q7x41shcachn7f4aksxbxd470yk38zh03fch1l2p8f";
+    url = "https://people.redhat.com/sgrubb/audit/audit-${finalAttrs.version}.tar.gz";
+    hash = "sha256-wLF5LR8KiMbxgocQUJy7mHBZ/GhxLJdmnKkOrhA9KH0=";
   };
 
+  postPatch = ''
+    substituteInPlace bindings/swig/src/auditswig.i \
+      --replace "/usr/include/linux/audit.h" \
+                "${linuxHeaders}/include/linux/audit.h"
+  '';
+
   outputs = [ "bin" "dev" "out" "man" ];
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isMusl
-    [ autoconf automake libtool ];
-  buildInputs = lib.optional enablePython python;
+  strictDeps = true;
+
+  depsBuildBuild = [
+    buildPackages.stdenv.cc
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ]
+  ++ lib.optionals enablePython [
+    python3
+    swig
+  ];
+
+  buildInputs = [
+    bash
+  ];
 
   configureFlags = [
-    # z/OS plugin is not useful on Linux,
-    # and pulls in an extra openldap dependency otherwise
+    # z/OS plugin is not useful on Linux, and pulls in an extra openldap
+    # dependency otherwise
     "--disable-zos-remote"
-    (if enablePython then "--with-python" else "--without-python")
     "--with-arm"
     "--with-aarch64"
+    (if enablePython then "--with-python" else "--without-python")
   ];
 
   enableParallelBuilding = true;
 
-  # TODO: Remove the musl patches when
-  #         https://github.com/linux-audit/audit-userspace/pull/25
-  #       is available with the next release.
-  patches = [ ./patches/weak-symbols.patch ]
-  ++ lib.optional stdenv.hostPlatform.isMusl [
-    (
-      let patch = fetchpatch {
-            url = "https://github.com/linux-audit/audit-userspace/commit/d579a08bb1cde71f939c13ac6b2261052ae9f77e.patch";
-            name = "Add-substitue-functions-for-strndupa-rawmemchr.patch";
-            sha256 = "015bvzflg1s1k5viap30nznlpjj44a66khyc8yq0waa68qwvdlsd";
-          };
-      in
-        runCommand "Add-substitue-functions-for-strndupa-rawmemchr.patch-fix-copyright-merge-conflict" {} ''
-          cp ${patch} $out
-          substituteInPlace $out --replace \
-              '-* Copyright (c) 2007-09,2011-16,2018 Red Hat Inc., Durham, North Carolina.' \
-              '-* Copyright (c) 2007-09,2011-16 Red Hat Inc., Durham, North Carolina.'
-        ''
-    )
-  ];
-
-  prePatch = ''
-    sed -i 's,#include <sys/poll.h>,#include <poll.h>\n#include <limits.h>,' audisp/audispd.c
-  ''
-  # According to https://stackoverflow.com/questions/13089166
-  # --whole-archive linker flag is required to be sure that linker
-  # correctly chooses strong version of symbol regardless of order of
-  # object files at command line.
-  + lib.optionalString stdenv.hostPlatform.isStatic ''
-    export LDFLAGS=-Wl,--whole-archive
-  '';
   meta = {
-    description = "Audit Library";
     homepage = "https://people.redhat.com/sgrubb/audit/";
-    license = lib.licenses.gpl2;
+    description = "Audit Library";
+    changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ ];
   };
-}
+})
diff --git a/pkgs/os-specific/linux/audit/patches/weak-symbols.patch b/pkgs/os-specific/linux/audit/patches/weak-symbols.patch
deleted file mode 100644
index 301ea9a5476..00000000000
--- a/pkgs/os-specific/linux/audit/patches/weak-symbols.patch
+++ /dev/null
@@ -1,147 +0,0 @@
-Executables in src/ directory are built from source files in src/
-and are linked to libauparse, with both src/auditd-config.c and
-auparse/auditd-config.c defining "free_config" function.
-
-It is known (although obscure) behaviour of shared libraries that
-symbol defined in binary itself overrides symbol in shared library;
-with static linkage it expectedly results in multiple definition
-error.
-
-This set of fixes explicitly marks libauparse versions of
-conflicting functions as weak to have behaviour coherent with
-dynamic linkage version -- definitions in src/ overriding definition
-in auparse/.
-
-Still, this architecture is very strange and confusing.
-
-diff -r -U5 audit-2.8.5-orig/auparse/auditd-config.c audit-2.8.5/auparse/auditd-config.c
---- audit-2.8.5-orig/auparse/auditd-config.c	2019-03-01 20:19:13.000000000 +0000
-+++ audit-2.8.5/auparse/auditd-config.c	2021-01-13 11:36:12.716226498 +0000
-@@ -68,10 +68,11 @@
- };
- 
- /*
-  * Set everything to its default value
- */
-+#pragma weak clear_config
- void clear_config(struct daemon_conf *config)
- {
- 	config->local_events = 1;
- 	config->qos = QOS_NON_BLOCKING;
- 	config->sender_uid = 0;
-@@ -322,10 +323,11 @@
- 	if (config->log_file == NULL)
- 		return 1;
- 	return 0;
- }
- 
-+#pragma weak free_config
- void free_config(struct daemon_conf *config)
- {
- 	free((void*)config->log_file);
- }
- 
-diff -r -U5 audit-2.8.5-orig/auparse/interpret.c audit-2.8.5/auparse/interpret.c
---- audit-2.8.5-orig/auparse/interpret.c	2019-03-01 20:19:13.000000000 +0000
-+++ audit-2.8.5/auparse/interpret.c	2021-01-13 11:39:42.107217224 +0000
-@@ -545,10 +545,11 @@
- 	else
- 		snprintf(buf, size, "unknown(%d)", uid);
- 	return buf;
- }
- 
-+#pragma weak aulookup_destroy_uid_list
- void aulookup_destroy_uid_list(void)
- {
- 	if (uid_cache_created == 0)
- 		return;
- 
-@@ -2810,10 +2811,11 @@
- 
- /*
-  * This is the main entry point for the auparse library. Call chain is:
-  * auparse_interpret_field -> nvlist_interp_cur_val -> interpret
-  */
-+#pragma weak interpret
- const char *interpret(const rnode *r, auparse_esc_t escape_mode)
- {
- 	const nvlist *nv = &r->nv;
- 	int type;
- 	idata id;
-diff -r -U5 audit-2.8.5-orig/auparse/nvlist.c audit-2.8.5/auparse/nvlist.c
---- audit-2.8.5-orig/auparse/nvlist.c	2019-02-04 14:26:52.000000000 +0000
-+++ audit-2.8.5/auparse/nvlist.c	2021-01-13 11:37:37.190222757 +0000
-@@ -27,10 +27,11 @@
- #include "nvlist.h"
- #include "interpret.h"
- #include "auparse-idata.h"
- 
- 
-+#pragma weak nvlist_create
- void nvlist_create(nvlist *l)
- {
- 	l->head = NULL;
- 	l->cur = NULL;
- 	l->cnt = 0;
-@@ -47,17 +48,19 @@
- 	while (node->next)
- 		node = node->next;
- 	l->cur = node;
- }
- 
-+#pragma weak nvlist_next
- nvnode *nvlist_next(nvlist *l)
- {
- 	if (l->cur)
- 		l->cur = l->cur->next;
- 	return l->cur;
- }
- 
-+#pragma weak nvlist_append
- void nvlist_append(nvlist *l, nvnode *node)
- {
- 	nvnode* newnode = malloc(sizeof(nvnode));
- 
- 	newnode->name = node->name;
-@@ -141,10 +144,11 @@
- 	if (l->cur->interp_val)
- 		return l->cur->interp_val;
- 	return interpret(r, escape_mode);
- }
- 
-+#pragma weak nvlist_clear
- void nvlist_clear(nvlist* l)
- {
- 	nvnode* nextnode;
- 	register nvnode* current;
- 
-diff -r -U5 audit-2.8.5-orig/auparse/strsplit.c audit-2.8.5/auparse/strsplit.c
---- audit-2.8.5-orig/auparse/strsplit.c	2019-03-01 21:15:30.000000000 +0000
-+++ audit-2.8.5/auparse/strsplit.c	2021-01-13 11:38:04.306221556 +0000
-@@ -54,10 +54,11 @@
- 			return NULL;
- 		return s;
- 	}
- }
- 
-+#pragma weak audit_strsplit
- char *audit_strsplit(char *s)
- {
- 	static char *str = NULL;
- 	char *ptr;
- 
-diff -r -U5 audit-2.8.5-orig/lib/strsplit.c audit-2.8.5/lib/strsplit.c
---- audit-2.8.5-orig/lib/strsplit.c	2019-03-01 20:19:13.000000000 +0000
-+++ audit-2.8.5/lib/strsplit.c	2021-01-13 11:38:29.444220443 +0000
-@@ -23,10 +23,11 @@
- 
- #include <string.h>
- #include "libaudit.h"
- #include "private.h"
- 
-+#pragma weak audit_strsplit_r
- char *audit_strsplit_r(char *s, char **savedpp)
- {
- 	char *ptr;
- 
- 	if (s)
diff --git a/pkgs/os-specific/linux/autofs/default.nix b/pkgs/os-specific/linux/autofs/default.nix
index 3055a91161b..48d12abcf2f 100644
--- a/pkgs/os-specific/linux/autofs/default.nix
+++ b/pkgs/os-specific/linux/autofs/default.nix
@@ -1,17 +1,26 @@
 { lib, stdenv, fetchurl, flex, bison, linuxHeaders, libtirpc, mount, umount, nfs-utils, e2fsprogs
-, libxml2, libkrb5, kmod, openldap, sssd, cyrus_sasl, openssl, rpcsvc-proto }:
+, libxml2, libkrb5, kmod, openldap, sssd, cyrus_sasl, openssl, rpcsvc-proto
+, fetchpatch
+}:
 
-let
+stdenv.mkDerivation rec {
   version = "5.1.6";
-  name = "autofs-${version}";
-in stdenv.mkDerivation {
-  inherit name;
+  pname = "autofs";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/daemons/autofs/v5/${name}.tar.xz";
+    url = "mirror://kernel/linux/daemons/autofs/v5/autofs-${version}.tar.xz";
     sha256 = "1vya21mb4izj3khcr3flibv7xc15vvx2v0rjfk5yd31qnzcy7pnx";
   };
 
+  patches = [
+    # glibc 2.34 compat
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/autofs/raw/cc745af5e42396d540d5b3b92fae486e232bf6bd/f/autofs-5.1.7-use-default-stack-size-for-threads.patch";
+      sha256 = "sha256-6ETDFbW7EhHR03xFWF+6OJBgn9NX3WW3bGhTNGodaOc=";
+      excludes = [ "CHANGELOG" ];
+    })
+  ];
+
   preConfigure = ''
     configureFlags="--enable-force-shutdown --enable-ignore-busy --with-path=$PATH"
     export sssldir="${sssd}/lib/sssd/modules"
@@ -29,7 +38,7 @@ in stdenv.mkDerivation {
   '';
 
   # configure script is not finding the right path
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
 
   installPhase = ''
     make install SUBDIRS="lib daemon modules man" # all but samples
diff --git a/pkgs/os-specific/linux/autosuspend/default.nix b/pkgs/os-specific/linux/autosuspend/default.nix
new file mode 100644
index 00000000000..fc2b2f0c4e3
--- /dev/null
+++ b/pkgs/os-specific/linux/autosuspend/default.nix
@@ -0,0 +1,79 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      # autosuspend is incompatible with tzlocal v5
+      # See https://github.com/regebro/tzlocal#api-change
+      tzlocal = super.tzlocal.overridePythonAttrs (prev: {
+        src = prev.src.override {
+          version = "4.3.1";
+          hash = "sha256-7jLvjCCAPBmpbtNmrd09SnKe9jCctcc1mgzC7ut/pGo=";
+        };
+      });
+    };
+  };
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "autosuspend";
+  version = "6.0.0";
+
+  disabled = python3.pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "languitar";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-gS8NNks4GaIGl7cEqWSP53I4/tIV4LypkmZ5vNOjspY=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace '--cov-config=setup.cfg' ""
+  '';
+
+  propagatedBuildInputs = with python.pkgs; [
+    dbus-python
+    icalendar
+    jsonpath-ng
+    lxml
+    mpd2
+    portalocker
+    psutil
+    python-dateutil
+    pytz
+    requests
+    requests-file
+    tzlocal
+  ];
+
+  nativeCheckInputs = with python.pkgs; [
+    freezegun
+    pytest-datadir
+    pytest-httpserver
+    pytest-mock
+    pytestCheckHook
+    python-dbusmock
+  ];
+
+  # Disable tests that need root
+  disabledTests = [
+    "test_smoke"
+    "test_multiple_sessions"
+  ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "A daemon to automatically suspend and wake up a system";
+    homepage = "https://autosuspend.readthedocs.io";
+    changelog = "https://github.com/languitar/autosuspend/releases/tag/v${version}";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ bzizou anthonyroussel ];
+    mainProgram = "autosuspend";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/ax99100/default.nix b/pkgs/os-specific/linux/ax99100/default.nix
new file mode 100644
index 00000000000..761800cfd7b
--- /dev/null
+++ b/pkgs/os-specific/linux/ax99100/default.nix
@@ -0,0 +1,53 @@
+{ kernel, stdenv, kmod, lib, fetchzip, dos2unix }:
+
+stdenv.mkDerivation {
+  pname = "ax99100";
+  version = "1.8.0";
+
+  nativeBuildInputs = [ dos2unix kmod ] ++ kernel.moduleBuildDependencies;
+
+  src = fetchzip {
+    url = "https://www.asix.com.tw/en/support/download/file/1229";
+    sha256 = "1rbp1m01qr6b3nbr72vpbw89pjh8mddc60im78z2yjd951xkbcjh";
+    extension = "tar.bz2";
+  };
+
+  prePatch = ''
+    # The sources come with Windows file endings and that makes
+    # applying patches hard without first fixing the line endings.
+    dos2unix *.c *.h
+  '';
+
+  # The patches are adapted from: https://aur.archlinux.org/packages/asix-ax99100
+  #
+  # We included them here instead of fetching them, because of line
+  # ending issues that are easier to fix manually. Also the
+  # set_termios patch needs to be applied for 6.1 not for 6.0.
+  patches = [
+    ./kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
+    ./kernel-6.1-set_termios-const-ktermios.patch
+  ] ++ lib.optionals (lib.versionAtLeast kernel.version "6.2") [
+    ./kernel-6.2-fix-pointer-type.patch
+    ./kernel-6.4-fix-define-semaphore.patch
+  ];
+
+  patchFlags = [ "-p0" ];
+
+  makeFlags = [ "KDIR='${kernel.dev}/lib/modules/${kernel.modDirVersion}/build'" ];
+
+  installPhase = ''
+    mkdir -p $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/tty/serial
+    cp ax99100.ko $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/tty/serial
+  '';
+
+  meta = {
+    description = "ASIX AX99100 Serial and Parallel Port driver";
+    homepage = "https://www.asix.com.tw/en/product/Interface/PCIe_Bridge/AX99100";
+    # According to the source code in the tarball, the license is gpl2.
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.linux;
+
+    # Older Linux versions need more patches to work.
+    broken = lib.versionOlder kernel.version "5.4.0";
+  };
+}
diff --git a/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch b/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
new file mode 100644
index 00000000000..05ec0cfad22
--- /dev/null
+++ b/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
@@ -0,0 +1,14 @@
+diff -pNaru5 a/ax99100_sp.h b/ax99100_sp.h
+--- ax99100_sp.h	2022-06-07 16:55:26.621034945 -0400
++++ ax99100_sp.h	2022-06-07 16:58:32.488989767 -0400
+@@ -255,5 +255,10 @@ struct custom_eeprom {
+ #define _INLINE_
+ #endif
+ 
+ #define DEFAULT99100_BAUD 115200
+ #endif
++
++/* #if LINUX_VERSION_CODE >= KERNEL_VERSION(5,18,0) */
++#define pci_alloc_consistent(hwdev,size,dma_handle) dma_alloc_coherent(&hwdev->dev, size, dma_handle, GFP_ATOMIC)
++#define pci_free_consistent(hwdev,size,vaddr,dma_handle) dma_free_coherent(&hwdev->dev, size, vaddr, dma_handle)
++/* #endif */
diff --git a/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch b/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch
new file mode 100644
index 00000000000..8d75ad454cf
--- /dev/null
+++ b/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch
@@ -0,0 +1,18 @@
+diff -pNaru5 a/ax99100_sp.c b/ax99100_sp.c
+--- ax99100_sp.c	2023-01-02 23:44:46.707423858 -0500
++++ ax99100_sp.c	2023-01-02 23:44:27.171293092 -0500
+@@ -1915,11 +1915,13 @@ static unsigned int serial99100_get_divi
+ 	DEBUG("In %s quot=%u----baud=%u-----------------------------END\n",__FUNCTION__,quot,baud);
+ 	return quot;	
+ }
+ 
+ //This is a port ops function to set the terminal settings.
+-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
++static void serial99100_set_termios(struct uart_port *port, struct ktermios *termios, const struct ktermios *old)
++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
+ static void serial99100_set_termios(struct uart_port *port, struct ktermios *termios, struct ktermios *old)
+ #else
+ static void serial99100_set_termios(struct uart_port *port, struct termios *termios, struct termios *old)
+ #endif
+ {
diff --git a/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch b/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch
new file mode 100644
index 00000000000..39071f2f479
--- /dev/null
+++ b/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch
@@ -0,0 +1,11 @@
+--- ax99100_spi.c
++++ ax99100_spi.c
+@@ -76,7 +76,7 @@ int spi_suspend_count;
+ static unsigned int spi_major = 241;
+ static unsigned int spi_min_count = 0;
+ /* device Class */
+-static char *ax_devnode(struct device *dev, umode_t *mode)
++static char *ax_devnode(const struct device *dev, umode_t *mode)
+ {
+ 	return kasprintf(GFP_KERNEL, "%s", dev_name(dev));
+ }
diff --git a/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch b/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch
new file mode 100644
index 00000000000..434bb559e17
--- /dev/null
+++ b/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch
@@ -0,0 +1,14 @@
+--- ax99100_sp.c
++++ ax99100_sp.c
+@@ -2670,8 +2670,10 @@ static void serial99100_dma_tx_tasklet (unsigned long param)
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)
+ static DECLARE_MUTEX(serial99100_sem);
+-#else
++#elif LINUX_VERSION_CODE < KERNEL_VERSION(6,4,0)
+ static DEFINE_SEMAPHORE(serial99100_sem);
++#else
++static DEFINE_SEMAPHORE(serial99100_sem, 1);
+ #endif
+ 
+ static struct uart_driver starex_serial_driver = {
diff --git a/pkgs/os-specific/linux/batman-adv/alfred.nix b/pkgs/os-specific/linux/batman-adv/alfred.nix
index 96040f2828c..ae7d784591d 100644
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ gpsd libcap libnl ];
 
   preBuild = ''
-    makeFlags="PREFIX=$out PKG_CONFIG=${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config"
+    makeFlags="PREFIX=$out"
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/batman-adv/batctl.nix b/pkgs/os-specific/linux/batman-adv/batctl.nix
index 079624c10ad..b01f48a242a 100644
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libnl ];
 
   preBuild = ''
-    makeFlags="PREFIX=$out PKG_CONFIG=${pkg-config}/bin/${pkg-config.targetPrefix}pkg-config"
+    makeFlags="PREFIX=$out"
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/batman-adv/default.nix b/pkgs/os-specific/linux/batman-adv/default.nix
index 354f4b1bff2..3d22720b962 100644
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -1,4 +1,9 @@
-{ lib, stdenv, fetchurl, kernel }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, kernel
+}:
 
 let cfg = import ./version.nix; in
 
@@ -12,11 +17,13 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
 
   hardeningDisable = [ "pic" ];
 
   preBuild = ''
-    makeFlags="KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," \
       -e /depmod/d Makefile
   '';
diff --git a/pkgs/os-specific/linux/batman-adv/version.nix b/pkgs/os-specific/linux/batman-adv/version.nix
index 71c7863cfa8..53a255fc215 100644
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@@ -1,9 +1,9 @@
 {
-  version = "2021.1";
+  version = "2023.2";
 
   sha256 = {
-    batman-adv = "1l1lk41h4chymrb41ihqrr3p80xdwhhp1kkksr157mzailyq8xxz";
-    alfred = "122y92vqrpp3g6dbjfv8hkhwjlfa3skr91lbzicr0pw8mm6wzqll";
-    batctl = "0xp1cqcw0g0irgw9yhkch01rbn39gzvfxv8b2yya32vbnkmqrcj4";
+    batman-adv = "sha256-OQfc1X4sW/2dQHE5YLlAK/HaT4DFm1/wN3ifu7vY+iU=";
+    alfred = "sha256-qSBgKFZPieW/t3FK4piDoWEPYr4+YcCW4f6zYgBxjg4=";
+    batctl = "sha256-cLX5MfpjYyVpe9829tE0oDxJBvTBfLdlCjxxSQFDbsg=";
   };
 }
diff --git a/pkgs/os-specific/linux/bbswitch/default.nix b/pkgs/os-specific/linux/bbswitch/default.nix
index 837906fb554..8312d64acdd 100644
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -1,8 +1,8 @@
-{ lib, stdenv, fetchurl, fetchpatch, kernel, runtimeShell }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel, runtimeShell }:
 
 let
   baseName = "bbswitch";
-  version = "0.8";
+  version = "unstable-2021-11-29";
   name = "${baseName}-${version}-${kernel.version}";
 
 in
@@ -10,19 +10,18 @@ in
 stdenv.mkDerivation {
   inherit name;
 
-  src = fetchurl {
-    url = "https://github.com/Bumblebee-Project/${baseName}/archive/v${version}.tar.gz";
-    sha256 = "0xql1nv8dafnrcg54f3jsi3ny3cd2ca9iv73pxpgxd2gfczvvjkn";
+  src = fetchFromGitHub {
+    owner = "Bumblebee-Project";
+    repo = "bbswitch";
+    # https://github.com/Bumblebee-Project/bbswitch/tree/develop
+    rev = "23891174a80ea79c7720bcc7048a5c2bfcde5cd9";
+    hash = "sha256-50v1Jxem5kaI1dHOKmgBbPLxI82QeYxiaRHhrHpWRzU=";
   };
 
   patches = [
     (fetchpatch {
-      url = "https://github.com/Bumblebee-Project/bbswitch/pull/102.patch";
-      sha256 = "1lbr6pyyby4k9rn2ry5qc38kc738d0442jhhq57vmdjb6hxjya7m";
-    })
-    (fetchpatch {
-      url = "https://github.com/Bumblebee-Project/bbswitch/pull/196.patch";
-      sha256 = "02ihy3piws7783qbm9q0mb9s18ipn5ckdy1iar74xn31qjrsn99n";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/0bd986055ba52887b81048de5c61e618eec06eb0/trunk/0003-kernel-5.18.patch";
+      sha256 = "sha256-va62/bR1qyBBMPg0lUwCH7slGG0XijxVCsFa4FCoHEQ=";
     })
   ];
 
@@ -32,10 +31,11 @@ stdenv.mkDerivation {
 
   preBuild = ''
     substituteInPlace Makefile \
-      --replace "\$(shell uname -r)" "${kernel.modDirVersion}" \
       --replace "/lib/modules" "${kernel.dev}/lib/modules"
   '';
 
+  makeFlags = kernel.makeFlags;
+
   installPhase = ''
     mkdir -p $out/lib/modules/${kernel.modDirVersion}/misc
     cp bbswitch.ko $out/lib/modules/${kernel.modDirVersion}/misc
@@ -59,5 +59,6 @@ stdenv.mkDerivation {
     platforms = [ "x86_64-linux" "i686-linux" ];
     homepage = "https://github.com/Bumblebee-Project/bbswitch";
     maintainers = with maintainers; [ abbradar ];
+    license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/os-specific/linux/bcc/absolute-ausyscall.patch b/pkgs/os-specific/linux/bcc/absolute-ausyscall.patch
new file mode 100644
index 00000000000..7480e9c5d97
--- /dev/null
+++ b/pkgs/os-specific/linux/bcc/absolute-ausyscall.patch
@@ -0,0 +1,43 @@
+From 01e793163231c5085afced37471df32b94a313f5 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Thu, 30 Dec 2021 06:34:41 +0100
+Subject: [PATCH] absolute ausyscall
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ libbpf-tools/syscall_helpers.c | 2 +-
+ src/python/bcc/syscall.py      | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libbpf-tools/syscall_helpers.c b/libbpf-tools/syscall_helpers.c
+index e114a08f..62adea78 100644
+--- a/libbpf-tools/syscall_helpers.c
++++ b/libbpf-tools/syscall_helpers.c
+@@ -47,7 +47,7 @@ void init_syscall_names(void)
+ 	int err;
+ 	FILE *f;
+ 
+-	f = popen("ausyscall --dump 2>/dev/null", "r");
++	f = popen("@ausyscall@ --dump 2>/dev/null", "r");
+ 	if (!f) {
+ 		warn("popen: ausyscall --dump: %s\n", strerror(errno));
+ 		return;
+diff --git a/src/python/bcc/syscall.py b/src/python/bcc/syscall.py
+index 1346b4e8..e7e29a11 100644
+--- a/src/python/bcc/syscall.py
++++ b/src/python/bcc/syscall.py
+@@ -376,7 +376,7 @@ def _parse_syscall(line):
+ try:
+     # Skip the first line, which is a header. The rest of the lines are simply
+     # SYSCALL_NUM\tSYSCALL_NAME pairs.
+-    out = subprocess.check_output(['ausyscall', '--dump'], stderr=subprocess.STDOUT)
++    out = subprocess.check_output(['@ausyscall@', '--dump'], stderr=subprocess.STDOUT)
+     # remove the first line of expected output
+     out = out.split(b'\n',1)[1]
+     syscalls = dict(map(_parse_syscall, out.strip().split(b'\n')))
+-- 
+2.34.0
+
diff --git a/pkgs/os-specific/linux/bcc/default.nix b/pkgs/os-specific/linux/bcc/default.nix
index 221f38faa87..acdaa6796d6 100644
--- a/pkgs/os-specific/linux/bcc/default.nix
+++ b/pkgs/os-specific/linux/bcc/default.nix
@@ -1,12 +1,26 @@
-{ lib, stdenv, fetchFromGitHub
-, makeWrapper, cmake, llvmPackages, kernel
-, flex, bison, elfutils, python, luajit, netperf, iperf, libelf
-, systemtap, bash, libbpf
+{ audit
+, bash
+, bison
+, cmake
+, elfutils
+, fetchFromGitHub
+, flex
+, iperf
+, lib
+, libbpf
+, llvmPackages
+, luajit
+, makeWrapper
+, netperf
+, nixosTests
+, python3
+, stdenv
+, zip
 }:
 
-python.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.20.0";
+  version = "0.28.0";
 
   disabled = !stdenv.isLinux;
 
@@ -14,15 +28,14 @@ python.pkgs.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     rev = "v${version}";
-    sha256 = "1xnpz2zv445dp5h0160drv6xlvrnwfj23ngc4dp3clcd59jh1baq";
+    sha256 = "sha256-+ecSaVroDC2bWbio4JsuwEvHQdCMpxLt7hIkeREMJs8=";
   };
   format = "other";
 
   buildInputs = with llvmPackages; [
-    llvm llvm.dev libclang kernel
+    llvm llvm.dev libclang
     elfutils luajit netperf iperf
-    systemtap.stapBuild flex bash
-    libbpf
+    flex bash libbpf
   ];
 
   patches = [
@@ -31,24 +44,46 @@ python.pkgs.buildPythonApplication rec {
     ./fix-deadlock-detector-import.patch
   ];
 
-  propagatedBuildInputs = [ python.pkgs.netaddr ];
-  nativeBuildInputs = [ makeWrapper cmake flex bison llvmPackages.llvm.dev ]
-    # libelf is incompatible with elfutils-libelf
-    ++ lib.filter (x: x != libelf) kernel.moduleBuildDependencies;
+  propagatedBuildInputs = [ python3.pkgs.netaddr ];
+  nativeBuildInputs = [
+    bison
+    cmake
+    flex
+    llvmPackages.llvm.dev
+    makeWrapper
+    python3.pkgs.setuptools
+    zip
+  ];
 
   cmakeFlags = [
-    "-DBCC_KERNEL_MODULES_DIR=${kernel.dev}/lib/modules"
+    "-DBCC_KERNEL_MODULES_DIR=/run/booted-system/kernel-modules/lib/modules"
     "-DREVISION=${version}"
     "-DENABLE_USDT=ON"
     "-DENABLE_CPP_API=ON"
     "-DCMAKE_USE_LIBBPF_PACKAGE=ON"
+    "-DENABLE_LIBDEBUGINFOD=OFF"
   ];
 
+  # to replace this executable path:
+  # https://github.com/iovisor/bcc/blob/master/src/python/bcc/syscall.py#L384
+  ausyscall = "${audit}/bin/ausyscall";
+
   postPatch = ''
     substituteAll ${./libbcc-path.patch} ./libbcc-path.patch
     patch -p1 < libbcc-path.patch
+
+    substituteAll ${./absolute-ausyscall.patch} ./absolute-ausyscall.patch
+    patch -p1 < absolute-ausyscall.patch
+
+    # https://github.com/iovisor/bcc/issues/3996
+    substituteInPlace src/cc/libbcc.pc.in \
+      --replace '$'{exec_prefix}/@CMAKE_INSTALL_LIBDIR@ @CMAKE_INSTALL_FULL_LIBDIR@
   '';
 
+  preInstall = ''
+    # required for setuptool during install
+    export PYTHONPATH=$out/${python3.sitePackages}:$PYTHONPATH
+  '';
   postInstall = ''
     mkdir -p $out/bin $out/share
     rm -r $out/share/bcc/tools/old
@@ -72,10 +107,16 @@ python.pkgs.buildPythonApplication rec {
     wrapPythonProgramsIn "$out/share/bcc/tools" "$out $pythonPath"
   '';
 
+  outputs = [ "out" "man" ];
+
+  passthru.tests = {
+    bpf = nixosTests.bpf;
+  };
+
   meta = with lib; {
     description = "Dynamic Tracing Tools for Linux";
     homepage    = "https://iovisor.github.io/bcc/";
     license     = licenses.asl20;
-    maintainers = with maintainers; [ ragge mic92 thoughtpolice ];
+    maintainers = with maintainers; [ ragge mic92 thoughtpolice martinetd ];
   };
 }
diff --git a/pkgs/os-specific/linux/below/default.nix b/pkgs/os-specific/linux/below/default.nix
new file mode 100644
index 00000000000..0a91fd58590
--- /dev/null
+++ b/pkgs/os-specific/linux/below/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, clang
+, pkg-config
+, elfutils
+, rustfmt
+, zlib
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "below";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "facebookincubator";
+    repo = "below";
+    rev = "v${version}";
+    sha256 = "sha256-d5a/M2XEw2E2iydopzedqZ/XfQU7KQyTC5NrPTeeNLg=";
+  };
+
+  cargoSha256 = "sha256-EoRCmEe9SAySZCm+QhaR4ngik4Arnm4SZjgDM5fSRmk=";
+
+  prePatch = ''sed -i "s,ExecStart=.*/bin,ExecStart=$out/bin," etc/below.service'';
+  postInstall = ''
+    install -d $out/lib/systemd/system
+    install -t $out/lib/systemd/system etc/below.service
+  '';
+
+  # bpf code compilation
+  hardeningDisable = [ "stackprotector" ];
+
+  nativeBuildInputs = [ clang pkg-config rustfmt ];
+  buildInputs = [ elfutils zlib ];
+
+  # needs /sys/fs/cgroup
+  doCheck = false;
+
+  meta = with lib; {
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ globin ];
+    description = "A time traveling resource monitor for modern Linux systems";
+    license = licenses.asl20;
+    homepage = "https://github.com/facebookincubator/below";
+    mainProgram = "below";
+  };
+}
diff --git a/pkgs/os-specific/linux/bionic-prebuilt/default.nix b/pkgs/os-specific/linux/bionic-prebuilt/default.nix
index 920732a2020..3ce10735f1d 100644
--- a/pkgs/os-specific/linux/bionic-prebuilt/default.nix
+++ b/pkgs/os-specific/linux/bionic-prebuilt/default.nix
@@ -1,23 +1,50 @@
-{ stdenvNoCC, lib, fetchzip, pkgs
+{ stdenv, stdenvNoCC, lib, fetchzip, pkgs
+, enableStatic ? stdenv.hostPlatform.isStatic
+, enableShared ? !stdenv.hostPlatform.isStatic
 }:
 let
 
-  prebuilt_crt = fetchzip {
-    url =  "https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/+archive/98dce673ad97a9640c5d90bbb1c718e75c21e071/lib/gcc/aarch64-linux-android/4.9.x.tar.gz";
-    sha256 = "sha256-LLD2OJi78sNN5NulOsJZl7Ei4F1EUYItGG6eUsKWULc=";
-    stripRoot = false;
+  choosePlatform =
+    let pname = stdenv.hostPlatform.parsed.cpu.name; in
+    pset: pset.${pname} or (throw "bionic-prebuilt: unsupported platform ${pname}");
+
+  prebuilt_crt = choosePlatform {
+    aarch64 = fetchzip {
+      url =  "https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/+archive/98dce673ad97a9640c5d90bbb1c718e75c21e071/lib/gcc/aarch64-linux-android/4.9.x.tar.gz";
+      sha256 = "sha256-LLD2OJi78sNN5NulOsJZl7Ei4F1EUYItGG6eUsKWULc=";
+      stripRoot = false;
+    };
+    x86_64 = fetchzip {
+      url = "https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/+archive/7e8507d2a2d4df3bced561b894576de70f065be4/lib/gcc/x86_64-linux-android/4.9.x.tar.gz";
+      sha256 = "sha256-y7CFLF76pTlj+oYev9taBnL2nlT3+Tx8c6wmicWmKEw=";
+      stripRoot = false;
+    };
   };
 
-  prebuilt_libs = fetchzip {
-    url = "https://android.googlesource.com/platform/prebuilts/ndk/+archive/f2c77d8ba8a7f5c2d91771e31164f29be0b8ff98/platform/platforms/android-30/arch-arm64/usr/lib.tar.gz";
-    sha256 = "sha256-TZBV7+D1QvKOCEi+VNGT5SStkgj0xRbyWoLH65zSrjw=";
-    stripRoot = false;
+  prebuilt_libs = choosePlatform {
+    aarch64 = fetchzip {
+      url = "https://android.googlesource.com/platform/prebuilts/ndk/+archive/f2c77d8ba8a7f5c2d91771e31164f29be0b8ff98/platform/platforms/android-30/arch-arm64/usr/lib.tar.gz";
+      sha256 = "sha256-TZBV7+D1QvKOCEi+VNGT5SStkgj0xRbyWoLH65zSrjw=";
+      stripRoot = false;
+    };
+    x86_64 = fetchzip {
+      url = "https://android.googlesource.com/platform/prebuilts/ndk/+archive/f2c77d8ba8a7f5c2d91771e31164f29be0b8ff98/platform/platforms/android-30/arch-x86_64/usr/lib64.tar.gz";
+      sha256 = "sha256-n2EuOKy3RGKmEYofNlm+vDDBuiQRuAJEJT6wq6NEJQs=";
+      stripRoot = false;
+    };
   };
 
-  prebuilt_ndk_crt = fetchzip {
-    url = "https://android.googlesource.com/toolchain/prebuilts/ndk/r23/+archive/6c5fa4c0d3999b9ee932f6acbd430eb2f31f3151/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/aarch64-linux-android/30.tar.gz";
-    sha256 = "sha256-KHw+cCwAwlm+5Nwp1o8WONqdi4BBDhFaVVr+7GxQ5uE=";
-    stripRoot = false;
+  prebuilt_ndk_crt = choosePlatform {
+    aarch64 = fetchzip {
+      url = "https://android.googlesource.com/toolchain/prebuilts/ndk/r23/+archive/6c5fa4c0d3999b9ee932f6acbd430eb2f31f3151/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/aarch64-linux-android/30.tar.gz";
+      sha256 = "sha256-KHw+cCwAwlm+5Nwp1o8WONqdi4BBDhFaVVr+7GxQ5uE=";
+      stripRoot = false;
+    };
+    x86_64 = fetchzip {
+      url = "https://android.googlesource.com/toolchain/prebuilts/ndk/r23/+archive/6c5fa4c0d3999b9ee932f6acbd430eb2f31f3151/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/x86_64-linux-android/30.tar.gz";
+      sha256 = "sha256-XEd7L3cBzn+1pKfji40V92G/uZhHSMMuZcRZaiKkLnk=";
+      stripRoot = false;
+    };
   };
 
   ndk_support_headers = fetchzip {
@@ -39,6 +66,7 @@ in
 stdenvNoCC.mkDerivation rec {
   pname = "bionic-prebuilt";
   version = "ndk-release-r23";
+  name = "${stdenv.hostPlatform.parsed.cpu.name}-${pname}-${version}";
 
   src = fetchzip {
     url = "https://android.googlesource.com/platform/bionic/+archive/00e8ce1142d8823b0d2fc8a98b40119b0f1f02cd.tar.gz";
@@ -92,10 +120,17 @@ stdenvNoCC.mkDerivation rec {
     cp -v ${prebuilt_crt.out}/*.o $out/lib/
     cp -v ${prebuilt_crt.out}/libgcc.a $out/lib/
     cp -v ${prebuilt_ndk_crt.out}/*.o $out/lib/
+  '' + lib.optionalString enableShared ''
     for i in libc.so libm.so libdl.so liblog.so; do
       cp -v ${prebuilt_libs.out}/$i $out/lib/
     done
-
+  '' + lib.optionalString enableStatic ''
+    # no liblog.a; while it's also part of the base libraries,
+    # it's only available as shared object in the prebuilts.
+    for i in libc.a libm.a libdl.a; do
+      cp -v ${prebuilt_ndk_crt.out}/$i $out/lib/
+    done
+  '' + ''
     mkdir -p $dev/include
     cp -v $out/include/*.h $dev/include/
   '';
diff --git a/pkgs/os-specific/linux/blktrace/default.nix b/pkgs/os-specific/linux/blktrace/default.nix
index fb5a5d06212..d1b2376e7bd 100644
--- a/pkgs/os-specific/linux/blktrace/default.nix
+++ b/pkgs/os-specific/linux/blktrace/default.nix
@@ -1,24 +1,27 @@
 { lib, stdenv, fetchurl, libaio }:
 
-stdenv.mkDerivation {
-  name = "blktrace-1.2.0";
+stdenv.mkDerivation rec {
+  pname = "blktrace";
+  version = "1.3.0";
 
   # Official source
-  # "git://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git"
+  # "https://git.kernel.org/pub/scm/linux/kernel/git/axboe/blktrace.git"
   src = fetchurl {
-    url = "http://brick.kernel.dk/snaps/blktrace-1.2.0.tar.bz2";
-    sha256 = "0i9z7ayh9qx4wi0ihyz15bhr1c9aknjl8v5i8c9mx3rhyy41i5i6";
+    url = "https://brick.kernel.dk/snaps/blktrace-${version}.tar.bz2";
+    sha256 = "sha256-1t7aA4Yt4r0bG5+6cpu7hi2bynleaqf3yoa2VoEacNY=";
   };
 
   buildInputs = [ libaio ];
 
-  preConfigure = ''
-    sed s,/usr/local,$out, -i Makefile
-  '';
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    "CC:=$(CC)"
+  ];
 
-  meta = {
+  meta = with lib; {
     description = "Block layer IO tracing mechanism";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
+    maintainers = with maintainers; [ nickcao ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/bluez/default.nix b/pkgs/os-specific/linux/bluez/default.nix
index 040b8fc8478..c6c7d9d0f50 100644
--- a/pkgs/os-specific/linux/bluez/default.nix
+++ b/pkgs/os-specific/linux/bluez/default.nix
@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , alsa-lib
 , dbus
 , ell
@@ -11,8 +12,9 @@
 , pkg-config
 , python3
 , readline
-, systemd
+, systemdMinimal
 , udev
+, withExperimental ? false
 }: let
   pythonPath = with python3.pkgs; [
     dbus-python
@@ -21,13 +23,21 @@
   ];
 in stdenv.mkDerivation rec {
   pname = "bluez";
-  version = "5.60";
+  version = "5.70";
 
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/${pname}-${version}.tar.xz";
-    sha256 = "sha256-cQmZWA0B7lnsWF5efAf9lO3e3AAaom/nRkxUb52UUwQ=";
+    sha256 = "sha256-N+Ny6RaVXhRMuIL4iOS+QImPEK47fCE93N1V7pwAkng=";
   };
 
+  patches = [
+    # replace use of a non-standard symbol to fix build with musl libc (pkgsMusl.bluez)
+    (fetchpatch {
+      url = "https://git.alpinelinux.org/aports/plain/main/bluez/max-input.patch?id=32b31b484cb13009bd8081c4106e4cf064ec2f1f";
+      sha256 = "sha256-SczbXtsxBkCO+izH8XOBcrJEO2f7MdtYVT3+2fCV8wU=";
+    })
+  ];
+
   buildInputs = [
     alsa-lib
     dbus
@@ -46,11 +56,11 @@ in stdenv.mkDerivation rec {
     python3.pkgs.wrapPython
   ];
 
-  outputs = [ "out" "dev" ] ++ lib.optional doCheck "test";
+  outputs = [ "out" "dev" "test" ];
 
   postPatch = ''
     substituteInPlace tools/hid2hci.rules \
-      --replace /sbin/udevadm ${systemd}/bin/udevadm \
+      --replace /sbin/udevadm ${systemdMinimal}/bin/udevadm \
       --replace "hid2hci " "$out/lib/udev/hid2hci "
     # Disable some tests:
     # - test-mesh-crypto depends on the following kernel settings:
@@ -75,9 +85,16 @@ in stdenv.mkDerivation rec {
     "--enable-mesh"
     "--enable-midi"
     "--enable-nfc"
-    "--enable-sap"
     "--enable-sixaxis"
-  ];
+    "--enable-btpclient"
+    "--enable-hid2hci"
+    "--enable-logger"
+
+    # To provide ciptool, sdptool, and rfcomm (unmaintained)
+    # superseded by new D-Bus APIs
+    "--enable-deprecated"
+  ] ++ lib.optional withExperimental "--enable-experimental";
+
 
   # Work around `make install' trying to create /var/lib/bluetooth.
   installFlags = [ "statedir=$(TMPDIR)/var/lib/bluetooth" ];
@@ -86,7 +103,7 @@ in stdenv.mkDerivation rec {
 
   doCheck = stdenv.hostPlatform.isx86_64;
 
-  postInstall = lib.optionalString doCheck ''
+  postInstall = ''
     mkdir -p $test/{bin,test}
     cp -a test $test
     pushd $test/test
@@ -112,11 +129,16 @@ in stdenv.mkDerivation rec {
     mkdir $out/etc/bluetooth
     ln -s /etc/bluetooth/main.conf $out/etc/bluetooth/main.conf
 
+    # https://github.com/NixOS/nixpkgs/issues/204418
+    ln -s /etc/bluetooth/input.conf $out/etc/bluetooth/input.conf
+    ln -s /etc/bluetooth/network.conf $out/etc/bluetooth/network.conf
+
     # Add missing tools, ref https://git.archlinux.org/svntogit/packages.git/tree/trunk/PKGBUILD?h=packages/bluez
     for files in `find tools/ -type f -perm -755`; do
       filename=$(basename $files)
       install -Dm755 tools/$filename $out/bin/$filename
     done
+    install -Dm755 attrib/gatttool $out/bin/gatttool
   '';
 
   enableParallelBuilding = true;
@@ -126,6 +148,5 @@ in stdenv.mkDerivation rec {
     homepage = "http://www.bluez.org/";
     license = with licenses; [ gpl2 lgpl21 ];
     platforms = platforms.linux;
-    repositories.git = "https://git.kernel.org/pub/scm/bluetooth/bluez.git";
   };
 }
diff --git a/pkgs/os-specific/linux/bolt/default.nix b/pkgs/os-specific/linux/bolt/default.nix
index d38a97387f5..df618cbff5a 100644
--- a/pkgs/os-specific/linux/bolt/default.nix
+++ b/pkgs/os-specific/linux/bolt/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , meson
 , ninja
 , pkg-config
@@ -12,7 +13,7 @@
 , libxml2
 , libxslt
 , docbook_xml_dtd_45
-, docbook_xsl
+, docbook-xsl-nons
 , glib
 , systemd
 , polkit
@@ -20,60 +21,65 @@
 
 stdenv.mkDerivation rec {
   pname = "bolt";
-  version = "0.9.1";
+  version = "0.9.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "bolt";
     repo = "bolt";
     rev = version;
-    sha256 = "1phgp8fs0dlj74kbkqlvfniwc32daz47b3pvsxlfxqzyrp77xrfm";
+    sha256 = "sha256-sJBY/pXUX5InLynsvAmapW54UF/WGn9eDlluWXjhubQ=";
   };
 
+  patches = [
+    # meson install tries to create /var/lib/boltd
+    ./0001-skip-mkdir.patch
+
+    # Test does not work on ZFS with atime disabled.
+    # Upstream issue: https://gitlab.freedesktop.org/bolt/bolt/-/issues/167
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/bolt/bolt/-/commit/c2f1d5c40ad71b20507e02faa11037b395fac2f8.diff";
+      revert = true;
+      sha256 = "6w7ll65W/CydrWAVi/qgzhrQeDv1PWWShulLxoglF+I=";
+    })
+  ];
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
     asciidoc
     docbook_xml_dtd_45
-    docbook_xsl
+    docbook-xsl-nons
     libxml2
     libxslt
     meson
     ninja
     pkg-config
+    glib
   ] ++ lib.optional (!doCheck) python3;
 
   buildInputs = [
-    glib
     polkit
     systemd
   ];
 
-  doCheck = true;
+  # https://gitlab.freedesktop.org/bolt/bolt/-/issues/181
+  doCheck = false;
 
   preCheck = ''
     export LD_LIBRARY_PATH=${umockdev.out}/lib/
   '';
 
-  checkInputs = [
+  nativeCheckInputs = [
     dbus
     gobject-introspection
     umockdev
-    (python3.withPackages
+    (python3.pythonOnBuildForHost.withPackages
       (p: [ p.pygobject3 p.dbus-python p.python-dbusmock ]))
   ];
 
-  patches = [
-    # meson install tries to create /var/lib/boltd
-    ./0001-skip-mkdir.patch
-
-    # https://github.com/NixOS/nixpkgs/issues/104429
-    # Upstream issue: https://gitlab.freedesktop.org/bolt/bolt/-/issues/167
-    (fetchpatch {
-      name = "disable-atime-tests.diff";
-      url = "https://gitlab.freedesktop.org/roberth/bolt/-/commit/1f672a7de2ebc4dd51590bb90f3b873a8ac0f4e6.diff";
-      sha256 = "134f5s6kjqs6612pwq5pm1miy58crn1kxbyyqhzjnzmf9m57fnc8";
-    })
-    ];
-
   postPatch = ''
     patchShebangs scripts tests
   '';
diff --git a/pkgs/os-specific/linux/bpfmon/default.nix b/pkgs/os-specific/linux/bpfmon/default.nix
new file mode 100644
index 00000000000..f0815376c2a
--- /dev/null
+++ b/pkgs/os-specific/linux/bpfmon/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, libpcap
+, yascreen
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bpfmon";
+  version = "2.52";
+
+  src = fetchFromGitHub {
+    owner = "bbonev";
+    repo = "bpfmon";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-W7OnrC+FCxMd4YbYiybjIvO0LT7Hr1/0Y3BQwItaTBs=";
+  };
+
+  buildInputs = [
+    libpcap
+    yascreen
+  ];
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  meta = with lib; {
+    description = "BPF based visual packet rate monitor";
+    homepage = "https://github.com/bbonev/bpfmon";
+    changelog = "https://github.com/bbonev/bpfmon/releases/tag/v${version}";
+    maintainers = with maintainers; [ arezvov ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/bpftools/default.nix b/pkgs/os-specific/linux/bpftools/default.nix
index f2ca8d87471..a23c4eb7b9e 100644
--- a/pkgs/os-specific/linux/bpftools/default.nix
+++ b/pkgs/os-specific/linux/bpftools/default.nix
@@ -1,15 +1,28 @@
-{ lib, stdenv
-, libopcodes, libbfd, libelf, readline
-, linuxPackages_latest, zlib
+{ lib, stdenv, linuxHeaders
+, libopcodes, libopcodes_2_38
+, libbfd, libbfd_2_38
+, elfutils, readline
+, zlib
 , python3, bison, flex
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "bpftools";
-  inherit (linuxPackages_latest.kernel) version src;
+
+  inherit (linuxHeaders) version src;
+
+  separateDebugInfo = true;
+
+  patches = [
+    # fix unknown type name '__vector128' on ppc64le
+    ./include-asm-types-for-ppc64le.patch
+  ];
 
   nativeBuildInputs = [ python3 bison flex ];
-  buildInputs = [ libopcodes libbfd libelf zlib readline ];
+  buildInputs = (if (lib.versionAtLeast version "5.20")
+                 then [ libopcodes libbfd ]
+                 else [ libopcodes_2_38 libbfd_2_38 ])
+    ++ [ elfutils zlib readline ];
 
   preConfigure = ''
     patchShebangs scripts/bpf_doc.py
diff --git a/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch b/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch
new file mode 100644
index 00000000000..47c8f8077a5
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftools/include-asm-types-for-ppc64le.patch
@@ -0,0 +1,13 @@
+diff --git a/tools/include/uapi/linux/types.h b/tools/include/uapi/linux/types.h
+index 91fa51a9c31d..bfbd9b47277f 100644
+--- a/tools/include/uapi/linux/types.h
++++ b/tools/include/uapi/linux/types.h
+@@ -2,7 +2,7 @@
+ #ifndef _UAPI_LINUX_TYPES_H
+ #define _UAPI_LINUX_TYPES_H
+ 
+-#include <asm-generic/int-ll64.h>
++#include <asm/types.h>
+ 
+ /* copied from linux:include/uapi/linux/types.h */
+ #define __bitwise
diff --git a/pkgs/os-specific/linux/bpftrace/default.nix b/pkgs/os-specific/linux/bpftrace/default.nix
index 4d2f29491fc..ecb34c373b7 100644
--- a/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/pkgs/os-specific/linux/bpftrace/default.nix
@@ -1,61 +1,71 @@
-{ lib, stdenv, fetchFromGitHub
+{ lib, stdenv, fetchFromGitHub, fetchpatch
+, llvmPackages, elfutils, bcc
+, libbpf, libbfd, libopcodes
+, cereal, asciidoctor
 , cmake, pkg-config, flex, bison
-, llvmPackages, kernel, elfutils
-, libelf, libbfd, libbpf, libopcodes, bcc
+, util-linux
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.13.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
-    owner  = "iovisor";
-    repo   = "bpftrace";
-    rev    = "v${version}";
-    sha256 = "sha256-BKWBdFzj0j7rAfG30A0fwyYCpOG/5NFRPODW46EP1u0=";
+    owner = "iovisor";
+    repo  = "bpftrace";
+    rev   = "v${version}";
+    hash  = "sha256-JyMogqyntSm2IDXzsOIjcUkf2YwG2oXKpqPpdx/eMNI=";
   };
 
-  buildInputs = with llvmPackages;
-    [ llvm libclang
-      kernel elfutils libelf bcc
-      libbpf libbfd libopcodes
-    ];
-
-  nativeBuildInputs = [ cmake pkg-config flex bison llvmPackages.llvm.dev ]
-    # libelf is incompatible with elfutils-libelf
-    ++ lib.filter (x: x != libelf) kernel.moduleBuildDependencies;
-
-  # patch the source, *then* substitute on @NIX_KERNEL_SRC@ in the result. we could
-  # also in theory make this an environment variable around bpftrace, but this works
-  # nicely without wrappers.
-  patchPhase = ''
-    patch -p1 < ${./fix-kernel-include-dir.patch}
-    substituteInPlace ./src/utils.cpp \
-      --subst-var-by NIX_KERNEL_SRC '${kernel.dev}/lib/modules/${kernel.modDirVersion}'
-  '';
+
+  buildInputs = with llvmPackages; [
+    llvm libclang
+    elfutils bcc
+    libbpf libbfd libopcodes
+    cereal asciidoctor
+  ];
+
+  nativeBuildInputs = [
+    cmake pkg-config flex bison
+    llvmPackages.llvm.dev
+    util-linux
+  ];
 
   # tests aren't built, due to gtest shenanigans. see:
   #
   #     https://github.com/iovisor/bpftrace/issues/161#issuecomment-453606728
   #     https://github.com/iovisor/bpftrace/pull/363
   #
-  cmakeFlags =
-    [ "-DBUILD_TESTING=FALSE"
-      "-DLIBBCC_INCLUDE_DIRS=${bcc}/include"
-    ];
+  cmakeFlags = [
+    "-DBUILD_TESTING=FALSE"
+    "-DLIBBCC_INCLUDE_DIRS=${bcc}/include"
+    "-DINSTALL_TOOL_DOCS=OFF"
+    "-DUSE_SYSTEM_BPF_BCC=ON"
+  ];
 
-  # nuke the example/reference output .txt files, for the included tools,
-  # stuffed inside $out. we don't need them at all.
+
+  # Pull BPF scripts into $PATH (next to their bcc program equivalents), but do
+  # not move them to keep `${pkgs.bpftrace}/share/bpftrace/tools/...` working.
   postInstall = ''
-    rm -rf $out/share/bpftrace/tools/doc
+    ln -sr $out/share/bpftrace/tools/*.bt $out/bin/
+    # do not use /usr/bin/env for shipped tools
+    # If someone can get patchShebangs to work here please fix.
+    sed -i -e "1s:#!/usr/bin/env bpftrace:#!$out/bin/bpftrace:" $out/share/bpftrace/tools/*.bt
   '';
 
   outputs = [ "out" "man" ];
 
+  passthru.tests = {
+    bpf = nixosTests.bpf;
+  };
+
   meta = with lib; {
     description = "High-level tracing language for Linux eBPF";
     homepage    = "https://github.com/iovisor/bpftrace";
+    changelog   = "https://github.com/iovisor/bpftrace/releases/tag/v${version}";
+    mainProgram = "bpftrace";
     license     = licenses.asl20;
-    maintainers = with maintainers; [ rvl thoughtpolice ];
+    maintainers = with maintainers; [ rvl thoughtpolice martinetd mfrw ];
   };
 }
diff --git a/pkgs/os-specific/linux/bpftrace/fix-kernel-include-dir.patch b/pkgs/os-specific/linux/bpftrace/fix-kernel-include-dir.patch
deleted file mode 100644
index bff370d51e2..00000000000
--- a/pkgs/os-specific/linux/bpftrace/fix-kernel-include-dir.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-commit b6172952c0150d84912fa6f09bab782dd0549f1e
-Author: Austin Seipp <aseipp@pobox.com>
-Date:   Fri May 3 00:47:12 2019 -0500
-
-    src: special case nix build directories for clang
-    
-    Signed-off-by: Austin Seipp <aseipp@pobox.com>
-
-diff --git a/src/clang_parser.cpp b/src/clang_parser.cpp
-index b1db8ff..0cfb01f 100644
---- a/src/utils.cpp
-+++ b/src/utils.cpp
-@@ -140,6 +140,9 @@ static bool is_dir(const std::string& path)
- // Both ksrc and kobj are guaranteed to be != "", if at least some trace of kernel sources was found.
- std::tuple<std::string, std::string> get_kernel_dirs(const struct utsname& utsname)
- {
-+  // NB (aseipp): special case the kernel directory for nix
-+  return { "@NIX_KERNEL_SRC@/source", "@NIX_KERNEL_SRC@/build" };
-+
- #ifdef KERNEL_HEADERS_DIR
-   return {KERNEL_HEADERS_DIR, KERNEL_HEADERS_DIR};
- #endif
diff --git a/pkgs/os-specific/linux/bpftune/default.nix b/pkgs/os-specific/linux/bpftune/default.nix
new file mode 100644
index 00000000000..c2fd9d3f6a5
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftune/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, clang
+, bpftools
+, docutils
+, libbpf
+, libcap
+, libnl
+, nixosTests
+}:
+
+stdenv.mkDerivation rec {
+  pname = "bpftune";
+  version = "unstable-2023-09-11";
+
+  src = fetchFromGitHub {
+    owner = "oracle";
+    repo = "bpftune";
+    rev = "22926812a555eac910eac0699100bac0f8776f1b";
+    hash = "sha256-BflJc5lYWYFIo9LzKfb34F4V1qOI8ywVjnzOLz605DI=";
+  };
+
+  postPatch = ''
+    # otherwise shrink rpath would drop $out/lib from rpath
+    substituteInPlace src/Makefile \
+      --replace /lib64   /lib \
+      --replace /sbin    /bin \
+      --replace ldconfig true
+    substituteInPlace src/bpftune.service \
+      --replace /usr/sbin/bpftune "$out/bin/bpftune"
+    substituteInPlace include/bpftune/libbpftune.h \
+      --replace /usr/lib64/bpftune/       "$out/lib/bpftune/" \
+      --replace /usr/local/lib64/bpftune/ "$out/lib/bpftune/"
+    substituteInPlace src/libbpftune.c \
+      --replace /lib/modules /run/booted-system/kernel-modules/lib/modules
+
+    substituteInPlace src/Makefile sample_tuner/Makefile \
+      --replace 'BPF_INCLUDE := /usr/include' 'BPF_INCLUDE := ${lib.getDev libbpf}/include' \
+  '';
+
+  nativeBuildInputs = [
+    clang
+    bpftools
+    docutils # rst2man
+  ];
+
+  buildInputs = [
+    libbpf
+    libcap
+    libnl
+  ];
+
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+    "confprefix=${placeholder "out"}/etc"
+    "BPFTUNE_VERSION=${version}"
+    "NL_INCLUDE=${lib.getDev libnl}/include/libnl3"
+  ];
+
+  hardeningDisable = [
+    "stackprotector"
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) bpftune;
+  };
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "BPF-based auto-tuning of Linux system parameters";
+    homepage = "https://github.com/oracle-samples/bpftune";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}
diff --git a/pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch b/pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch
deleted file mode 100644
index c9149bfec38..00000000000
--- a/pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch
+++ /dev/null
@@ -1,11 +0,0 @@
-diff --git a/libbridge/libbridge.h b/libbridge/libbridge.h
-index 39964f2..dd14bae 100644
---- a/libbridge/libbridge.h
-+++ b/libbridge/libbridge.h
-@@ -20,6 +20,7 @@
- #define _LIBBRIDGE_H
-
- #include <sys/socket.h>
-+#include <netinet/in.h>
- #include <linux/if.h>
- #include <linux/if_bridge.h>
diff --git a/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch b/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch
index efa41075644..21b089179ce 100644
--- a/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch
+++ b/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch
@@ -1,7 +1,5 @@
-diff --git a/configure.in b/configure.in
-index 5e3f89b..19be6d9 100644
---- a/configure.in
-+++ b/configure.in
+--- a/configure.ac
++++ b/configure.ac
 @@ -9,6 +9,7 @@ dnl Checks for programs.
  AC_PROG_CC
  AC_PROG_INSTALL
@@ -10,8 +8,6 @@ index 5e3f89b..19be6d9 100644
  
  dnl Checks for header files.
  AC_HEADER_STDC
-diff --git a/libbridge/Makefile.in b/libbridge/Makefile.in
-index 20512c4..83c802b 100644
 --- a/libbridge/Makefile.in
 +++ b/libbridge/Makefile.in
 @@ -1,7 +1,7 @@
diff --git a/pkgs/os-specific/linux/bridge-utils/default.nix b/pkgs/os-specific/linux/bridge-utils/default.nix
index 12655c3bed6..a03cb12727c 100644
--- a/pkgs/os-specific/linux/bridge-utils/default.nix
+++ b/pkgs/os-specific/linux/bridge-utils/default.nix
@@ -1,29 +1,28 @@
-{ lib, stdenv, fetchurl, autoreconfHook }:
+{ lib, stdenv, fetchurl, autoreconfHook, fetchpatch }:
 
 stdenv.mkDerivation rec {
-  name = "bridge-utils-1.5";
+  pname = "bridge-utils";
+  version = "1.7.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/bridge/${name}.tar.gz";
-    sha256 = "42f9e5fb8f6c52e63a98a43b81bd281c227c529f194913e1c51ec48a393b6688";
+    url = "https://kernel.org/pub/linux/utils/net/bridge-utils/bridge-utils-${version}.tar.xz";
+    sha256 = "sha256-ph2L5PGhQFxgyO841UTwwYwFszubB+W0sxAzU2Fl5g4=";
   };
 
   patches = [
     ./autoconf-ar.patch
-    ./add-ip6-header.patch # Remove patch once the kernel headers are updated
+
+    (fetchpatch {
+      name = "musl-includes.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/bridge-utils/fix-PATH_MAX-on-ppc64le.patch?id=12c9046eee3a0a35665dc4e280c1f5ae2af5845d";
+      sha256 = "sha256-uY1tgJhcm1DFctg9scmC8e+mgowgz4f/oF0+k+x+jqw=";
+    })
   ];
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  postInstall = ''
-    # The bridge utils build does not fail even if the brctl binary
-    # is not build. This test ensures that we fail if we don't produce a brctl
-    # binary.
-    test -f $out/sbin/brctl
-  '';
-
   meta = {
-    description = "https://sourceforge.net/projects/bridge/";
+    description = "An userspace tool to configure linux bridges (deprecated in favour or iproute2).";
     homepage = "https://wiki.linuxfoundation.org/networking/bridge";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/brillo/default.nix b/pkgs/os-specific/linux/brillo/default.nix
index 0736a13ce12..237b6db65b0 100644
--- a/pkgs/os-specific/linux/brillo/default.nix
+++ b/pkgs/os-specific/linux/brillo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "brillo";
-  version = "1.4.9";
+  version = "1.4.12";
 
   src = fetchFromGitLab {
     owner= "cameronnemo";
     repo= "brillo";
     rev= "v${version}";
-    sha256 = "0ab7s60zcgl6hvm0a9rlwq35p25n3jnw6r9256pwl4cdwyjyybsb";
+    sha256 = "sha256-dKGNioWGVAFuB4kySO+QGTnstyAD0bt4/6FBVwuRxJo=";
   };
 
   patches = [
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Backlight and Keyboard LED control tool";
     homepage = "https://gitlab.com/cameronnemo/brillo";
+    mainProgram = "brillo";
     license = [ licenses.gpl3 licenses.bsd0 ];
     platforms = platforms.linux;
     maintainers = [ maintainers.alexarice ];
diff --git a/pkgs/os-specific/linux/broadcom-sta/default.nix b/pkgs/os-specific/linux/broadcom-sta/default.nix
index 527d2253e5b..6b7d8b912fa 100644
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -39,6 +39,15 @@ stdenv.mkDerivation {
     ./linux-5.6.patch
     # source: https://gist.github.com/joanbm/5c640ac074d27fd1d82c74a5b67a1290
     ./linux-5.9.patch
+    # source: https://github.com/archlinux/svntogit-community/blob/33b4bd2b9e30679b03f5d7aa2741911d914dcf94/trunk/012-linux517.patch
+    ./linux-5.17.patch
+    # source: https://github.com/archlinux/svntogit-community/blob/2e1fd240f9ce06f500feeaa3e4a9675e65e6b967/trunk/013-linux518.patch
+    ./linux-5.18.patch
+    # source: https://gist.github.com/joanbm/207210d74637870c01ef5a3c262a597d
+    ./linux-6.0.patch
+    # source: https://gist.github.com/joanbm/94323ea99eff1e1d1c51241b5b651549
+    ./linux-6.1.patch
+    ./pedantic-fix.patch
     ./null-pointer-fix.patch
     ./gcc.patch
   ];
@@ -63,7 +72,7 @@ stdenv.mkDerivation {
     description = "Kernel module driver for some Broadcom's wireless cards";
     homepage = "http://www.broadcom.com/support/802.11/linux_sta.php";
     license = lib.licenses.unfreeRedistributable;
-    maintainers = with lib.maintainers; [ phreedom ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch b/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch
index cfa16075409..9bb093ca49c 100644
--- a/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch
+++ b/pkgs/os-specific/linux/broadcom-sta/i686-build-failure.patch
@@ -1,5 +1,5 @@
-https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=fe47ae6e1a5005b2e82f7eab57b5c3820453293a
-https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=4ea1636b04dbd66536fa387bae2eea463efc705b
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=fe47ae6e1a5005b2e82f7eab57b5c3820453293a
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=4ea1636b04dbd66536fa387bae2eea463efc705b
 
 diff -ru a/src/shared/linux_osl.c b/src/shared/linux_osl.c
 --- a/src/shared/linux_osl.c	2015-09-19 01:47:15.000000000 +0300
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch b/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch
index 566680a0914..44222b3324b 100644
--- a/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch
+++ b/pkgs/os-specific/linux/broadcom-sta/linux-4.7.patch
@@ -2,12 +2,12 @@ Since Linux 4.7, the enum ieee80211_band is no longer used
 
 This shall cause no problem's since both enums ieee80211_band
 and nl80211_band were added in the same commit:
-https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=13ae75b103e07304a34ab40c9136e9f53e06475c
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=13ae75b103e07304a34ab40c9136e9f53e06475c
 
 This patch refactors the references of IEEE80211_BAND_* to NL80211_BAND_*
 
 Reference:
-https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=57fbcce37be7c1d2622b56587c10ade00e96afa3
+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=57fbcce37be7c1d2622b56587c10ade00e96afa3
 
 --- a/src/wl/sys/wl_cfg80211_hybrid.c	2016-06-13 11:57:36.159340297 -0500
 +++ b/src/wl/sys/wl_cfg80211_hybrid.c	2016-06-13 11:58:18.442323435 -0500
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-5.17.patch b/pkgs/os-specific/linux/broadcom-sta/linux-5.17.patch
new file mode 100644
index 00000000000..6f23316691c
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/linux-5.17.patch
@@ -0,0 +1,80 @@
+From 31b7849092c43805c7fbaf7518b99874aa1b310c Mon Sep 17 00:00:00 2001
+From: Joan Bruguera <joanbrugueram@gmail.com>
+Date: Wed, 12 Jan 2022 20:49:20 +0100
+Subject: [PATCH] Tentative fix for broadcom-wl 6.30.223.271 driver for Linux 5.17-rc1
+
+Set netdev->dev_addr through dev_addr_mod + PDE_DATA fix
+
+Since Linux 5.17 netdev->dev_addr is const and must be changed through
+dev_addr_mod, otherwise a warning is logged in dmesg and bad things may happen.
+
+NB: The #if is not wrong, dev_addr_mod is defined since Linux 5.15-rc1
+
+Plus a trivial fix for PDE_DATA.
+
+Applies on top of all the patches applied to broadcom-wl-dkms 6.30.223.271-28 on Arch Linux.
+
+See also: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=adeef3e32146a8d2a73c399dc6f5d76a449131b1
+          https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=359745d78351c6f5442435f81549f0207ece28aa
+---
+ src/wl/sys/wl_linux.c | 16 +++++++++++++---
+ 1 file changed, 13 insertions(+), 3 deletions(-)
+
+diff --git a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
+index e491df7..e4614fb 100644
+--- a/src/wl/sys/wl_linux.c
++++ b/src/wl/sys/wl_linux.c
+@@ -93,6 +93,10 @@ struct iw_statistics *wl_get_wireless_stats(struct net_device *dev);
+ 
+ #include <wlc_wowl.h>
+ 
++#if (LINUX_VERSION_CODE >= KERNEL_VERSION(5, 17, 0))
++#define PDE_DATA pde_data
++#endif
++
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
+ static void wl_timer(struct timer_list *tl);
+ #else
+@@ -490,6 +494,12 @@ wl_if_setup(struct net_device *dev)
+ #endif
+ }
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 15, 0)
++static inline void eth_hw_addr_set(struct net_device *dev, const void *addr) {
++	memcpy(dev->dev_addr, addr, ETHER_ADDR_LEN);
++}
++#endif
++
+ static wl_info_t *
+ wl_attach(uint16 vendor, uint16 device, ulong regs,
+ 	uint bustype, void *btparam, uint irq, uchar* bar1_addr, uint32 bar1_size)
+@@ -634,7 +644,7 @@ wl_attach(uint16 vendor, uint16 device, ulong regs,
+ 			WL_ERROR(("wl%d: Error setting MAC ADDRESS\n", unit));
+ 	}
+ #endif 
+-	bcopy(&wl->pub->cur_etheraddr, dev->dev_addr, ETHER_ADDR_LEN);
++	eth_hw_addr_set(dev, wl->pub->cur_etheraddr.octet);
+ 
+ 	online_cpus = 1;
+ 
+@@ -1835,7 +1845,7 @@ wl_set_mac_address(struct net_device *dev, void *addr)
+ 
+ 	WL_LOCK(wl);
+ 
+-	bcopy(sa->sa_data, dev->dev_addr, ETHER_ADDR_LEN);
++	eth_hw_addr_set(dev, sa->sa_data);
+ 	err = wlc_iovar_op(wl->wlc, "cur_etheraddr", NULL, 0, sa->sa_data, ETHER_ADDR_LEN,
+ 		IOV_SET, (WL_DEV_IF(dev))->wlcif);
+ 	WL_UNLOCK(wl);
+@@ -3010,7 +3020,7 @@ _wl_add_monitor_if(wl_task_t *task)
+ 	else
+ 		dev->type = ARPHRD_IEEE80211_RADIOTAP;
+ 
+-	bcopy(wl->dev->dev_addr, dev->dev_addr, ETHER_ADDR_LEN);
++	eth_hw_addr_set(dev, wl->dev->dev_addr);
+ 
+ #if defined(WL_USE_NETDEV_OPS)
+ 	dev->netdev_ops = &wl_netdev_monitor_ops;
+-- 
+2.35.1
+
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-5.18.patch b/pkgs/os-specific/linux/broadcom-sta/linux-5.18.patch
new file mode 100644
index 00000000000..d837429a689
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/linux-5.18.patch
@@ -0,0 +1,71 @@
+diff -u -r a/src/shared/linux_osl.c b/src/shared/linux_osl.c
+--- a/src/shared/linux_osl.c	2022-05-24 20:51:15.662604980 +0000
++++ b/src/shared/linux_osl.c	2022-05-24 21:13:38.264472425 +0000
+@@ -599,6 +599,8 @@
+ 	va = kmalloc(size, GFP_ATOMIC | __GFP_ZERO);
+ 	if (va)
+ 		*pap = (ulong)__virt_to_phys(va);
++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
++	va = dma_alloc_coherent(&((struct pci_dev *)osh->pdev)->dev, size, (dma_addr_t*)pap, GFP_ATOMIC);
+ #else
+ 	va = pci_alloc_consistent(osh->pdev, size, (dma_addr_t*)pap);
+ #endif
+@@ -612,6 +614,8 @@
+ 
+ #ifdef __ARM_ARCH_7A__
+ 	kfree(va);
++#elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
++	dma_free_coherent(&((struct pci_dev *)osh->pdev)->dev, size, va, (dma_addr_t)pa);
+ #else
+ 	pci_free_consistent(osh->pdev, size, va, (dma_addr_t)pa);
+ #endif
+@@ -623,7 +627,11 @@
+ 	int dir;
+ 
+ 	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
++	dir = (direction == DMA_TX)? DMA_TO_DEVICE: DMA_FROM_DEVICE;
++#else
+ 	dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
++#endif
+ 
+ #if defined(__ARM_ARCH_7A__) && defined(BCMDMASGLISTOSL)
+ 	if (dmah != NULL) {
+@@ -641,7 +649,11 @@
+ 				ASSERT(totsegs + nsegs <= MAX_DMA_SEGS);
+ 				sg->page_link = 0;
+ 				sg_set_buf(sg, PKTDATA(osh, skb), PKTLEN(osh, skb));
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
++				dma_map_single(&((struct pci_dev *)osh->pdev)->dev, PKTDATA(osh, skb), PKTLEN(osh, skb), dir);
++#else
+ 				pci_map_single(osh->pdev, PKTDATA(osh, skb), PKTLEN(osh, skb), dir);
++#endif
+ 			}
+ 			totsegs += nsegs;
+ 			totlen += PKTLEN(osh, skb);
+@@ -656,7 +668,11 @@
+ 	}
+ #endif 
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
++	return (dma_map_single(&((struct pci_dev *)osh->pdev)->dev, va, size, dir));
++#else
+ 	return (pci_map_single(osh->pdev, va, size, dir));
++#endif
+ }
+ 
+ void BCMFASTPATH
+@@ -665,8 +681,13 @@
+ 	int dir;
+ 
+ 	ASSERT((osh && (osh->magic == OS_HANDLE_MAGIC)));
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 18, 0)
++	dir = (direction == DMA_TX)? DMA_TO_DEVICE: DMA_FROM_DEVICE;
++	dma_unmap_single(&((struct pci_dev *)osh->pdev)->dev, (uint32)pa, size, dir);
++#else
+ 	dir = (direction == DMA_TX)? PCI_DMA_TODEVICE: PCI_DMA_FROMDEVICE;
+ 	pci_unmap_single(osh->pdev, (uint32)pa, size, dir);
++#endif
+ }
+ 
+ #if defined(BCMDBG_ASSERT)
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-6.0.patch b/pkgs/os-specific/linux/broadcom-sta/linux-6.0.patch
new file mode 100644
index 00000000000..dcb5515264d
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/linux-6.0.patch
@@ -0,0 +1,30 @@
+From dbee29df729e543a89b3f95c1436e982eb0047c1 Mon Sep 17 00:00:00 2001
+From: Joan Bruguera <joanbrugueram@gmail.com>
+Date: Thu, 30 Jun 2022 02:15:35 +0200
+Subject: [PATCH] Tentative patch for broadcom-wl 6.30.223.271 driver for Linux 6.0-rc1
+
+Applies on top of all the patches applied to broadcom-wl-dkms 6.30.223.271-33 on Arch Linux.
+---
+ src/wl/sys/wl_cfg80211_hybrid.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/src/wl/sys/wl_cfg80211_hybrid.c
+index d815b33..7faa735 100644
+--- a/src/wl/sys/wl_cfg80211_hybrid.c
++++ b/src/wl/sys/wl_cfg80211_hybrid.c
+@@ -2381,7 +2381,12 @@ wl_bss_roaming_done(struct wl_cfg80211_priv *wl, struct net_device *ndev,
+ 	bss = cfg80211_get_bss(wl_to_wiphy(wl), NULL, (s8 *)&wl->bssid,
+ 	ssid->SSID, ssid->SSID_len, WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+ 	struct cfg80211_roam_info roam_info = {
++// Rel. commit "cfg80211: Indicate MLO connection info in connect and roam callbacks" (Veerendranath Jakkam, Wed Jun 8)
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 0, 0)
+ 		.bss = bss,
++#else
++		.links[0].bss = bss,
++#endif
+ 		.req_ie = conn_info->req_ie,
+ 		.req_ie_len = conn_info->req_ie_len,
+ 		.resp_ie = conn_info->resp_ie,
+-- 
+2.37.0
+
diff --git a/pkgs/os-specific/linux/broadcom-sta/linux-6.1.patch b/pkgs/os-specific/linux/broadcom-sta/linux-6.1.patch
new file mode 100644
index 00000000000..5ececd487d7
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/linux-6.1.patch
@@ -0,0 +1,83 @@
+From a63a5f70e5cf05f6bce4cda2e0dd67462e1d76a5 Mon Sep 17 00:00:00 2001
+From: Joan Bruguera <joanbrugueram@gmail.com>
+Date: Mon, 29 Aug 2022 00:06:53 +0200
+Subject: [PATCH] Tentative patch for broadcom-wl 6.30.223.271 driver for Linux 6.1-rc1
+
+Applies on top of all the patches applied to broadcom-wl-dkms 6.30.223.271-35 on Arch Linux
+---
+ src/wl/sys/wl_cfg80211_hybrid.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/src/wl/sys/wl_cfg80211_hybrid.c
+index 4fef22a..50d1e34 100644
+--- a/src/wl/sys/wl_cfg80211_hybrid.c
++++ b/src/wl/sys/wl_cfg80211_hybrid.c
+@@ -105,20 +105,25 @@ static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wd
+ static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm);
+ #endif
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 0)
++#define MAYBE_INT_LINK_ID int link_id,
++#else
++#define MAYBE_INT_LINK_ID
++#endif
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+ static s32 wl_cfg80211_config_default_key(struct wiphy *wiphy,
+-           struct net_device *dev, u8 key_idx, bool unicast, bool multicast);
++           struct net_device *dev, MAYBE_INT_LINK_ID u8 key_idx, bool unicast, bool multicast);
+ #else
+ static s32 wl_cfg80211_config_default_key(struct wiphy *wiphy,
+            struct net_device *dev, u8 key_idx);
+ #endif
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+ static s32 wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+-           u8 key_idx, bool pairwise, const u8 *mac_addr, struct key_params *params);
++           MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr, struct key_params *params);
+ static s32 wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+-           u8 key_idx, bool pairwise, const u8 *mac_addr);
++           MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr);
+ static s32 wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+-           u8 key_idx, bool pairwise, const u8 *mac_addr,
++           MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr,
+            void *cookie, void (*callback) (void *cookie, struct key_params *params));
+ #else
+ static s32 wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+@@ -1165,7 +1170,7 @@ static s32 wl_cfg80211_get_tx_power(struct wiphy *wiphy, s32 *dbm)
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
+ static s32
+ wl_cfg80211_config_default_key(struct wiphy *wiphy,
+-	struct net_device *dev, u8 key_idx, bool unicast, bool multicast)
++	struct net_device *dev, MAYBE_INT_LINK_ID u8 key_idx, bool unicast, bool multicast)
+ #else
+ static s32
+ wl_cfg80211_config_default_key(struct wiphy *wiphy,
+@@ -1190,7 +1195,7 @@ wl_cfg80211_config_default_key(struct wiphy *wiphy,
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+ static s32
+ wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+-                    u8 key_idx, bool pairwise, const u8 *mac_addr, struct key_params *params)
++                    MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr, struct key_params *params)
+ #else
+ static s32
+ wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+@@ -1311,7 +1316,7 @@ wl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *dev,
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+ static s32
+ wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+-                    u8 key_idx, bool pairwise, const u8 *mac_addr)
++                    MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr)
+ #else
+ static s32
+ wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+@@ -1354,7 +1359,7 @@ wl_cfg80211_del_key(struct wiphy *wiphy, struct net_device *dev,
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 37)
+ static s32
+ wl_cfg80211_get_key(struct wiphy *wiphy, struct net_device *dev,
+-                    u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
++                    MAYBE_INT_LINK_ID u8 key_idx, bool pairwise, const u8 *mac_addr, void *cookie,
+                     void (*callback) (void *cookie, struct key_params * params))
+ #else
+ static s32
+-- 
+2.37.2
+
diff --git a/pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch b/pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch
new file mode 100644
index 00000000000..3d190b9d1f8
--- /dev/null
+++ b/pkgs/os-specific/linux/broadcom-sta/pedantic-fix.patch
@@ -0,0 +1,99 @@
+diff --git a/src/shared/linux_osl.c b/src/shared/linux_osl.c
+index 711b771..5a2636a 100644
+--- a/src/shared/linux_osl.c
++++ b/src/shared/linux_osl.c
+@@ -1105,7 +1105,7 @@ osl_os_get_image_block(char *buf, int len, void *image)
+ 	if (!image)
+ 		return 0;
+ 
+-	rdlen = kernel_read(fp, fp->f_pos, buf, len);
++	rdlen = kernel_read(fp, (void *)fp->f_pos, (size_t)len, (loff_t *)buf);
+ 	if (rdlen > 0)
+ 		fp->f_pos += rdlen;
+ 
+diff --git a/src/wl/sys/wl_cfg80211_hybrid.c b/src/wl/sys/wl_cfg80211_hybrid.c
+index 2b3c290..093dce6 100644
+--- a/src/wl/sys/wl_cfg80211_hybrid.c
++++ b/src/wl/sys/wl_cfg80211_hybrid.c
+@@ -790,6 +790,7 @@ wl_set_auth_type(struct net_device *dev, struct cfg80211_connect_params *sme)
+ 		break;
+ 	case NL80211_AUTHTYPE_NETWORK_EAP:
+ 		WL_DBG(("network eap\n"));
++		break;
+ 	default:
+ 		val = 2;
+ 		WL_ERR(("invalid auth type (%d)\n", sme->auth_type));
+@@ -2347,26 +2348,24 @@ wl_bss_roaming_done(struct wl_cfg80211_priv *wl, struct net_device *ndev,
+                     const wl_event_msg_t *e, void *data)
+ {
+ 	struct wl_cfg80211_connect_info *conn_info = wl_to_conn(wl);
++	s32 err = 0;
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 12, 0)
+ 	struct cfg80211_bss *bss;
+ 	struct wlc_ssid *ssid;
++	struct cfg80211_roam_info roam_info;
+ 	ssid = &wl->profile->ssid;
+ 	bss = cfg80211_get_bss(wl_to_wiphy(wl), NULL, (s8 *)&wl->bssid,
+ 	ssid->SSID, ssid->SSID_len, WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+-	struct cfg80211_roam_info roam_info = {
+ // Rel. commit "cfg80211: Indicate MLO connection info in connect and roam callbacks" (Veerendranath Jakkam, Wed Jun 8)
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 0, 0)
+-		.bss = bss,
++	roam_info.bss = bss;
+ #else
+-		.links[0].bss = bss,
++	roam_info.links[0].bss = bss;
+ #endif
+-		.req_ie = conn_info->req_ie,
+-		.req_ie_len = conn_info->req_ie_len,
+-		.resp_ie = conn_info->resp_ie,
+-		.resp_ie_len = conn_info->resp_ie_len,
+-	};
++	roam_info.req_ie = conn_info->req_ie;
++	roam_info.req_ie_len = conn_info->req_ie_len;
++	roam_info.resp_ie = conn_info->resp_ie;
+ #endif
+-	s32 err = 0;
+ 
+ 	wl_get_assoc_ies(wl);
+ 	memcpy(wl->profile->bssid, &e->addr, ETHER_ADDR_LEN);
+diff --git a/src/wl/sys/wl_iw.h b/src/wl/sys/wl_iw.h
+index 3ab084f..471d11f 100644
+--- a/src/wl/sys/wl_iw.h
++++ b/src/wl/sys/wl_iw.h
+@@ -70,7 +70,6 @@ struct cntry_locales_custom {
+ #define	WL_IW_RSSI_EXCELLENT	-57	
+ #define	WL_IW_RSSI_INVALID	 0	
+ #define MAX_WX_STRING 80
+-#define isprint(c) bcm_isprint(c)
+ #define WL_IW_SET_ACTIVE_SCAN	(SIOCIWFIRSTPRIV+1)
+ #define WL_IW_GET_RSSI			(SIOCIWFIRSTPRIV+3)
+ #define WL_IW_SET_PASSIVE_SCAN	(SIOCIWFIRSTPRIV+5)
+diff --git a/src/wl/sys/wl_linux.c b/src/wl/sys/wl_linux.c
+index d13fb98..97ae2a6 100644
+--- a/src/wl/sys/wl_linux.c
++++ b/src/wl/sys/wl_linux.c
+@@ -797,14 +797,15 @@ wl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	pci_read_config_dword(pdev, 0x40, &val);
+ 	if ((val & 0x0000ff00) != 0)
+ 		pci_write_config_dword(pdev, 0x40, val & 0xffff00ff);
+-		bar1_size = pci_resource_len(pdev, 2);
+-		#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
+-		bar1_addr = (uchar *)ioremap(pci_resource_start(pdev, 2),
+-			bar1_size);
+-		#else
+-		bar1_addr = (uchar *)ioremap_nocache(pci_resource_start(pdev, 2),
+-			bar1_size);
+-		#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) */
++
++	bar1_size = pci_resource_len(pdev, 2);
++	#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0)
++	bar1_addr = (uchar *)ioremap(pci_resource_start(pdev, 2),
++		bar1_size);
++	#else
++	bar1_addr = (uchar *)ioremap_nocache(pci_resource_start(pdev, 2),
++		bar1_size);
++	#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 6, 0) */
+ 	wl = wl_attach(pdev->vendor, pdev->device, pci_resource_start(pdev, 0), PCI_BUS, pdev,
+ 		pdev->irq, bar1_addr, bar1_size);
+ 
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index 4949cd7c14a..c72be801aee 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -1,6 +1,7 @@
 { stdenv, lib, buildPackages, fetchurl, fetchFromGitLab
 , enableStatic ? stdenv.hostPlatform.isStatic
 , enableMinimal ? false
+, enableAppletSymlinks ? true
 # Allow forcing musl without switching stdenv itself, e.g. for our bootstrapping:
 # nix build -f pkgs/top-level/release.nix stdenvBootstrapTools.x86_64-linux.dist
 , useMusl ? stdenv.hostPlatform.libc == "musl", musl
@@ -49,14 +50,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "busybox";
-  version = "1.33.1";
+  version = "1.36.1";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "0a0dcvsh7nxnhxc5y73fky0z30i9p7r30qfidm2akn0n5fywdkhj";
+    sha256 = "sha256-uMwkyVdNgJ5yecO+NJeVxdXOtv3xnKcJ+AzeUOR94xQ=";
   };
 
   hardeningDisable = [ "format" "pie" ]
@@ -64,8 +65,20 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./busybox-in-store.patch
+    (fetchurl {
+      name = "CVE-2022-28391.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
+      sha256 = "sha256-yviw1GV+t9tbHbY7YNxEqPi7xEreiXVqbeRyf8c6Awo=";
+    })
+    (fetchurl {
+      name = "CVE-2022-28391.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
+      sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
+    })
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
 
+  separateDebugInfo = true;
+
   postPatch = "patchShebangs .";
 
   configurePhase = ''
@@ -81,10 +94,23 @@ stdenv.mkDerivation rec {
 
     CONFIG_LFS y
 
+    # More features for modprobe.
+    ${lib.optionalString (!enableMinimal) ''
+      CONFIG_FEATURE_MODPROBE_BLACKLIST y
+      CONFIG_FEATURE_MODUTILS_ALIAS y
+      CONFIG_FEATURE_MODUTILS_SYMBOLS y
+      CONFIG_MODPROBE_SMALL n
+    ''}
+
     ${lib.optionalString enableStatic ''
       CONFIG_STATIC y
     ''}
 
+    ${lib.optionalString (!enableAppletSymlinks) ''
+      CONFIG_INSTALL_APPLET_DONT y
+      CONFIG_INSTALL_APPLET_SYMLINKS n
+    ''}
+
     # Use the external mount.cifs program.
     CONFIG_FEATURE_MOUNT_CIFS n
     CONFIG_FEATURE_MOUNT_HELPERS y
@@ -112,6 +138,8 @@ stdenv.mkDerivation rec {
     makeFlagsArray+=("CC=${stdenv.cc.targetPrefix}cc -isystem ${musl.dev}/include -B${musl}/lib -L${musl}/lib")
   '';
 
+  makeFlags = [ "SKIP_STRIP=y" ];
+
   postInstall = ''
     sed -e '
     1 a busybox() { '$out'/bin/busybox "$@"; }\
@@ -135,7 +163,7 @@ stdenv.mkDerivation rec {
     description = "Tiny versions of common UNIX utilities in a single small executable";
     homepage = "https://busybox.net/";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ TethysSvensson ];
+    maintainers = with maintainers; [ TethysSvensson qyliss ];
     platforms = platforms.linux;
     priority = 10;
   };
diff --git a/pkgs/os-specific/linux/can-isotp/default.nix b/pkgs/os-specific/linux/can-isotp/default.nix
index 9c30aae86fe..7c20b74e54c 100644
--- a/pkgs/os-specific/linux/can-isotp/default.nix
+++ b/pkgs/os-specific/linux/can-isotp/default.nix
@@ -13,20 +13,18 @@ stdenv.mkDerivation {
     sha256 = "1laax93czalclg7cy9iq1r7hfh9jigh7igj06y9lski75ap2vhfq";
   };
 
-  KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-  INSTALL_MOD_PATH = "\${out}";
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
-  buildPhase = ''
-    make modules
-  '';
-
-  installPhase = ''
-    make modules_install
-  '';
+  buildFlags = [ "modules" ];
+  installTargets = [ "modules_install" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   meta = with lib; {
+    broken = kernel.kernelAtLeast "5.16";
     description = "Kernel module for ISO-TP (ISO 15765-2)";
     homepage = "https://github.com/hartkopp/can-isotp";
     license = licenses.gpl2;
diff --git a/pkgs/os-specific/linux/can-utils/default.nix b/pkgs/os-specific/linux/can-utils/default.nix
index 90261e82904..6d5b7e0d650 100644
--- a/pkgs/os-specific/linux/can-utils/default.nix
+++ b/pkgs/os-specific/linux/can-utils/default.nix
@@ -1,31 +1,23 @@
 { lib, stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "can-utils";
-  # There are no releases (source archives or git tags), so use the date of the
-  # latest commit in git master as version number.
-  version = "20170830";
+  version = "2023.03";
 
   src = fetchFromGitHub {
     owner = "linux-can";
     repo = "can-utils";
-    rev = "5b518a0a5fa56856f804372a6b99b518dedb5386";
-    sha256 = "1ygzp8rjr8f1gs48mb1pz7psdgbfhlvr6kjdnmzbsqcml06zvrpr";
+    rev = "v${version}";
+    hash = "sha256-FaopviBJOmO0lXoJcdKNdtsoaJ8JrFEJGyO1aNBv+Pg=";
   };
 
-  # Fixup build with newer Linux headers.
-  postPatch = ''
-    sed '1i#include <linux/sockios.h>' -i \
-      slcanpty.c cansniffer.c canlogserver.c isotpdump.c isotpsniffer.c isotpperf.c
-  '';
-
-  preConfigure = ''makeFlagsArray+=(PREFIX="$out")'';
+  makeFlags = [ "PREFIX=$(out)" ];
 
   meta = with lib; {
     description = "CAN userspace utilities and tools (for use with Linux SocketCAN)";
     homepage = "https://github.com/linux-can/can-utils";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
+    maintainers = with maintainers; [ bjornfor Luflosi ];
   };
 }
diff --git a/pkgs/os-specific/linux/cannelloni/default.nix b/pkgs/os-specific/linux/cannelloni/default.nix
new file mode 100644
index 00000000000..0a27c53eefc
--- /dev/null
+++ b/pkgs/os-specific/linux/cannelloni/default.nix
@@ -0,0 +1,30 @@
+{ lib, stdenv, fetchFromGitHub, cmake, lksctp-tools, sctpSupport ? true }:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cannelloni";
+  version = "1.1.0";
+  src = fetchFromGitHub {
+    owner = "mguentner";
+    repo = "cannelloni";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-pAXHo9NCXMFKYcIJogytBiPkQE0nK6chU5TKiDNCKA8=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = lib.optionals sctpSupport [ lksctp-tools ];
+
+  cmakeFlags = [
+    "-DSCTP_SUPPORT=${lib.boolToString sctpSupport}"
+  ];
+
+  meta = with lib; {
+    description = "A SocketCAN over Ethernet tunnel";
+    homepage = "https://github.com/mguentner/cannelloni";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.samw ];
+  };
+})
diff --git a/pkgs/os-specific/linux/catfs/Cargo.lock b/pkgs/os-specific/linux/catfs/Cargo.lock
new file mode 100644
index 00000000000..d79e0a9e168
--- /dev/null
+++ b/pkgs/os-specific/linux/catfs/Cargo.lock
@@ -0,0 +1,651 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b6a2d3371669ab3ca9797670853d61402b03d0b4b9ebf33d677dfa720203072"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee2a4ec343196209d6594e19543ae87a39f96d5534d7174822a3ad825dd6ed7e"
+
+[[package]]
+name = "aho-corasick"
+version = "0.6.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81ce3d38065e618af2d7b77e10c5ad9a069859b4be3c2250f674af3840d9c8a5"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "ansi_term"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
+
+[[package]]
+name = "backtrace"
+version = "0.3.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec1931848a574faa8f7c71a12ea00453ff5effbb5f51afe7f77d7a48cace6ac1"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9bf6104718e80d7b26a68fdbacff3481cfc05df670821affc7e9cbc1884400c"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02b4ff8b16e6076c3e14220b39fbc1fabb6737522281a388998046859400895f"
+
+[[package]]
+name = "bitflags"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
+
+[[package]]
+name = "block-buffer"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1339a1042f5d9f295737ad4d9a6ab6bf81c84a933dba110b9200cd6d1448b814"
+dependencies = [
+ "byte-tools",
+ "generic-array",
+]
+
+[[package]]
+name = "byte-tools"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "560c32574a12a89ecd91f5e742165893f86e3ab98d21f8ea548658eb9eef5f40"
+
+[[package]]
+name = "catfs"
+version = "0.9.0"
+dependencies = [
+ "backtrace",
+ "chan-signal",
+ "clap",
+ "daemonize",
+ "env_logger",
+ "fd",
+ "fuse",
+ "generic-array",
+ "itertools",
+ "libc",
+ "log 0.3.9",
+ "rand 0.3.23",
+ "sha2",
+ "syslog",
+ "threadpool",
+ "time",
+ "twox-hash",
+ "xattr",
+]
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+
+[[package]]
+name = "chan"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d14956a3dae065ffaa0d92ece848ab4ced88d32361e7fdfbfd653a5c454a1ed8"
+dependencies = [
+ "rand 0.3.23",
+]
+
+[[package]]
+name = "chan-signal"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f3bb6c3bc387004ad914f0c5b7f33ace8bf7604bbec35f228b1a017f52cd3a0"
+dependencies = [
+ "bit-set",
+ "chan",
+ "lazy_static 0.2.11",
+ "libc",
+]
+
+[[package]]
+name = "clap"
+version = "2.33.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
+dependencies = [
+ "ansi_term",
+ "atty",
+ "bitflags",
+ "strsim",
+ "textwrap",
+ "unicode-width",
+ "vec_map",
+]
+
+[[package]]
+name = "daemonize"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0239832c1b4ca406d5ec73728cf4c7336d25cf85dd32db9e047e9e706ee0e935"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "digest"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5b29bf156f3f4b3c4f610a25ff69370616ae6e0657d416de22645483e72af0a"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "either"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
+
+[[package]]
+name = "env_logger"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ddf21e73e016298f5cb37d6ef8e8da8e39f91f9ec8b0df44b7deb16a9f8cd5b"
+dependencies = [
+ "log 0.3.9",
+ "regex",
+]
+
+[[package]]
+name = "fake-simd"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e88a8acf291dafb59c2d96e8f59828f3838bb1a70398823ade51a84de6a6deed"
+
+[[package]]
+name = "fd"
+version = "0.2.3"
+source = "git+https://github.com/stemjail/fd-rs.git?rev=3bc3e3587f8904cce8bf29163a2021c2f5906557#3bc3e3587f8904cce8bf29163a2021c2f5906557"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "fuse"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80e57070510966bfef93662a81cb8aa2b1c7db0964354fa9921434f04b9e8660"
+dependencies = [
+ "libc",
+ "log 0.3.9",
+ "pkg-config",
+ "thread-scoped",
+ "time",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fceb69994e330afed50c93524be68c42fa898c2d9fd4ee8da03bd7363acd26f2"
+dependencies = [
+ "nodrop",
+ "typenum",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "gimli"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaf91faf136cb47367fa430cd46e37a788775e7fa104f8b4bcb3861dc389b724"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c30f6d0bc6b00693347368a67d41b58f2fb851215ff1da49e90fe2c5c667151"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "itertools"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3f2be4da1690a039e9ae5fd575f706a63ad5a2120f161b1d653c9da3930dd21"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "lazy_static"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76f033c7ad61445c5b347c7382dd1237847eb1bce590fe50365dcb33d546be73"
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.78"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa7087f49d294270db4e1928fc110c976cd4b9e5a16348e0a1df09afa99e6c98"
+
+[[package]]
+name = "log"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e19e8d5c34a3e0e2223db8e060f9e8264aeeb5c5fc64a4ee9965c062211c024b"
+dependencies = [
+ "log 0.4.11",
+]
+
+[[package]]
+name = "log"
+version = "0.4.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "memchr"
+version = "2.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c60c0dfe32c10b43a144bad8fc83538c52f58302c92300ea7ec7bf7b38d5a7b9"
+dependencies = [
+ "adler",
+ "autocfg",
+]
+
+[[package]]
+name = "nodrop"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
+
+[[package]]
+name = "num_cpus"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "object"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d36492546b6af1463394d46f0c834346f31548646f6ba10849802c9c9a27ac33"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c36fa947111f5c62a733b652544dd0016a43ce89619538a8ef92724a6f501a20"
+
+[[package]]
+name = "rand"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64ac302d8f83c0c1974bf758f6b041c6c8ada916fbb44a609158ca8b064cc76c"
+dependencies = [
+ "libc",
+ "rand 0.4.6",
+]
+
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+dependencies = [
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.3.1",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom",
+ "libc",
+ "rand_chacha",
+ "rand_core 0.5.1",
+ "rand_hc",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "regex"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9329abc99e39129fcceabd24cf5d85b4671ef7c29c50e972bc5afe32438ec384"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+ "thread_local",
+ "utf8-ranges",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d707a4fa2637f2dca2ef9fd02225ec7661fe01a53623c1e6515b6916511f7a7"
+dependencies = [
+ "ucd-util",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c691c0e608126e00913e33f0ccf3727d5fc84573623b8d65b2df340b5201783"
+
+[[package]]
+name = "sha2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d963c78ce367df26d7ea8b8cc655c651b42e8a1e584e869c1e17dae3ccb116a"
+dependencies = [
+ "block-buffer",
+ "byte-tools",
+ "digest",
+ "fake-simd",
+ "generic-array",
+]
+
+[[package]]
+name = "strsim"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
+
+[[package]]
+name = "syslog"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbc9b0acde4f7c05fdc1cfb05239b8a53a66815dd86c67fee5aa9bfac5b4ed42"
+dependencies = [
+ "libc",
+ "log 0.3.9",
+ "time",
+ "unix_socket",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d326610f408c7a4eb6f51c37c330e496b08506c9457c9d34287ecc38809fb060"
+dependencies = [
+ "unicode-width",
+]
+
+[[package]]
+name = "thread-scoped"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcbb6aa301e5d3b0b5ef639c9a9c7e2f1c944f177b460c04dc24c69b1fa2bd99"
+
+[[package]]
+name = "thread_local"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6b53e329000edc2b34dbe8545fd20e55a333362d0a321909685a19bd28c3f1b"
+dependencies = [
+ "lazy_static 1.4.0",
+]
+
+[[package]]
+name = "threadpool"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
+dependencies = [
+ "num_cpus",
+]
+
+[[package]]
+name = "time"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+dependencies = [
+ "libc",
+ "wasi 0.10.0+wasi-snapshot-preview1",
+ "winapi",
+]
+
+[[package]]
+name = "twox-hash"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bfd5b7557925ce778ff9b9ef90e3ade34c524b5ff10e239c69a42d546d2af56"
+dependencies = [
+ "rand 0.7.3",
+]
+
+[[package]]
+name = "typenum"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33"
+
+[[package]]
+name = "ucd-util"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c85f514e095d348c279b1e5cd76795082cf15bd59b93207832abe0b1d8fed236"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
+
+[[package]]
+name = "unix_socket"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6aa2700417c405c38f5e6902d699345241c28c0b7ade4abaad71e35a87eb1564"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "utf8-ranges"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ae116fef2b7fea257ed6440d3cfcff7f190865f170cdad00bb6465bf18ecba"
+
+[[package]]
+name = "vec_map"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
+[[package]]
+name = "wasi"
+version = "0.10.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "xattr"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "244c3741f4240ef46274860397c7c74e50eb23624996930e484c16679633a54c"
+dependencies = [
+ "libc",
+]
diff --git a/pkgs/os-specific/linux/catfs/default.nix b/pkgs/os-specific/linux/catfs/default.nix
index dbb525e0e29..fb4d2182075 100644
--- a/pkgs/os-specific/linux/catfs/default.nix
+++ b/pkgs/os-specific/linux/catfs/default.nix
@@ -6,25 +6,27 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "catfs";
-  version = "unstable-2020-03-21";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "kahing";
     repo = pname;
-    rev = "daa2b85798fa8ca38306242d51cbc39ed122e271";
-    sha256 = "0zca0c4n2p9s5kn8c9f9lyxdf3df88a63nmhprpgflj86bh8wgf5";
+    rev = "v${version}";
+    hash = "sha256-OvmtU2jpewP5EqPwEFAf67t8UCI1WuzUO2QQj4cH1Ak=";
   };
 
-  cargoSha256 = "1agcwq409s40kyij487wjrp8mj7942r9l2nqwks4xqlfb0bvaimf";
-
-  cargoPatches = [
-    # update cargo lock
-    (fetchpatch {
-      url = "https://github.com/kahing/catfs/commit/f838c1cf862cec3f1d862492e5be82b6dbe16ac5.patch";
-      sha256 = "1r1p0vbr3j9xyj9r1ahipg4acii3m4ni4m9mp3avbi1rfgzhblhw";
-    })
+  patches = [
+    # monitor https://github.com/kahing/catfs/issues/71
+    ./fix-for-rust-1.65.diff
   ];
 
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "fd-0.2.3" = "sha256-Xps5s30urCZ8FZYce41nOZGUAk7eRyvObUS/mMx6Tfg=";
+    };
+  };
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ fuse ];
diff --git a/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff b/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff
new file mode 100644
index 00000000000..4208c362ebc
--- /dev/null
+++ b/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff
@@ -0,0 +1,13 @@
+diff --git a/src/catfs/file.rs b/src/catfs/file.rs
+index 6e781eb..92fdd80 100644
+--- a/src/catfs/file.rs
++++ b/src/catfs/file.rs
+@@ -569,7 +569,7 @@ impl Handle {
+         path: &dyn AsRef<Path>,
+         create: bool,
+     ) -> error::Result<()> {
+-        let _ = self.page_in_res.0.lock().unwrap();
++        drop(self.page_in_res.0.lock().unwrap());
+ 
+         let mut buf = [0u8; 0];
+         let mut flags = rlibc::O_RDWR;
diff --git a/pkgs/os-specific/linux/cfs-zen-tweaks/default.nix b/pkgs/os-specific/linux/cfs-zen-tweaks/default.nix
new file mode 100644
index 00000000000..ef5dfe8e2e0
--- /dev/null
+++ b/pkgs/os-specific/linux/cfs-zen-tweaks/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, makeWrapper
+, gawk
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cfs-zen-tweaks";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "igo95862";
+    repo = "cfs-zen-tweaks";
+    rev = version;
+    sha256 = "HRR2tdjNmWyrpbcMlihSdb/7g/tHma3YyXogQpRCVyo=";
+  };
+
+  preConfigure = ''
+    substituteInPlace set-cfs-zen-tweaks.bash \
+      --replace '$(gawk' '$(${gawk}/bin/gawk'
+  '';
+
+  preFixup = ''
+    chmod +x $out/lib/cfs-zen-tweaks/set-cfs-zen-tweaks.bash
+  '';
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Tweak Linux CPU scheduler for desktop responsiveness";
+    homepage = "https://github.com/igo95862/cfs-zen-tweaks";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mkg20001 ];
+  };
+}
diff --git a/pkgs/os-specific/linux/ch9344/default.nix b/pkgs/os-specific/linux/ch9344/default.nix
new file mode 100644
index 00000000000..e7da864b90c
--- /dev/null
+++ b/pkgs/os-specific/linux/ch9344/default.nix
@@ -0,0 +1,51 @@
+{ stdenv, lib, fetchzip, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "ch9344";
+  version = "1.9";
+
+  src = fetchzip {
+    name = "CH9344SER_LINUX.zip";
+    url = "https://www.wch.cn/downloads/file/386.html#CH9344SER_LINUX.zip";
+    hash = "sha256-g55ftAfjKKlUFzGhI1a/O7Eqbz6rkGf1vWuEJjBZxBE=";
+  };
+
+  patches = lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.1") [
+    # https://github.com/torvalds/linux/commit/a8c11c1520347be74b02312d10ef686b01b525f1
+    ./fix-incompatible-pointer-types.patch
+  ] ++ lib.optionals (lib.versionAtLeast kernel.modDirVersion "6.3") [
+    # https://github.com/torvalds/linux/commit/5d420399073770134d2b03e004b2c0201c7fa26f
+    ./fix-incompatible-pointer-types_6_3.patch
+  ];
+
+  sourceRoot = "${src.name}/driver";
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "KERNELDIR :=" "KERNELDIR ?="
+  '';
+
+  makeFlags = [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D ch9344.ko $out/lib/modules/${kernel.modDirVersion}/usb/serial/ch9344.ko
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.wch-ic.com/";
+    downloadPage = "https://www.wch.cn/downloads/CH9344SER_LINUX_ZIP.html";
+    description = "WCH CH9344/CH348 UART driver";
+    longDescription = ''
+      A kernel module for WinChipHead CH9344/CH348 USB To Multi Serial Ports controller.
+    '';
+    # Archive contains no license.
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ MakiseKurisu ];
+  };
+}
diff --git a/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch b/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch
new file mode 100644
index 00000000000..31088538733
--- /dev/null
+++ b/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types.patch
@@ -0,0 +1,22 @@
+diff --git a/ch9344.c b/ch9344.c
+index 1e37293..a16af82 100644
+--- a/ch9344.c
++++ b/ch9344.c
+@@ -79,7 +79,7 @@ static DEFINE_IDR(ch9344_minors);
+ static DEFINE_MUTEX(ch9344_minors_lock);
+ 
+ static void ch9344_tty_set_termios(struct tty_struct *tty,
+-                                   struct ktermios *termios_old);
++                                   const struct ktermios *termios_old);
+ 
+ static int ch9344_get_portnum(int index);
+ 
+@@ -1597,7 +1597,7 @@ u8 cal_recv_tmt(__le32 bd)
+ }
+ 
+ static void ch9344_tty_set_termios(struct tty_struct *tty,
+-                                   struct ktermios *termios_old)
++                                   const struct ktermios *termios_old)
+ {
+     struct ch9344 *ch9344 = tty->driver_data;
+     struct ktermios *termios = &tty->termios;
diff --git a/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types_6_3.patch b/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types_6_3.patch
new file mode 100644
index 00000000000..b4cf265daac
--- /dev/null
+++ b/pkgs/os-specific/linux/ch9344/fix-incompatible-pointer-types_6_3.patch
@@ -0,0 +1,13 @@
+diff --git a/ch9344.c b/ch9344.c
+index a16af82..8922ed9 100644
+--- a/ch9344.c
++++ b/ch9344.c
+@@ -774,7 +774,7 @@ static inline void *tty_get_portdata(struct ch9344_ttyport *port)
+     return (port->portdata);
+ }
+ 
+-static void ch9344_port_dtr_rts(struct tty_port *port, int raise)
++static void ch9344_port_dtr_rts(struct tty_port *port, bool raise)
+ {
+     struct ch9344_ttyport *ttyport = container_of(port, struct ch9344_ttyport, port);
+     struct ch9344 *ch9344 = tty_get_portdata(ttyport);
diff --git a/pkgs/os-specific/linux/checkpolicy/default.nix b/pkgs/os-specific/linux/checkpolicy/default.nix
index c3d8928c7ba..5b08739667d 100644
--- a/pkgs/os-specific/linux/checkpolicy/default.nix
+++ b/pkgs/os-specific/linux/checkpolicy/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "checkpolicy";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.5";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/checkpolicy-${version}.tar.gz";
-    sha256 = "13jz6f8zdrijvn5w1j102b36fs41z0q8ii74axw48cj550mw6im9";
+    url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
+    sha256 = "sha256-eqSKsiIqC5iBER1tf3DDAU09kziCfZ4C3xBaaMDfXbw=";
   };
 
   nativeBuildInputs = [ bison flex ];
diff --git a/pkgs/os-specific/linux/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch b/pkgs/os-specific/linux/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch
index 9beeab0f954..2aabbc4d4c8 100644
--- a/pkgs/os-specific/linux/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch
+++ b/pkgs/os-specific/linux/checksec/0001-attempt-to-modprobe-config-before-checking-kernel.patch
@@ -1,28 +1,24 @@
-From 6503848d9e0eb009e5f462116a963beacb208930 Mon Sep 17 00:00:00 2001
+From 5cfb08effd21d9278e3eb8901c85112a331c3181 Mon Sep 17 00:00:00 2001
 From: Austin Seipp <aseipp@pobox.com>
-Date: Thu, 20 Feb 2014 00:11:44 -0600
+Date: Tue, 26 Oct 2021 09:23:07 +0000
 Subject: [PATCH] attempt to 'modprobe config' before checking kernel
 
-Signed-off-by: Austin Seipp <aseipp@pobox.com>
 ---
- checksec.sh | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
+ checksec | 1 +
+ 1 file changed, 1 insertion(+)
 
 diff --git a/checksec b/checksec
-index dd1f72e..63acc29 100644
+index 5536250..895073b 100755
 --- a/checksec
 +++ b/checksec
-@@ -676,7 +676,8 @@ kernelcheck() {
-   echo_message "  userspace processes, this option lists the status of kernel configuration\n" '' '' ''
+@@ -1059,6 +1059,7 @@ kernelcheck() {
    echo_message "  options that harden the kernel itself against attack.\n\n" '' '' ''
    echo_message "  Kernel config:\n" '' '' '{ "kernel": '
--
-+
+
 +  modprobe configs 2> /dev/null
-   if [[ ! "${1}" == "" ]] ; then
+   if [[ ! "${1}" == "" ]]; then
      kconfig="cat ${1}"
-     echo_message "  Warning: The config ${1} on disk may not represent running kernel config!\n\n" "${1}" "<kernel config=\"${1}\"" "{ \"KernelConfig\":\"${1}\","
-     # update the architecture based on the config rather than the system
+     echo_message "  Warning: The config ${1} on disk may not represent running kernel config!\n\n" "${1}" "<kernel config=\"${1}\"" "{ \"KernelConfig\":\"${1}\""
 -- 
-1.8.3.2
+2.33.0
 
diff --git a/pkgs/os-specific/linux/checksec/0002-don-t-sanatize-the-environment.patch b/pkgs/os-specific/linux/checksec/0002-don-t-sanatize-the-environment.patch
new file mode 100644
index 00000000000..bd639574f63
--- /dev/null
+++ b/pkgs/os-specific/linux/checksec/0002-don-t-sanatize-the-environment.patch
@@ -0,0 +1,25 @@
+From 3b047ab4271919856ae0a3dee3a03a24045c0016 Mon Sep 17 00:00:00 2001
+From: Paul Meyer <49727155+katexochen@users.noreply.github.com>
+Date: Mon, 13 Nov 2023 20:24:54 +0000
+Subject: [PATCH] don't sanatize the environment
+
+---
+ checksec | 3 ---
+ 1 file changed, 3 deletions(-)
+
+diff --git a/checksec b/checksec
+index 4fc3c31..135223a 100755
+--- a/checksec
++++ b/checksec
+@@ -2,9 +2,6 @@
+ # Do not edit this file directly, this file is generated from the files
+ # in the src directory. Any updates to this file will be overwritten when generated
+
+-# sanitize the environment before run
+-[[ "$(env | /bin/sed -r -e '/^(PWD|SHLVL|_)=/d')" ]] && exec -c "$0" "$@"
+-
+ # --- Modified Version ---
+ # Name    : checksec.sh
+ # Version : 1.7.0
+--
+2.42.0
diff --git a/pkgs/os-specific/linux/checksec/default.nix b/pkgs/os-specific/linux/checksec/default.nix
index e0a65589571..07574722cd2 100644
--- a/pkgs/os-specific/linux/checksec/default.nix
+++ b/pkgs/os-specific/linux/checksec/default.nix
@@ -1,39 +1,105 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, file, findutils
-, binutils-unwrapped, glibc, coreutils, sysctl, openssl
+{ lib
+, stdenv
+, fetchpatch
+, fetchFromGitHub
+, makeWrapper
+, testers
+, runCommand
+
+  # dependencies
+, binutils
+, coreutils
+, curl
+, elfutils
+, file
+, findutils
+, gawk
+, glibc
+, gnugrep
+, gnused
+, openssl
+, procps
+, sysctl
+, wget
+, which
+
+  # tests
+, checksec
 }:
 
 stdenv.mkDerivation rec {
   pname = "checksec";
-  version = "2.4.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "slimm609";
     repo = "checksec.sh";
     rev = version;
-    sha256 = "1gbbq85d3g3mnm3xvgvi2085aba7qc3cmsbwn76al50ax1518j2q";
+    hash = "sha256-BWtchWXukIDSLJkFX8M/NZBvfi7vUE2j4yFfS0KEZDo=";
   };
 
-  patches = [ ./0001-attempt-to-modprobe-config-before-checking-kernel.patch ];
-  nativeBuildInputs = [ makeWrapper ];
-
-  installPhase = let
-    path = lib.makeBinPath [
-      findutils file binutils-unwrapped sysctl openssl
-    ];
-  in ''
-    mkdir -p $out/bin
-    install checksec $out/bin
-    substituteInPlace $out/bin/checksec --replace /lib/libc.so.6 ${glibc.out}/lib/libc.so.6
-    substituteInPlace $out/bin/checksec --replace "/usr/bin/id -" "${coreutils}/bin/id -"
-    wrapProgram $out/bin/checksec \
-      --prefix PATH : ${path}
-  '';
+  patches = [
+    ./0001-attempt-to-modprobe-config-before-checking-kernel.patch
+    # Tool would sanitize the environment, removing the PATH set by our wrapper.
+    ./0002-don-t-sanatize-the-environment.patch
+    # Fix the exit code of debug_report command. Check if PR 226 was merged when upgrading version.
+    (fetchpatch {
+      url = "https://github.com/slimm609/checksec.sh/commit/851ebff6972f122fde5507f1883e268bbff1f23d.patch";
+      hash = "sha256-DOcVF+oPGIR9VSbqE+EqWlcNANEvou1gV8qBvJLGLBE=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase =
+    let
+      path = lib.makeBinPath [
+        binutils
+        coreutils
+        curl
+        elfutils
+        file
+        findutils
+        gawk
+        gnugrep
+        gnused
+        openssl
+        procps
+        sysctl
+        wget
+        which
+      ];
+    in
+    ''
+      mkdir -p $out/bin
+      install checksec $out/bin
+      substituteInPlace $out/bin/checksec \
+        --replace "/bin/sed" "${gnused}/bin/sed" \
+        --replace "/usr/bin/id" "${coreutils}/bin/id" \
+        --replace "/lib/libc.so.6" "${glibc}/lib/libc.so.6"
+      wrapProgram $out/bin/checksec \
+        --prefix PATH : ${path}
+    '';
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = checksec;
+      version = "v${version}";
+    };
+    debug-report = runCommand "debug-report" { buildInputs = [ checksec ]; } ''
+      checksec --debug_report || exit 1
+      echo "OK"
+      touch $out
+    '';
+  };
 
   meta = with lib; {
-    description = "A tool for checking security bits on executables";
-    homepage    = "https://www.trapkit.de/tools/checksec/";
-    license     = licenses.bsd3;
-    platforms   = platforms.linux;
+    description = "Tool for checking security bits on executables";
+    homepage = "https://www.trapkit.de/tools/checksec/";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
     maintainers = with maintainers; [ thoughtpolice globin ];
   };
 }
diff --git a/pkgs/os-specific/linux/chromium-os/common-mk/0001-common-mk-don-t-leak-source-absolute-paths.patch b/pkgs/os-specific/linux/chromium-os/common-mk/0001-common-mk-don-t-leak-source-absolute-paths.patch
deleted file mode 100644
index c2e33dbde66..00000000000
--- a/pkgs/os-specific/linux/chromium-os/common-mk/0001-common-mk-don-t-leak-source-absolute-paths.patch
+++ /dev/null
@@ -1,207 +0,0 @@
-From ae0c98ed2715c685b0cb97ac6e5d65101168b625 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Sun, 24 Nov 2019 16:56:11 +0000
-Subject: [PATCH 1/6] common-mk: don't leak source-absolute paths
-
-Source-absolute paths like //vm_tools/whatever were being leaked to
-subprocesses, which of course didn't know how to understand them.
-With this patch, source-absolute paths are only used to tell GN the
-outputs, and normal Unix paths are passed to subprocesses.
----
- common-mk/external_dependencies/BUILD.gn    |  3 ++-
- common-mk/mojom_bindings_generator.gni      | 12 ++++++------
- common-mk/mojom_type_mappings_generator.gni |  2 +-
- common-mk/pkg_config.gni                    |  3 ++-
- common-mk/proto_library.gni                 | 19 ++++++++++---------
- 5 files changed, 21 insertions(+), 18 deletions(-)
-
-diff --git a/common-mk/external_dependencies/BUILD.gn b/common-mk/external_dependencies/BUILD.gn
-index 2581d31ac8..2ead288006 100644
---- a/common-mk/external_dependencies/BUILD.gn
-+++ b/common-mk/external_dependencies/BUILD.gn
-@@ -45,6 +45,7 @@ genxml2cpp("dbus-proxies") {
- action("cloud_policy_proto_generator") {
-   policy_resources_dir = "${sysroot}/usr/share/policy_resources"
-   proto_out_dir = "${target_gen_dir}/proto"
-+  cloud_policy_protobuf_dir = rebase_path(proto_out_dir)
-   policy_tools_dir = "${sysroot}/usr/share/policy_tools"
- 
-   script = "${policy_tools_dir}/generate_policy_source.py"
-@@ -54,7 +55,7 @@ action("cloud_policy_proto_generator") {
-   ]
-   outputs = [ "${proto_out_dir}/cloud_policy.proto" ]
-   args = [
--    "--cloud-policy-protobuf=${proto_out_dir}/cloud_policy.proto",
-+    "--cloud-policy-protobuf=${cloud_policy_protobuf_dir}/cloud_policy.proto",
-     "--chrome-version-file=${policy_resources_dir}/VERSION",
-     "--target-platform=chromeos",
-     "--policy-templates-file=${policy_resources_dir}/policy_templates.json",
-diff --git a/common-mk/mojom_bindings_generator.gni b/common-mk/mojom_bindings_generator.gni
-index 038c20ed36..205d7d3037 100644
---- a/common-mk/mojom_bindings_generator.gni
-+++ b/common-mk/mojom_bindings_generator.gni
-@@ -100,7 +100,7 @@ template("generate_mojom_bindings_gen") {
-     args = [
-       "mkdir",
-       "-p",
--      mojo_templates_dir,
-+      rebase_path(mojo_templates_dir),
-     ]
-   }
- 
-@@ -116,7 +116,7 @@ template("generate_mojom_bindings_gen") {
-     args = [
-       "--use_bundled_pylibs",
-       "-o",
--      mojo_templates_dir,
-+      rebase_path(mojo_templates_dir),
-       "precompile",
-     ]
-     deps = [ ":${mojo_templates_dir_action_name}" ]
-@@ -143,7 +143,7 @@ template("generate_mojom_bindings_gen") {
-     args = [
-       "--mojom-file-list={{response_file_name}}",
-       "--output-root",
--      _mojo_output_base,
-+      rebase_path(_mojo_output_base),
-       "--input-root",
-       mojo_root,  # Mojo depth.
-       "--input-root",
-@@ -188,11 +188,11 @@ template("generate_mojom_bindings_gen") {
-              mojom_bindings_generator,
-              "--use_bundled_pylibs",
-              "--output_dir",
--             _mojo_output_base,
-+             rebase_path(_mojo_output_base),
-              "generate",
-              "--filelist={{response_file_name}}",
-              "--bytecode_path",
--             mojo_templates_dir,
-+             rebase_path(mojo_templates_dir),
-              "-I",
-              mojo_root,  # Mojo include path.
-              "-d",
-@@ -216,7 +216,7 @@ template("generate_mojom_bindings_gen") {
-       foreach(typemap, invoker.typemaps) {
-         args += [
-           "--typemap",
--          typemap,
-+          rebase_path(typemap),
-         ]
-       }
-     }
-diff --git a/common-mk/mojom_type_mappings_generator.gni b/common-mk/mojom_type_mappings_generator.gni
-index ff09397111..959a8b6ca9 100644
---- a/common-mk/mojom_type_mappings_generator.gni
-+++ b/common-mk/mojom_type_mappings_generator.gni
-@@ -21,7 +21,7 @@ template("generate_mojom_type_mappings") {
-     outputs = [ "$target_gen_dir/${target_name}_typemapping" ]
-     args = [
-              "--output",
--             "$target_gen_dir/${target_name}_typemapping",
-+             rebase_path("$target_gen_dir/${target_name}_typemapping"),
-            ] + rebase_path(sources, root_build_dir)
-   }
- }
-diff --git a/common-mk/pkg_config.gni b/common-mk/pkg_config.gni
-index b2c58845d4..31d3f4ab51 100644
---- a/common-mk/pkg_config.gni
-+++ b/common-mk/pkg_config.gni
-@@ -81,7 +81,8 @@ template("generate_pkg_config") {
-     if (!defined(output_name)) {
-       output_name = name
-     }
--    outputs = [ "${target_out_dir}/${output_name}.pc" ]
-+    lib_path = "${target_out_dir}/${output_name}.pc"
-+    outputs = [ lib_path ]
- 
-     script = "//common-mk/generate-pc.py"
-     args = [ "--output" ] + rebase_path(outputs) + [ "--name=" + name ]
-diff --git a/common-mk/proto_library.gni b/common-mk/proto_library.gni
-index e64aedabe0..fb9fb4231d 100644
---- a/common-mk/proto_library.gni
-+++ b/common-mk/proto_library.gni
-@@ -56,7 +56,7 @@ template("proto_library") {
- 
-     cc_dir = "${root_gen_dir}/${proto_out_dir}"
-     proto_in_dir = rebase_path(proto_in_dir)
--    proto_out_dir = rebase_path(proto_out_dir)
-+    proto_out_dir = rebase_path(cc_dir)
- 
-     proto_lib_dirs = [
-       proto_in_dir,
-@@ -96,10 +96,9 @@ template("proto_library") {
-     }
-     outputs = []
-     if (gen_python) {
--      python_dir = "${root_gen_dir}/${proto_out_dir}/py"
-       args += [
-         "--python_out",
--        "${python_dir}",
-+        "${proto_out_dir}/py",
-       ]
-       foreach(source, sources) {
-         source = rebase_path(source, proto_in_dir)
-@@ -109,19 +108,19 @@ template("proto_library") {
-     }
-     if (gen_grpc) {
-       if (gen_grpc_gmock) {
--        args += [ "--grpc_out=generate_mock_code=true:${cc_dir}" ]
-+        args += [ "--grpc_out=generate_mock_code=true:${proto_out_dir}" ]
-         foreach(source, sources) {
-           source = rebase_path(source, proto_in_dir)
-           source = string_replace(source, ".proto", "")
-           outputs += [ "${cc_dir}/${source}_mock.grpc.pb.h" ]
-         }
-       } else {
--        args += [ "--grpc_out=${cc_dir}" ]
-+        args += [ "--grpc_out=${proto_out_dir}" ]
-       }
-       grpc_cpp_plugin = "/usr/bin/grpc_cpp_plugin"
-       args += [
-         "--plugin=protoc-gen-grpc=${grpc_cpp_plugin}",
--        "--cpp_out=${gen_cpp_mode}${cc_dir}",
-+        "--cpp_out=${gen_cpp_mode}${proto_out_dir}",
-       ]
-       foreach(source, sources) {
-         source = rebase_path(source, proto_in_dir)
-@@ -135,7 +134,7 @@ template("proto_library") {
-       }
-     }
-     if (!gen_grpc && !gen_python) {
--      args += [ "--cpp_out=${gen_cpp_mode}${cc_dir}" ]
-+      args += [ "--cpp_out=${gen_cpp_mode}${proto_out_dir}" ]
-       foreach(source, sources) {
-         source = rebase_path(source, proto_in_dir)
-         source = string_replace(source, ".proto", "")
-@@ -238,7 +237,9 @@ template("goproto_library") {
-     # otherwise file descriptor var name will conflict.
-     # cf) https://github.com/golang/protobuf/issues/109
- 
-+    cc_dir = "${root_gen_dir}/${proto_out_dir}"
-     proto_in_dir = rebase_path(invoker.proto_in_dir)
-+    proto_out_dir = rebase_path(cc_dir)
- 
-     # Build protoc command line to run.
-     script = "//common-mk/file_generator_wrapper.py"
-@@ -278,7 +279,7 @@ template("goproto_library") {
-       "--go_out",
- 
-       # go_out_prefix can be empty, so we can always add a colon here.
--      "${go_out_prefix}:${root_gen_dir}/${proto_out_dir}",
-+      "${go_out_prefix}:${proto_out_dir}",
-     ]
-     foreach(source, sources) {
-       args += [ rebase_path(source) ]
-@@ -288,7 +289,7 @@ template("goproto_library") {
-     outputs = []
-     foreach(source, invoker.sources) {
-       name = get_path_info(source, "name")
--      outputs += [ "${root_gen_dir}/${proto_out_dir}/${name}.pb.go" ]
-+      outputs += [ "${cc_dir}/${name}.pb.go" ]
-     }
-   }
- }
--- 
-2.32.0
-
diff --git a/pkgs/os-specific/linux/chromium-os/common-mk/0002-common-mk-.gn-don-t-hardcode-env-path.patch b/pkgs/os-specific/linux/chromium-os/common-mk/0002-common-mk-.gn-don-t-hardcode-env-path.patch
deleted file mode 100644
index a6ac5b1e9ac..00000000000
--- a/pkgs/os-specific/linux/chromium-os/common-mk/0002-common-mk-.gn-don-t-hardcode-env-path.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From 7d33bcd724ec79d00281c2752f9642be25782370 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Sun, 24 Nov 2019 17:20:46 +0000
-Subject: [PATCH 2/6] common-mk: .gn: don't hardcode env path
-
-This is needlessly non-portable.
----
- .gn | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/.gn b/.gn
-index e7dba8c91c..e29fcd61ee 100644
---- a/.gn
-+++ b/.gn
-@@ -7,4 +7,4 @@ root = "//common-mk/gn_root/:"
- 
- # This makes all scripts run by gn respect the shebang setting of the script.
- # Otherwise, the default is to always use `python`.
--script_executable = "/usr/bin/env"
-+script_executable = "env"
--- 
-2.32.0
-
diff --git a/pkgs/os-specific/linux/chromium-os/common-mk/default.nix b/pkgs/os-specific/linux/chromium-os/common-mk/default.nix
deleted file mode 100644
index d617401138f..00000000000
--- a/pkgs/os-specific/linux/chromium-os/common-mk/default.nix
+++ /dev/null
@@ -1,122 +0,0 @@
-{ stdenv, lib, fetchFromGitiles, upstreamInfo, gn, pkgconfig, python3, ninja
-# , libchrome
-}:
-
-{ platformSubdir
-
-# Mandatory, unlike in mkDerivation, because Google doesn't provide
-# install tasks and just does that in their ebuilds.
-, installPhase
-
-# src allows an out-of-tree (i.e., out-of-platform2) package to be
-# built with common-mk.  patches will be applied to `src` -- to patch
-# platform2 itself use platform2Patches.
-, src ? null, platform2Patches ? []
-
-# gnArgs allows structured data (attribute sets) to be serialized and
-# passed to gn, unlike gnFlags provided by gn's setupHook, which is a
-# flat list of strings.
-, gnArgs ? {}, gnFlags ? [], use ? {}
-
-, postUnpack ? "", prePatch ? "", postPatch ? ""
-, nativeBuildInputs ? []
-, meta ? {}
-, ... } @ args:
-
-let
-  platform2 = fetchFromGitiles upstreamInfo.components."src/platform2";
-
-  attrsToGnList = lib.mapAttrsToList (name: value: "${name}=${toGn value}");
-
-  toGn = value:
-    if lib.isAttrs value then
-      "{${lib.concatStringsSep " " (attrsToGnList value)}}"
-    else
-      builtins.toJSON value;
-in
-
-stdenv.mkDerivation ({
-  pname = lib.last (lib.splitString "/" platformSubdir);
-  inherit (upstreamInfo) version;
-
-  srcs = [ platform2 ] ++ lib.optional (src != null) src;
-  sourceRoot = "platform2";
-
-  postUnpack = lib.optionalString (src != null) ''
-    ln -s ../${src.name} $sourceRoot/${platformSubdir}
-    chmod -R +w ${src.name}
-  '' + postUnpack;
-
-  prePatch = ''
-    pushd ${platformSubdir}
-  '' + prePatch;
-
-  postPatch = ''
-    popd
-    ${lib.concatMapStrings (patch: ''
-      echo applying patch ${patch}
-      patch -p1 < ${patch} 
-    '') ([
-      ./0001-common-mk-don-t-leak-source-absolute-paths.patch
-      ./0002-common-mk-.gn-don-t-hardcode-env-path.patch
-    ] ++ platform2Patches)}
-
-    patchShebangs common-mk
-  '' + (lib.optionalString (!stdenv.cc.isClang) ''
-    substituteInPlace common-mk/BUILD.gn \
-        --replace '"-Wno-c99-designator",' "" \
-        --replace '"-Wstring-compare",' "" \
-        --replace '"-Wstring-plus-int",' "" \
-        --replace '"-Wxor-used-as-pow",' "" \
-        --replace '"-Wunreachable-code-return",' ""
-  '') + postPatch;
-
-  nativeBuildInputs = [ gn pkgconfig python3 ninja ] ++ nativeBuildInputs;
-
-  gnFlags = (attrsToGnList ({
-    ar = "ar";
-    cc = "cc";
-    cxx = "c++";
-    # libbase_ver = libchrome.version;
-    libdir = placeholder "out";
-    pkg_config = "pkg-config";
-    platform2_root = ".";
-    platform_subdir = platformSubdir;
-    use = {
-      amd64 = stdenv.targetPlatform.isx86_64;
-      arm = stdenv.targetPlatform.isAarch32 || stdenv.targetPlatform.isAarch64;
-      asan = false;
-      coverage = false;
-      cros_host = false;
-      crypto = false;
-      dbus = false;
-      device_mapper = false;
-      fuzzer = false;
-      mojo = false;
-      profiling = false;
-      tcmalloc = false;
-      test = false;
-      timers = false;
-      udev = false;
-    } // use;
-  } // gnArgs)) ++ gnFlags;
-
-  passthru.updateScript = ../update.py;
-
-  meta = {
-    homepage =
-      if src == null then
-        "${platform2.meta.homepage}/+/HEAD/${platformSubdir}"
-      else
-        src.meta.homepage;
-    platform = lib.platforms.linux;
-  } // lib.optionalAttrs (src == null) {
-    license = lib.licenses.bsd3;
-  } // meta;
-} // (builtins.removeAttrs args [
-  "src"
-  "gnArgs" "gnFlags" "use"
-  "postUnpack" "prePatch" "postPatch"
-  "nativeBuildInputs"
-  "meta"
-]))
diff --git a/pkgs/os-specific/linux/chromium-os/crosvm/VIRTIO_NET_F_MAC.patch b/pkgs/os-specific/linux/chromium-os/crosvm/VIRTIO_NET_F_MAC.patch
deleted file mode 100644
index 80cab56b1f8..00000000000
--- a/pkgs/os-specific/linux/chromium-os/crosvm/VIRTIO_NET_F_MAC.patch
+++ /dev/null
@@ -1,278 +0,0 @@
-From 2b5a83bd9e2c1c9642773c1daf785d03f95f33a3 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Sun, 27 Sep 2020 15:34:02 +0000
-Subject: [PATCH crosvm v3] crosvm: support setting guest MAC from tap-fd
-
-This adds a mac= option to crosvm's --tap-fd option.  The virtio-net
-driver in the guest will read the desired MAC from virtio
-configuration space.
-
-See the documentation for VIRTIO_NET_F_MAC in the Virtio spec[1].
-
-[1]: https://docs.oasis-open.org/virtio/virtio/v1.1/virtio-v1.1.html
-
-Thanks-to: Puck Meerburg <puck@puckipedia.com>
-Reviewed-by: Cole Helbling <cole.e.helbling@outlook.com>
-Message-Id: <20210517185700.3591932-1-hi@alyssa.is>
----
- devices/src/virtio/net.rs | 20 ++++++++++--
- src/crosvm.rs             |  8 +++--
- src/linux.rs              | 19 +++++++-----
- src/main.rs               | 64 +++++++++++++++++++++++++++++++--------
- 4 files changed, 88 insertions(+), 23 deletions(-)
-
-diff --git a/devices/src/virtio/net.rs b/devices/src/virtio/net.rs
-index b88dc44ae..b7489eb2b 100644
---- a/devices/src/virtio/net.rs
-+++ b/devices/src/virtio/net.rs
-@@ -419,6 +419,7 @@ where
- }
- 
- pub struct Net<T: TapT> {
-+    mac_address: Option<MacAddress>,
-     queue_sizes: Box<[u16]>,
-     workers_kill_evt: Vec<Event>,
-     kill_evts: Vec<Event>,
-@@ -439,6 +440,7 @@ where
-         ip_addr: Ipv4Addr,
-         netmask: Ipv4Addr,
-         mac_addr: MacAddress,
-+        guest_mac_addr: Option<MacAddress>,
-         vq_pairs: u16,
-     ) -> Result<Net<T>, NetError> {
-         let multi_queue = vq_pairs > 1;
-@@ -450,12 +452,17 @@ where
- 
-         tap.enable().map_err(NetError::TapEnable)?;
- 
--        Net::from(base_features, tap, vq_pairs)
-+        Net::with_tap(base_features, tap, vq_pairs, guest_mac_addr)
-     }
- 
-     /// Creates a new virtio network device from a tap device that has already been
-     /// configured.
--    pub fn from(base_features: u64, tap: T, vq_pairs: u16) -> Result<Net<T>, NetError> {
-+    pub fn with_tap(
-+        base_features: u64,
-+        tap: T,
-+        vq_pairs: u16,
-+        mac_address: Option<MacAddress>,
-+    ) -> Result<Net<T>, NetError> {
-         let taps = tap.into_mq_taps(vq_pairs).map_err(NetError::TapOpen)?;
- 
-         // This would also validate a tap created by Self::new(), but that's a good thing as it
-@@ -488,7 +495,12 @@ where
-             workers_kill_evt.push(worker_kill_evt);
-         }
- 
-+        if mac_address.is_some() {
-+            avail_features |= 1 << virtio_net::VIRTIO_NET_F_MAC;
-+        }
-+
-         Ok(Net {
-+            mac_address,
-             queue_sizes: vec![QUEUE_SIZE; (vq_pairs * 2 + 1) as usize].into_boxed_slice(),
-             workers_kill_evt,
-             kill_evts,
-@@ -503,6 +515,10 @@ where
-         let vq_pairs = self.queue_sizes.len() as u16 / 2;
- 
-         VirtioNetConfig {
-+            mac: self
-+                .mac_address
-+                .map(|m| m.octets())
-+                .unwrap_or_else(Default::default),
-             max_vq_pairs: Le16::from(vq_pairs),
-             // Other field has meaningful value when the corresponding feature
-             // is enabled, but all these features aren't supported now.
-diff --git a/src/crosvm.rs b/src/crosvm.rs
-index eededc02e..62b3019db 100644
---- a/src/crosvm.rs
-+++ b/src/crosvm.rs
-@@ -191,6 +191,10 @@ impl Default for SharedDir {
-     }
- }
- 
-+pub struct TapFdOption {
-+    pub mac: Option<net_util::MacAddress>,
-+}
-+
- /// Aggregate of all configurable options for a running VM.
- pub struct Config {
-     pub kvm_device_path: PathBuf,
-@@ -217,7 +221,7 @@ pub struct Config {
-     pub mac_address: Option<net_util::MacAddress>,
-     pub net_vq_pairs: Option<u16>,
-     pub vhost_net: bool,
--    pub tap_fd: Vec<RawFd>,
-+    pub tap_fd: BTreeMap<RawFd, TapFdOption>,
-     pub cid: Option<u64>,
-     pub wayland_socket_paths: BTreeMap<String, PathBuf>,
-     pub wayland_dmabuf: bool,
-@@ -291,7 +295,7 @@ impl Default for Config {
-             mac_address: None,
-             net_vq_pairs: None,
-             vhost_net: false,
--            tap_fd: Vec::new(),
-+            tap_fd: BTreeMap::new(),
-             cid: None,
-             #[cfg(feature = "gpu")]
-             gpu_parameters: None,
-diff --git a/src/linux.rs b/src/linux.rs
-index ba2d28f96..e9601478a 100644
---- a/src/linux.rs
-+++ b/src/linux.rs
-@@ -60,8 +60,8 @@ use vm_memory::{GuestAddress, GuestMemory};
- #[cfg(all(target_arch = "x86_64", feature = "gdb"))]
- use crate::gdb::{gdb_thread, GdbStub};
- use crate::{
--    Config, DiskOption, Executable, SharedDir, SharedDirKind, TouchDeviceOption, VhostUserFsOption,
--    VhostUserOption,
-+    Config, DiskOption, Executable, SharedDir, SharedDirKind, TapFdOption, TouchDeviceOption,
-+    VhostUserFsOption, VhostUserOption,
- };
- use arch::{
-     self, LinuxArch, RunnableLinuxVm, SerialHardware, SerialParameters, VcpuAffinity,
-@@ -763,7 +763,11 @@ fn create_balloon_device(cfg: &Config, tube: Tube) -> DeviceResult {
-     })
- }
- 
--fn create_tap_net_device(cfg: &Config, tap_fd: RawDescriptor) -> DeviceResult {
-+fn create_tap_net_device(
-+    cfg: &Config,
-+    tap_fd: RawDescriptor,
-+    options: &TapFdOption,
-+) -> DeviceResult {
-     // Safe because we ensure that we get a unique handle to the fd.
-     let tap = unsafe {
-         Tap::from_raw_descriptor(
-@@ -779,7 +783,8 @@ fn create_tap_net_device(cfg: &Config, tap_fd: RawDescriptor) -> DeviceResult {
-         vq_pairs = 1;
-     }
-     let features = virtio::base_features(cfg.protected_vm);
--    let dev = virtio::Net::from(features, tap, vq_pairs).map_err(Error::NetDeviceNew)?;
-+    let dev =
-+        virtio::Net::with_tap(features, tap, vq_pairs, options.mac).map_err(Error::NetDeviceNew)?;
- 
-     Ok(VirtioDeviceStub {
-         dev: Box::new(dev),
-@@ -814,7 +819,7 @@ fn create_net_device(
-         .map_err(Error::VhostNetDeviceNew)?;
-         Box::new(dev) as Box<dyn VirtioDevice>
-     } else {
--        let dev = virtio::Net::<Tap>::new(features, host_ip, netmask, mac_address, vq_pairs)
-+        let dev = virtio::Net::<Tap>::new(features, host_ip, netmask, mac_address, None, vq_pairs)
-             .map_err(Error::NetDeviceNew)?;
-         Box::new(dev) as Box<dyn VirtioDevice>
-     };
-@@ -1445,8 +1450,8 @@ fn create_virtio_devices(
-     devs.push(create_balloon_device(cfg, balloon_device_tube)?);
- 
-     // We checked above that if the IP is defined, then the netmask is, too.
--    for tap_fd in &cfg.tap_fd {
--        devs.push(create_tap_net_device(cfg, *tap_fd)?);
-+    for (tap_fd, options) in &cfg.tap_fd {
-+        devs.push(create_tap_net_device(cfg, *tap_fd, options)?);
-     }
- 
-     if let (Some(host_ip), Some(netmask), Some(mac_address)) =
-diff --git a/src/main.rs b/src/main.rs
-index ab62f2543..e1188a86c 100644
---- a/src/main.rs
-+++ b/src/main.rs
-@@ -20,13 +20,15 @@ use arch::{
-     set_default_serial_parameters, Pstore, SerialHardware, SerialParameters, SerialType,
-     VcpuAffinity,
- };
--use base::{debug, error, getpid, info, kill_process_group, reap_child, syslog, warn};
-+use base::{
-+    debug, error, getpid, info, kill_process_group, reap_child, syslog, warn, RawDescriptor,
-+};
- #[cfg(feature = "direct")]
- use crosvm::DirectIoOption;
- use crosvm::{
-     argument::{self, print_help, set_arguments, Argument},
--    platform, BindMount, Config, DiskOption, Executable, GidMap, SharedDir, TouchDeviceOption,
--    VhostUserFsOption, VhostUserOption, DISK_ID_LEN,
-+    platform, BindMount, Config, DiskOption, Executable, GidMap, SharedDir, TapFdOption,
-+    TouchDeviceOption, VhostUserFsOption, VhostUserOption, DISK_ID_LEN,
- };
- #[cfg(feature = "gpu")]
- use devices::virtio::gpu::{GpuMode, GpuParameters};
-@@ -1460,17 +1462,55 @@ fn set_argument(cfg: &mut Config, name: &str, value: Option<&str>) -> argument::
-         }
-         "vhost-net" => cfg.vhost_net = true,
-         "tap-fd" => {
--            cfg.tap_fd.push(
--                value
--                    .unwrap()
--                    .parse()
--                    .map_err(|_| argument::Error::InvalidValue {
-+            let mut components = value.unwrap().split(',');
-+
-+            let fd: RawDescriptor =
-+                components
-+                    .next()
-+                    .and_then(|x| x.parse().ok())
-+                    .ok_or_else(|| argument::Error::InvalidValue {
-                         value: value.unwrap().to_owned(),
-                         expected: String::from(
-                             "this value for `tap-fd` must be an unsigned integer",
-                         ),
--                    })?,
--            );
-+                    })?;
-+
-+            let mut mac = None;
-+            for c in components {
-+                let mut kv = c.splitn(2, '=');
-+                let (kind, value) = match (kv.next(), kv.next()) {
-+                    (Some(kind), Some(value)) => (kind, value),
-+                    _ => {
-+                        return Err(argument::Error::InvalidValue {
-+                            value: c.to_owned(),
-+                            expected: String::from("option must be of the form `kind=value`"),
-+                        })
-+                    }
-+                };
-+                match kind {
-+                    "mac" => {
-+                        mac = Some(value.parse().map_err(|_| argument::Error::InvalidValue {
-+                            value: value.to_owned(),
-+                            expected: String::from(
-+                                "`mac` needs to be in the form \"XX:XX:XX:XX:XX:XX\"",
-+                            ),
-+                        })?)
-+                    }
-+                    _ => {
-+                        return Err(argument::Error::InvalidValue {
-+                            value: kind.to_owned(),
-+                            expected: String::from("unrecognized option"),
-+                        })
-+                    }
-+                }
-+            }
-+            if cfg.tap_fd.contains_key(&fd) {
-+                return Err(argument::Error::TooManyArguments(format!(
-+                    "TAP FD already used: '{}'",
-+                    name
-+                )));
-+            }
-+            cfg.tap_fd.insert(fd, TapFdOption { mac });
-         }
-         #[cfg(feature = "gpu")]
-         "gpu" => {
-@@ -1907,8 +1947,8 @@ writeback=BOOL - Indicates whether the VM can use writeback caching (default: fa
-           Argument::value("plugin-gid-map-file", "PATH", "Path to the file listing supplemental GIDs that should be mapped in plugin jail.  Can be given more than once."),
-           Argument::flag("vhost-net", "Use vhost for networking."),
-           Argument::value("tap-fd",
--                          "fd",
--                          "File descriptor for configured tap device. A different virtual network card will be added each time this argument is given."),
-+                          "FD[,mac=MAC]",
-+                          "File descriptor for configured tap device. A different virtual network card will be added each time this argument is given. MAC is the MAC address that will be set in the guest."),
-           #[cfg(feature = "gpu")]
-           Argument::flag_or_value("gpu",
-                                   "[width=INT,height=INT]",
--- 
-2.31.1
-
diff --git a/pkgs/os-specific/linux/chromium-os/crosvm/default-seccomp-policy-dir.diff b/pkgs/os-specific/linux/chromium-os/crosvm/default-seccomp-policy-dir.diff
deleted file mode 100644
index f1aa50ee102..00000000000
--- a/pkgs/os-specific/linux/chromium-os/crosvm/default-seccomp-policy-dir.diff
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/src/crosvm.rs b/src/crosvm.rs
-index b7055df..5989c87 100644
---- a/src/crosvm.rs
-+++ b/src/crosvm.rs
-@@ -141,7 +141,9 @@ impl Default for Config {
-             x_display: None,
-             shared_dirs: Vec::new(),
-             sandbox: !cfg!(feature = "default-no-sandbox"),
--            seccomp_policy_dir: PathBuf::from(SECCOMP_POLICY_DIR),
-+            seccomp_policy_dir: PathBuf::from(
-+                option_env!("DEFAULT_SECCOMP_POLICY_DIR").unwrap_or(SECCOMP_POLICY_DIR),
-+            ),
-             seccomp_log_failures: false,
-             cras_audio: false,
-             cras_capture: false,
diff --git a/pkgs/os-specific/linux/chromium-os/crosvm/default.nix b/pkgs/os-specific/linux/chromium-os/crosvm/default.nix
deleted file mode 100644
index 25fa4e2d937..00000000000
--- a/pkgs/os-specific/linux/chromium-os/crosvm/default.nix
+++ /dev/null
@@ -1,85 +0,0 @@
-{ stdenv, lib, rustPlatform, fetchFromGitiles, upstreamInfo
-, pkg-config, minigbm, minijail, wayland, wayland-protocols, dtc, libusb1
-, libcap, linux
-}:
-
-let
-  arch = with stdenv.hostPlatform;
-    if isAarch64 then "arm"
-    else if isx86_64 then "x86_64"
-    else throw "no seccomp policy files available for host platform";
-
-  getSrc = path: fetchFromGitiles upstreamInfo.components.${path};
-  srcs = lib.genAttrs [
-    "src/aosp/external/minijail"
-    "src/platform/crosvm"
-    "src/platform2"
-    "src/third_party/adhd"
-    "src/third_party/rust-vmm/vhost"
-  ] getSrc;
-in
-
-  rustPlatform.buildRustPackage rec {
-    pname = "crosvm";
-    inherit (upstreamInfo) version;
-
-    unpackPhase = ''
-      runHook preUnpack
-
-      ${lib.concatStringsSep "\n" (lib.mapAttrsToList (path: src: ''
-        mkdir -p ${dirOf path}
-        pushd ${dirOf path}
-        unpackFile ${src}
-        popd
-      '') srcs)}
-
-      chmod -R u+w -- "$sourceRoot"
-
-      runHook postUnpack
-    '';
-
-    sourceRoot = "src/platform/crosvm";
-
-    patches = [
-      ./default-seccomp-policy-dir.diff
-      ./VIRTIO_NET_F_MAC.patch
-    ];
-
-    cargoSha256 = "1yhxw19niqwipi1fbrskrpvhs915lrs8sdcpknmqd9izq67r3a06";
-
-    nativeBuildInputs = [ pkg-config wayland ];
-
-    buildInputs = [ dtc libcap libusb1 minigbm minijail wayland wayland-protocols ];
-
-    postPatch = ''
-      sed -i "s|/usr/share/policy/crosvm/|$out/share/policy/|g" \
-             seccomp/*/*.policy
-    '';
-
-    preBuild = ''
-      export DEFAULT_SECCOMP_POLICY_DIR=$out/share/policy
-    '';
-
-    postInstall = ''
-      mkdir -p $out/share/policy/
-      cp seccomp/${arch}/* $out/share/policy/
-    '';
-
-    CROSVM_CARGO_TEST_KERNEL_BINARY =
-      lib.optionalString (stdenv.buildPlatform == stdenv.hostPlatform)
-        "${linux}/${stdenv.hostPlatform.linux-kernel.target}";
-
-    passthru = {
-      inherit srcs;
-      src = srcs.${sourceRoot};
-      updateScript = ../update.py;
-    };
-
-    meta = with lib; {
-      description = "A secure virtual machine monitor for KVM";
-      homepage = "https://chromium.googlesource.com/chromiumos/platform/crosvm/";
-      maintainers = with maintainers; [ qyliss ];
-      license = licenses.bsd3;
-      platforms = [ "aarch64-linux" "x86_64-linux" ];
-    };
-  }
diff --git a/pkgs/os-specific/linux/chromium-os/dbus-properties/default.nix b/pkgs/os-specific/linux/chromium-os/dbus-properties/default.nix
deleted file mode 100644
index e95ef4a9aa8..00000000000
--- a/pkgs/os-specific/linux/chromium-os/dbus-properties/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ runCommand, chromiumos-overlay }:
-
-runCommand "dbus-properties" {
-  passthru.updateScript = ../update.py;
-} ''
-  mkdir -p $out/share/dbus-1/interfaces
-  cp ${chromiumos-overlay}/sys-apps/dbus/files/org.freedesktop.DBus.Properties.xml \
-      $out/share/dbus-1/interfaces
-''
diff --git a/pkgs/os-specific/linux/chromium-os/default.nix b/pkgs/os-specific/linux/chromium-os/default.nix
deleted file mode 100644
index efdf600756f..00000000000
--- a/pkgs/os-specific/linux/chromium-os/default.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{ lib, newScope, fetchFromGitiles, symlinkJoin
-, kernelPatches, libqmi, linux_5_4, makeLinuxHeaders, modemmanager
-}:
-
-let
-  self = with self; {
-    callPackage = newScope self;
-
-    upstreamInfo = lib.importJSON ./upstream-info.json;
-
-    chromiumos-overlay = (fetchFromGitiles
-      upstreamInfo.components."src/third_party/chromiumos-overlay") // {
-        passthru.updateScript = ./update.py;
-      };
-
-    common-mk = callPackage ./common-mk { };
-
-    crosvm = callPackage ./crosvm { };
-
-    dbus-properties = callPackage ./dbus-properties { };
-
-    dbus-interfaces = symlinkJoin {
-      name = "dbus-interfaces";
-      paths = [ dbus-properties self.modemmanager modemmanager-next ];
-      passthru.updateScript = ./update.py;
-    };
-
-    libqmi = callPackage ./libqmi {
-      inherit libqmi;
-    };
-
-    linux_5_4 = callPackage ../kernel/linux-cros.nix {
-      kernelPatches =
-        lib.remove kernelPatches.rtl8761b_support linux_5_4.kernelPatches;
-    };
-
-    linux = self.linux_5_4;
-
-    linuxHeaders = (makeLinuxHeaders {
-      inherit (linux) version src patches;
-    });
-
-    minigbm = callPackage ./minigbm { };
-
-    modemmanager = callPackage ./modem-manager {
-      inherit modemmanager;
-    };
-
-    modemmanager-next = callPackage ./modem-manager/next.nix {
-      inherit modemmanager;
-    };
-
-    modp_b64 = callPackage ./modp_b64 { };
-
-    protofiles = callPackage ./protofiles { };
-
-    sommelier = callPackage ./sommelier { };
-
-    vm_protos = callPackage ./vm_protos { };
-  };
-
-in self // (with self; {
-  inherit (upstreamInfo) version;
-})
diff --git a/pkgs/os-specific/linux/chromium-os/libqmi/default.nix b/pkgs/os-specific/linux/chromium-os/libqmi/default.nix
deleted file mode 100644
index b96b5224b57..00000000000
--- a/pkgs/os-specific/linux/chromium-os/libqmi/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ libqmi, lib, fetchFromGitiles, upstreamInfo
-, autoreconfHook, autoconf-archive, gtk-doc, docbook-xsl-nons
-}:
-
-libqmi.overrideAttrs (
-  { configureFlags ? [], nativeBuildInputs ? [], passthru ? {}, meta ? {}, ... }:
-  {
-    pname = "libqmi-unstable";
-    version = "2019-12-16";
-
-    src = fetchFromGitiles upstreamInfo.components."src/third_party/libqmi";
-
-    nativeBuildInputs = nativeBuildInputs ++
-      [ autoreconfHook autoconf-archive gtk-doc docbook-xsl-nons ];
-
-    # ModemManager tests fail with QRTR in Chromium OS 91.
-    # Will hopefully be fixed in CrOS 92.
-    configureFlags = configureFlags ++ [ "--enable-gtk-doc" "--disable-qrtr" ];
-
-    passthru = passthru // {
-      updateScript = ../update.py;
-    };
-
-    meta = with lib; meta // {
-      maintainers = with maintainers; [ qyliss ];
-    };
-  }
-)
diff --git a/pkgs/os-specific/linux/chromium-os/minigbm/default.nix b/pkgs/os-specific/linux/chromium-os/minigbm/default.nix
deleted file mode 100644
index 6c532a4deb2..00000000000
--- a/pkgs/os-specific/linux/chromium-os/minigbm/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ stdenv, lib, fetchFromGitiles, upstreamInfo, pkg-config, libdrm }:
-
-stdenv.mkDerivation {
-  name = "minigbm";
-  inherit (upstreamInfo) version;
-
-  src = fetchFromGitiles upstreamInfo.components."src/platform/minigbm";
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libdrm ];
-
-  patchPhase = ''
-    substituteInPlace Makefile --replace /usr/include $out/include
-  '';
-
-  buildFlags = [ "ECHO=echo" "PKG_CONFIG=pkg-config" ];
-  installFlags = [ "LIBDIR=$(out)/lib" ];
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "GBM implementation for Chromium";
-    homepage = "https://chromium.googlesource.com/chromiumos/platform/minigbm/";
-    maintainers = with maintainers; [ qyliss ];
-    license = licenses.bsd3;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/chromium-os/modem-manager/default.nix b/pkgs/os-specific/linux/chromium-os/modem-manager/default.nix
deleted file mode 100644
index f1d6cbdd465..00000000000
--- a/pkgs/os-specific/linux/chromium-os/modem-manager/default.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ modemmanager, lib, fetchFromGitiles
-, autoreconfHook, libtool, intltool, libxslt, dbus_glib, chromiumos-overlay
-}:
-
-modemmanager.overrideAttrs (
-  { pname, nativeBuildInputs ? [], buildInputs ? [], postInstall ? "", meta ? {}
-  , ... }:
-  {
-    pname = "${pname}-chromiumos-unstable";
-    version = "2012-04-10";
-
-    src = fetchFromGitiles {
-      url = "https://chromium.googlesource.com/chromiumos/third_party/modemmanager";
-      rev = "657324d1abfd446b0319e4c51bd30cf4967eccf4";
-      sha256 = "12wlak8zx914zix4vv5a8sl0nyi58v7593h4gjchgv3i8ysgj9ah";
-    };
-
-    patches = [];
-
-    nativeBuildInputs = nativeBuildInputs ++ [ autoreconfHook libtool intltool libxslt ];
-    buildInputs = buildInputs ++ [ dbus_glib ];
-
-    preAutoreconf = ''
-      intltoolize
-    '';
-
-    NIX_CFLAGS_COMPILE = [ "-Wno-error" ];
-
-    meta = with lib; meta // {
-      maintainers = with maintainers; [ qyliss ];
-    };
-  }
-)
diff --git a/pkgs/os-specific/linux/chromium-os/modem-manager/next.nix b/pkgs/os-specific/linux/chromium-os/modem-manager/next.nix
deleted file mode 100644
index d008470b682..00000000000
--- a/pkgs/os-specific/linux/chromium-os/modem-manager/next.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ modemmanager, lib, fetchFromGitiles, upstreamInfo
-, autoreconfHook, autoconf-archive, gtk-doc, libqmi, libxslt
-}:
-
-(modemmanager.override { inherit libqmi; }).overrideAttrs (
-  { pname, nativeBuildInputs ? [], passthru ? {}, meta ? {}, ... }:
-  {
-    pname = "${pname}-chromiumos-next-unstable";
-    version = "2019-10-17";
-
-    src = fetchFromGitiles
-      upstreamInfo.components."src/third_party/modemmanager-next";
-
-    nativeBuildInputs = nativeBuildInputs ++
-      [ autoreconfHook autoconf-archive gtk-doc libxslt ];
-
-    passthru = passthru // {
-      updateScript = ../update.py;
-    };
-
-    meta = with lib; meta // {
-      maintainers = with maintainers; [ qyliss ];
-    };
-  }
-)
diff --git a/pkgs/os-specific/linux/chromium-os/modp_b64/default.nix b/pkgs/os-specific/linux/chromium-os/modp_b64/default.nix
deleted file mode 100644
index 557769336ce..00000000000
--- a/pkgs/os-specific/linux/chromium-os/modp_b64/default.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{ common-mk, lib, fetchFromGitiles, upstreamInfo }:
-
-common-mk {
-  platformSubdir = "modp_b64";
-
-  src = fetchFromGitiles upstreamInfo.components."src/third_party/modp_b64";
-
-  installPhase = ''
-    mkdir -p $out/lib
-    install -m 0644 libmodp_b64.a $out/lib
-
-    mkdir $out/include
-    cp -r ../../modp_b64/modp_b64 $out/include
-  '';
-
-  meta = with lib; {
-    description = "High performance base64 encoder/decoder";
-    homepage = "https://github.com/client9/stringencoders";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ qyliss ];
-    platform = platforms.all;
-  };
-}
diff --git a/pkgs/os-specific/linux/chromium-os/protofiles/default.nix b/pkgs/os-specific/linux/chromium-os/protofiles/default.nix
deleted file mode 100644
index de8ecbb6963..00000000000
--- a/pkgs/os-specific/linux/chromium-os/protofiles/default.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ stdenv, lib, fetchFromGitiles, chromiumos-overlay, python2 }:
-
-stdenv.mkDerivation rec {
-  pname = "protofiles";
-  version = "0.0.36";
-
-  src = fetchFromGitiles {
-    url = "https://chromium.googlesource.com/chromium/src/components/policy";
-    rev = "72e354e16600a8999c85528147dcf762f31a4b78";
-    sha256 = "11v7n8d0ma426ba3i6q82k0vj0m5l1hx49waffivplpn0c92bm94";
-  };
-
-  buildInputs = [ python2 ];
-
-  installPhase = ''
-    mkdir -p $out/include/proto $out/share/protofiles \
-        $out/share/policy_resources $out/share/policy_tools
-
-    install -m 0644 proto/*.proto $out/include/proto
-    ln -s $out/include/proto/*.proto $out/share/protofiles
-    install -m 0644 resources/policy_templates.json $out/share/policy_resources
-    install -m 0644 ${chromiumos-overlay}/chromeos-base/protofiles/files/VERSION \
-      $out/share/policy_resources
-
-    install tools/generate_policy_source.py $out/share/policy_tools
-  '';
-
-  meta = with lib; {
-    inherit (src.meta) homepage;
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ qyliss ];
-    platform = platforms.all;
-  };
-}
diff --git a/pkgs/os-specific/linux/chromium-os/sommelier/0005-sommelier-don-t-leak-source-absolute-paths.patch b/pkgs/os-specific/linux/chromium-os/sommelier/0005-sommelier-don-t-leak-source-absolute-paths.patch
deleted file mode 100644
index d40ff8f022c..00000000000
--- a/pkgs/os-specific/linux/chromium-os/sommelier/0005-sommelier-don-t-leak-source-absolute-paths.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 04bdfd44bbaa9f619d3ff03cad3273c46493396e Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Sun, 1 Dec 2019 17:04:04 +0000
-Subject: [PATCH 5/6] sommelier: don't leak source-absolute paths
-
----
- vm_tools/sommelier/wayland_protocol.gni | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/vm_tools/sommelier/wayland_protocol.gni b/vm_tools/sommelier/wayland_protocol.gni
-index f894adf81d..28bb5a006b 100644
---- a/vm_tools/sommelier/wayland_protocol.gni
-+++ b/vm_tools/sommelier/wayland_protocol.gni
-@@ -42,7 +42,7 @@ template("wayland_protocol_library") {
-         "wayland-scanner",
-         g.subcommand,
-         "{{source}}",
--        output_file,
-+        rebase_path(output_file),
-       ]
-     }
-   }
--- 
-2.32.0
-
diff --git a/pkgs/os-specific/linux/chromium-os/sommelier/0006-Revert-Revert-vm_tools-sommelier-Switch-to-the-stabl.patch b/pkgs/os-specific/linux/chromium-os/sommelier/0006-Revert-Revert-vm_tools-sommelier-Switch-to-the-stabl.patch
deleted file mode 100644
index c7b1eeafc0d..00000000000
--- a/pkgs/os-specific/linux/chromium-os/sommelier/0006-Revert-Revert-vm_tools-sommelier-Switch-to-the-stabl.patch
+++ /dev/null
@@ -1,1840 +0,0 @@
-From e97193872755e44aae51dd88e9323d8a069a40ca Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Fri, 2 Apr 2021 17:55:55 +0000
-Subject: [PATCH 6/6] Revert "Revert "vm_tools: sommelier: Switch to the stable
- version of xdg-shell""
-
-This reverts commit 32050c0ea6c00c16999915856b40a6a6b8b41bb9.
----
- vm_tools/sommelier/BUILD.gn                   |   2 +-
- vm_tools/sommelier/meson.build                |   2 +-
- ...dg-shell-unstable-v6.xml => xdg-shell.xml} | 435 +++++++++++++-----
- vm_tools/sommelier/sommelier-xdg-shell.cc     | 217 +++++----
- vm_tools/sommelier/sommelier.cc               | 210 +++++----
- vm_tools/sommelier/sommelier.h                |   8 +-
- 6 files changed, 535 insertions(+), 339 deletions(-)
- rename vm_tools/sommelier/protocol/{xdg-shell-unstable-v6.xml => xdg-shell.xml} (71%)
-
-diff --git a/vm_tools/sommelier/BUILD.gn b/vm_tools/sommelier/BUILD.gn
-index 52df0e3403..fe543138ef 100644
---- a/vm_tools/sommelier/BUILD.gn
-+++ b/vm_tools/sommelier/BUILD.gn
-@@ -49,7 +49,7 @@ wayland_protocol_library("sommelier-protocol") {
-     "protocol/relative-pointer-unstable-v1.xml",
-     "protocol/text-input-unstable-v1.xml",
-     "protocol/viewporter.xml",
--    "protocol/xdg-shell-unstable-v6.xml",
-+    "protocol/xdg-shell.xml",
-   ]
- }
- 
-diff --git a/vm_tools/sommelier/meson.build b/vm_tools/sommelier/meson.build
-index 088e3e173f..86bcced912 100644
---- a/vm_tools/sommelier/meson.build
-+++ b/vm_tools/sommelier/meson.build
-@@ -58,7 +58,7 @@ wl_protocols = [
-     'protocol/relative-pointer-unstable-v1.xml',
-     'protocol/text-input-unstable-v1.xml',
-     'protocol/viewporter.xml',
--    'protocol/xdg-shell-unstable-v6.xml',
-+    'protocol/xdg-shell.xml',
- ]
- 
- wl_outs = []
-diff --git a/vm_tools/sommelier/protocol/xdg-shell-unstable-v6.xml b/vm_tools/sommelier/protocol/xdg-shell.xml
-similarity index 71%
-rename from vm_tools/sommelier/protocol/xdg-shell-unstable-v6.xml
-rename to vm_tools/sommelier/protocol/xdg-shell.xml
-index 1c0f92452b..f7377a713c 100644
---- a/vm_tools/sommelier/protocol/xdg-shell-unstable-v6.xml
-+++ b/vm_tools/sommelier/protocol/xdg-shell.xml
-@@ -1,11 +1,13 @@
- <?xml version="1.0" encoding="UTF-8"?>
--<protocol name="xdg_shell_unstable_v6">
-+<protocol name="xdg_shell">
- 
-   <copyright>
-     Copyright © 2008-2013 Kristian Høgsberg
-     Copyright © 2013      Rafael Antognolli
-     Copyright © 2013      Jasper St. Pierre
-     Copyright © 2010-2013 Intel Corporation
-+    Copyright © 2015-2017 Samsung Electronics Co., Ltd
-+    Copyright © 2015-2017 Red Hat Inc.
- 
-     Permission is hereby granted, free of charge, to any person obtaining a
-     copy of this software and associated documentation files (the "Software"),
-@@ -27,18 +29,19 @@
-     DEALINGS IN THE SOFTWARE.
-   </copyright>
- 
--  <interface name="zxdg_shell_v6" version="1">
-+  <interface name="xdg_wm_base" version="3">
-     <description summary="create desktop-style surfaces">
--      xdg_shell allows clients to turn a wl_surface into a "real window"
--      which can be dragged, resized, stacked, and moved around by the
--      user. Everything about this interface is suited towards traditional
--      desktop environments.
-+      The xdg_wm_base interface is exposed as a global object enabling clients
-+      to turn their wl_surfaces into windows in a desktop environment. It
-+      defines the basic functionality needed for clients and the compositor to
-+      create windows that can be dragged, resized, maximized, etc, as well as
-+      creating transient windows such as popup menus.
-     </description>
- 
-     <enum name="error">
-       <entry name="role" value="0" summary="given wl_surface has another role"/>
-       <entry name="defunct_surfaces" value="1"
--	     summary="xdg_shell was destroyed before children"/>
-+	     summary="xdg_wm_base was destroyed before children"/>
-       <entry name="not_the_topmost_popup" value="2"
- 	     summary="the client tried to map or destroy a non-topmost popup"/>
-       <entry name="invalid_popup_parent" value="3"
-@@ -50,11 +53,11 @@
-     </enum>
- 
-     <request name="destroy" type="destructor">
--      <description summary="destroy xdg_shell">
--	Destroy this xdg_shell object.
-+      <description summary="destroy xdg_wm_base">
-+	Destroy this xdg_wm_base object.
- 
--	Destroying a bound xdg_shell object while there are surfaces
--	still alive created by this xdg_shell object instance is illegal
-+	Destroying a bound xdg_wm_base object while there are surfaces
-+	still alive created by this xdg_wm_base object instance is illegal
- 	and will result in a protocol error.
-       </description>
-     </request>
-@@ -65,7 +68,7 @@
- 	surfaces relative to some parent surface. See the interface description
- 	and xdg_surface.get_popup for details.
-       </description>
--      <arg name="id" type="new_id" interface="zxdg_positioner_v6"/>
-+      <arg name="id" type="new_id" interface="xdg_positioner"/>
-     </request>
- 
-     <request name="get_xdg_surface">
-@@ -82,14 +85,14 @@
- 	See the documentation of xdg_surface for more details about what an
- 	xdg_surface is and how it is used.
-       </description>
--      <arg name="id" type="new_id" interface="zxdg_surface_v6"/>
-+      <arg name="id" type="new_id" interface="xdg_surface"/>
-       <arg name="surface" type="object" interface="wl_surface"/>
-     </request>
- 
-     <request name="pong">
-       <description summary="respond to a ping event">
- 	A client must respond to a ping event with a pong request or
--	the client may be deemed unresponsive. See xdg_shell.ping.
-+	the client may be deemed unresponsive. See xdg_wm_base.ping.
-       </description>
-       <arg name="serial" type="uint" summary="serial of the ping event"/>
-     </request>
-@@ -98,7 +101,7 @@
-       <description summary="check if the client is alive">
- 	The ping event asks the client if it's still alive. Pass the
- 	serial specified in the event back to the compositor by sending
--	a "pong" request back with the specified serial. See xdg_shell.ping.
-+	a "pong" request back with the specified serial. See xdg_wm_base.pong.
- 
- 	Compositors can use this to determine if the client is still
- 	alive. It's unspecified what will happen if the client doesn't
-@@ -106,13 +109,13 @@
- 	try to respond in a reasonable amount of time.
- 
- 	A compositor is free to ping in any way it wants, but a client must
--	always respond to any xdg_shell object it created.
-+	always respond to any xdg_wm_base object it created.
-       </description>
-       <arg name="serial" type="uint" summary="pass this to the pong request"/>
-     </event>
-   </interface>
- 
--  <interface name="zxdg_positioner_v6" version="1">
-+  <interface name="xdg_positioner" version="3">
-     <description summary="child surface positioner">
-       The xdg_positioner provides a collection of rules for the placement of a
-       child surface relative to a parent surface. Rules can be defined to ensure
-@@ -162,13 +165,13 @@
- 	Specify the anchor rectangle within the parent surface that the child
- 	surface will be placed relative to. The rectangle is relative to the
- 	window geometry as defined by xdg_surface.set_window_geometry of the
--	parent surface. The rectangle must be at least 1x1 large.
-+	parent surface.
- 
- 	When the xdg_positioner object is used to position a child surface, the
- 	anchor rectangle may not extend outside the window geometry of the
- 	positioned child's parent surface.
- 
--	If a zero or negative size is set the invalid_input error is raised.
-+	If a negative size is set the invalid_input error is raised.
-       </description>
-       <arg name="x" type="int" summary="x position of anchor rectangle"/>
-       <arg name="y" type="int" summary="y position of anchor rectangle"/>
-@@ -176,63 +179,54 @@
-       <arg name="height" type="int" summary="height of anchor rectangle"/>
-     </request>
- 
--    <enum name="anchor" bitfield="true">
--      <entry name="none" value="0"
--	     summary="the center of the anchor rectangle"/>
--      <entry name="top" value="1"
--	     summary="the top edge of the anchor rectangle"/>
--      <entry name="bottom" value="2"
--	     summary="the bottom edge of the anchor rectangle"/>
--      <entry name="left" value="4"
--	     summary="the left edge of the anchor rectangle"/>
--      <entry name="right" value="8"
--	     summary="the right edge of the anchor rectangle"/>
-+    <enum name="anchor">
-+      <entry name="none" value="0"/>
-+      <entry name="top" value="1"/>
-+      <entry name="bottom" value="2"/>
-+      <entry name="left" value="3"/>
-+      <entry name="right" value="4"/>
-+      <entry name="top_left" value="5"/>
-+      <entry name="bottom_left" value="6"/>
-+      <entry name="top_right" value="7"/>
-+      <entry name="bottom_right" value="8"/>
-     </enum>
- 
-     <request name="set_anchor">
--      <description summary="set anchor rectangle anchor edges">
--	Defines a set of edges for the anchor rectangle. These are used to
--	derive an anchor point that the child surface will be positioned
--	relative to. If two orthogonal edges are specified (e.g. 'top' and
--	'left'), then the anchor point will be the intersection of the edges
--	(e.g. the top left position of the rectangle); otherwise, the derived
--	anchor point will be centered on the specified edge, or in the center of
--	the anchor rectangle if no edge is specified.
--
--	If two parallel anchor edges are specified (e.g. 'left' and 'right'),
--	the invalid_input error is raised.
-+      <description summary="set anchor rectangle anchor">
-+	Defines the anchor point for the anchor rectangle. The specified anchor
-+	is used derive an anchor point that the child surface will be
-+	positioned relative to. If a corner anchor is set (e.g. 'top_left' or
-+	'bottom_right'), the anchor point will be at the specified corner;
-+	otherwise, the derived anchor point will be centered on the specified
-+	edge, or in the center of the anchor rectangle if no edge is specified.
-       </description>
-       <arg name="anchor" type="uint" enum="anchor"
--	   summary="bit mask of anchor edges"/>
-+	   summary="anchor"/>
-     </request>
- 
--    <enum name="gravity" bitfield="true">
--      <entry name="none" value="0"
--	     summary="center over the anchor edge"/>
--      <entry name="top" value="1"
--	     summary="position above the anchor edge"/>
--      <entry name="bottom" value="2"
--	     summary="position below the anchor edge"/>
--      <entry name="left" value="4"
--	     summary="position to the left of the anchor edge"/>
--      <entry name="right" value="8"
--	     summary="position to the right of the anchor edge"/>
-+    <enum name="gravity">
-+      <entry name="none" value="0"/>
-+      <entry name="top" value="1"/>
-+      <entry name="bottom" value="2"/>
-+      <entry name="left" value="3"/>
-+      <entry name="right" value="4"/>
-+      <entry name="top_left" value="5"/>
-+      <entry name="bottom_left" value="6"/>
-+      <entry name="top_right" value="7"/>
-+      <entry name="bottom_right" value="8"/>
-     </enum>
- 
-     <request name="set_gravity">
-       <description summary="set child surface gravity">
- 	Defines in what direction a surface should be positioned, relative to
--	the anchor point of the parent surface. If two orthogonal gravities are
--	specified (e.g. 'bottom' and 'right'), then the child surface will be
--	placed in the specified direction; otherwise, the child surface will be
--	centered over the anchor point on any axis that had no gravity
--	specified.
--
--	If two parallel gravities are specified (e.g. 'left' and 'right'), the
--	invalid_input error is raised.
-+	the anchor point of the parent surface. If a corner gravity is
-+	specified (e.g. 'bottom_right' or 'top_left'), then the child surface
-+	will be placed towards the specified gravity; otherwise, the child
-+	surface will be centered over the anchor point on any axis that had no
-+	gravity specified.
-       </description>
-       <arg name="gravity" type="uint" enum="gravity"
--	   summary="bit mask of gravity directions"/>
-+	   summary="gravity direction"/>
-     </request>
- 
-     <enum name="constraint_adjustment" bitfield="true">
-@@ -252,7 +246,7 @@
-       <entry name="none" value="0">
- 	<description summary="don't move the child surface when constrained">
- 	  Don't alter the surface position even if it is constrained on some
--	  axis, for example partially outside the edge of a monitor.
-+	  axis, for example partially outside the edge of an output.
- 	</description>
-       </entry>
-       <entry name="slide_x" value="1">
-@@ -304,6 +298,10 @@
- 	  surface is constrained, the gravity is 'bottom' and the anchor is
- 	  'bottom', change the gravity to 'top' and the anchor to 'top'.
- 
-+	  The adjusted position is calculated given the original anchor
-+	  rectangle and offset, but with the new flipped anchor and gravity
-+	  values.
-+
- 	  If the adjusted position also ends up being constrained, the resulting
- 	  position of the flip_y adjustment will be the one before the
- 	  adjustment.
-@@ -359,9 +357,49 @@
-       <arg name="x" type="int" summary="surface position x offset"/>
-       <arg name="y" type="int" summary="surface position y offset"/>
-     </request>
-+
-+    <!-- Version 3 additions -->
-+
-+    <request name="set_reactive" since="3">
-+      <description summary="continuously reconstrain the surface">
-+	When set reactive, the surface is reconstrained if the conditions used
-+	for constraining changed, e.g. the parent window moved.
-+
-+	If the conditions changed and the popup was reconstrained, an
-+	xdg_popup.configure event is sent with updated geometry, followed by an
-+	xdg_surface.configure event.
-+      </description>
-+    </request>
-+
-+    <request name="set_parent_size" since="3">
-+      <description summary="">
-+	Set the parent window geometry the compositor should use when
-+	positioning the popup. The compositor may use this information to
-+	determine the future state the popup should be constrained using. If
-+	this doesn't match the dimension of the parent the popup is eventually
-+	positioned against, the behavior is undefined.
-+
-+	The arguments are given in the surface-local coordinate space.
-+      </description>
-+      <arg name="parent_width" type="int"
-+	   summary="future window geometry width of parent"/>
-+      <arg name="parent_height" type="int"
-+	   summary="future window geometry height of parent"/>
-+    </request>
-+
-+    <request name="set_parent_configure" since="3">
-+      <description summary="set parent configure this is a response to">
-+	Set the serial of a xdg_surface.configure event this positioner will be
-+	used in response to. The compositor may use this information together
-+	with set_parent_size to determine what future state the popup should be
-+	constrained using.
-+      </description>
-+      <arg name="serial" type="uint"
-+	   summary="serial of parent configure event"/>
-+    </request>
-   </interface>
- 
--  <interface name="zxdg_surface_v6" version="1">
-+  <interface name="xdg_surface" version="3">
-     <description summary="desktop user interface surface base interface">
-       An interface that may be implemented by a wl_surface, for
-       implementations that provide a desktop-style user interface.
-@@ -388,11 +426,25 @@
-       manipulate a buffer prior to the first xdg_surface.configure call must
-       also be treated as errors.
- 
--      For a surface to be mapped by the compositor, the following conditions
--      must be met: (1) the client has assigned a xdg_surface based role to the
--      surface, (2) the client has set and committed the xdg_surface state and
--      the role dependent state to the surface and (3) the client has committed a
--      buffer to the surface.
-+      After creating a role-specific object and setting it up, the client must
-+      perform an initial commit without any buffer attached. The compositor
-+      will reply with an xdg_surface.configure event. The client must
-+      acknowledge it and is then allowed to attach a buffer to map the surface.
-+
-+      Mapping an xdg_surface-based role surface is defined as making it
-+      possible for the surface to be shown by the compositor. Note that
-+      a mapped surface is not guaranteed to be visible once it is mapped.
-+
-+      For an xdg_surface to be mapped by the compositor, the following
-+      conditions must be met:
-+      (1) the client has assigned an xdg_surface-based role to the surface
-+      (2) the client has set and committed the xdg_surface state and the
-+	  role-dependent state to the surface
-+      (3) the client has committed a buffer to the surface
-+
-+      A newly-unmapped surface is considered to have met condition (1) out
-+      of the 3 required conditions for mapping a surface if its role surface
-+      has not been destroyed.
-     </description>
- 
-     <enum name="error">
-@@ -416,20 +468,23 @@
- 	See the documentation of xdg_toplevel for more details about what an
- 	xdg_toplevel is and how it is used.
-       </description>
--      <arg name="id" type="new_id" interface="zxdg_toplevel_v6"/>
-+      <arg name="id" type="new_id" interface="xdg_toplevel"/>
-     </request>
- 
-     <request name="get_popup">
-       <description summary="assign the xdg_popup surface role">
--	This creates an xdg_popup object for the given xdg_surface and gives the
--	associated wl_surface the xdg_popup role.
-+	This creates an xdg_popup object for the given xdg_surface and gives
-+	the associated wl_surface the xdg_popup role.
-+
-+	If null is passed as a parent, a parent surface must be specified using
-+	some other protocol, before committing the initial state.
- 
- 	See the documentation of xdg_popup for more details about what an
- 	xdg_popup is and how it is used.
-       </description>
--      <arg name="id" type="new_id" interface="zxdg_popup_v6"/>
--      <arg name="parent" type="object" interface="zxdg_surface_v6"/>
--      <arg name="positioner" type="object" interface="zxdg_positioner_v6"/>
-+      <arg name="id" type="new_id" interface="xdg_popup"/>
-+      <arg name="parent" type="object" interface="xdg_surface" allow-null="true"/>
-+      <arg name="positioner" type="object" interface="xdg_positioner"/>
-     </request>
- 
-     <request name="set_window_geometry">
-@@ -442,6 +497,11 @@
- 	The window geometry is double buffered, and will be applied at the
- 	time wl_surface.commit of the corresponding wl_surface is called.
- 
-+	When maintaining a position, the compositor should treat the (x, y)
-+	coordinate of the window geometry as the top left corner of the window.
-+	A client changing the (x, y) window geometry coordinate should in
-+	general not alter the position of the window.
-+
- 	Once the window geometry of the surface is set, it is not possible to
- 	unset it, and it will remain the same until set_window_geometry is
- 	called again, even if a new subsurface or buffer is attached.
-@@ -511,36 +571,57 @@
-       </description>
-       <arg name="serial" type="uint" summary="serial of the configure event"/>
-     </event>
-+
-   </interface>
- 
--  <interface name="zxdg_toplevel_v6" version="1">
-+  <interface name="xdg_toplevel" version="3">
-     <description summary="toplevel surface">
-       This interface defines an xdg_surface role which allows a surface to,
-       among other things, set window-like properties such as maximize,
-       fullscreen, and minimize, set application-specific metadata like title and
-       id, and well as trigger user interactive operations such as interactive
-       resize and move.
-+
-+      Unmapping an xdg_toplevel means that the surface cannot be shown
-+      by the compositor until it is explicitly mapped again.
-+      All active operations (e.g., move, resize) are canceled and all
-+      attributes (e.g. title, state, stacking, ...) are discarded for
-+      an xdg_toplevel surface when it is unmapped. The xdg_toplevel returns to
-+      the state it had right after xdg_surface.get_toplevel. The client
-+      can re-map the toplevel by perfoming a commit without any buffer
-+      attached, waiting for a configure event and handling it as usual (see
-+      xdg_surface description).
-+
-+      Attaching a null buffer to a toplevel unmaps the surface.
-     </description>
- 
-     <request name="destroy" type="destructor">
-       <description summary="destroy the xdg_toplevel">
--	Unmap and destroy the window. The window will be effectively
--	hidden from the user's point of view, and all state like
--	maximization, fullscreen, and so on, will be lost.
-+	This request destroys the role surface and unmaps the surface;
-+	see "Unmapping" behavior in interface section for details.
-       </description>
-     </request>
- 
-     <request name="set_parent">
-       <description summary="set the parent of this surface">
--	Set the "parent" of this surface. This window should be stacked
--	above a parent. The parent surface must be mapped as long as this
--	surface is mapped.
-+	Set the "parent" of this surface. This surface should be stacked
-+	above the parent surface and all other ancestor surfaces.
- 
- 	Parent windows should be set on dialogs, toolboxes, or other
- 	"auxiliary" surfaces, so that the parent is raised when the dialog
- 	is raised.
-+
-+	Setting a null parent for a child window removes any parent-child
-+	relationship for the child. Setting a null parent for a window which
-+	currently has no parent is a no-op.
-+
-+	If the parent is unmapped then its children are managed as
-+	though the parent of the now-unmapped parent has become the
-+	parent of this surface. If no parent exists for the now-unmapped
-+	parent then the children are managed as though they have no
-+	parent surface.
-       </description>
--      <arg name="parent" type="object" interface="zxdg_toplevel_v6" allow-null="true"/>
-+      <arg name="parent" type="object" interface="xdg_toplevel" allow-null="true"/>
-     </request>
- 
-     <request name="set_title">
-@@ -573,6 +654,9 @@
- 	For example, "org.freedesktop.FooViewer" where the .desktop file is
- 	"org.freedesktop.FooViewer.desktop".
- 
-+	Like other properties, a set_app_id request can be sent after the
-+	xdg_toplevel has been mapped to update the property.
-+
- 	See the desktop-entry specification [0] for more details on
- 	application identifiers and how they relate to well-known D-Bus
- 	names and .desktop files.
-@@ -676,7 +760,7 @@
-       </description>
-       <arg name="seat" type="object" interface="wl_seat" summary="the wl_seat of the user event"/>
-       <arg name="serial" type="uint" summary="the serial of the user event"/>
--      <arg name="edges" type="uint" summary="which edge or corner is being dragged"/>
-+      <arg name="edges" type="uint" enum="resize_edge" summary="which edge or corner is being dragged"/>
-     </request>
- 
-     <enum name="state">
-@@ -693,12 +777,18 @@
- 	<description summary="the surface is maximized">
- 	  The surface is maximized. The window geometry specified in the configure
- 	  event must be obeyed by the client.
-+
-+	  The client should draw without shadow or other
-+	  decoration outside of the window geometry.
- 	</description>
-       </entry>
-       <entry name="fullscreen" value="2" summary="the surface is fullscreen">
- 	<description summary="the surface is fullscreen">
--	  The surface is fullscreen. The window geometry specified in the configure
--	  event must be obeyed by the client.
-+	  The surface is fullscreen. The window geometry specified in the
-+	  configure event is a maximum; the client cannot resize beyond it. For
-+	  a surface to cover the whole fullscreened area, the geometry
-+	  dimensions must be obeyed by the client. For more details, see
-+	  xdg_toplevel.set_fullscreen.
- 	</description>
-       </entry>
-       <entry name="resizing" value="3" summary="the surface is being resized">
-@@ -716,6 +806,30 @@
- 	  keyboard or pointer focus.
- 	</description>
-       </entry>
-+      <entry name="tiled_left" value="5" since="2">
-+	<description summary="the surface is tiled">
-+	  The window is currently in a tiled layout and the left edge is
-+	  considered to be adjacent to another part of the tiling grid.
-+	</description>
-+      </entry>
-+      <entry name="tiled_right" value="6" since="2">
-+	<description summary="the surface is tiled">
-+	  The window is currently in a tiled layout and the right edge is
-+	  considered to be adjacent to another part of the tiling grid.
-+	</description>
-+      </entry>
-+      <entry name="tiled_top" value="7" since="2">
-+	<description summary="the surface is tiled">
-+	  The window is currently in a tiled layout and the top edge is
-+	  considered to be adjacent to another part of the tiling grid.
-+	</description>
-+      </entry>
-+      <entry name="tiled_bottom" value="8" since="2">
-+	<description summary="the surface is tiled">
-+	  The window is currently in a tiled layout and the bottom edge is
-+	  considered to be adjacent to another part of the tiling grid.
-+	</description>
-+      </entry>
-     </enum>
- 
-     <request name="set_max_size">
-@@ -805,12 +919,11 @@
- 	Maximize the surface.
- 
- 	After requesting that the surface should be maximized, the compositor
--	will respond by emitting a configure event with the "maximized" state
--	and the required window geometry. The client should then update its
--	content, drawing it in a maximized state, i.e. without shadow or other
--	decoration outside of the window geometry. The client must also
--	acknowledge the configure when committing the new content (see
--	ack_configure).
-+	will respond by emitting a configure event. Whether this configure
-+	actually sets the window maximized is subject to compositor policies.
-+	The client must then update its content, drawing in the configured
-+	state. The client must also acknowledge the configure when committing
-+	the new content (see ack_configure).
- 
- 	It is up to the compositor to decide how and where to maximize the
- 	surface, for example which output and what region of the screen should
-@@ -818,6 +931,10 @@
- 
- 	If the surface was already maximized, the compositor will still emit
- 	a configure event with the "maximized" state.
-+
-+	If the surface is in a fullscreen state, this request has no direct
-+	effect. It may alter the state the surface is returned to when
-+	unmaximized unless overridden by the compositor.
-       </description>
-     </request>
- 
-@@ -826,13 +943,13 @@
- 	Unmaximize the surface.
- 
- 	After requesting that the surface should be unmaximized, the compositor
--	will respond by emitting a configure event without the "maximized"
--	state. If available, the compositor will include the window geometry
--	dimensions the window had prior to being maximized in the configure
--	request. The client must then update its content, drawing it in a
--	regular state, i.e. potentially with shadow, etc. The client must also
--	acknowledge the configure when committing the new content (see
--	ack_configure).
-+	will respond by emitting a configure event. Whether this actually
-+	un-maximizes the window is subject to compositor policies.
-+	If available and applicable, the compositor will include the window
-+	geometry dimensions the window had prior to being maximized in the
-+	configure event. The client must then update its content, drawing it in
-+	the configured state. The client must also acknowledge the configure
-+	when committing the new content (see ack_configure).
- 
- 	It is up to the compositor to position the surface after it was
- 	unmaximized; usually the position the surface had before maximizing, if
-@@ -840,24 +957,63 @@
- 
- 	If the surface was already not maximized, the compositor will still
- 	emit a configure event without the "maximized" state.
-+
-+	If the surface is in a fullscreen state, this request has no direct
-+	effect. It may alter the state the surface is returned to when
-+	unmaximized unless overridden by the compositor.
-       </description>
-     </request>
- 
-     <request name="set_fullscreen">
--      <description summary="set the window as fullscreen on a monitor">
-+      <description summary="set the window as fullscreen on an output">
- 	Make the surface fullscreen.
- 
--	You can specify an output that you would prefer to be fullscreen.
--	If this value is NULL, it's up to the compositor to choose which
--	display will be used to map this surface.
-+	After requesting that the surface should be fullscreened, the
-+	compositor will respond by emitting a configure event. Whether the
-+	client is actually put into a fullscreen state is subject to compositor
-+	policies. The client must also acknowledge the configure when
-+	committing the new content (see ack_configure).
-+
-+	The output passed by the request indicates the client's preference as
-+	to which display it should be set fullscreen on. If this value is NULL,
-+	it's up to the compositor to choose which display will be used to map
-+	this surface.
- 
- 	If the surface doesn't cover the whole output, the compositor will
- 	position the surface in the center of the output and compensate with
--	black borders filling the rest of the output.
-+	with border fill covering the rest of the output. The content of the
-+	border fill is undefined, but should be assumed to be in some way that
-+	attempts to blend into the surrounding area (e.g. solid black).
-+
-+	If the fullscreened surface is not opaque, the compositor must make
-+	sure that other screen content not part of the same surface tree (made
-+	up of subsurfaces, popups or similarly coupled surfaces) are not
-+	visible below the fullscreened surface.
-       </description>
-       <arg name="output" type="object" interface="wl_output" allow-null="true"/>
-     </request>
--    <request name="unset_fullscreen" />
-+
-+    <request name="unset_fullscreen">
-+      <description summary="unset the window as fullscreen">
-+	Make the surface no longer fullscreen.
-+
-+	After requesting that the surface should be unfullscreened, the
-+	compositor will respond by emitting a configure event.
-+	Whether this actually removes the fullscreen state of the client is
-+	subject to compositor policies.
-+
-+	Making a surface unfullscreen sets states for the surface based on the following:
-+	* the state(s) it may have had before becoming fullscreen
-+	* any state(s) decided by the compositor
-+	* any state(s) requested by the client while the surface was fullscreen
-+
-+	The compositor may include the previous window geometry dimensions in
-+	the configure event, if applicable.
-+
-+	The client must also acknowledge the configure when committing the new
-+	content (see ack_configure).
-+      </description>
-+    </request>
- 
-     <request name="set_minimized">
-       <description summary="set the window as minimized">
-@@ -913,7 +1069,7 @@
-     </event>
-   </interface>
- 
--  <interface name="zxdg_popup_v6" version="1">
-+  <interface name="xdg_popup" version="3">
-     <description summary="short-lived, popup surfaces for menus">
-       A popup surface is a short-lived, temporary surface. It can be used to
-       implement for example menus, popovers, tooltips and other similar user
-@@ -931,21 +1087,12 @@
-       surface of their own is clicked should dismiss the popup using the destroy
-       request.
- 
--      The parent surface must have either the xdg_toplevel or xdg_popup surface
--      role.
--
-       A newly created xdg_popup will be stacked on top of all previously created
-       xdg_popup surfaces associated with the same xdg_toplevel.
- 
-       The parent of an xdg_popup must be mapped (see the xdg_surface
-       description) before the xdg_popup itself.
- 
--      The x and y arguments passed when creating the popup object specify
--      where the top left of the popup should be placed, relative to the
--      local surface coordinates of the parent surface. See
--      xdg_surface.get_popup. An xdg_popup must intersect with or be at least
--      partially adjacent to its parent surface.
--
-       The client must call wl_surface.commit on the corresponding wl_surface
-       for the xdg_popup state to take effect.
-     </description>
-@@ -1023,6 +1170,11 @@
- 	The x and y arguments represent the position the popup was placed at
- 	given the xdg_positioner rule, relative to the upper left corner of the
- 	window geometry of the parent surface.
-+
-+	For version 2 or older, the configure event for an xdg_popup is only
-+	ever sent once for the initial configuration. Starting with version 3,
-+	it may be sent again if the popup is setup with an xdg_positioner with
-+	set_reactive requested, or in response to xdg_popup.reposition requests.
-       </description>
-       <arg name="x" type="int"
- 	   summary="x position relative to parent surface window geometry"/>
-@@ -1040,5 +1192,58 @@
-       </description>
-     </event>
- 
-+    <!-- Version 3 additions -->
-+
-+    <request name="reposition" since="3">
-+      <description summary="recalculate the popup's location">
-+	Reposition an already-mapped popup. The popup will be placed given the
-+	details in the passed xdg_positioner object, and a
-+	xdg_popup.repositioned followed by xdg_popup.configure and
-+	xdg_surface.configure will be emitted in response. Any parameters set
-+	by the previous positioner will be discarded.
-+
-+	The passed token will be sent in the corresponding
-+	xdg_popup.repositioned event. The new popup position will not take
-+	effect until the corresponding configure event is acknowledged by the
-+	client. See xdg_popup.repositioned for details. The token itself is
-+	opaque, and has no other special meaning.
-+
-+	If multiple reposition requests are sent, the compositor may skip all
-+	but the last one.
-+
-+	If the popup is repositioned in response to a configure event for its
-+	parent, the client should send an xdg_positioner.set_parent_configure
-+	and possibly a xdg_positioner.set_parent_size request to allow the
-+	compositor to properly constrain the popup.
-+
-+	If the popup is repositioned together with a parent that is being
-+	resized, but not in response to a configure event, the client should
-+	send a xdg_positioner.set_parent_size request.
-+      </description>
-+      <arg name="positioner" type="object" interface="xdg_positioner"/>
-+      <arg name="token" type="uint" summary="reposition request token"/>
-+    </request>
-+
-+    <event name="repositioned" since="3">
-+      <description summary="signal the completion of a repositioned request">
-+	The repositioned event is sent as part of a popup configuration
-+	sequence, together with xdg_popup.configure and lastly
-+	xdg_surface.configure to notify the completion of a reposition request.
-+
-+	The repositioned event is to notify about the completion of a
-+	xdg_popup.reposition request. The token argument is the token passed
-+	in the xdg_popup.reposition request.
-+
-+	Immediately after this event is emitted, xdg_popup.configure and
-+	xdg_surface.configure will be sent with the updated size and position,
-+	as well as a new configure serial.
-+
-+	The client should optionally update the content of the popup, but must
-+	acknowledge the new popup configuration for the new position to take
-+	effect. See xdg_surface.ack_configure for details.
-+      </description>
-+      <arg name="token" type="uint" summary="reposition request token"/>
-+    </event>
-+
-   </interface>
- </protocol>
-diff --git a/vm_tools/sommelier/sommelier-xdg-shell.cc b/vm_tools/sommelier/sommelier-xdg-shell.cc
-index 91744a67e3..45b8eeb93e 100644
---- a/vm_tools/sommelier/sommelier-xdg-shell.cc
-+++ b/vm_tools/sommelier/sommelier-xdg-shell.cc
-@@ -7,37 +7,37 @@
- #include <assert.h>
- #include <stdlib.h>
- 
--#include "xdg-shell-unstable-v6-client-protocol.h"  // NOLINT(build/include_directory)
--#include "xdg-shell-unstable-v6-server-protocol.h"  // NOLINT(build/include_directory)
-+#include "xdg-shell-client-protocol.h"  // NOLINT(build/include_directory)
-+#include "xdg-shell-server-protocol.h"  // NOLINT(build/include_directory)
- 
- struct sl_host_xdg_shell {
-   struct sl_context* ctx;
-   struct wl_resource* resource;
--  struct zxdg_shell_v6* proxy;
-+  struct xdg_wm_base* proxy;
- };
- 
- struct sl_host_xdg_surface {
-   struct sl_context* ctx;
-   struct wl_resource* resource;
--  struct zxdg_surface_v6* proxy;
-+  struct xdg_surface* proxy;
- };
- 
- struct sl_host_xdg_toplevel {
-   struct sl_context* ctx;
-   struct wl_resource* resource;
--  struct zxdg_toplevel_v6* proxy;
-+  struct xdg_toplevel* proxy;
- };
- 
- struct sl_host_xdg_popup {
-   struct sl_context* ctx;
-   struct wl_resource* resource;
--  struct zxdg_popup_v6* proxy;
-+  struct xdg_popup* proxy;
- };
- 
- struct sl_host_xdg_positioner {
-   struct sl_context* ctx;
-   struct wl_resource* resource;
--  struct zxdg_positioner_v6* proxy;
-+  struct xdg_positioner* proxy;
- };
- 
- static void sl_xdg_positioner_destroy(struct wl_client* client,
-@@ -53,7 +53,7 @@ static void sl_xdg_positioner_set_size(struct wl_client* client,
-       static_cast<sl_host_xdg_positioner*>(wl_resource_get_user_data(resource));
-   double scale = host->ctx->scale;
- 
--  zxdg_positioner_v6_set_size(host->proxy, width / scale, height / scale);
-+  xdg_positioner_set_size(host->proxy, width / scale, height / scale);
- }
- 
- static void sl_xdg_positioner_set_anchor_rect(struct wl_client* client,
-@@ -72,7 +72,7 @@ static void sl_xdg_positioner_set_anchor_rect(struct wl_client* client,
-   x2 = (x + width) / scale;
-   y2 = (y + height) / scale;
- 
--  zxdg_positioner_v6_set_anchor_rect(host->proxy, x1, y1, x2 - x1, y2 - y1);
-+  xdg_positioner_set_anchor_rect(host->proxy, x1, y1, x2 - x1, y2 - y1);
- }
- 
- static void sl_xdg_positioner_set_anchor(struct wl_client* client,
-@@ -81,7 +81,7 @@ static void sl_xdg_positioner_set_anchor(struct wl_client* client,
-   struct sl_host_xdg_positioner* host =
-       static_cast<sl_host_xdg_positioner*>(wl_resource_get_user_data(resource));
- 
--  zxdg_positioner_v6_set_anchor(host->proxy, anchor);
-+  xdg_positioner_set_anchor(host->proxy, anchor);
- }
- 
- static void sl_xdg_positioner_set_gravity(struct wl_client* client,
-@@ -90,7 +90,7 @@ static void sl_xdg_positioner_set_gravity(struct wl_client* client,
-   struct sl_host_xdg_positioner* host =
-       static_cast<sl_host_xdg_positioner*>(wl_resource_get_user_data(resource));
- 
--  zxdg_positioner_v6_set_gravity(host->proxy, gravity);
-+  xdg_positioner_set_gravity(host->proxy, gravity);
- }
- 
- static void sl_xdg_positioner_set_constraint_adjustment(
-@@ -100,8 +100,7 @@ static void sl_xdg_positioner_set_constraint_adjustment(
-   struct sl_host_xdg_positioner* host =
-       static_cast<sl_host_xdg_positioner*>(wl_resource_get_user_data(resource));
- 
--  zxdg_positioner_v6_set_constraint_adjustment(host->proxy,
--                                               constraint_adjustment);
-+  xdg_positioner_set_constraint_adjustment(host->proxy, constraint_adjustment);
- }  // NOLINT(whitespace/indent)
- 
- static void sl_xdg_positioner_set_offset(struct wl_client* client,
-@@ -112,24 +111,23 @@ static void sl_xdg_positioner_set_offset(struct wl_client* client,
-       static_cast<sl_host_xdg_positioner*>(wl_resource_get_user_data(resource));
-   double scale = host->ctx->scale;
- 
--  zxdg_positioner_v6_set_offset(host->proxy, x / scale, y / scale);
-+  xdg_positioner_set_offset(host->proxy, x / scale, y / scale);
- }
- 
--static const struct zxdg_positioner_v6_interface
--    sl_xdg_positioner_implementation = {
--        sl_xdg_positioner_destroy,
--        sl_xdg_positioner_set_size,
--        sl_xdg_positioner_set_anchor_rect,
--        sl_xdg_positioner_set_anchor,
--        sl_xdg_positioner_set_gravity,
--        sl_xdg_positioner_set_constraint_adjustment,
--        sl_xdg_positioner_set_offset};
-+static const struct xdg_positioner_interface sl_xdg_positioner_implementation =
-+    {sl_xdg_positioner_destroy,
-+     sl_xdg_positioner_set_size,
-+     sl_xdg_positioner_set_anchor_rect,
-+     sl_xdg_positioner_set_anchor,
-+     sl_xdg_positioner_set_gravity,
-+     sl_xdg_positioner_set_constraint_adjustment,
-+     sl_xdg_positioner_set_offset};
- 
- static void sl_destroy_host_xdg_positioner(struct wl_resource* resource) {
-   struct sl_host_xdg_positioner* host =
-       static_cast<sl_host_xdg_positioner*>(wl_resource_get_user_data(resource));
- 
--  zxdg_positioner_v6_destroy(host->proxy);
-+  xdg_positioner_destroy(host->proxy);
-   wl_resource_set_user_data(resource, NULL);
-   free(host);
- }
-@@ -148,20 +146,20 @@ static void sl_xdg_popup_grab(struct wl_client* client,
-   struct sl_host_seat* host_seat =
-       static_cast<sl_host_seat*>(wl_resource_get_user_data(seat_resource));
- 
--  zxdg_popup_v6_grab(host->proxy, host_seat->proxy, serial);
-+  xdg_popup_grab(host->proxy, host_seat->proxy, serial);
- }  // NOLINT(whitespace/indent)
- 
--static const struct zxdg_popup_v6_interface sl_xdg_popup_implementation = {
-+static const struct xdg_popup_interface sl_xdg_popup_implementation = {
-     sl_xdg_popup_destroy, sl_xdg_popup_grab};
- 
- static void sl_xdg_popup_configure(void* data,
--                                   struct zxdg_popup_v6* xdg_popup,
-+                                   struct xdg_popup* xdg_popup,
-                                    int32_t x,
-                                    int32_t y,
-                                    int32_t width,
-                                    int32_t height) {
-   struct sl_host_xdg_popup* host =
--      static_cast<sl_host_xdg_popup*>(zxdg_popup_v6_get_user_data(xdg_popup));
-+      static_cast<sl_host_xdg_popup*>(xdg_popup_get_user_data(xdg_popup));
-   double scale = host->ctx->scale;
-   int32_t x1, y1, x2, y2;
- 
-@@ -170,25 +168,24 @@ static void sl_xdg_popup_configure(void* data,
-   x2 = (x + width) * scale;
-   y2 = (y + height) * scale;
- 
--  zxdg_popup_v6_send_configure(host->resource, x1, y1, x2 - x1, y2 - y1);
-+  xdg_popup_send_configure(host->resource, x1, y1, x2 - x1, y2 - y1);
- }
- 
--static void sl_xdg_popup_popup_done(void* data,
--                                    struct zxdg_popup_v6* xdg_popup) {
-+static void sl_xdg_popup_popup_done(void* data, struct xdg_popup* xdg_popup) {
-   struct sl_host_xdg_popup* host =
--      static_cast<sl_host_xdg_popup*>(zxdg_popup_v6_get_user_data(xdg_popup));
-+      static_cast<sl_host_xdg_popup*>(xdg_popup_get_user_data(xdg_popup));
- 
--  zxdg_popup_v6_send_popup_done(host->resource);
-+  xdg_popup_send_popup_done(host->resource);
- }
- 
--static const struct zxdg_popup_v6_listener sl_xdg_popup_listener = {
-+static const struct xdg_popup_listener sl_xdg_popup_listener = {
-     sl_xdg_popup_configure, sl_xdg_popup_popup_done};
- 
- static void sl_destroy_host_xdg_popup(struct wl_resource* resource) {
-   struct sl_host_xdg_popup* host =
-       static_cast<sl_host_xdg_popup*>(wl_resource_get_user_data(resource));
- 
--  zxdg_popup_v6_destroy(host->proxy);
-+  xdg_popup_destroy(host->proxy);
-   wl_resource_set_user_data(resource, NULL);
-   free(host);
- }
-@@ -208,8 +205,7 @@ static void sl_xdg_toplevel_set_parent(struct wl_client* client,
-                             wl_resource_get_user_data(parent_resource))
-                       : NULL;
- 
--  zxdg_toplevel_v6_set_parent(host->proxy,
--                              host_parent ? host_parent->proxy : NULL);
-+  xdg_toplevel_set_parent(host->proxy, host_parent ? host_parent->proxy : NULL);
- }
- 
- static void sl_xdg_toplevel_set_title(struct wl_client* client,
-@@ -218,7 +214,7 @@ static void sl_xdg_toplevel_set_title(struct wl_client* client,
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_set_title(host->proxy, title);
-+  xdg_toplevel_set_title(host->proxy, title);
- }
- 
- static void sl_xdg_toplevel_set_app_id(struct wl_client* client,
-@@ -227,7 +223,7 @@ static void sl_xdg_toplevel_set_app_id(struct wl_client* client,
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_set_app_id(host->proxy, app_id);
-+  xdg_toplevel_set_app_id(host->proxy, app_id);
- }
- 
- static void sl_xdg_toplevel_show_window_menu(struct wl_client* client,
-@@ -243,7 +239,7 @@ static void sl_xdg_toplevel_show_window_menu(struct wl_client* client,
-           ? static_cast<sl_host_seat*>(wl_resource_get_user_data(seat_resource))
-           : NULL;
- 
--  zxdg_toplevel_v6_show_window_menu(
-+  xdg_toplevel_show_window_menu(
-       host->proxy, host_seat ? host_seat->proxy : NULL, serial, x, y);
- }  // NOLINT(whitespace/indent)
- 
-@@ -258,8 +254,7 @@ static void sl_xdg_toplevel_move(struct wl_client* client,
-           ? static_cast<sl_host_seat*>(wl_resource_get_user_data(seat_resource))
-           : NULL;
- 
--  zxdg_toplevel_v6_move(host->proxy, host_seat ? host_seat->proxy : NULL,
--                        serial);
-+  xdg_toplevel_move(host->proxy, host_seat ? host_seat->proxy : NULL, serial);
- }  // NOLINT(whitespace/indent)
- 
- static void sl_xdg_toplevel_resize(struct wl_client* client,
-@@ -274,8 +269,8 @@ static void sl_xdg_toplevel_resize(struct wl_client* client,
-           ? static_cast<sl_host_seat*>(wl_resource_get_user_data(seat_resource))
-           : NULL;
- 
--  zxdg_toplevel_v6_resize(host->proxy, host_seat ? host_seat->proxy : NULL,
--                          serial, edges);
-+  xdg_toplevel_resize(host->proxy, host_seat ? host_seat->proxy : NULL, serial,
-+                      edges);
- }  // NOLINT(whitespace/indent)
- 
- static void sl_xdg_toplevel_set_max_size(struct wl_client* client,
-@@ -285,7 +280,7 @@ static void sl_xdg_toplevel_set_max_size(struct wl_client* client,
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_set_max_size(host->proxy, width, height);
-+  xdg_toplevel_set_max_size(host->proxy, width, height);
- }
- 
- static void sl_xdg_toplevel_set_min_size(struct wl_client* client,
-@@ -295,7 +290,7 @@ static void sl_xdg_toplevel_set_min_size(struct wl_client* client,
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_set_min_size(host->proxy, width, height);
-+  xdg_toplevel_set_min_size(host->proxy, width, height);
- }
- 
- static void sl_xdg_toplevel_set_maximized(struct wl_client* client,
-@@ -303,7 +298,7 @@ static void sl_xdg_toplevel_set_maximized(struct wl_client* client,
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_set_maximized(host->proxy);
-+  xdg_toplevel_set_maximized(host->proxy);
- }
- 
- static void sl_xdg_toplevel_unset_maximized(struct wl_client* client,
-@@ -311,7 +306,7 @@ static void sl_xdg_toplevel_unset_maximized(struct wl_client* client,
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_unset_maximized(host->proxy);
-+  xdg_toplevel_unset_maximized(host->proxy);
- }
- 
- static void sl_xdg_toplevel_set_fullscreen(
-@@ -325,8 +320,8 @@ static void sl_xdg_toplevel_set_fullscreen(
-                             wl_resource_get_user_data(output_resource))
-                       : NULL;
- 
--  zxdg_toplevel_v6_set_fullscreen(host->proxy,
--                                  host_output ? host_output->proxy : NULL);
-+  xdg_toplevel_set_fullscreen(host->proxy,
-+                              host_output ? host_output->proxy : NULL);
- }  // NOLINT(whitespace/indent)
- 
- static void sl_xdg_toplevel_unset_fullscreen(struct wl_client* client,
-@@ -334,7 +329,7 @@ static void sl_xdg_toplevel_unset_fullscreen(struct wl_client* client,
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_unset_fullscreen(host->proxy);
-+  xdg_toplevel_unset_fullscreen(host->proxy);
- }
- 
- static void sl_xdg_toplevel_set_minimized(struct wl_client* client,
-@@ -342,47 +337,47 @@ static void sl_xdg_toplevel_set_minimized(struct wl_client* client,
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_set_minimized(host->proxy);
-+  xdg_toplevel_set_minimized(host->proxy);
- }
- 
--static const struct zxdg_toplevel_v6_interface sl_xdg_toplevel_implementation =
--    {sl_xdg_toplevel_destroy,          sl_xdg_toplevel_set_parent,
--     sl_xdg_toplevel_set_title,        sl_xdg_toplevel_set_app_id,
--     sl_xdg_toplevel_show_window_menu, sl_xdg_toplevel_move,
--     sl_xdg_toplevel_resize,           sl_xdg_toplevel_set_max_size,
--     sl_xdg_toplevel_set_min_size,     sl_xdg_toplevel_set_maximized,
--     sl_xdg_toplevel_unset_maximized,  sl_xdg_toplevel_set_fullscreen,
--     sl_xdg_toplevel_unset_fullscreen, sl_xdg_toplevel_set_minimized};
-+static const struct xdg_toplevel_interface sl_xdg_toplevel_implementation = {
-+    sl_xdg_toplevel_destroy,          sl_xdg_toplevel_set_parent,
-+    sl_xdg_toplevel_set_title,        sl_xdg_toplevel_set_app_id,
-+    sl_xdg_toplevel_show_window_menu, sl_xdg_toplevel_move,
-+    sl_xdg_toplevel_resize,           sl_xdg_toplevel_set_max_size,
-+    sl_xdg_toplevel_set_min_size,     sl_xdg_toplevel_set_maximized,
-+    sl_xdg_toplevel_unset_maximized,  sl_xdg_toplevel_set_fullscreen,
-+    sl_xdg_toplevel_unset_fullscreen, sl_xdg_toplevel_set_minimized};
- 
- static void sl_xdg_toplevel_configure(void* data,
--                                      struct zxdg_toplevel_v6* xdg_toplevel,
-+                                      struct xdg_toplevel* xdg_toplevel,
-                                       int32_t width,
-                                       int32_t height,
-                                       struct wl_array* states) {
-   struct sl_host_xdg_toplevel* host = static_cast<sl_host_xdg_toplevel*>(
--      zxdg_toplevel_v6_get_user_data(xdg_toplevel));
-+      xdg_toplevel_get_user_data(xdg_toplevel));
-   double scale = host->ctx->scale;
- 
--  zxdg_toplevel_v6_send_configure(host->resource, width * scale, height * scale,
--                                  states);
-+  xdg_toplevel_send_configure(host->resource, width * scale, height * scale,
-+                              states);
- }
- 
- static void sl_xdg_toplevel_close(void* data,
--                                  struct zxdg_toplevel_v6* xdg_toplevel) {
-+                                  struct xdg_toplevel* xdg_toplevel) {
-   struct sl_host_xdg_toplevel* host = static_cast<sl_host_xdg_toplevel*>(
--      zxdg_toplevel_v6_get_user_data(xdg_toplevel));
-+      xdg_toplevel_get_user_data(xdg_toplevel));
- 
--  zxdg_toplevel_v6_send_close(host->resource);
-+  xdg_toplevel_send_close(host->resource);
- }
- 
--static const struct zxdg_toplevel_v6_listener sl_xdg_toplevel_listener = {
-+static const struct xdg_toplevel_listener sl_xdg_toplevel_listener = {
-     sl_xdg_toplevel_configure, sl_xdg_toplevel_close};
- 
- static void sl_destroy_host_xdg_toplevel(struct wl_resource* resource) {
-   struct sl_host_xdg_toplevel* host =
-       static_cast<sl_host_xdg_toplevel*>(wl_resource_get_user_data(resource));
- 
--  zxdg_toplevel_v6_destroy(host->proxy);
-+  xdg_toplevel_destroy(host->proxy);
-   wl_resource_set_user_data(resource, NULL);
-   free(host);
- }
-@@ -403,14 +398,14 @@ static void sl_xdg_surface_get_toplevel(struct wl_client* client,
- 
-   host_xdg_toplevel->ctx = host->ctx;
-   host_xdg_toplevel->resource =
--      wl_resource_create(client, &zxdg_toplevel_v6_interface, 1, id);
-+      wl_resource_create(client, &xdg_toplevel_interface, 1, id);
-   wl_resource_set_implementation(
-       host_xdg_toplevel->resource, &sl_xdg_toplevel_implementation,
-       host_xdg_toplevel, sl_destroy_host_xdg_toplevel);
--  host_xdg_toplevel->proxy = zxdg_surface_v6_get_toplevel(host->proxy);
--  zxdg_toplevel_v6_set_user_data(host_xdg_toplevel->proxy, host_xdg_toplevel);
--  zxdg_toplevel_v6_add_listener(host_xdg_toplevel->proxy,
--                                &sl_xdg_toplevel_listener, host_xdg_toplevel);
-+  host_xdg_toplevel->proxy = xdg_surface_get_toplevel(host->proxy);
-+  xdg_toplevel_set_user_data(host_xdg_toplevel->proxy, host_xdg_toplevel);
-+  xdg_toplevel_add_listener(host_xdg_toplevel->proxy, &sl_xdg_toplevel_listener,
-+                            host_xdg_toplevel);
- }
- 
- static void sl_xdg_surface_get_popup(struct wl_client* client,
-@@ -421,7 +416,7 @@ static void sl_xdg_surface_get_popup(struct wl_client* client,
-   struct sl_host_xdg_surface* host =
-       static_cast<sl_host_xdg_surface*>(wl_resource_get_user_data(resource));
-   struct sl_host_xdg_surface* host_parent = static_cast<sl_host_xdg_surface*>(
--      wl_resource_get_user_data(parent_resource));
-+      parent_resource ? wl_resource_get_user_data(parent_resource) : NULL);
-   struct sl_host_xdg_positioner* host_positioner =
-       static_cast<sl_host_xdg_positioner*>(
-           wl_resource_get_user_data(positioner_resource));
-@@ -431,15 +426,16 @@ static void sl_xdg_surface_get_popup(struct wl_client* client,
- 
-   host_xdg_popup->ctx = host->ctx;
-   host_xdg_popup->resource =
--      wl_resource_create(client, &zxdg_popup_v6_interface, 1, id);
-+      wl_resource_create(client, &xdg_popup_interface, 1, id);
-   wl_resource_set_implementation(host_xdg_popup->resource,
-                                  &sl_xdg_popup_implementation, host_xdg_popup,
-                                  sl_destroy_host_xdg_popup);
--  host_xdg_popup->proxy = zxdg_surface_v6_get_popup(
--      host->proxy, host_parent->proxy, host_positioner->proxy);
--  zxdg_popup_v6_set_user_data(host_xdg_popup->proxy, host_xdg_popup);
--  zxdg_popup_v6_add_listener(host_xdg_popup->proxy, &sl_xdg_popup_listener,
--                             host_xdg_popup);
-+  host_xdg_popup->proxy = xdg_surface_get_popup(
-+      host->proxy, host_parent ? host_parent->proxy : NULL,
-+      host_positioner->proxy);
-+  xdg_popup_set_user_data(host_xdg_popup->proxy, host_xdg_popup);
-+  xdg_popup_add_listener(host_xdg_popup->proxy, &sl_xdg_popup_listener,
-+                         host_xdg_popup);
- }  // NOLINT(whitespace/indent)
- 
- static void sl_xdg_surface_set_window_geometry(struct wl_client* client,
-@@ -458,7 +454,7 @@ static void sl_xdg_surface_set_window_geometry(struct wl_client* client,
-   x2 = (x + width) / scale;
-   y2 = (y + height) / scale;
- 
--  zxdg_surface_v6_set_window_geometry(host->proxy, x1, y1, x2 - x1, y2 - y1);
-+  xdg_surface_set_window_geometry(host->proxy, x1, y1, x2 - x1, y2 - y1);
- }
- 
- static void sl_xdg_surface_ack_configure(struct wl_client* client,
-@@ -467,31 +463,31 @@ static void sl_xdg_surface_ack_configure(struct wl_client* client,
-   struct sl_host_xdg_surface* host =
-       static_cast<sl_host_xdg_surface*>(wl_resource_get_user_data(resource));
- 
--  zxdg_surface_v6_ack_configure(host->proxy, serial);
-+  xdg_surface_ack_configure(host->proxy, serial);
- }
- 
--static const struct zxdg_surface_v6_interface sl_xdg_surface_implementation = {
-+static const struct xdg_surface_interface sl_xdg_surface_implementation = {
-     sl_xdg_surface_destroy, sl_xdg_surface_get_toplevel,
-     sl_xdg_surface_get_popup, sl_xdg_surface_set_window_geometry,
-     sl_xdg_surface_ack_configure};
- 
- static void sl_xdg_surface_configure(void* data,
--                                     struct zxdg_surface_v6* xdg_surface,
-+                                     struct xdg_surface* xdg_surface,
-                                      uint32_t serial) {
-   struct sl_host_xdg_surface* host = static_cast<sl_host_xdg_surface*>(
--      zxdg_surface_v6_get_user_data(xdg_surface));
-+      xdg_surface_get_user_data(xdg_surface));
- 
--  zxdg_surface_v6_send_configure(host->resource, serial);
-+  xdg_surface_send_configure(host->resource, serial);
- }
- 
--static const struct zxdg_surface_v6_listener sl_xdg_surface_listener = {
-+static const struct xdg_surface_listener sl_xdg_surface_listener = {
-     sl_xdg_surface_configure};
- 
- static void sl_destroy_host_xdg_surface(struct wl_resource* resource) {
-   struct sl_host_xdg_surface* host =
-       static_cast<sl_host_xdg_surface*>(wl_resource_get_user_data(resource));
- 
--  zxdg_surface_v6_destroy(host->proxy);
-+  xdg_surface_destroy(host->proxy);
-   wl_resource_set_user_data(resource, NULL);
-   free(host);
- }
-@@ -513,13 +509,12 @@ static void sl_xdg_shell_create_positioner(struct wl_client* client,
- 
-   host_xdg_positioner->ctx = host->ctx;
-   host_xdg_positioner->resource =
--      wl_resource_create(client, &zxdg_positioner_v6_interface, 1, id);
-+      wl_resource_create(client, &xdg_positioner_interface, 1, id);
-   wl_resource_set_implementation(
-       host_xdg_positioner->resource, &sl_xdg_positioner_implementation,
-       host_xdg_positioner, sl_destroy_host_xdg_positioner);
--  host_xdg_positioner->proxy = zxdg_shell_v6_create_positioner(host->proxy);
--  zxdg_positioner_v6_set_user_data(host_xdg_positioner->proxy,
--                                   host_xdg_positioner);
-+  host_xdg_positioner->proxy = xdg_wm_base_create_positioner(host->proxy);
-+  xdg_positioner_set_user_data(host_xdg_positioner->proxy, host_xdg_positioner);
- }
- 
- static void sl_xdg_shell_get_xdg_surface(struct wl_client* client,
-@@ -536,15 +531,15 @@ static void sl_xdg_shell_get_xdg_surface(struct wl_client* client,
- 
-   host_xdg_surface->ctx = host->ctx;
-   host_xdg_surface->resource =
--      wl_resource_create(client, &zxdg_surface_v6_interface, 1, id);
-+      wl_resource_create(client, &xdg_surface_interface, 1, id);
-   wl_resource_set_implementation(host_xdg_surface->resource,
-                                  &sl_xdg_surface_implementation,
-                                  host_xdg_surface, sl_destroy_host_xdg_surface);
-   host_xdg_surface->proxy =
--      zxdg_shell_v6_get_xdg_surface(host->proxy, host_surface->proxy);
--  zxdg_surface_v6_set_user_data(host_xdg_surface->proxy, host_xdg_surface);
--  zxdg_surface_v6_add_listener(host_xdg_surface->proxy,
--                               &sl_xdg_surface_listener, host_xdg_surface);
-+      xdg_wm_base_get_xdg_surface(host->proxy, host_surface->proxy);
-+  xdg_surface_set_user_data(host_xdg_surface->proxy, host_xdg_surface);
-+  xdg_surface_add_listener(host_xdg_surface->proxy, &sl_xdg_surface_listener,
-+                           host_xdg_surface);
-   host_surface->has_role = 1;
- }
- 
-@@ -554,30 +549,30 @@ static void sl_xdg_shell_pong(struct wl_client* client,
-   struct sl_host_xdg_shell* host =
-       static_cast<sl_host_xdg_shell*>(wl_resource_get_user_data(resource));
- 
--  zxdg_shell_v6_pong(host->proxy, serial);
-+  xdg_wm_base_pong(host->proxy, serial);
- }
- 
--static const struct zxdg_shell_v6_interface sl_xdg_shell_implementation = {
-+static const struct xdg_wm_base_interface sl_xdg_shell_implementation = {
-     sl_xdg_shell_destroy, sl_xdg_shell_create_positioner,
-     sl_xdg_shell_get_xdg_surface, sl_xdg_shell_pong};
- 
- static void sl_xdg_shell_ping(void* data,
--                              struct zxdg_shell_v6* xdg_shell,
-+                              struct xdg_wm_base* xdg_shell,
-                               uint32_t serial) {
-   struct sl_host_xdg_shell* host =
--      static_cast<sl_host_xdg_shell*>(zxdg_shell_v6_get_user_data(xdg_shell));
-+      static_cast<sl_host_xdg_shell*>(xdg_wm_base_get_user_data(xdg_shell));
- 
--  zxdg_shell_v6_send_ping(host->resource, serial);
-+  xdg_wm_base_send_ping(host->resource, serial);
- }
- 
--static const struct zxdg_shell_v6_listener sl_xdg_shell_listener = {
-+static const struct xdg_wm_base_listener sl_xdg_shell_listener = {
-     sl_xdg_shell_ping};
- 
- static void sl_destroy_host_xdg_shell(struct wl_resource* resource) {
-   struct sl_host_xdg_shell* host =
-       static_cast<sl_host_xdg_shell*>(wl_resource_get_user_data(resource));
- 
--  zxdg_shell_v6_destroy(host->proxy);
-+  xdg_wm_base_destroy(host->proxy);
-   wl_resource_set_user_data(resource, NULL);
-   free(host);
- }
-@@ -591,17 +586,17 @@ static void sl_bind_host_xdg_shell(struct wl_client* client,
-       static_cast<sl_host_xdg_shell*>(malloc(sizeof(*host)));
-   assert(host);
-   host->ctx = ctx;
--  host->resource = wl_resource_create(client, &zxdg_shell_v6_interface, 1, id);
-+  host->resource = wl_resource_create(client, &xdg_wm_base_interface, 1, id);
-   wl_resource_set_implementation(host->resource, &sl_xdg_shell_implementation,
-                                  host, sl_destroy_host_xdg_shell);
--  host->proxy = static_cast<zxdg_shell_v6*>(
-+  host->proxy = static_cast<xdg_wm_base*>(
-       wl_registry_bind(wl_display_get_registry(ctx->display),
--                       ctx->xdg_shell->id, &zxdg_shell_v6_interface, 1));
--  zxdg_shell_v6_set_user_data(host->proxy, host);
--  zxdg_shell_v6_add_listener(host->proxy, &sl_xdg_shell_listener, host);
-+                       ctx->xdg_shell->id, &xdg_wm_base_interface, 1));
-+  xdg_wm_base_set_user_data(host->proxy, host);
-+  xdg_wm_base_add_listener(host->proxy, &sl_xdg_shell_listener, host);
- }
- 
- struct sl_global* sl_xdg_shell_global_create(struct sl_context* ctx) {
--  return sl_global_create(ctx, &zxdg_shell_v6_interface, 1, ctx,
-+  return sl_global_create(ctx, &xdg_wm_base_interface, 1, ctx,
-                           sl_bind_host_xdg_shell);
- }
-diff --git a/vm_tools/sommelier/sommelier.cc b/vm_tools/sommelier/sommelier.cc
-index 2833e52a61..8f53b3b65b 100644
---- a/vm_tools/sommelier/sommelier.cc
-+++ b/vm_tools/sommelier/sommelier.cc
-@@ -39,7 +39,7 @@
- #include "relative-pointer-unstable-v1-client-protocol.h"  // NOLINT(build/include_directory)
- #include "text-input-unstable-v1-client-protocol.h"  // NOLINT(build/include_directory)
- #include "viewporter-client-protocol.h"  // NOLINT(build/include_directory)
--#include "xdg-shell-unstable-v6-client-protocol.h"  // NOLINT(build/include_directory)
-+#include "xdg-shell-client-protocol.h"  // NOLINT(build/include_directory)
- 
- #define errno_assert(rv)                                          \
-   {                                                               \
-@@ -372,13 +372,13 @@ void sl_sync_point_destroy(struct sl_sync_point* sync_point) {
- }
- 
- static void sl_internal_xdg_shell_ping(void* data,
--                                       struct zxdg_shell_v6* xdg_shell,
-+                                       struct xdg_wm_base* xdg_shell,
-                                        uint32_t serial) {
-   TRACE_EVENT("shell", "sl_internal_xdg_shell_ping");
--  zxdg_shell_v6_pong(xdg_shell, serial);
-+  xdg_wm_base_pong(xdg_shell, serial);
- }
- 
--static const struct zxdg_shell_v6_listener sl_internal_xdg_shell_listener = {
-+static const struct xdg_wm_base_listener sl_internal_xdg_shell_listener = {
-     sl_internal_xdg_shell_ping};
- 
- static void sl_send_configure_notify(struct sl_window* window) {
-@@ -549,8 +549,8 @@ int sl_process_pending_configure_acks(struct sl_window* window,
-   }
- 
-   if (window->xdg_surface) {
--    zxdg_surface_v6_ack_configure(window->xdg_surface,
--                                  window->pending_config.serial);
-+    xdg_surface_ack_configure(window->xdg_surface,
-+                              window->pending_config.serial);
-   }
-   window->pending_config.serial = 0;
- 
-@@ -567,11 +567,12 @@ void sl_commit(struct sl_window* window, struct sl_host_surface* host_surface) {
-   }
- }
- 
--static void sl_internal_xdg_surface_configure(
--    void* data, struct zxdg_surface_v6* xdg_surface, uint32_t serial) {
-+static void sl_internal_xdg_surface_configure(void* data,
-+                                              struct xdg_surface* xdg_surface,
-+                                              uint32_t serial) {
-   TRACE_EVENT("surface", "sl_internal_xdg_surface_configure");
-   struct sl_window* window =
--      static_cast<sl_window*>(zxdg_surface_v6_get_user_data(xdg_surface));
-+      static_cast<sl_window*>(xdg_surface_get_user_data(xdg_surface));
- 
-   window->next_config.serial = serial;
-   if (!window->pending_config.serial) {
-@@ -589,18 +590,18 @@ static void sl_internal_xdg_surface_configure(
-   }
- }
- 
--static const struct zxdg_surface_v6_listener sl_internal_xdg_surface_listener =
--    {sl_internal_xdg_surface_configure};
-+static const struct xdg_surface_listener sl_internal_xdg_surface_listener = {
-+    sl_internal_xdg_surface_configure};
- 
- static void sl_internal_xdg_toplevel_configure(
-     void* data,
--    struct zxdg_toplevel_v6* xdg_toplevel,
-+    struct xdg_toplevel* xdg_toplevel,
-     int32_t width,
-     int32_t height,
-     struct wl_array* states) {
-   TRACE_EVENT("other", "sl_internal_xdg_toplevel_configure");
-   struct sl_window* window =
--      static_cast<sl_window*>(zxdg_toplevel_v6_get_user_data(xdg_toplevel));
-+      static_cast<sl_window*>(xdg_toplevel_get_user_data(xdg_toplevel));
-   int activated = 0;
-   uint32_t* state;
-   int i = 0;
-@@ -630,24 +631,24 @@ static void sl_internal_xdg_toplevel_configure(
- 
-   window->allow_resize = 1;
-   sl_array_for_each(state, states) {
--    if (*state == ZXDG_TOPLEVEL_V6_STATE_FULLSCREEN) {
-+    if (*state == XDG_TOPLEVEL_STATE_FULLSCREEN) {
-       window->allow_resize = 0;
-       window->next_config.states[i++] =
-           window->ctx->atoms[ATOM_NET_WM_STATE_FULLSCREEN].value;
-     }
--    if (*state == ZXDG_TOPLEVEL_V6_STATE_MAXIMIZED) {
-+    if (*state == XDG_TOPLEVEL_STATE_MAXIMIZED) {
-       window->allow_resize = 0;
-       window->next_config.states[i++] =
-           window->ctx->atoms[ATOM_NET_WM_STATE_MAXIMIZED_VERT].value;
-       window->next_config.states[i++] =
-           window->ctx->atoms[ATOM_NET_WM_STATE_MAXIMIZED_HORZ].value;
-     }
--    if (*state == ZXDG_TOPLEVEL_V6_STATE_ACTIVATED) {
-+    if (*state == XDG_TOPLEVEL_STATE_ACTIVATED) {
-       activated = 1;
-       window->next_config.states[i++] =
-           window->ctx->atoms[ATOM_NET_WM_STATE_FOCUSED].value;
-     }
--    if (*state == ZXDG_TOPLEVEL_V6_STATE_RESIZING)
-+    if (*state == XDG_TOPLEVEL_STATE_RESIZING)
-       window->allow_resize = 0;
-   }
- 
-@@ -662,11 +663,11 @@ static void sl_internal_xdg_toplevel_configure(
-   window->next_config.states_length = i;
- }
- 
--static void sl_internal_xdg_toplevel_close(
--    void* data, struct zxdg_toplevel_v6* xdg_toplevel) {
-+static void sl_internal_xdg_toplevel_close(void* data,
-+                                           struct xdg_toplevel* xdg_toplevel) {
-   TRACE_EVENT("other", "sl_internal_xdg_toplevel_close");
-   struct sl_window* window =
--      static_cast<sl_window*>(zxdg_toplevel_v6_get_user_data(xdg_toplevel));
-+      static_cast<sl_window*>(xdg_toplevel_get_user_data(xdg_toplevel));
-   xcb_client_message_event_t event = {};
-   event.response_type = XCB_CLIENT_MESSAGE;
-   event.format = 32;
-@@ -679,21 +680,20 @@ static void sl_internal_xdg_toplevel_close(
-                  XCB_EVENT_MASK_NO_EVENT, (const char*)&event);
- }
- 
--static const struct zxdg_toplevel_v6_listener
--    sl_internal_xdg_toplevel_listener = {sl_internal_xdg_toplevel_configure,
--                                         sl_internal_xdg_toplevel_close};
-+static const struct xdg_toplevel_listener sl_internal_xdg_toplevel_listener = {
-+    sl_internal_xdg_toplevel_configure, sl_internal_xdg_toplevel_close};
- 
- static void sl_internal_xdg_popup_configure(void* data,
--                                            struct zxdg_popup_v6* xdg_popup,
-+                                            struct xdg_popup* xdg_popup,
-                                             int32_t x,
-                                             int32_t y,
-                                             int32_t width,
-                                             int32_t height) {}
- 
- static void sl_internal_xdg_popup_done(void* data,
--                                       struct zxdg_popup_v6* zxdg_popup_v6) {}
-+                                       struct xdg_popup* xdg_popup) {}
- 
--static const struct zxdg_popup_v6_listener sl_internal_xdg_popup_listener = {
-+static const struct xdg_popup_listener sl_internal_xdg_popup_listener = {
-     sl_internal_xdg_popup_configure, sl_internal_xdg_popup_done};
- 
- static void sl_window_set_wm_state(struct sl_window* window, int state) {
-@@ -765,15 +765,15 @@ void sl_window_update(struct sl_window* window) {
-       window->aura_surface = NULL;
-     }
-     if (window->xdg_toplevel) {
--      zxdg_toplevel_v6_destroy(window->xdg_toplevel);
-+      xdg_toplevel_destroy(window->xdg_toplevel);
-       window->xdg_toplevel = NULL;
-     }
-     if (window->xdg_popup) {
--      zxdg_popup_v6_destroy(window->xdg_popup);
-+      xdg_popup_destroy(window->xdg_popup);
-       window->xdg_popup = NULL;
-     }
-     if (window->xdg_surface) {
--      zxdg_surface_v6_destroy(window->xdg_surface);
-+      xdg_surface_destroy(window->xdg_surface);
-       window->xdg_surface = NULL;
-     }
-     window->realized = 0;
-@@ -849,11 +849,11 @@ void sl_window_update(struct sl_window* window) {
-   }
- 
-   if (!window->xdg_surface) {
--    window->xdg_surface = zxdg_shell_v6_get_xdg_surface(
--        ctx->xdg_shell->internal, host_surface->proxy);
--    zxdg_surface_v6_set_user_data(window->xdg_surface, window);
--    zxdg_surface_v6_add_listener(window->xdg_surface,
--                                 &sl_internal_xdg_surface_listener, window);
-+    window->xdg_surface = xdg_wm_base_get_xdg_surface(ctx->xdg_shell->internal,
-+                                                      host_surface->proxy);
-+    xdg_surface_set_user_data(window->xdg_surface, window);
-+    xdg_surface_add_listener(window->xdg_surface,
-+                             &sl_internal_xdg_surface_listener, window);
-   }
- 
-   if (ctx->aura_shell) {
-@@ -888,50 +888,46 @@ void sl_window_update(struct sl_window* window) {
-   // window is closed.
-   if (ctx->xwayland || !parent) {
-     if (!window->xdg_toplevel) {
--      window->xdg_toplevel = zxdg_surface_v6_get_toplevel(window->xdg_surface);
--      zxdg_toplevel_v6_set_user_data(window->xdg_toplevel, window);
--      zxdg_toplevel_v6_add_listener(window->xdg_toplevel,
--                                    &sl_internal_xdg_toplevel_listener, window);
-+      window->xdg_toplevel = xdg_surface_get_toplevel(window->xdg_surface);
-+      xdg_toplevel_set_user_data(window->xdg_toplevel, window);
-+      xdg_toplevel_add_listener(window->xdg_toplevel,
-+                                &sl_internal_xdg_toplevel_listener, window);
-     }
-     if (parent)
--      zxdg_toplevel_v6_set_parent(window->xdg_toplevel, parent->xdg_toplevel);
-+      xdg_toplevel_set_parent(window->xdg_toplevel, parent->xdg_toplevel);
-     if (window->name)
--      zxdg_toplevel_v6_set_title(window->xdg_toplevel, window->name);
-+      xdg_toplevel_set_title(window->xdg_toplevel, window->name);
-     if (window->size_flags & P_MIN_SIZE) {
--      zxdg_toplevel_v6_set_min_size(window->xdg_toplevel,
--                                    window->min_width / ctx->scale,
--                                    window->min_height / ctx->scale);
-+      xdg_toplevel_set_min_size(window->xdg_toplevel,
-+                                window->min_width / ctx->scale,
-+                                window->min_height / ctx->scale);
-     }
-     if (window->size_flags & P_MAX_SIZE) {
--      zxdg_toplevel_v6_set_max_size(window->xdg_toplevel,
--                                    window->max_width / ctx->scale,
--                                    window->max_height / ctx->scale);
-+      xdg_toplevel_set_max_size(window->xdg_toplevel,
-+                                window->max_width / ctx->scale,
-+                                window->max_height / ctx->scale);
-     }
-     if (window->maximized) {
--      zxdg_toplevel_v6_set_maximized(window->xdg_toplevel);
-+      xdg_toplevel_set_maximized(window->xdg_toplevel);
-     }
-   } else if (!window->xdg_popup) {
--    struct zxdg_positioner_v6* positioner;
-+    struct xdg_positioner* positioner;
- 
--    positioner = zxdg_shell_v6_create_positioner(ctx->xdg_shell->internal);
-+    positioner = xdg_wm_base_create_positioner(ctx->xdg_shell->internal);
-     assert(positioner);
--    zxdg_positioner_v6_set_anchor(
--        positioner,
--        ZXDG_POSITIONER_V6_ANCHOR_TOP | ZXDG_POSITIONER_V6_ANCHOR_LEFT);
--    zxdg_positioner_v6_set_gravity(
--        positioner,
--        ZXDG_POSITIONER_V6_GRAVITY_BOTTOM | ZXDG_POSITIONER_V6_GRAVITY_RIGHT);
--    zxdg_positioner_v6_set_anchor_rect(
--        positioner, (window->x - parent->x) / ctx->scale,
--        (window->y - parent->y) / ctx->scale, 1, 1);
-+    xdg_positioner_set_anchor(positioner, XDG_POSITIONER_ANCHOR_TOP_LEFT);
-+    xdg_positioner_set_gravity(positioner, XDG_POSITIONER_GRAVITY_BOTTOM_RIGHT);
-+    xdg_positioner_set_anchor_rect(positioner,
-+                                   (window->x - parent->x) / ctx->scale,
-+                                   (window->y - parent->y) / ctx->scale, 1, 1);
- 
--    window->xdg_popup = zxdg_surface_v6_get_popup(
--        window->xdg_surface, parent->xdg_surface, positioner);
--    zxdg_popup_v6_set_user_data(window->xdg_popup, window);
--    zxdg_popup_v6_add_listener(window->xdg_popup,
--                               &sl_internal_xdg_popup_listener, window);
-+    window->xdg_popup = xdg_surface_get_popup(window->xdg_surface,
-+                                              parent->xdg_surface, positioner);
-+    xdg_popup_set_user_data(window->xdg_popup, window);
-+    xdg_popup_add_listener(window->xdg_popup, &sl_internal_xdg_popup_listener,
-+                           window);
- 
--    zxdg_positioner_v6_destroy(positioner);
-+    xdg_positioner_destroy(positioner);
-   }
- 
-   if ((window->size_flags & (US_POSITION | P_POSITION)) && parent &&
-@@ -1332,7 +1328,7 @@ static void sl_registry_handler(void* data,
-       data_device_manager->host_global =
-           sl_data_device_manager_global_create(ctx);
-     }
--  } else if (strcmp(interface, "zxdg_shell_v6") == 0) {
-+  } else if (strcmp(interface, "xdg_wm_base") == 0) {
-     struct sl_xdg_shell* xdg_shell =
-         static_cast<sl_xdg_shell*>(malloc(sizeof(struct sl_xdg_shell)));
-     assert(xdg_shell);
-@@ -1343,10 +1339,10 @@ static void sl_registry_handler(void* data,
-     assert(!ctx->xdg_shell);
-     ctx->xdg_shell = xdg_shell;
-     if (ctx->xwayland) {
--      xdg_shell->internal = static_cast<zxdg_shell_v6*>(
--          wl_registry_bind(registry, id, &zxdg_shell_v6_interface, 1));
--      zxdg_shell_v6_add_listener(xdg_shell->internal,
--                                 &sl_internal_xdg_shell_listener, NULL);
-+      xdg_shell->internal = static_cast<xdg_wm_base*>(
-+          wl_registry_bind(registry, id, &xdg_wm_base_interface, 1));
-+      xdg_wm_base_add_listener(xdg_shell->internal,
-+                               &sl_internal_xdg_shell_listener, NULL);
-     } else {
-       xdg_shell->host_global = sl_xdg_shell_global_create(ctx);
-     }
-@@ -1479,7 +1475,7 @@ static void sl_registry_remover(void* data,
-     if (ctx->xdg_shell->host_global)
-       sl_global_destroy(ctx->xdg_shell->host_global);
-     if (ctx->xdg_shell->internal)
--      zxdg_shell_v6_destroy(ctx->xdg_shell->internal);
-+      xdg_wm_base_destroy(ctx->xdg_shell->internal);
-     free(ctx->xdg_shell);
-     ctx->xdg_shell = NULL;
-     return;
-@@ -1656,11 +1652,11 @@ static void sl_destroy_window(struct sl_window* window) {
-   }
- 
-   if (window->xdg_popup)
--    zxdg_popup_v6_destroy(window->xdg_popup);
-+    xdg_popup_destroy(window->xdg_popup);
-   if (window->xdg_toplevel)
--    zxdg_toplevel_v6_destroy(window->xdg_toplevel);
-+    xdg_toplevel_destroy(window->xdg_toplevel);
-   if (window->xdg_surface)
--    zxdg_surface_v6_destroy(window->xdg_surface);
-+    xdg_surface_destroy(window->xdg_surface);
-   if (window->aura_surface)
-     zaura_surface_destroy(window->aura_surface);
- 
-@@ -2124,15 +2120,15 @@ static void sl_handle_configure_request(struct sl_context* ctx,
-   // that matching contents will arrive.
-   if (window->xdg_toplevel) {
-     if (window->pending_config.serial) {
--      zxdg_surface_v6_ack_configure(window->xdg_surface,
--                                    window->pending_config.serial);
-+      xdg_surface_ack_configure(window->xdg_surface,
-+                                window->pending_config.serial);
-       window->pending_config.serial = 0;
-       window->pending_config.mask = 0;
-       window->pending_config.states_length = 0;
-     }
-     if (window->next_config.serial) {
--      zxdg_surface_v6_ack_configure(window->xdg_surface,
--                                    window->next_config.serial);
-+      xdg_surface_ack_configure(window->xdg_surface,
-+                                window->next_config.serial);
-       window->next_config.serial = 0;
-       window->next_config.mask = 0;
-       window->next_config.states_length = 0;
-@@ -2253,23 +2249,23 @@ static void sl_handle_configure_notify(struct sl_context* ctx,
- static uint32_t sl_resize_edge(int net_wm_moveresize_size) {
-   switch (net_wm_moveresize_size) {
-     case NET_WM_MOVERESIZE_SIZE_TOPLEFT:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_TOP_LEFT;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_TOP_LEFT;
-     case NET_WM_MOVERESIZE_SIZE_TOP:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_TOP;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_TOP;
-     case NET_WM_MOVERESIZE_SIZE_TOPRIGHT:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_TOP_RIGHT;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_TOP_RIGHT;
-     case NET_WM_MOVERESIZE_SIZE_RIGHT:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_RIGHT;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_RIGHT;
-     case NET_WM_MOVERESIZE_SIZE_BOTTOMRIGHT:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_BOTTOM_RIGHT;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_BOTTOM_RIGHT;
-     case NET_WM_MOVERESIZE_SIZE_BOTTOM:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_BOTTOM;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_BOTTOM;
-     case NET_WM_MOVERESIZE_SIZE_BOTTOMLEFT:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_BOTTOM_LEFT;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_BOTTOM_LEFT;
-     case NET_WM_MOVERESIZE_SIZE_LEFT:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_LEFT;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_LEFT;
-     default:
--      return ZXDG_TOPLEVEL_V6_RESIZE_EDGE_NONE;
-+      return XDG_TOPLEVEL_RESIZE_EDGE_NONE;
-   }
- }
- 
-@@ -2368,16 +2364,16 @@ static void sl_handle_client_message(struct sl_context* ctx,
-         return;
- 
-       if (event->data.data32[2] == NET_WM_MOVERESIZE_MOVE) {
--        zxdg_toplevel_v6_move(window->xdg_toplevel, seat->proxy,
--                              seat->seat->last_serial);
-+        xdg_toplevel_move(window->xdg_toplevel, seat->proxy,
-+                          seat->seat->last_serial);
-       } else {
-         uint32_t edge = sl_resize_edge(event->data.data32[2]);
- 
--        if (edge == ZXDG_TOPLEVEL_V6_RESIZE_EDGE_NONE)
-+        if (edge == XDG_TOPLEVEL_RESIZE_EDGE_NONE)
-           return;
- 
--        zxdg_toplevel_v6_resize(window->xdg_toplevel, seat->proxy,
--                                seat->seat->last_serial, edge);
-+        xdg_toplevel_resize(window->xdg_toplevel, seat->proxy,
-+                            seat->seat->last_serial, edge);
-       }
-     }
-   } else if (event->type == ctx->atoms[ATOM_NET_WM_STATE].value) {
-@@ -2398,9 +2394,9 @@ static void sl_handle_client_message(struct sl_context* ctx,
-                     "action", net_wm_state_to_string(action), "window->name",
-                     window->name);
-         if (action == NET_WM_STATE_ADD)
--          zxdg_toplevel_v6_set_fullscreen(window->xdg_toplevel, NULL);
-+          xdg_toplevel_set_fullscreen(window->xdg_toplevel, NULL);
-         else if (action == NET_WM_STATE_REMOVE)
--          zxdg_toplevel_v6_unset_fullscreen(window->xdg_toplevel);
-+          xdg_toplevel_unset_fullscreen(window->xdg_toplevel);
-       }
- 
-       if (changed[ATOM_NET_WM_STATE_MAXIMIZED_VERT] &&
-@@ -2411,9 +2407,9 @@ static void sl_handle_client_message(struct sl_context* ctx,
-             "action", net_wm_state_to_string(action), "window->name",
-             window->name);
-         if (action == NET_WM_STATE_ADD)
--          zxdg_toplevel_v6_set_maximized(window->xdg_toplevel);
-+          xdg_toplevel_set_maximized(window->xdg_toplevel);
-         else if (action == NET_WM_STATE_REMOVE)
--          zxdg_toplevel_v6_unset_maximized(window->xdg_toplevel);
-+          xdg_toplevel_unset_maximized(window->xdg_toplevel);
-       }
-     }
-   } else if (event->type == ctx->atoms[ATOM_WM_CHANGE_STATE].value &&
-@@ -2422,7 +2418,7 @@ static void sl_handle_client_message(struct sl_context* ctx,
-     TRACE_EVENT("x11wm", "XCB_CLIENT_MESSAGE: WM_STATE_ICONIC (minimize)",
-                 "window->name", window ? window->name : "<unknown>");
-     if (window && window->xdg_toplevel) {
--      zxdg_toplevel_v6_set_minimized(window->xdg_toplevel);
-+      xdg_toplevel_set_minimized(window->xdg_toplevel);
-     }
-   }
- }
-@@ -2435,7 +2431,7 @@ static void sl_handle_focus_in(struct sl_context* ctx,
-     // window was realized.
-     struct sl_window* parent = sl_lookup_window(ctx, window->transient_for);
-     if (parent && parent->xdg_toplevel && window->xdg_toplevel)
--      zxdg_toplevel_v6_set_parent(window->xdg_toplevel, parent->xdg_toplevel);
-+      xdg_toplevel_set_parent(window->xdg_toplevel, parent->xdg_toplevel);
-   }
- }
- 
-@@ -2744,9 +2740,9 @@ static void sl_handle_property_notify(struct sl_context* ctx,
-       return;
- 
-     if (window->name) {
--      zxdg_toplevel_v6_set_title(window->xdg_toplevel, window->name);
-+      xdg_toplevel_set_title(window->xdg_toplevel, window->name);
-     } else {
--      zxdg_toplevel_v6_set_title(window->xdg_toplevel, "");
-+      xdg_toplevel_set_title(window->xdg_toplevel, "");
-     }
-   } else if (event->atom == XCB_ATOM_WM_CLASS) {
-     struct sl_window* window = sl_lookup_window(ctx, event->window);
-@@ -2802,19 +2798,19 @@ static void sl_handle_property_notify(struct sl_context* ctx,
-       return;
- 
-     if (window->size_flags & P_MIN_SIZE) {
--      zxdg_toplevel_v6_set_min_size(window->xdg_toplevel,
--                                    window->min_width / ctx->scale,
--                                    window->min_height / ctx->scale);
-+      xdg_toplevel_set_min_size(window->xdg_toplevel,
-+                                window->min_width / ctx->scale,
-+                                window->min_height / ctx->scale);
-     } else {
--      zxdg_toplevel_v6_set_min_size(window->xdg_toplevel, 0, 0);
-+      xdg_toplevel_set_min_size(window->xdg_toplevel, 0, 0);
-     }
- 
-     if (window->size_flags & P_MAX_SIZE) {
--      zxdg_toplevel_v6_set_max_size(window->xdg_toplevel,
--                                    window->max_width / ctx->scale,
--                                    window->max_height / ctx->scale);
-+      xdg_toplevel_set_max_size(window->xdg_toplevel,
-+                                window->max_width / ctx->scale,
-+                                window->max_height / ctx->scale);
-     } else {
--      zxdg_toplevel_v6_set_max_size(window->xdg_toplevel, 0, 0);
-+      xdg_toplevel_set_max_size(window->xdg_toplevel, 0, 0);
-     }
-   } else if (event->atom == XCB_ATOM_WM_HINTS) {
-     struct sl_window* window = sl_lookup_window(ctx, event->window);
-diff --git a/vm_tools/sommelier/sommelier.h b/vm_tools/sommelier/sommelier.h
-index 79bcf6a3b3..d3157cd8a9 100644
---- a/vm_tools/sommelier/sommelier.h
-+++ b/vm_tools/sommelier/sommelier.h
-@@ -400,7 +400,7 @@ struct sl_xdg_shell {
-   struct sl_context* ctx;
-   uint32_t id;
-   struct sl_global* host_global;
--  struct zxdg_shell_v6* internal;
-+  struct xdg_wm_base* internal;
- };
- 
- struct sl_aura_shell {
-@@ -500,9 +500,9 @@ struct sl_window {
-   int max_height;
-   struct sl_config next_config;
-   struct sl_config pending_config;
--  struct zxdg_surface_v6* xdg_surface;
--  struct zxdg_toplevel_v6* xdg_toplevel;
--  struct zxdg_popup_v6* xdg_popup;
-+  struct xdg_surface* xdg_surface;
-+  struct xdg_toplevel* xdg_toplevel;
-+  struct xdg_popup* xdg_popup;
-   struct zaura_surface* aura_surface;
-   struct wl_list link;
- };
--- 
-2.32.0
-
diff --git a/pkgs/os-specific/linux/chromium-os/sommelier/default.nix b/pkgs/os-specific/linux/chromium-os/sommelier/default.nix
deleted file mode 100644
index b45ab330c34..00000000000
--- a/pkgs/os-specific/linux/chromium-os/sommelier/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ common-mk, lib
-, abseil-cpp, mesa, grpc, openssl, libdrm, xlibs, protobuf, wayland
-, libxkbcommon, vm_protos, linuxHeaders, c-ares, zlib
-}:
-
-common-mk {
-  platformSubdir = "vm_tools/sommelier";
-
-  platform2Patches = [
-    ./0005-sommelier-don-t-leak-source-absolute-paths.patch
-    ./0006-Revert-Revert-vm_tools-sommelier-Switch-to-the-stabl.patch
-  ];
-
-  buildInputs = [
-    abseil-cpp mesa grpc openssl libdrm protobuf wayland libxkbcommon vm_protos
-    linuxHeaders c-ares zlib
-  ] ++ (with xlibs; [ pixman libxcb libX11 ]);
-
-  gnArgs.use_demos = false;
-
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=sign-compare"
-    "-Wno-error=stringop-truncation"
-    "-Wno-error=class-memaccess"
-    "-Wno-error=maybe-uninitialized"
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    install sommelier $out/bin
-  '';
-
-  meta = with lib; {
-    description = "Nested Wayland compositor with support for X11 forwarding";
-    maintainers = with maintainers; [ qyliss ];
-  };
-}
diff --git a/pkgs/os-specific/linux/chromium-os/update.py b/pkgs/os-specific/linux/chromium-os/update.py
deleted file mode 100755
index 5852d4a3069..00000000000
--- a/pkgs/os-specific/linux/chromium-os/update.py
+++ /dev/null
@@ -1,131 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i python -p "python3.withPackages (ps: with ps; [ lxml ])"
-
-import base64
-import json
-import subprocess
-from codecs import iterdecode
-from os import scandir
-from os.path import dirname, splitext
-from lxml import etree
-from lxml.etree import HTMLParser
-from re import MULTILINE, fullmatch, match, search
-from urllib.request import urlopen
-
-# ChromiumOS components used in Nixpkgs
-component_paths = [
-    'src/aosp/external/minijail',
-    'src/platform/crosvm',
-    'src/platform/minigbm',
-    'src/platform2',
-    'src/third_party/adhd',
-    'src/third_party/chromiumos-overlay',
-    'src/third_party/kernel/v5.4',
-    'src/third_party/libqmi',
-    'src/third_party/modemmanager-next',
-    'src/third_party/modp_b64',
-    'src/third_party/rust-vmm/vhost',
-]
-
-git_root = 'https://chromium.googlesource.com/'
-manifest_versions = f'{git_root}chromiumos/manifest-versions'
-buildspecs_url = f'{manifest_versions}/+/refs/heads/master/full/buildspecs/'
-
-# CrOS version numbers look like this:
-# [<chrome-major-version>.]<tip-build>.<branch-build>.<branch-branch-build>
-#
-# As far as I can tell, branches are where internal Google
-# modifications are added to turn Chromium OS into Chrome OS, and
-# branch branches are used for fixes for specific devices.  So for
-# Chromium OS they will always be 0.  This is a best guess, and is not
-# documented.
-with urlopen('https://cros-updates-serving.appspot.com/') as resp:
-    document = etree.parse(resp, HTMLParser())
-
-    # bgcolor="lightgreen" is set on the most up-to-date version for
-    # each channel, so find a lightgreen cell in the "Stable" column.
-    (platform_version, chrome_version) = document.xpath("""
-        (//table[@id="cros-updates"]/tr/td[1 + count(
-            //table[@id="cros-updates"]/thead/tr[1]/th[text() = "Stable"]
-            /preceding-sibling::*)
-        ][@bgcolor="lightgreen"])[1]/text()
-    """)
-
-chrome_major_version = match(r'\d+', chrome_version)[0]
-chromeos_tip_build = match(r'\d+', platform_version)[0]
-
-# Find the most recent buildspec for the stable Chrome version and
-# Chromium OS build number.  Its branch build and branch branch build
-# numbers will (almost?) certainly be 0.  It will then end with an rc
-# number -- presumably these are release candidates, one of which
-# becomes the final release.  Presumably the one with the highest rc
-# number.
-with urlopen(f'{buildspecs_url}{chrome_major_version}/?format=TEXT') as resp:
-    listing = base64.decodebytes(resp.read()).decode('utf-8')
-    buildspecs = [(line.split('\t', 1)[1]) for line in listing.splitlines()]
-    buildspecs = [s for s in buildspecs if s.startswith(chromeos_tip_build)]
-    buildspecs.sort(reverse=True)
-    buildspec = splitext(buildspecs[0])[0]
-
-components = {}
-
-# Read the buildspec, and extract the git revisions for each component.
-with urlopen(f'{buildspecs_url}{chrome_major_version}/{buildspec}.xml?format=TEXT') as resp:
-    xml = base64.decodebytes(resp.read())
-    root = etree.fromstring(xml)
-
-    default_remote = root.find('default').get('remote')
-    remotes = {}
-    for remote in root.findall('remote'):
-        remotes[remote.get('name')] = remote.get('fetch')
-
-    for project in root.findall('project'):
-        name = project.get('name')
-        path = project.get('path')
-        remote_name = project.get('remote') or default_remote
-        remote = remotes[remote_name]
-
-        components[path] = {
-            'revision': project.get('revision'),
-            'url': f'{remote}/{name}',
-        }
-
-# Initialize the data that will be output from this script.  Leave the
-# rc number in buildspec so nobody else is subject to the same level
-# of confusion I have been.
-data = {'version': f'{chrome_major_version}.{buildspec}', 'components': {}}
-
-paths = {}
-
-# Fill in the 'components' dictionary with the output from
-# nix-prefetch-git, which can be passed straight to fetchGit when
-# imported by Nix.
-for path in component_paths:
-    name = path.split('/')[-1]
-    url = components[path]['url']
-    rev = components[path]['revision']
-    tarball = f'{url}/+archive/{rev}.tar.gz'
-    output = subprocess.check_output(['nix-prefetch-url', '--print-path', '--unpack', '--name', name, tarball])
-    (sha256, store_path) = output.decode('utf-8').splitlines()
-    paths[path] = store_path
-    data['components'][path] = {
-        'name': name,
-        'url': url,
-        'rev': rev,
-        'sha256': sha256,
-    }
-
-# Get the version number of the kernel.
-kernel = paths['src/third_party/kernel/v5.4']
-makefile = open(f'{kernel}/Makefile').read()
-version = search(r'^VERSION = (.+)$', makefile, MULTILINE)[1]
-patchlevel = search(r'^PATCHLEVEL = (.*?)$', makefile, MULTILINE)[1]
-sublevel = search(r'^SUBLEVEL = (.*?)$', makefile, MULTILINE)[1]
-extra = search(r'^EXTRAVERSION =[ \t]*(.*?)$', makefile, MULTILINE)[1]
-full_ver = '.'.join(filter(None, [version, patchlevel, sublevel])) + extra
-data['components']['src/third_party/kernel/v5.4']['version'] = full_ver
-
-# Finally, write the output.
-with open(dirname(__file__) + '/upstream-info.json', 'w') as out:
-    json.dump(data, out, indent=2)
-    out.write('\n')
diff --git a/pkgs/os-specific/linux/chromium-os/upstream-info.json b/pkgs/os-specific/linux/chromium-os/upstream-info.json
deleted file mode 100644
index f23948d9cb4..00000000000
--- a/pkgs/os-specific/linux/chromium-os/upstream-info.json
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  "version": "91.13904.0.0-rc2",
-  "components": {
-    "src/aosp/external/minijail": {
-      "name": "minijail",
-      "url": "https://android.googlesource.com/platform/external/minijail",
-      "rev": "4f830bddad22ccbb5862a866efd9931393a4b83b",
-      "sha256": "044ll9jmanjlv6ibb8n77nsqifsb1iqck3bgkyix43i3yqamlq5h"
-    },
-    "src/platform/crosvm": {
-      "name": "crosvm",
-      "url": "https://chromium.googlesource.com/chromiumos/platform/crosvm",
-      "rev": "401340ee7fa81db720a4f7a9476b6eea133e5b64",
-      "sha256": "0wbfprqqm0hqhypdb0x90bqn65kv0f3vpibr84p3paby6hmx14y2"
-    },
-    "src/platform/minigbm": {
-      "name": "minigbm",
-      "url": "https://chromium.googlesource.com/chromiumos/platform/minigbm",
-      "rev": "231913e75751498902132c825d5b8567684e3b8d",
-      "sha256": "03wcdwd4l0wg9k6z9nnqim2wqqddlmppa49v6bkry7mhmiar1jc9"
-    },
-    "src/platform2": {
-      "name": "platform2",
-      "url": "https://chromium.googlesource.com/chromiumos/platform2",
-      "rev": "1fcefaa166e868069ad1b81091333ff75e0657f6",
-      "sha256": "1p4rcq53qz35sfbqldmcnjz5ikjxppdw1xcb348zn8n3hnb6vmqf"
-    },
-    "src/third_party/adhd": {
-      "name": "adhd",
-      "url": "https://chromium.googlesource.com/chromiumos/third_party/adhd",
-      "rev": "3624a4296888926a21462bfd499d4ba91268046b",
-      "sha256": "0flph3fagyl21dbwpdvhhizwnhbrgll87yfpq1i00xzr0c9xc1cc"
-    },
-    "src/third_party/chromiumos-overlay": {
-      "name": "chromiumos-overlay",
-      "url": "https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay",
-      "rev": "f5b0e4767c2e5f8caa899127c8b3060fda2a3694",
-      "sha256": "1vpfccb0ikqa1xh6m0wizbxcaick2arki7d76sacz8qgrxinq8mn"
-    },
-    "src/third_party/kernel/v5.4": {
-      "name": "v5.4",
-      "url": "https://chromium.googlesource.com/chromiumos/third_party/kernel",
-      "rev": "15178e41cf17cd7ce9f9a087bcb0677eaa57f82b",
-      "sha256": "0cwvxm5bx0xs80l2rq3dqj88445qdhiqxp1999ix1gcc8awvwzdb",
-      "version": "5.4.109"
-    },
-    "src/third_party/libqmi": {
-      "name": "libqmi",
-      "url": "https://chromium.googlesource.com/chromiumos/third_party/libqmi",
-      "rev": "d9def40a2e068fd7e961aa0a4c699cf62cb8672c",
-      "sha256": "0grf510l85p32hc8gn7ks12ma0c2s3gnk76dyq62kmrvfb43ijzm"
-    },
-    "src/third_party/modemmanager-next": {
-      "name": "modemmanager-next",
-      "url": "https://chromium.googlesource.com/chromiumos/third_party/modemmanager-next",
-      "rev": "2de7877b2662d64c162434a7d3fb89d43f24b913",
-      "sha256": "027pnj92kidfgrzfpgwz18pl7gjgxi128il6wx1s8jdxsk2m00jc"
-    },
-    "src/third_party/modp_b64": {
-      "name": "modp_b64",
-      "url": "https://chromium.googlesource.com/aosp/platform/external/modp_b64",
-      "rev": "269b6fb8401617b85e2dff7ae8a7b0f97613e2cd",
-      "sha256": "1mc5w70svgj7rq49r6lxkw9ix6q09dxrw0lamx3hn8anq5q8y532"
-    },
-    "src/third_party/rust-vmm/vhost": {
-      "name": "vhost",
-      "url": "https://chromium.googlesource.com/chromiumos/third_party/rust-vmm/vhost",
-      "rev": "98298cb96972c20e05bffed58861456b48328d43",
-      "sha256": "0ym5cmnaifn3ywcidvqmbswmsxqi0zw6gx88gfqfq0p5jis8vjhi"
-    }
-  }
-}
diff --git a/pkgs/os-specific/linux/chromium-os/vm_protos/0003-common-mk-add-goproto_library-source_relative-opt.patch b/pkgs/os-specific/linux/chromium-os/vm_protos/0003-common-mk-add-goproto_library-source_relative-opt.patch
deleted file mode 100644
index e921abd8032..00000000000
--- a/pkgs/os-specific/linux/chromium-os/vm_protos/0003-common-mk-add-goproto_library-source_relative-opt.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From 211eea8e623c9e9beb61f38720c718f080bae883 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Mon, 28 Jun 2021 17:10:46 +0000
-Subject: [PATCH 3/6] common-mk: add goproto_library source_relative opt
-
-We need this for the go_package changes in protoc-gen-go 1.5.x.  If we
-didn't use source-relative paths, the full module path would be
-repeated in the output location, so we'd get paths like
-src/chromiumos/vm_tools/vm_crash/chromiumos/vm_tools/vm_crash/vm_crash.pb.go.
-
-To avoid the duplication, we either need to set source_relative, or
-set proto_out_dir to just go/src.  The latter isn't workable, because
-then everything two libraries that both use common.proto will both
-generate outputs called "go/src/common.pb.go", which will upset GN.
-
-Reviewed-by: Cole Helbling <cole.e.helbling@outlook.com>
----
- common-mk/proto_library.gni | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/common-mk/proto_library.gni b/common-mk/proto_library.gni
-index fb9fb4231d..23645a134f 100644
---- a/common-mk/proto_library.gni
-+++ b/common-mk/proto_library.gni
-@@ -225,6 +225,9 @@ template("proto_library") {
- #   proto_lib_dirs (optional)
- #       Directories to search for protos a proto file depends on.
- #       proto_in_dir and "${sysroot}/usr/share/proto" are added by default.
-+#   source_relative (optional)
-+#       If true, the output file is placed in the same relative directory as the
-+#       input file (but under proto_out_dir).
- template("goproto_library") {
-   action(target_name) {
-     forward_variables_from(invoker,
-@@ -254,6 +257,10 @@ template("goproto_library") {
- 
-     go_plugin_parameters = []
- 
-+    if (defined(invoker.source_relative) && invoker.source_relative) {
-+      go_plugin_parameters += [ "paths=source_relative" ]
-+    }
-+
-     if (defined(invoker.gen_grpc) && invoker.gen_grpc) {
-       go_plugin_parameters += [ "plugins=grpc" ]
-     }
--- 
-2.32.0
-
diff --git a/pkgs/os-specific/linux/chromium-os/vm_protos/0004-vm_tools-proto-set-go_package-correctly.patch b/pkgs/os-specific/linux/chromium-os/vm_protos/0004-vm_tools-proto-set-go_package-correctly.patch
deleted file mode 100644
index d77bcf2bdef..00000000000
--- a/pkgs/os-specific/linux/chromium-os/vm_protos/0004-vm_tools-proto-set-go_package-correctly.patch
+++ /dev/null
@@ -1,102 +0,0 @@
-From fae12c5b06864c0a9687320735c9bed9219c30c8 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Wed, 16 Jun 2021 16:09:01 +0000
-Subject: [PATCH 4/6] vm_tools: proto: set go_package correctly
-
-protoc-gen-go 1.5.x has become a lot stricter about this.  We have to
-use import_mapping for common.proto because it ends up being included
-in multiple Go libraries.  I'm not sure why it needs to be built once
-per library, but that's the way it works.
-
-Reviewed-by: Cole Helbling <cole.e.helbling@outlook.com>
----
- vm_tools/proto/BUILD.gn       | 5 +++++
- vm_tools/proto/tremplin.proto | 2 +-
- vm_tools/proto/vm_crash.proto | 2 +-
- vm_tools/proto/vm_guest.proto | 1 +
- vm_tools/proto/vm_host.proto  | 1 +
- 5 files changed, 9 insertions(+), 2 deletions(-)
-
-diff --git a/vm_tools/proto/BUILD.gn b/vm_tools/proto/BUILD.gn
-index 79c9b94c9f..aadc40165c 100644
---- a/vm_tools/proto/BUILD.gn
-+++ b/vm_tools/proto/BUILD.gn
-@@ -60,6 +60,8 @@ goproto_library("vm-crash-gorpcs") {
-   proto_in_dir = "./"
-   proto_out_dir = "go/src/chromiumos/vm_tools/vm_crash"
-   gen_grpc = true
-+  source_relative = true
-+  import_mapping = [ "common.proto=chromiumos/vm_tools/vm_crash" ]
-   sources = [
-     "${proto_in_dir}/common.proto",
-     "${proto_in_dir}/vm_crash.proto",
-@@ -97,6 +99,7 @@ goproto_library("tremplin-gorpcs") {
-   proto_in_dir = "./"
-   proto_out_dir = "go/src/chromiumos/vm_tools/tremplin_proto"
-   gen_grpc = true
-+  source_relative = true
-   sources = [ "${proto_in_dir}/tremplin.proto" ]
- }
- 
-@@ -120,6 +123,8 @@ goproto_library("vm-gorpcs") {
-   proto_in_dir = "./"
-   proto_out_dir = "go/src/chromiumos/vm_tools/vm_rpc"
-   gen_grpc = true
-+  source_relative = true
-+  import_mapping = [ "common.proto=chromiumos/vm_tools/vm_rpc" ]
-   sources = [
-     "${proto_in_dir}/common.proto",
-     "${proto_in_dir}/vm_guest.proto",
-diff --git a/vm_tools/proto/tremplin.proto b/vm_tools/proto/tremplin.proto
-index aac76f7a9e..e6a7bbed0e 100644
---- a/vm_tools/proto/tremplin.proto
-+++ b/vm_tools/proto/tremplin.proto
-@@ -8,7 +8,7 @@ option cc_enable_arenas = true;
- 
- // This file defines services for tremplin, the container springboard service.
- package vm_tools.tremplin;
--option go_package = "tremplin_proto";
-+option go_package = "chromiumos/vm_tools/tremplin_proto";
- 
- // This needs to be duplicated because the gyp rule for building
- // go code makes it difficult to have imports.
-diff --git a/vm_tools/proto/vm_crash.proto b/vm_tools/proto/vm_crash.proto
-index 6e4f62fe13..3cd4279989 100644
---- a/vm_tools/proto/vm_crash.proto
-+++ b/vm_tools/proto/vm_crash.proto
-@@ -7,7 +7,7 @@ syntax = "proto3";
- option cc_enable_arenas = true;
- 
- package vm_tools.cicerone;
--option go_package = "vm_crash";
-+option go_package = "chromiumos/vm_tools/vm_crash";
- 
- import "common.proto";
- 
-diff --git a/vm_tools/proto/vm_guest.proto b/vm_tools/proto/vm_guest.proto
-index 86f11d0812..d0946078d5 100644
---- a/vm_tools/proto/vm_guest.proto
-+++ b/vm_tools/proto/vm_guest.proto
-@@ -8,6 +8,7 @@ option cc_enable_arenas = true;
- 
- // This file defines services that will be running in the guest VM.
- package vm_tools;
-+option go_package = "chromiumos/vm_tools/vm_rpc";
- 
- import "common.proto";
- import "google/protobuf/timestamp.proto";
-diff --git a/vm_tools/proto/vm_host.proto b/vm_tools/proto/vm_host.proto
-index a8bd066f61..19759b0271 100644
---- a/vm_tools/proto/vm_host.proto
-+++ b/vm_tools/proto/vm_host.proto
-@@ -8,6 +8,7 @@ option cc_enable_arenas = true;
- 
- // This file defines services that will be running on the host for the VM.
- package vm_tools;
-+option go_package = "chromiumos/vm_tools/vm_rpc";
- 
- import "common.proto";
- 
--- 
-2.32.0
-
diff --git a/pkgs/os-specific/linux/chromium-os/vm_protos/default.nix b/pkgs/os-specific/linux/chromium-os/vm_protos/default.nix
deleted file mode 100644
index cded9c988b3..00000000000
--- a/pkgs/os-specific/linux/chromium-os/vm_protos/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ common-mk, lib, go-protobuf, grpc, openssl, protobuf }:
-
-common-mk {
-  pname = "vm_protos";
-  platformSubdir = "vm_tools/proto";
-
-  nativeBuildInputs = [ go-protobuf ];
-  buildInputs = [ grpc openssl protobuf ];
-
-  platform2Patches = [
-    ./0003-common-mk-add-goproto_library-source_relative-opt.patch
-    ./0004-vm_tools-proto-set-go_package-correctly.patch
-  ];
-
-  NIX_CFLAGS_COMPILE = [
-    "-Wno-error=array-bounds"
-    "-Wno-error=deprecated-declarations"
-  ];
-
-  postPatch = ''
-    substituteInPlace common-mk/proto_library.gni \
-        --replace /usr/bin/grpc_cpp_plugin ${grpc}/bin/grpc_cpp_plugin
-  '';
-
-  installPhase = ''
-    mkdir -p $out/lib/pkgconfig
-    install -m 644 ../../vm_tools/proto/vm_protos.pc $out/lib/pkgconfig
-
-    headerPath=include/vm_protos/proto_bindings
-    mkdir -p $out/$headerPath
-    install -m 644 gen/$headerPath/*.h $out/$headerPath
-
-    install -m 644 *.a $out/lib
-  '';
-
-  meta = with lib; {
-    description = "Protobuf definitions for Chromium OS system VMs";
-    maintainers = with maintainers; [ qyliss ];
-    platform = platforms.all;
-  };
-}
diff --git a/pkgs/os-specific/linux/cifs-utils/default.nix b/pkgs/os-specific/linux/cifs-utils/default.nix
index 8c587a40196..cae7901386d 100644
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cifs-utils";
-  version = "6.13";
+  version = "7.0";
 
   src = fetchurl {
     url = "mirror://samba/pub/linux-cifs/cifs-utils/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-Q9h4bIYTysz6hJEwgcHWK8JAlXWFTPiVsFtIrwhj0FY=";
+    sha256 = "sha256-De+quFvT6kb/xFq0H7DQrVTQWuLPqn5QPehtTxK8gWE=";
   };
 
   nativeBuildInputs = [ autoreconfHook docutils pkg-config ];
diff --git a/pkgs/os-specific/linux/conky/default.nix b/pkgs/os-specific/linux/conky/default.nix
index 9bd8890e713..ab55839c340 100644
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -1,7 +1,7 @@
 { config, lib, stdenv, fetchFromGitHub, pkg-config, cmake
 
 # dependencies
-, glib, libXinerama
+, glib, libXinerama, catch2
 
 # optional features without extra dependencies
 , mpdSupport          ? true
@@ -15,7 +15,7 @@
                             , docbook_xsl ? null , docbook_xml_dtd_44 ? null
 
 , ncursesSupport      ? true      , ncurses       ? null
-, x11Support          ? true      , xlibsWrapper           ? null
+, x11Support          ? true      , freetype, xorg
 , xdamageSupport      ? x11Support, libXdamage    ? null
 , doubleBufferSupport ? x11Support
 , imlib2Support       ? x11Support, imlib2        ? null
@@ -43,7 +43,6 @@ assert docsSupport         -> docbook2x != null && libxslt != null
 
 assert ncursesSupport      -> ncurses != null;
 
-assert x11Support          -> xlibsWrapper != null;
 assert xdamageSupport      -> x11Support && libXdamage != null;
 assert imlib2Support       -> x11Support && imlib2     != null;
 assert luaSupport          -> lua != null;
@@ -52,7 +51,7 @@ assert luaImlib2Support    -> luaSupport && imlib2Support
 assert luaCairoSupport     -> luaSupport && toluapp != null
                                          && cairo   != null;
 assert luaCairoSupport || luaImlib2Support
-                           -> lua.luaversion == "5.3";
+                           -> lua.luaversion == "5.4";
 
 assert wirelessSupport     -> wirelesstools != null;
 assert nvidiaSupport       -> libXNVCtrl != null;
@@ -68,32 +67,35 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "conky";
-  version = "1.12.2";
+  version = "1.19.6";
 
   src = fetchFromGitHub {
     owner = "brndnmtthws";
     repo = "conky";
     rev = "v${version}";
-    sha256 = "sha256-x6bR5E5LIvKWiVM15IEoUgGas/hcRp3F/O4MTOhVPb8=";
+    hash = "sha256-L8YSbdk+qQl17L4IRajFD/AEWRXb2w7xH9sM9qPGrQo=";
   };
 
   postPatch = ''
     sed -i -e '/include.*CheckIncludeFile)/i include(CheckIncludeFiles)' \
       cmake/ConkyPlatformChecks.cmake
   '' + optionalString docsSupport ''
-    # Drop examples, since they contain non-ASCII characters that break docbook2x :(
-    sed -i 's/ Example: .*$//' doc/config_settings.xml
-
     substituteInPlace cmake/Conky.cmake --replace "# set(RELEASE true)" "set(RELEASE true)"
+
+    cp ${catch2}/include/catch2/catch.hpp tests/catch2/catch.hpp
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  env = {
+    # For some reason -Werror is on by default, causing the project to fail compilation.
+    NIX_CFLAGS_COMPILE = "-Wno-error";
+    NIX_LDFLAGS = "-lgcc_s";
+  };
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ glib libXinerama ]
     ++ optionals docsSupport        [ docbook2x docbook_xsl docbook_xml_dtd_44 libxslt man less ]
     ++ optional  ncursesSupport     ncurses
-    ++ optional  x11Support         xlibsWrapper
+    ++ optionals x11Support         [ freetype xorg.libICE xorg.libX11 xorg.libXext xorg.libXft xorg.libSM ]
     ++ optional  xdamageSupport     libXdamage
     ++ optional  imlib2Support      imlib2
     ++ optional  luaSupport         lua
@@ -133,8 +135,11 @@ stdenv.mkDerivation rec {
   # src/conky.cc:137:23: fatal error: defconfig.h: No such file or directory
   enableParallelBuilding = false;
 
+  doCheck = true;
+
   meta = with lib; {
-    homepage = "http://conky.sourceforge.net/";
+    homepage = "https://conky.cc";
+    changelog = "https://github.com/brndnmtthws/conky/releases/tag/v${version}";
     description = "Advanced, highly configurable system monitor based on torsmo";
     maintainers = [ maintainers.guibert ];
     license = licenses.gpl3Plus;
diff --git a/pkgs/os-specific/linux/conntrack-tools/default.nix b/pkgs/os-specific/linux/conntrack-tools/default.nix
index 0b14398e58f..42741fae5b6 100644
--- a/pkgs/os-specific/linux/conntrack-tools/default.nix
+++ b/pkgs/os-specific/linux/conntrack-tools/default.nix
@@ -1,24 +1,30 @@
 { fetchurl, lib, stdenv, flex, bison, pkg-config, libmnl, libnfnetlink
 , libnetfilter_conntrack, libnetfilter_queue, libnetfilter_cttimeout
-, libnetfilter_cthelper, systemd
-, libtirpc
+, libnetfilter_cthelper, libtirpc
+, systemdSupport ? true, systemd
 }:
 
 stdenv.mkDerivation rec {
   pname = "conntrack-tools";
-  version = "1.4.6";
+  version = "1.4.8";
 
   src = fetchurl {
-    url = "https://www.netfilter.org/projects/conntrack-tools/files/${pname}-${version}.tar.bz2";
-    sha256 = "0psx41bclqrh4514yzq03rvs3cq3scfpd1v4kkyxnic2hk65j22r";
+    url = "https://www.netfilter.org/projects/conntrack-tools/files/${pname}-${version}.tar.xz";
+    hash = "sha256-BnZ39MX2VkgZ547TqdSomAk16pJz86uyKkIOowq13tY=";
   };
 
   buildInputs = [
     libmnl libnfnetlink libnetfilter_conntrack libnetfilter_queue
-    libnetfilter_cttimeout libnetfilter_cthelper systemd libtirpc
+    libnetfilter_cttimeout libnetfilter_cthelper libtirpc
+  ] ++ lib.optionals systemdSupport [
+    systemd
   ];
   nativeBuildInputs = [ flex bison pkg-config ];
 
+  configureFlags = [
+    (lib.enableFeature systemdSupport "systemd")
+  ];
+
   meta = with lib; {
     homepage = "http://conntrack-tools.netfilter.org/";
     description = "Connection tracking userspace tools";
diff --git a/pkgs/os-specific/linux/consoletools/default.nix b/pkgs/os-specific/linux/consoletools/default.nix
index 8def013b956..61ddd5203cd 100644
--- a/pkgs/os-specific/linux/consoletools/default.nix
+++ b/pkgs/os-specific/linux/consoletools/default.nix
@@ -1,15 +1,16 @@
-{ lib, stdenv, fetchurl, SDL }:
+{ lib, stdenv, fetchurl, pkg-config, SDL, SDL2 }:
 
 stdenv.mkDerivation rec {
   pname = "linuxconsoletools";
-  version = "1.6.1";
+  version = "1.8.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxconsole/${pname}-${version}.tar.bz2";
-    sha256 = "0d2r3j916fl2y7pk1y82b9fvbr10dgs1gw7rqwzfpispdidb1mp9";
+    sha256 = "sha256-TaKXRceCt9sY9fN8Sed78WMSHdN2Hi/HY2+gy/NcJFY=";
   };
 
-  buildInputs = [ SDL ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ SDL SDL2 ];
 
   makeFlags = [ "DESTDIR=$(out)"];
 
diff --git a/pkgs/os-specific/linux/conspy/default.nix b/pkgs/os-specific/linux/conspy/default.nix
index 480962024f7..00e97855e26 100644
--- a/pkgs/os-specific/linux/conspy/default.nix
+++ b/pkgs/os-specific/linux/conspy/default.nix
@@ -1,25 +1,20 @@
-{lib, stdenv, fetchurl, autoconf, automake, ncurses}:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="conspy";
-    version="1.16";
-    name="${baseName}-${version}";
-    hash="02andak806vd04bgjlr0y0d2ddx7cazyf8nvca80vlh8x94gcppf";
-    url="mirror://sourceforge/project/conspy/conspy-1.16-1/conspy-1.16.tar.gz";
-    sha256="02andak806vd04bgjlr0y0d2ddx7cazyf8nvca80vlh8x94gcppf";
-  };
-  buildInputs = [
-    autoconf automake ncurses
-  ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
+{ lib, stdenv, fetchurl, autoconf, automake, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "conspy";
+  version = "1.16";
+
   src = fetchurl {
-    inherit (s) url sha256;
+    url = "mirror://sourceforge/project/conspy/conspy-${version}-1/conspy-${version}.tar.gz";
+    sha256 = "02andak806vd04bgjlr0y0d2ddx7cazyf8nvca80vlh8x94gcppf";
     curlOpts = " -A application/octet-stream ";
   };
+
+  nativeBuildInputs = [ autoconf automake ];
+  buildInputs = [
+    ncurses
+  ];
+
   preConfigure = ''
     touch NEWS
     echo "EPL 1.0" > COPYING
@@ -27,11 +22,11 @@ stdenv.mkDerivation {
     automake --add-missing
     autoconf
   '';
-  meta = {
-    inherit (s) version;
+
+  meta = with lib; {
     description = "Linux text console viewer";
-    license = lib.licenses.epl10 ;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.epl10;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/conspy/default.upstream b/pkgs/os-specific/linux/conspy/default.upstream
deleted file mode 100644
index 3f9ff3e4a82..00000000000
--- a/pkgs/os-specific/linux/conspy/default.upstream
+++ /dev/null
@@ -1,5 +0,0 @@
-url https://sourceforge.net/projects/conspy/files/
-version_link 'conspy-[-0-9.]+/$'
-version_link '[-0-9.]+[.]tar[.][a-z0-9]+/download$'
-SF_redirect
-version '.*-([-0-9.]+)[.]tar[.].*' '\1'
diff --git a/pkgs/os-specific/linux/cpufrequtils/default.nix b/pkgs/os-specific/linux/cpufrequtils/default.nix
index 6f94d0f8925..f62d8463714 100644
--- a/pkgs/os-specific/linux/cpufrequtils/default.nix
+++ b/pkgs/os-specific/linux/cpufrequtils/default.nix
@@ -1,11 +1,12 @@
 { lib, stdenv, fetchurl, libtool, gettext }:
 
 stdenv.mkDerivation rec {
-  name = "cpufrequtils-008";
+  pname = "cpufrequtils";
+  version = "008";
 
   src = fetchurl {
-    url = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/${name}.tar.gz";
-    sha256 = "127i38d4w1hv2dzdy756gmbhq25q3k34nqb2s0xlhsfhhdqs0lq0";
+    url = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/cpufrequtils-${version}.tar.gz";
+    hash = "sha256-AFOgcYPQaUg70GJhS8YcuAgMV32mHN9+ExsGThoa8Yg=";
   };
 
   patches = [
@@ -26,5 +27,6 @@ stdenv.mkDerivation rec {
     homepage = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/cpufrequtils.html";
     license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" ];
+    mainProgram = "cpufreq-set";
   };
 }
diff --git a/pkgs/os-specific/linux/cpuid/default.nix b/pkgs/os-specific/linux/cpuid/default.nix
index ea9ae06130e..396baa4b98c 100644
--- a/pkgs/os-specific/linux/cpuid/default.nix
+++ b/pkgs/os-specific/linux/cpuid/default.nix
@@ -1,20 +1,27 @@
-{ lib, stdenv, fetchurl, perl }:
+{ lib
+, stdenv
+, fetchurl
+, perl
+}:
 
 stdenv.mkDerivation rec {
   pname = "cpuid";
-  version = "20201006";
+  version = "20230614";
 
   src = fetchurl {
-    name = "${pname}-${version}.src.tar.gz";
     url = "http://etallen.com/cpuid/${pname}-${version}.src.tar.gz";
-    sha256 = "19jnkh57f979b78ak5mpxmdvnkgc33r55cw9shgd2hc380b3zi8k";
+    sha256 = "sha256-scgwRe/CYHYwd1HgZi1YAnf1+b+JzwJyMaeBIAPDpOg=";
   };
 
   # For pod2man during the build process.
-  nativeBuildInputs = [ perl ];
+  nativeBuildInputs = [
+    perl
+  ];
 
   # As runtime dependency for cpuinfo2cpuid.
-  buildInputs = [ perl ];
+  buildInputs = [
+    perl
+  ];
 
   # The Makefile hardcodes $(BUILDROOT)/usr as installation
   # destination. Just nuke all mentions of /usr to get the right
@@ -32,7 +39,7 @@ stdenv.mkDerivation rec {
     fi
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Linux tool to dump x86 CPUID information about the CPU";
     longDescription = ''
       cpuid dumps detailed information about the CPU(s) gathered from the CPUID
@@ -40,11 +47,9 @@ stdenv.mkDerivation rec {
       Intel, AMD, VIA, Hygon, and Zhaoxin CPUs, as well as older Transmeta,
       Cyrix, UMC, NexGen, Rise, and SiS CPUs.
     '';
-
-    platforms = [ "i686-linux" "x86_64-linux" ];
-    license = lib.licenses.gpl2;
     homepage = "http://etallen.com/cpuid.html";
-    maintainers = with lib.maintainers; [ blitz ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ blitz ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
   };
-
 }
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
new file mode 100644
index 00000000000..1f57bc9428f
--- /dev/null
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -0,0 +1,103 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, buildPythonApplication
+, appstream-glib
+, dbus-python
+, desktop-file-utils
+, gettext
+, glib
+, gobject-introspection
+, gtk3
+, hicolor-icon-theme
+, libappindicator
+, libhandy
+, meson
+, ninja
+, pkg-config
+, pygobject3
+, pyxdg
+, systemd
+, wrapGAppsHook
+}:
+
+buildPythonApplication rec {
+  pname = "cpupower-gui";
+  version = "1.0.0";
+
+  # This packages doesn't have a setup.py
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "vagnum08";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "05lvpi3wgyi741sd8lgcslj8i7yi3wz7jwl7ca3y539y50hwrdas";
+  };
+
+  patches = [
+    # Fix build with 0.61, can be removed on next update
+    # https://hydra.nixos.org/build/171052557/nixlog/1
+    (fetchpatch {
+      url = "https://github.com/vagnum08/cpupower-gui/commit/97f8ac02fe33e412b59d3f3968c16a217753e74b.patch";
+      sha256 = "XYnpm03kq8JLMjAT73BMCJWlzz40IAuHESm715VV6G0=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils # needed for update-desktop-database
+    gettext
+    glib # needed for glib-compile-schemas
+    gobject-introspection # need for gtk namespace to be available
+    hicolor-icon-theme # needed for postinstall script
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+
+    # Python packages
+    dbus-python
+    libappindicator
+    pygobject3
+    pyxdg
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libhandy
+  ];
+
+  propagatedBuildInputs = [
+    dbus-python
+    libappindicator
+    pygobject3
+    pyxdg
+  ];
+
+  mesonFlags = [
+    "-Dsystemddir=${placeholder "out"}/lib/systemd"
+  ];
+
+  preConfigure = ''
+    patchShebangs build-aux/meson/postinstall.py
+  '';
+
+  strictDeps = false;
+  dontWrapGApps = true;
+
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
+  postFixup = ''
+    wrapPythonProgramsIn $out/lib "$out $propagatedBuildInputs"
+  '';
+
+  meta = with lib; {
+    description = "Change the frequency limits of your cpu and its governor";
+    homepage = "https://github.com/vagnum08/cpupower-gui/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ unode ];
+  };
+}
diff --git a/pkgs/os-specific/linux/cpupower/default.nix b/pkgs/os-specific/linux/cpupower/default.nix
index cfc0ace8e0a..13e2fc78b82 100644
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation {
   pname = "cpupower";
-  inherit (kernel) version src;
+  inherit (kernel) version src patches;
 
   nativeBuildInputs = [ gettext ];
   buildInputs = [ pciutils ];
diff --git a/pkgs/os-specific/linux/cpuset/default.nix b/pkgs/os-specific/linux/cpuset/default.nix
index e82e3f5901c..bb7a953c119 100644
--- a/pkgs/os-specific/linux/cpuset/default.nix
+++ b/pkgs/os-specific/linux/cpuset/default.nix
@@ -40,5 +40,6 @@ pythonPackages.buildPythonApplication rec {
     homepage    = "https://github.com/lpechacek/cpuset";
     license     = licenses.gpl2;
     maintainers = with maintainers; [ thiagokokada wykurz ];
+    mainProgram = "cset";
   };
 }
diff --git a/pkgs/os-specific/linux/cpustat/default.nix b/pkgs/os-specific/linux/cpustat/default.nix
index 23ed2b07c96..e5bbd388081 100644
--- a/pkgs/os-specific/linux/cpustat/default.nix
+++ b/pkgs/os-specific/linux/cpustat/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, lib, fetchurl, ncurses }:
+{ stdenv, lib, fetchFromGitHub, ncurses }:
 
 stdenv.mkDerivation rec {
   pname = "cpustat";
-  version = "0.02.09";
+  version = "0.02.19";
 
-  src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "12xahv65yrhs5r830clkl1qnwg3dnrk5qn3zsznzbv1iy2f3cj7y";
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    hash = "sha256-MujdgA+rFLrRc/N9yN7udnarA1TCzX//95hoXTUHG8Q=";
   };
 
   buildInputs = [ ncurses ];
@@ -14,11 +16,12 @@ stdenv.mkDerivation rec {
   installFlags = [
     "BINDIR=${placeholder "out"}/bin"
     "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
   meta = with lib; {
     description = "CPU usage monitoring tool";
-    homepage = "https://kernel.ubuntu.com/~cking/cpustat/";
+    homepage = "https://github.com/ColinIanKing/cpustat";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ dtzWill ];
diff --git a/pkgs/os-specific/linux/cramfsprogs/default.nix b/pkgs/os-specific/linux/cramfsprogs/default.nix
index 3f3e8a075b1..59fbfed1b72 100644
--- a/pkgs/os-specific/linux/cramfsprogs/default.nix
+++ b/pkgs/os-specific/linux/cramfsprogs/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
   # So patch the "missing include" bug ourselves.
   patches = [ ./include-sysmacros.patch ];
 
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
   installPhase = ''
     install --target $out/bin -D cramfsck mkcramfs
   '';
diff --git a/pkgs/os-specific/linux/cramfsswap/default.nix b/pkgs/os-specific/linux/cramfsswap/default.nix
index f47482c1111..f7992118638 100644
--- a/pkgs/os-specific/linux/cramfsswap/default.nix
+++ b/pkgs/os-specific/linux/cramfsswap/default.nix
@@ -2,12 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "cramfsswap";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
-    url = "mirror://debian/pool/main/c/cramfsswap/${pname}_${version}.tar.gz";
-    sha256 = "0c6lbx1inkbcvvhh3y6fvfaq3w7d1zv7psgpjs5f3zjk1jysi9qd";
+    url = "mirror://debian/pool/main/c/cramfsswap/${pname}_${version}.tar.xz";
+    sha256 = "10mj45zx71inaa3l1d81g64f7yn1xcprvq4v4yzpdwbxqmqaikw1";
   };
+  #  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996964
+  patches = [ ./parallel-make.patch ];
+
+  # Needed for cross-compilation
+  postPatch = ''
+    substituteInPlace Makefile --replace 'strip ' '$(STRIP) '
+  '';
 
   buildInputs = [zlib];
 
@@ -18,7 +25,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Swap endianess of a cram filesystem (cramfs)";
     homepage = "https://packages.debian.org/sid/utils/cramfsswap";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/cramfsswap/parallel-make.patch b/pkgs/os-specific/linux/cramfsswap/parallel-make.patch
new file mode 100644
index 00000000000..280c5286b79
--- /dev/null
+++ b/pkgs/os-specific/linux/cramfsswap/parallel-make.patch
@@ -0,0 +1,14 @@
+Fix parallel build failure bya dding the dependency.
+
+https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996964
+--- a/Makefile
++++ b/Makefile
+@@ -6,7 +6,7 @@ debian: cramfsswap
+ cramfsswap: cramfsswap.c
+ 	$(CC) -Wall -g -O $(CPPFLAGS) $(CFLAGS) $(LDFLAGS) -o cramfsswap cramfsswap.c -lz
+ 
+-strip:
++strip: cramfsswap
+ 	strip cramfsswap
+ 
+ install: cramfsswap
diff --git a/pkgs/os-specific/linux/crda/default.nix b/pkgs/os-specific/linux/crda/default.nix
index c337da2fe72..ffed5fc36a7 100644
--- a/pkgs/os-specific/linux/crda/default.nix
+++ b/pkgs/os-specific/linux/crda/default.nix
@@ -2,35 +2,42 @@
 
 stdenv.mkDerivation rec {
   pname = "crda";
-  version = "3.18";
+  version = "4.14";
 
   src = fetchurl {
-    sha256 = "1gydiqgb08d9gbx4l6gv98zg3pljc984m50hmn3ysxcbkxkvkz23";
-    url = "http://kernel.org/pub/software/network/crda/crda-${version}.tar.xz";
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/mcgrof/crda.git/snapshot/crda-${version}.tar.gz";
+    sha256 = "sha256-Wo81u4snR09Gaw511FG6kXQz2KqxiJZ4pk2cTnKouMI=";
   };
 
   patches = [
-    # Switch to Python 3
-    # https://lore.kernel.org/linux-wireless/1437542484-23409-1-git-send-email-ahmed.taahir@gmail.com/
+    # Fix python 3 build: except ImportError, e: SyntaxError: invalid syntax
     (fetchpatch {
-      url = "https://lore.kernel.org/linux-wireless/1437542484-23409-2-git-send-email-ahmed.taahir@gmail.com/raw";
-      sha256 = "0s2n340cgaasvg1k8g9v8xjrbh4y2mcgrhdmv97ja2fs8xjcjbf1";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/d234fddf451fab0f4fc412e2769f54e11f10d7d8/trunk/crda-4.14-python-3.patch";
+      sha256 = "sha256-KEezEKrfizq9k4ZiE2mf3Nl4JiBayhXeVnFl7wYh28Y=";
     })
+
     (fetchpatch {
-      url = "https://lore.kernel.org/linux-wireless/1437542484-23409-3-git-send-email-ahmed.taahir@gmail.com/raw";
-      sha256 = "01dlfw7kqhyx025jxq2l75950b181p9r7i9zkflcwvbzzdmx59md";
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/d48ec843222b0d74c85bce86fa6f087c7dfdf952/trunk/0001-Makefile-Link-libreg.so-against-the-crypto-library.patch";
+      sha256 = "sha256-j93oydi209f22OF8aXZ/NczuUOnlhkdSeYvy2WRRvm0=";
     })
   ];
 
-  buildInputs = [ libgcrypt libnl ];
+  strictDeps = true;
+
   nativeBuildInputs = [
     pkg-config
-    python3Packages.pycrypto
+    python3Packages.m2crypto # only used for a build time script
+  ];
+
+  buildInputs = [
+    libgcrypt
+    libnl
   ];
 
   postPatch = ''
     patchShebangs utils/
     substituteInPlace Makefile \
+      --replace 'gzip' 'gzip -n' \
       --replace ldconfig true \
       --replace pkg-config $PKG_CONFIG
     sed -i crda.c \
@@ -45,19 +52,12 @@ stdenv.mkDerivation rec {
     "REG_BIN=${wireless-regdb}/lib/crda/regulatory.bin"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-const-variable";
-
   buildFlags = [ "all_noverify" ];
   enableParallelBuilding = true;
 
   doCheck = true;
   checkTarget = "verify";
 
-  postInstall = ''
-    # The patch installs build header
-    rm $out/include/reglib/keys-gcrypt.h
-  '';
-
   meta = with lib; {
     description = "Linux wireless Central Regulatory Domain Agent";
     longDescription = ''
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
 
       to the system configuration.
     '';
-    homepage = "http://drvbp1.linux-foundation.org/~mcgrof/rel-html/crda/";
+    homepage = "https://wireless.wiki.kernel.org/en/developers/regulatory/crda";
     license = licenses.free; # "copyleft-next 0.3.0", as yet without a web site
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/criu/default.nix b/pkgs/os-specific/linux/criu/default.nix
index af772645824..00d46591c13 100644
--- a/pkgs/os-specific/linux/criu/default.nix
+++ b/pkgs/os-specific/linux/criu/default.nix
@@ -1,20 +1,67 @@
-{ stdenv, lib, fetchurl, protobuf, protobufc, asciidoc, iptables
-, xmlto, docbook_xsl, libpaper, libnl, libcap, libnet, pkg-config
-, which, python3, makeWrapper, docbook_xml_dtd_45, perl }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, protobuf, protobufc, asciidoc, iptables
+, xmlto, docbook_xsl, libpaper, libnl, libcap, libnet, pkg-config, iproute2, gzip
+, which, python3, makeWrapper, docbook_xml_dtd_45, perl, nftables, libbsd, gnutar
+, buildPackages
+}:
 
 stdenv.mkDerivation rec {
   pname = "criu";
-  version = "3.15";
+  version = "3.17.1";
 
-  src = fetchurl {
-    url    = "https://download.openvz.org/criu/${pname}-${version}.tar.bz2";
-    sha256 = "09d0j24x0cyc7wkgi7cnxqgfjk7kbdlm79zxpj8d356sa3rw2z24";
+  src = fetchFromGitHub {
+    owner = "checkpoint-restore";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-0B0cdX5bemy4glF9iWjrQIXIqilyYcCcAN9x4Jjrwzk=";
   };
 
+  patches = [
+    # Fixes redefinition of rseq headers
+    (fetchpatch {
+      url = "https://github.com/checkpoint-restore/criu/commit/1e6e826ffb7ac05f33fa123051c2fc2ddf0f68ea.patch";
+      hash = "sha256-LJjk0jQ5v5wqeprvBMpxhjLXn7v+lSPldEGgazGUM44=";
+    })
+
+    # compat fixes for glibc-2.36
+    (fetchpatch {
+      url = "https://github.com/checkpoint-restore/criu/commit/8cd5fccd6cf3d03afb5abe463134d31f54d42258.patch";
+      sha256 = "sha256-b65DdLmyIuZik0dNRuWJKUPcDFA6CKq0bi4Vd26zgS4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/checkpoint-restore/criu/commit/517c0947050e63aac72f63a3bf373d76264723b9.patch";
+      sha256 = "sha256-MPZ6oILVoZ7BQEZFjUlp3RuMC7iKTKXAtrUDFqbN4T8=";
+    })
+  ];
+
   enableParallelBuilding = true;
-  nativeBuildInputs = [ pkg-config docbook_xsl which makeWrapper docbook_xml_dtd_45 python3 python3.pkgs.wrapPython perl ];
-  buildInputs = [ protobuf protobufc asciidoc xmlto libpaper libnl libcap libnet iptables ];
-  propagatedBuildInputs = with python3.pkgs; [ python python3.pkgs.protobuf ];
+  depsBuildBuild = [ protobufc buildPackages.stdenv.cc ];
+  nativeBuildInputs = [
+    pkg-config
+    asciidoc
+    xmlto
+    libpaper
+    docbook_xsl
+    which
+    makeWrapper
+    docbook_xml_dtd_45
+    python3
+    python3.pkgs.wrapPython
+    perl
+  ];
+  buildInputs = [
+    protobuf
+    libnl
+    libcap
+    libnet
+    nftables
+    libbsd
+  ];
+  propagatedBuildInputs = [
+    protobufc
+  ] ++ (with python3.pkgs; [
+    python
+    python3.pkgs.protobuf
+  ]);
 
   postPatch = ''
     substituteInPlace ./Documentation/Makefile \
@@ -24,7 +71,27 @@ stdenv.mkDerivation rec {
     ln -sf ${protobuf}/include/google/protobuf/descriptor.proto ./images/google/protobuf/descriptor.proto
   '';
 
-  makeFlags = [ "PREFIX=$(out)" "ASCIIDOC=${asciidoc}/bin/asciidoc" "XMLTO=${xmlto}/bin/xmlto" ];
+  makeFlags = let
+    # criu's Makefile infrastructure expects to be passed a target architecture
+    # which neither matches the config-tuple's first part, nor the
+    # targetPlatform.linuxArch attribute. Thus we take the latter and map it
+    # onto the expected string:
+    linuxArchMapping = {
+      "x86_64" = "x86";
+      "arm" = "arm";
+      "arm64" = "aarch64";
+      "powerpc" = "ppc64";
+      "s390" = "s390";
+      "mips" = "mips";
+    };
+  in [
+    "PREFIX=$(out)"
+    "ASCIIDOC=${buildPackages.asciidoc}/bin/asciidoc"
+    "XMLTO=${buildPackages.xmlto}/bin/xmlto"
+  ] ++ (lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "ARCH=${linuxArchMapping."${stdenv.hostPlatform.linuxArch}"}"
+    "CROSS_COMPILE=${stdenv.hostPlatform.config}-"
+  ]);
 
   outputs = [ "out" "dev" "man" ];
 
@@ -39,7 +106,9 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     wrapProgram $out/bin/criu \
-      --prefix PATH : ${lib.makeBinPath [ iptables ]}
+      --set-default CR_IPTABLES ${iptables}/bin/iptables \
+      --set-default CR_IP_TOOL ${iproute2}/bin/ip \
+      --prefix PATH : ${lib.makeBinPath [ gnutar gzip ]}
     wrapPythonPrograms
   '';
 
@@ -47,7 +116,7 @@ stdenv.mkDerivation rec {
     description = "Userspace checkpoint/restore for Linux";
     homepage    = "https://criu.org";
     license     = licenses.gpl2;
-    platforms   = [ "x86_64-linux" "aarch64-linux" ];
+    platforms   = [ "x86_64-linux" "aarch64-linux" "armv7l-linux" ];
     maintainers = [ maintainers.thoughtpolice ];
   };
 }
diff --git a/pkgs/os-specific/linux/cryptodev/default.nix b/pkgs/os-specific/linux/cryptodev/default.nix
index f09679ba212..cacef99afd7 100644
--- a/pkgs/os-specific/linux/cryptodev/default.nix
+++ b/pkgs/os-specific/linux/cryptodev/default.nix
@@ -1,26 +1,29 @@
 { fetchFromGitHub, lib, stdenv, kernel ? false }:
 
 stdenv.mkDerivation rec {
-  pname = "cryptodev-linux-1.12";
+  pname = "cryptodev-linux-1.13";
   name = "${pname}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "cryptodev-linux";
     repo = "cryptodev-linux";
     rev = pname;
-    sha256 = "sha256-vJQ10rG5FGbeEOqCUmH/pZ0P77kAW/MtUarywbtIyHw=";
+    hash = "sha256-EzTPoKYa+XWOAa/Dk7ru02JmlymHeXVX7RMmEoJ1OT0=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" ];
 
-  KERNEL_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
-  INSTALL_MOD_PATH = "\${out}";
-  prefix = "\${out}";
+  makeFlags = kernel.makeFlags ++ [
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+    "prefix=$(out)"
+  ];
 
   meta = {
     description = "Device that allows access to Linux kernel cryptographic drivers";
     homepage = "http://cryptodev-linux.org/";
-    maintainers = with lib.maintainers; [ fortuneteller2k ];
+    maintainers = with lib.maintainers; [ moni ];
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index e7304e19679..fbff9a3363d 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -1,19 +1,33 @@
-{ lib, stdenv, fetchurl, lvm2, json_c
-, openssl, libuuid, pkg-config, popt }:
+{ lib, stdenv, fetchurl, lvm2, json_c, asciidoctor
+, openssl, libuuid, pkg-config, popt, nixosTests
+, libargon2, withInternalArgon2 ? false
+
+  # Programs enabled by default upstream are implicitly enabled unless
+  # manually set to false.
+, programs ? {}
+  # The release tarballs contain precomputed manpage files, so we don't need
+  # to run asciidoctor on the man sources. By avoiding asciidoctor, we make
+  # the bare NixOS build hash independent of changes to the ruby ecosystem,
+  # saving mass-rebuilds.
+, rebuildMan ? false
+}:
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.3.6";
+  version = "2.6.1";
 
-  outputs = [ "out" "dev" "man" ];
+  outputs = [ "bin" "out" "dev" "man" ];
+  separateDebugInfo = true;
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/cryptsetup/v2.3/${pname}-${version}.tar.xz";
-    sha256 = "sha256-spa3oh6ldsKxgGEcyxnQauyN3a7ffHBLDGqBIQwlY18=";
+    url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    hash = "sha256-QQ3tZaEHKrnI5Brd7Te5cpwIf+9NLbArtO9SmtbaRpM=";
   };
 
-  # Disable 4 test cases that fail in a sandbox
-  patches = [ ./disable-failing-tests.patch ];
+  patches = [
+    # Allow reading tokens from a relative path, see #167994
+    ./relative-token-path.patch
+  ];
 
   postPatch = ''
     patchShebangs tests
@@ -24,23 +38,51 @@ stdenv.mkDerivation rec {
     substituteInPlace tests/unit-utils-io.c --replace "| O_DIRECT" ""
   '';
 
-  NIX_LDFLAGS = "-lgcc_s";
+  NIX_LDFLAGS = lib.optionalString (stdenv.cc.isGNU && !stdenv.hostPlatform.isStatic) "-lgcc_s";
 
   configureFlags = [
-    "--enable-cryptsetup-reencrypt"
     "--with-crypto_backend=openssl"
-  ];
+    "--disable-ssh-token"
+  ] ++ lib.optionals (!rebuildMan) [
+    "--disable-asciidoc"
+  ] ++ lib.optionals (!withInternalArgon2) [
+    "--enable-libargon2"
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "--disable-external-tokens"
+    # We have to override this even though we're removing token
+    # support, because the path still gets included in the binary even
+    # though it isn't used.
+    "--with-luks2-external-tokens-path=/"
+  ] ++ (with lib; mapAttrsToList (flip enableFeature)) programs;
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ lvm2 json_c openssl libuuid popt ];
+  nativeBuildInputs = [ pkg-config ] ++ lib.optionals rebuildMan [ asciidoctor ];
+  buildInputs = [ lvm2 json_c openssl libuuid popt ] ++ lib.optional (!withInternalArgon2) libargon2;
 
-  doCheck = true;
+  # The test [7] header backup in compat-test fails with a mysterious
+  # "out of memory" error, even though tons of memory is available.
+  # Issue filed upstream: https://gitlab.com/cryptsetup/cryptsetup/-/issues/763
+  doCheck = !stdenv.hostPlatform.isMusl;
+
+  passthru = {
+    tests = {
+      nixos =
+        lib.optionalAttrs stdenv.hostPlatform.isLinux (
+          lib.recurseIntoAttrs (
+            lib.filterAttrs
+              (name: _value: lib.hasPrefix "luks" name)
+              nixosTests.installer
+          )
+        );
+    };
+  };
 
   meta = {
     homepage = "https://gitlab.com/cryptsetup/cryptsetup/";
     description = "LUKS for dm-crypt";
+    changelog = "https://gitlab.com/cryptsetup/cryptsetup/-/raw/v${version}/docs/v${version}-ReleaseNotes";
     license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ ];
+    mainProgram = "cryptsetup";
+    maintainers = with lib.maintainers; [ raitobezarius ];
     platforms = with lib.platforms; linux;
   };
 }
diff --git a/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch b/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
deleted file mode 100644
index 1504bf3e151..00000000000
--- a/pkgs/os-specific/linux/cryptsetup/disable-failing-tests.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff -ur a/tests/blockwise-compat b/tests/blockwise-compat
---- a/tests/blockwise-compat	2018-09-08 12:23:11.706555098 +0200
-+++ b/tests/blockwise-compat	2018-09-08 12:24:24.444393460 +0200
-@@ -148,15 +148,11 @@
- 	# device/file fn_name length
- 	RUN "P" $1 read_buffer $BSIZE
- 	RUN "P" $1 read_buffer $((2*BSIZE))
--	RUN "F" $1 read_buffer $((BSIZE-1))
--	RUN "F" $1 read_buffer $((BSIZE+1))
- 	RUN "P" $1 read_buffer 0
- 
- 	RUN "P" $1 write_buffer $BSIZE
- 	RUN "P" $1 write_buffer $((2*BSIZE))
- 
--	RUN "F" $1 write_buffer $((BSIZE-1))
--	RUN "F" $1 write_buffer $((BSIZE+1))
- 	RUN "F" $1 write_buffer 0
- 
- 	# basic blockwise functions
diff --git a/pkgs/os-specific/linux/cryptsetup/relative-token-path.patch b/pkgs/os-specific/linux/cryptsetup/relative-token-path.patch
new file mode 100644
index 00000000000..dffd0ba3bb5
--- /dev/null
+++ b/pkgs/os-specific/linux/cryptsetup/relative-token-path.patch
@@ -0,0 +1,50 @@
+From 4f95ab1f8110a8ab9d7b0e192731ce467f6e5c26 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Janne=20He=C3=9F?= <janne@hess.ooo>
+Date: Sun, 4 Sep 2022 11:15:02 -0600
+Subject: [PATCH] Allow loading token handlers from the default search path
+
+Since [1] landed in cryptsetup, token handlers (libcryptsetup-token-*.so)
+are loaded from a fixed path defined at compile-time. This is
+problematic with NixOS since it introduces a dependency cycle
+between cryptsetup and systemd.
+
+This downstream patch [2] allows loading token plugins from the
+default library search path. This approach is not accepted upstream [3]
+due to security concerns, but the potential attack vectors require
+root access and they are sufficiently addressed:
+
+* cryptsetup could be used as a setuid binary (not used in NixOS).
+  In this case, LD_LIBRARY_PATH is ignored because of secure-execution
+  mode.
+* cryptsetup running as root could lead to a malicious token handler
+  being loaded through LD_LIBRARY_PATH. However, fixing the path
+  doesn't prevent the same malicious .so being loaded through LD_PRELOAD.
+
+[1] https://gitlab.com/cryptsetup/cryptsetup/-/commit/5b9e98f94178d3cd179d9f6e2a0a68c7d9eb6507
+[2] https://github.com/NixOS/nixpkgs/issues/167994#issuecomment-1094249369
+[3] https://gitlab.com/cryptsetup/cryptsetup/-/issues/733
+---
+ lib/luks2/luks2_token.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+diff --git a/lib/luks2/luks2_token.c b/lib/luks2/luks2_token.c
+index 26467253..6f8329f0 100644
+--- a/lib/luks2/luks2_token.c
++++ b/lib/luks2/luks2_token.c
+@@ -151,12 +151,10 @@ crypt_token_load_external(struct crypt_device *cd, const char *name, struct cryp
+ 
+ 	token = &ret->u.v2;
+ 
+-	r = snprintf(buf, sizeof(buf), "%s/libcryptsetup-token-%s.so", crypt_token_external_path(), name);
++	r = snprintf(buf, sizeof(buf), "libcryptsetup-token-%s.so", name);
+ 	if (r < 0 || (size_t)r >= sizeof(buf))
+ 		return -EINVAL;
+ 
+-	assert(*buf == '/');
+-
+ 	log_dbg(cd, "Trying to load %s.", buf);
+ 
+ 	h = dlopen(buf, RTLD_LAZY);
+-- 
+2.37.2
+
diff --git a/pkgs/os-specific/linux/cshatag/default.nix b/pkgs/os-specific/linux/cshatag/default.nix
index bc1b7f7ecf5..84de0c5dd11 100644
--- a/pkgs/os-specific/linux/cshatag/default.nix
+++ b/pkgs/os-specific/linux/cshatag/default.nix
@@ -1,25 +1,23 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "cshatag";
-  version = "2019-12-03";
-
-  goPackagePath = "github.com/rfjakob/cshatag";
-  goDeps = ./deps.nix;
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = pname;
-    rev = "b169f0a9dd35a7381774eb176d4badf64d403560";
-    sha256 = "16kam3w75avh8khkk6jfdnxwggz2pw6ccv6v7d064j0fbb9y8x0v";
+    rev = "v${version}";
+    sha256 = "sha256-Ez8zGVX10A7xuggkh3n7w/qzda8f4t6EgSc9l6SPEZQ=";
   };
 
-  makeFlags = [ "PREFIX=$(out)" "GITVERSION=${version}" ];
+  vendorHash = "sha256-QTnwltsoyUbH4vob5go1KBrb9gwxaaPNW3S4sxVls3k=";
+
+  ldflags = [ "-s" "-w" ];
 
   postInstall = ''
     # Install man page
-    cd go/src/${goPackagePath}
-    make install $makeFlags
+    install -D -m755 -t $out/share/man/man1/ cshatag.1
   '';
 
   meta = with lib; {
@@ -28,5 +26,4 @@ buildGoPackage rec {
     license = licenses.mit;
     platforms = platforms.linux;
   };
-
 }
diff --git a/pkgs/os-specific/linux/cshatag/deps.nix b/pkgs/os-specific/linux/cshatag/deps.nix
deleted file mode 100644
index 6daad985678..00000000000
--- a/pkgs/os-specific/linux/cshatag/deps.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/pkg/xattr";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/xattr";
-      rev = "d304131d5e58ca76d8b31ceefbb0c85c7b2d2a36";
-      sha256 = "0bxskiai283zfra13z5f7q7f77zz2cgswaj6l6jr2nwnc3l5m80i";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "201ba4db2418b54b698efb4d8082dcb504617cdb";
-      sha256 = "1cqaiwp19kl38g4d6brfhi32822rhnh2q8x1j0i6yg7a8dzfvbz6";
-    };
-  }
-]
diff --git a/pkgs/os-specific/linux/dbus-broker/default.nix b/pkgs/os-specific/linux/dbus-broker/default.nix
index b7e0a6b6158..847f76a528c 100644
--- a/pkgs/os-specific/linux/dbus-broker/default.nix
+++ b/pkgs/os-specific/linux/dbus-broker/default.nix
@@ -1,30 +1,84 @@
-{ lib, stdenv, fetchFromGitHub, docutils, meson, ninja, pkg-config
-, dbus, linuxHeaders, systemd }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, docutils
+, meson
+, ninja
+, pkg-config
+, dbus
+, linuxHeaders
+, systemd
+}:
 
-stdenv.mkDerivation rec {
+let
+
+  dep = { pname, version, hash, rev ? "v${version}", buildInputs ? [ ] }:
+    stdenv.mkDerivation {
+      inherit pname version;
+      src = fetchFromGitHub {
+        owner = "c-util";
+        repo = pname;
+        inherit hash rev;
+      };
+      nativeBuildInputs = [ meson ninja pkg-config ];
+      inherit buildInputs;
+    };
+
+  # These libraries are not used outside of dbus-broker.
+  #
+  # If that changes, we can always break them out, but they are essentially
+  # part of the dbus-broker project, just in separate repositories.
+  c-dvar = dep { pname = "c-dvar"; version = "1.0.0"; hash = "sha256-P7y7gUHXQn2eyS6IcV7m7yGy4VGtQ2orgBkS7Y729ZY="; buildInputs = [ c-stdaux c-utf8 ]; };
+  c-ini = dep { pname = "c-ini"; version = "1.0.0"; hash = "sha256-VKxoGexMcquakMmiH5IJt0382TjkV1FLncTSyEqf4X0="; buildInputs = [ c-list c-rbtree c-stdaux c-utf8 ]; };
+  c-list = dep { pname = "c-list"; version = "3.1.0"; hash = "sha256-fp3EAqcbFCLaT2EstLSzwP2X13pi2EFpFAullhoCtpw="; };
+  c-rbtree = dep { pname = "c-rbtree"; version = "3.1.0"; hash = "sha256-ozVzL6FllAn8eHbso0RZc/+PGWwEp6r/R1MR+r4Bi/4="; buildInputs = [ c-stdaux ]; };
+  c-shquote = dep { pname = "c-shquote"; version = "1.0.0"; hash = "sha256-Ze1enX0VJ6Xi5e4EhWzaiHc7PnuaifrUP+JuJnauv5c="; buildInputs = [ c-stdaux ]; };
+  c-stdaux = dep { pname = "c-stdaux"; version = "1.4.0"; hash = "sha256-gEqXVBAUE0dHD03ina9QbEP26NU12cHKRpuD7GoPmDs="; };
+  c-utf8 = dep { pname = "c-utf8"; version = "1.0.0"; hash = "sha256-QEnjmfQ6kxJdsHfyRgXAlP+oGrKLYQ0m9r+D2L+pizI="; buildInputs = [ c-stdaux ]; };
+
+in
+
+stdenv.mkDerivation ( finalAttrs: {
   pname = "dbus-broker";
-  version = "29";
+  version = "33";
 
   src = fetchFromGitHub {
-    owner  = "bus1";
-    repo   = "dbus-broker";
-    rev    = "v${version}";
-    sha256 = "1abbi8c0mgdqjidlp2wnmy0a88xv173hq88sh5m966c5r1h6alkq";
-    fetchSubmodules = true;
+    owner = "bus1";
+    repo = "dbus-broker";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-c5kEUB2k9CCuno9d4QOUUp1wbQfsvraGDLN6Yaa7T2w=";
   };
 
+  patches = [ ./paths.patch ];
+
   nativeBuildInputs = [ docutils meson ninja pkg-config ];
 
-  buildInputs = [ dbus linuxHeaders systemd ];
+  buildInputs = [
+    c-dvar
+    c-ini
+    c-list
+    c-rbtree
+    c-shquote
+    c-stdaux
+    c-utf8
+    dbus
+    linuxHeaders
+    systemd
+  ];
 
-  mesonFlags = [ "-D=system-console-users=gdm,sddm,lightdm" ];
+  mesonFlags = [
+    # while we technically support 4.9 and 4.14, the NixOS module will throw an
+    # error when using a kernel that's too old
+    "-D=linux-4-17=true"
+    "-D=system-console-users=gdm,sddm,lightdm"
+  ];
 
   PKG_CONFIG_SYSTEMD_SYSTEMDSYSTEMUNITDIR = "${placeholder "out"}/lib/systemd/system";
   PKG_CONFIG_SYSTEMD_SYSTEMDUSERUNITDIR = "${placeholder "out"}/lib/systemd/user";
   PKG_CONFIG_SYSTEMD_CATALOGDIR = "${placeholder "out"}/lib/systemd/catalog";
 
   postInstall = ''
-    install -Dm644 $src/README.md $out/share/doc/dbus-broker/README
+    install -Dm444 $src/README.md $out/share/doc/dbus-broker/README
 
     sed -i $out/lib/systemd/{system,user}/dbus-broker.service \
       -e 's,^ExecReload.*busctl,ExecReload=${systemd}/bin/busctl,'
@@ -34,9 +88,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Linux D-Bus Message Broker";
-    homepage    = "https://github.com/bus1/dbus-broker/wiki";
-    license     = licenses.asl20;
-    platforms   = platforms.linux;
+    homepage = "https://github.com/bus1/dbus-broker/wiki";
+    license = licenses.asl20;
     maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
   };
-}
+} )
diff --git a/pkgs/os-specific/linux/dbus-broker/paths.patch b/pkgs/os-specific/linux/dbus-broker/paths.patch
new file mode 100644
index 00000000000..577270d30dc
--- /dev/null
+++ b/pkgs/os-specific/linux/dbus-broker/paths.patch
@@ -0,0 +1,27 @@
+diff --git a/src/launch/launcher.c b/src/launch/launcher.c
+index 5bf5cf5..06ce7f4 100644
+--- a/src/launch/launcher.c
++++ b/src/launch/launcher.c
+@@ -924,9 +924,7 @@ static int launcher_load_standard_session_services(Launcher *launcher, NSSCache
+ 
+ static int launcher_load_standard_system_services(Launcher *launcher, NSSCache *nss_cache) {
+         static const char *default_data_dirs[] = {
+-                "/usr/local/share",
+-                "/usr/share",
+-                "/lib",
++                "/run/current-system/sw/share",
+                 NULL,
+         };
+         const char *suffix = "dbus-1/system-services";
+@@ -1012,9 +1010,9 @@ static int launcher_parse_config(Launcher *launcher, ConfigRoot **rootp, NSSCach
+         if (launcher->configfile)
+                 configfile = launcher->configfile;
+         else if (launcher->user_scope)
+-                configfile = "/usr/share/dbus-1/session.conf";
++                configfile = "/etc/dbus-1/session.conf";
+         else
+-                configfile = "/usr/share/dbus-1/system.conf";
++                configfile = "/etc/dbus-1/system.conf";
+ 
+         config_parser_init(&parser);
+ 
diff --git a/pkgs/os-specific/linux/dcgm/default.nix b/pkgs/os-specific/linux/dcgm/default.nix
new file mode 100644
index 00000000000..f3ebdf1427e
--- /dev/null
+++ b/pkgs/os-specific/linux/dcgm/default.nix
@@ -0,0 +1,139 @@
+{ lib
+, gcc11Stdenv
+, fetchFromGitHub
+, catch2
+, cmake
+, cudaPackages_10_2
+, cudaPackages_11_8
+, cudaPackages_12
+, fmt_9
+, git
+, jsoncpp
+, libevent
+, plog
+, python3
+, symlinkJoin
+, tclap_1_4
+, yaml-cpp
+}:
+let
+  # Flags copied from DCGM's libevent build script
+  libevent-nossl = libevent.override { sslSupport = false; };
+  libevent-nossl-static = libevent-nossl.overrideAttrs (super: {
+    CFLAGS = "-Wno-cast-function-type -Wno-implicit-fallthrough -fPIC";
+    CXXFLAGS = "-Wno-cast-function-type -Wno-implicit-fallthrough -fPIC";
+    configureFlags = super.configureFlags ++ [ "--disable-shared" "--with-pic" ];
+  });
+
+  jsoncpp-static = jsoncpp.override { enableStatic = true; };
+
+  # DCGM depends on 3 different versions of CUDA at the same time.
+  # The runtime closure, thankfully, is quite small because most things
+  # are statically linked.
+  cudaPackageSetByVersion = [
+    {
+      version = "10";
+      # Nixpkgs cudaPackages_10 doesn't have redist packages broken out.
+      pkgSet = [
+        cudaPackages_10_2.cudatoolkit
+        cudaPackages_10_2.cudatoolkit.lib
+      ];
+    }
+    {
+      version = "11";
+      pkgSet = getCudaPackages cudaPackages_11_8;
+    }
+    {
+      version = "12";
+      pkgSet = getCudaPackages cudaPackages_12;
+    }
+  ];
+
+  # Select needed redist packages from cudaPackages
+  # C.f. https://github.com/NVIDIA/DCGM/blob/7e1012302679e4bb7496483b32dcffb56e528c92/dcgmbuild/scripts/0080_cuda.sh#L24-L39
+  getCudaPackages = p: with p; [
+    cuda_cccl
+    cuda_cudart
+    cuda_nvcc
+    cuda_nvml_dev
+    libcublas
+    libcufft
+    libcurand
+  ];
+
+  # Builds CMake code to add CUDA paths for include and lib.
+  mkAppendCudaPaths = { version, pkgSet }:
+    let
+      # The DCGM CMake assumes that the folder containing cuda.h contains all headers, so we must
+      # combine everything together for headers to work.
+      # It would be more convenient to use symlinkJoin on *just* the include subdirectories
+      # of each package, but not all of them have an include directory and making that work
+      # is more effort than it's worth for this temporary, build-time package.
+      combined = symlinkJoin {
+        name = "cuda-combined-${version}";
+        paths = pkgSet;
+      };
+      # The combined package above breaks the build for some reason so we just configure
+      # each package's library path.
+      libs = lib.concatMapStringsSep " " (x: ''"${x}/lib"'') pkgSet;
+    in ''
+      list(APPEND Cuda${version}_INCLUDE_PATHS "${combined}/include")
+      list(APPEND Cuda${version}_LIB_PATHS ${libs})
+    '';
+
+# gcc11 is required by DCGM's very particular build system
+# C.f. https://github.com/NVIDIA/DCGM/blob/7e1012302679e4bb7496483b32dcffb56e528c92/dcgmbuild/build.sh#L22
+in gcc11Stdenv.mkDerivation rec {
+  pname = "dcgm";
+  version = "3.2.5"; # N.B: If you change this, be sure prometheus-dcgm-exporter supports this version.
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "DCGM";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-iMyYOr3dSpdRV2S/TlB/tEOAWYhK09373ZRbd5vzogQ=";
+  };
+
+  # Add our paths to the CUDA paths so FindCuda.cmake can find them.
+  EXTRA_CUDA_PATHS = lib.concatMapStringsSep "\n" mkAppendCudaPaths cudaPackageSetByVersion;
+  prePatch = ''
+    echo "$EXTRA_CUDA_PATHS"$'\n'"$(cat cmake/FindCuda.cmake)" > cmake/FindCuda.cmake
+  '';
+
+  hardeningDisable = [ "all" ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    # autoAddOpenGLRunpathHook does not actually depend on or incur any dependency
+    # of cudaPackages. It merely adds an impure, non-Nix PATH to the RPATHs of
+    # executables that need to use cuda at runtime.
+    cudaPackages_12.autoAddOpenGLRunpathHook
+
+    cmake
+    git
+    python3
+  ];
+
+  buildInputs = [
+    plog.dev # header-only
+    tclap_1_4 # header-only
+
+    catch2
+    fmt_9
+    jsoncpp-static
+    libevent-nossl-static
+    yaml-cpp
+  ];
+
+  disallowedReferences = lib.concatMap (x: x.pkgSet) cudaPackageSetByVersion;
+
+  meta = with lib; {
+    description = "Data Center GPU Manager (DCGM) is a daemon that allows users to monitor NVIDIA data-center GPUs.";
+    homepage = "https://developer.nvidia.com/dcgm";
+    license = licenses.asl20;
+    maintainers = teams.deshaw.members;
+    mainProgram = "dcgmi";
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/ddcci/default.nix b/pkgs/os-specific/linux/ddcci/default.nix
index 7e5f95cb206..ce435b3874f 100644
--- a/pkgs/os-specific/linux/ddcci/default.nix
+++ b/pkgs/os-specific/linux/ddcci/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ddcci-driver";
-  version = "0.3.3";
+  version = "0.4.4";
   name = "${pname}-${kernel.version}-${version}";
 
   src = fetchFromGitLab {
     owner = "${pname}-linux";
     repo = "${pname}-linux";
     rev = "v${version}";
-    sha256 = "0vkkja3ykjil783zjpwp0vz7jy2fp9ccazzi3afd4fjk8gldin7f";
+    hash = "sha256-4pCfXJcteWwU6cK8OOSph4XlhKTk289QqLxsSWY7cac=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
       --replace depmod \#
   '';
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "KVER=${kernel.modDirVersion}"
     "KERNEL_MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"
@@ -35,8 +35,9 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Kernel module driver for DDC/CI monitors";
     homepage = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ bricewge ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.1";
   };
 }
diff --git a/pkgs/os-specific/linux/dddvb/default.nix b/pkgs/os-specific/linux/dddvb/default.nix
new file mode 100644
index 00000000000..809010be2a7
--- /dev/null
+++ b/pkgs/os-specific/linux/dddvb/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, kernel
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dddvb";
+  version = "0.9.38-pre.6";
+
+  src = fetchFromGitHub {
+    owner = "DigitalDevices";
+    repo = "dddvb";
+    rev = "refs/tags/${version}";
+    hash = "sha256-bt/vMnqRWDDChZ6R4JbCr77cz3nlSPkx6siC9KLSEqs=";
+  };
+
+  patches = [
+    (fetchpatch {
+      # pci_*_dma_mask no longer exists in 5.18
+      url = "https://github.com/DigitalDevices/dddvb/commit/871821d6a0be147313bb52570591ce3853b3d370.patch";
+      hash = "sha256-wY05HrsduvsIdp/KpS9NWfL3hR9IvGjuNCDljFn7dd0=";
+    })
+  ];
+
+  postPatch = ''
+    sed -i '/depmod/d' Makefile
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  INSTALL_MOD_PATH = placeholder "out";
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/DigitalDevices/dddvb";
+    description = "ddbridge linux driver";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ hexa ];
+    platforms = platforms.linux;
+    broken = lib.versionAtLeast kernel.version "6.2";
+  };
+}
diff --git a/pkgs/os-specific/linux/decklink/default.nix b/pkgs/os-specific/linux/decklink/default.nix
new file mode 100644
index 00000000000..63bfe4a63af
--- /dev/null
+++ b/pkgs/os-specific/linux/decklink/default.nix
@@ -0,0 +1,52 @@
+{ stdenv
+, lib
+, blackmagic-desktop-video
+, kernel
+}:
+
+stdenv.mkDerivation rec {
+  pname = "decklink";
+
+  # the download is a horrible curl mess. we reuse it between the kernel module
+  # and desktop service, since the version of the two have to match anyways.
+  # See pkgs/tools/video/blackmagic-desktop-video/default.nix for more.
+  inherit (blackmagic-desktop-video) src version;
+
+  KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  INSTALL_MOD_PATH = placeholder "out";
+
+  nativeBuildInputs =  kernel.moduleBuildDependencies;
+
+  postUnpack = ''
+    tar xf Blackmagic_Desktop_Video_Linux_${lib.versions.majorMinor version}/other/${stdenv.hostPlatform.uname.processor}/desktopvideo-${version}-${stdenv.hostPlatform.uname.processor}.tar.gz
+    moduleRoot=$NIX_BUILD_TOP/desktopvideo-${version}-${stdenv.hostPlatform.uname.processor}/usr/src
+  '';
+
+
+  buildPhase = ''
+    runHook preBuild
+
+    make -C $moduleRoot/blackmagic-${version} -j$NIX_BUILD_CORES
+    make -C $moduleRoot/blackmagic-io-${version} -j$NIX_BUILD_CORES
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    make -C $KERNELDIR M=$moduleRoot/blackmagic-${version} modules_install
+    make -C $KERNELDIR M=$moduleRoot/blackmagic-io-${version} modules_install
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.blackmagicdesign.com/support/family/capture-and-playback";
+    maintainers = [ maintainers.hexchen ];
+    license = licenses.unfree;
+    description = "Kernel module for the Blackmagic Design Decklink cards";
+    sourceProvenance = with lib.sourceTypes; [ binaryFirmware ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/device-tree/default.nix b/pkgs/os-specific/linux/device-tree/default.nix
index 13c609cdf7d..1a50d799b4b 100644
--- a/pkgs/os-specific/linux/device-tree/default.nix
+++ b/pkgs/os-specific/linux/device-tree/default.nix
@@ -1,28 +1,62 @@
-{ lib, stdenvNoCC, dtc, findutils }:
+{ lib, stdenv, stdenvNoCC, dtc }:
 
 with lib; {
+  # Compile single Device Tree overlay source
+  # file (.dts) into its compiled variant (.dtb)
+  compileDTS = ({
+    name,
+    dtsFile,
+    includePaths ? [],
+    extraPreprocessorFlags ? []
+  }: stdenv.mkDerivation {
+    inherit name;
+
+    nativeBuildInputs = [ dtc ];
+
+    buildCommand =
+      let
+        includeFlagsStr = lib.concatMapStringsSep " " (includePath: "-I${includePath}") includePaths;
+        extraPreprocessorFlagsStr = lib.concatStringsSep " " extraPreprocessorFlags;
+      in
+      ''
+        $CC -E -nostdinc ${includeFlagsStr} -undef -D__DTS__ -x assembler-with-cpp ${extraPreprocessorFlagsStr} ${dtsFile} | \
+        dtc -I dts -O dtb -@ -o $out
+      '';
+  });
+
   applyOverlays = (base: overlays': stdenvNoCC.mkDerivation {
     name = "device-tree-overlays";
-    nativeBuildInputs = [ dtc findutils ];
+    nativeBuildInputs = [ dtc ];
     buildCommand = let
       overlays = toList overlays';
     in ''
       mkdir -p $out
-      cd ${base}
+      cd "${base}"
       find . -type f -name '*.dtb' -print0 \
-        | xargs -0 cp -v --no-preserve=mode --target-directory $out --parents
+        | xargs -0 cp -v --no-preserve=mode --target-directory "$out" --parents
 
-      for dtb in $(find $out -type f -name '*.dtb'); do
-        dtbCompat="$( fdtget -t s $dtb / compatible )"
+      for dtb in $(find "$out" -type f -name '*.dtb'); do
+        dtbCompat=$(fdtget -t s "$dtb" / compatible 2>/dev/null || true)
+        # skip files without `compatible` string
+        test -z "$dtbCompat" && continue
 
         ${flip (concatMapStringsSep "\n") overlays (o: ''
-        overlayCompat="$( fdtget -t s ${o.dtboFile} / compatible )"
-        # overlayCompat in dtbCompat
-        if [[ "$dtbCompat" =~ "$overlayCompat" ]]; then
-          echo "Applying overlay ${o.name} to $( basename $dtb )"
-          mv $dtb{,.in}
-          fdtoverlay -o "$dtb" -i "$dtb.in" ${o.dtboFile};
-          rm $dtb.in
+        overlayCompat="$(fdtget -t s "${o.dtboFile}" / compatible)"
+
+        # skip incompatible and non-matching overlays
+        if [[ ! "$dtbCompat" =~ "$overlayCompat" ]]; then
+          echo "Skipping overlay ${o.name}: incompatible with $(basename "$dtb")"
+        elif ${if (o.filter == null) then "false" else ''
+          [[ "''${dtb//${o.filter}/}" ==  "$dtb" ]]
+        ''}
+        then
+          echo "Skipping overlay ${o.name}: filter does not match $(basename "$dtb")"
+        else
+          echo -n "Applying overlay ${o.name} to $(basename "$dtb")... "
+          mv "$dtb"{,.in}
+          fdtoverlay -o "$dtb" -i "$dtb.in" "${o.dtboFile}"
+          echo "ok"
+          rm "$dtb.in"
         fi
         '')}
 
diff --git a/pkgs/os-specific/linux/device-tree/raspberrypi.nix b/pkgs/os-specific/linux/device-tree/raspberrypi.nix
index b4b40f8331f..d9ccb70f1f0 100644
--- a/pkgs/os-specific/linux/device-tree/raspberrypi.nix
+++ b/pkgs/os-specific/linux/device-tree/raspberrypi.nix
@@ -1,7 +1,8 @@
 { lib, stdenvNoCC, raspberrypifw }:
 
 stdenvNoCC.mkDerivation {
-  name = "raspberrypi-dtbs-${raspberrypifw.version}";
+  pname = "raspberrypi-dtbs";
+  version = raspberrypifw.version;
   nativeBuildInputs = [ raspberrypifw ];
 
   # Rename DTBs so u-boot finds them, like linux-rpi.nix
diff --git a/pkgs/os-specific/linux/devmem2/default.nix b/pkgs/os-specific/linux/devmem2/default.nix
index 86f6f916cef..fbf47204b3e 100644
--- a/pkgs/os-specific/linux/devmem2/default.nix
+++ b/pkgs/os-specific/linux/devmem2/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation {
-  name = "devmem2-2004-08-05";
+  pname = "devmem2";
+  version = "unstable-2004-08-05";
 
   src = fetchurl {
     urls = [
diff --git a/pkgs/os-specific/linux/digimend/default.nix b/pkgs/os-specific/linux/digimend/default.nix
index 6b5f66f825b..11756dcbe85 100644
--- a/pkgs/os-specific/linux/digimend/default.nix
+++ b/pkgs/os-specific/linux/digimend/default.nix
@@ -1,33 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel }:
-
-assert lib.versionAtLeast kernel.version "3.5";
+{ lib, stdenv, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
   pname = "digimend";
-  version = "unstable-2019-06-18";
+  version = "unstable-2023-05-03";
 
   src = fetchFromGitHub {
     owner = "digimend";
     repo = "digimend-kernel-drivers";
-    rev = "8b228a755e44106c11f9baaadb30ce668eede5d4";
-    sha256 = "1l54j85540386a8aypqka7p5hy1b63cwmpsscv9rmmf10f78v8mm";
+    rev = "eca6e1b701bffb80a293234a485ebf6b4bc85562";
+    hash = "sha256-0mjIUgHvbNcVQVzU3xzaloe5R41a4eknDhdhruJH+6c=";
   };
 
-  INSTALL_MOD_PATH = "\${out}";
-
   postPatch = ''
     sed 's/udevadm /true /' -i Makefile
     sed 's/depmod /true /' -i Makefile
   '';
 
-  patches = [
-    # Fix build on Linux kernel >= 5.4
-    # https://github.com/DIGImend/digimend-kernel-drivers/pull/331
-    (fetchpatch {
-      url = "https://github.com/DIGImend/digimend-kernel-drivers/commit/fb8a2eb6a9198bb35aaccb81e22dd5ebe36124d1.patch";
-      sha256 = "1j7l5hsk59gccydpf7n6xx1ki4rm6aka7k879a7ah5jn8p1ylgw9";
-    })
-  ];
+  # Fix build on Linux kernel >= 5.18
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
@@ -38,10 +28,11 @@ stdenv.mkDerivation rec {
     rm -r $out/lib/udev
   '';
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KVERSION=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "DESTDIR=${placeholder "out"}"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
   ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/directvnc/default.nix b/pkgs/os-specific/linux/directvnc/default.nix
index d20b69775bf..78ccb677257 100644
--- a/pkgs/os-specific/linux/directvnc/default.nix
+++ b/pkgs/os-specific/linux/directvnc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, directfb, zlib, libjpeg, xorgproto }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, directfb, zlib, libjpeg, xorgproto }:
 
 stdenv.mkDerivation {
   pname = "directvnc";
@@ -11,6 +11,17 @@ stdenv.mkDerivation {
     sha256 = "16x7mr7x728qw7nbi6rqhrwsy73zsbpiz8pbgfzfl2aqhfdiz88b";
   };
 
+  patches = [
+    # Pull fix pending upstream inclusion for -fno-common toolchain
+    # support:
+    #   https://github.com/drinkmilk/directvnc/pull/7
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/drinkmilk/directvnc/commit/e9c23d049bcf31d0097348d44391fe5fd9aad12b.patch";
+      sha256 = "1dnzr0dnx20w80r73j4a9n6mhbazjzlr5ps9xjj898924cg140zx";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
 
   buildInputs = [ directfb zlib libjpeg xorgproto ];
diff --git a/pkgs/os-specific/linux/disk-indicator/default.nix b/pkgs/os-specific/linux/disk-indicator/default.nix
index f754882ccd0..f5c7f3bc774 100644
--- a/pkgs/os-specific/linux/disk-indicator/default.nix
+++ b/pkgs/os-specific/linux/disk-indicator/default.nix
@@ -1,30 +1,41 @@
-{ lib, stdenv, fetchgit, libX11 }:
+{ lib, stdenv, fetchFromGitHub, libX11 }:
 
 stdenv.mkDerivation {
-  name = "disk-indicator-2014-05-19";
-
-  src = fetchgit {
-    url = "git://github.com/MeanEYE/Disk-Indicator.git";
-    rev = "51ef4afd8141b8d0659cbc7dc62189c56ae9c2da";
-    sha256 = "10jx6mx9qarn21p2l2jayxkn1gmqhvck1wymgsr4jmbwxl8ra5kd";
+  pname = "disk-indicator";
+  version = "unstable-2018-12-18";
+
+  src = fetchFromGitHub {
+    owner = "MeanEYE";
+    repo = "Disk-Indicator";
+    rev = "ec2d2f6833f038f07a72d15e2d52625c23e10b12";
+    sha256 = "sha256-cRqgIxF6H1WyJs5hhaAXVdWAlv6t22BZLp3p/qRlCSM=";
   };
 
   buildInputs = [ libX11 ];
 
-  patchPhase = ''
-    substituteInPlace ./makefile --replace "COMPILER=c99" "COMPILER=gcc -std=c99"
-    substituteInPlace ./makefile --replace "COMPILE_FLAGS=" "COMPILE_FLAGS=-O2 "
+  postPatch = ''
+    # avoid -Werror
+    substituteInPlace Makefile --replace "-Werror" ""
+    # avoid host-specific options
+    substituteInPlace Makefile --replace "-march=native" ""
   '';
 
-  buildPhase = "make -f makefile";
-
-  NIX_CFLAGS_COMPILE = "-Wno-error=cpp";
+  postConfigure = ''
+    patchShebangs ./configure.sh
+    ./configure.sh --all
+  '';
 
-  hardeningDisable = [ "fortify" ];
+  makeFlags = [
+    "COMPILER=${stdenv.cc.targetPrefix}cc"
+  ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out/bin"
     cp ./disk_indicator "$out/bin/"
+
+    runHook postInstall
   '';
 
   meta = {
diff --git a/pkgs/os-specific/linux/displaylink/default.nix b/pkgs/os-specific/linux/displaylink/default.nix
index ca3e38c2e70..e71062e8ac4 100644
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -8,34 +8,36 @@
 , makeWrapper
 , requireFile
 , substituteAll
+, nixosTests
 }:
+
 let
-  arch =
-    if stdenv.hostPlatform.system == "x86_64-linux" then "x64"
-    else if stdenv.hostPlatform.system == "i686-linux" then "x86"
+  bins =
+    if stdenv.hostPlatform.system == "x86_64-linux" then "x64-ubuntu-1604"
+    else if stdenv.hostPlatform.system == "i686-linux" then "x86-ubuntu-1604"
+    else if stdenv.hostPlatform.system == "aarch64-linux" then "aarch64-linux-gnu"
     else throw "Unsupported architecture";
-  bins = "${arch}-ubuntu-1604";
   libPath = lib.makeLibraryPath [ stdenv.cc.cc util-linux libusb1 evdi ];
 
 in
 stdenv.mkDerivation rec {
   pname = "displaylink";
-  version = "5.4.0-55.153";
+  version = "5.8.0-63.33";
 
   src = requireFile rec {
-    name = "displaylink.zip";
-    sha256 = "1m2l3bnlfwfp94w7khr05npsbysg9mcyi7hi85n78xkd0xdcxml8";
+    name = "displaylink-580.zip";
+    sha256 = "05m8vm6i9pc9pmvar021lw3ls60inlmq92nling0vj28skm55i92";
     message = ''
       In order to install the DisplayLink drivers, you must first
       comply with DisplayLink's EULA and download the binaries and
       sources from here:
 
-      https://www.synaptics.com/node/3751
+      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.8
 
       Once you have downloaded the file, please use the following
       commands and re-run the installation:
 
-      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu ${lib.versions.majorMinor version}.zip" \$PWD/${name}
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.8-EXE.zip" \$PWD/${name}
       nix-prefetch-url file://\$PWD/${name}
     '';
   };
@@ -51,25 +53,35 @@ stdenv.mkDerivation rec {
   installPhase = ''
     install -Dt $out/lib/displaylink *.spkg
     install -Dm755 ${bins}/DisplayLinkManager $out/bin/DisplayLinkManager
-    mkdir -p $out/lib/udev/rules.d
+    mkdir -p $out/lib/udev/rules.d $out/share
     cp ${./99-displaylink.rules} $out/lib/udev/rules.d/99-displaylink.rules
     patchelf \
       --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
       --set-rpath ${libPath} \
       $out/bin/DisplayLinkManager
     wrapProgram $out/bin/DisplayLinkManager \
-      --run "cd $out/lib/displaylink"
+      --chdir "$out/lib/displaylink"
+
+    # We introduce a dependency on the source file so that it need not be redownloaded everytime
+    echo $src >> "$out/share/workspace_dependencies.pin"
   '';
 
   dontStrip = true;
   dontPatchELF = true;
 
+  passthru = {
+    tests = {
+      inherit (nixosTests) displaylink;
+    };
+  };
 
   meta = with lib; {
     description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
-    maintainers = with maintainers; [ nshalman abbradar peterhoeg eyjhb ];
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    license = licenses.unfree;
     homepage = "https://www.displaylink.com/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ abbradar ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+    hydraPlatforms = [];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
 }
diff --git a/pkgs/os-specific/linux/dlm/default.nix b/pkgs/os-specific/linux/dlm/default.nix
deleted file mode 100644
index 3b6f4773a29..00000000000
--- a/pkgs/os-specific/linux/dlm/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, rustPlatform
-, fetchFromSourcehut
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "dlm";
-  version = "2020-01-07";
-
-  src = fetchFromSourcehut {
-    owner = "~kennylevinsen";
-    repo = pname;
-    rev = "6b0e11c4f453b1a4d7a32019227539a980b7ce66";
-    sha256 = "1r3w7my0g3v2ya317qnvjx8wnagjahpj7yx72a65hf2pjbf5x42p";
-  };
-
-  cargoSha256 = "01a8k60qnx2pgxb2adgw30c2hjb60w6230khm5hyqgmp7z4rm8k8";
-
-  meta = with lib; {
-    description = "A stupid simple graphical login manager";
-    homepage = "https://git.sr.ht/~kennylevinsen/dlm";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/dmidecode/default.nix b/pkgs/os-specific/linux/dmidecode/default.nix
index a4e09492deb..f09dec758f7 100644
--- a/pkgs/os-specific/linux/dmidecode/default.nix
+++ b/pkgs/os-specific/linux/dmidecode/default.nix
@@ -1,63 +1,24 @@
-{ lib, stdenv, fetchurl, fetchpatch }:
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "dmidecode-3.2";
+  pname = "dmidecode";
+  version = "3.5";
 
   src = fetchurl {
-    url = "mirror://savannah/dmidecode/${name}.tar.xz";
-    sha256 = "1pcfhcgs2ifdjwp7amnsr3lq95pgxpr150bjhdinvl505px0cw07";
+    url = "mirror://savannah/dmidecode/dmidecode-${version}.tar.xz";
+    sha256 = "sha256-eddnNe6OJRluKnIpZM+Wg/WglYFQNTeISyVrATicwHM=";
   };
 
-  patches = [
-    # suggested patches for 3.2 according to https://www.nongnu.org/dmidecode/
-    (fetchpatch {
-      name = "0001-fix_redfish_hostname_print_length.patch";
-      url = "https://git.savannah.gnu.org/cgit/dmidecode.git/patch/?id=fde47bb227b8fa817c88d7e10a8eb771c46de1df";
-      sha256 = "133nd0c72p68hnqs5m714167761r1pp6bd3kgbsrsrwdx40jlc3m";
-    })
-    (fetchpatch {
-      name = "0002-add_logical_non-volatile_device_to_memory_device_types.patch";
-      url = "https://git.savannah.gnu.org/cgit/dmidecode.git/patch/?id=74dfb854b8199ddb0a27e89296fa565f4706cb9d";
-      sha256 = "0wdpmlcwmqdyyrsmyis8jb7cx3q6fnqpdpc5xly663dj841jcvwh";
-    })
-    (fetchpatch {
-      name = "0003-only-scan-devmem-for-entry-point-on-x86.patch";
-      url = "https://git.savannah.gnu.org/cgit/dmidecode.git/patch/?id=e12ec26e19e02281d3e7258c3aabb88a5cf5ec1d";
-      sha256 = "1y2858n98bfa49syjinx911vza6mm7aa6xalvzjgdlyirhccs30i";
-    })
-    (fetchpatch {
-      name = "0004-fix_formatting_of_tpm_table_output.patch";
-      url = "https://git.savannah.gnu.org/cgit/dmidecode.git/patch/?id=1d0db85949a5bdd96375f6131d393a11204302a6";
-      sha256 = "11s8jciw7xf2668v79qcq2c9w2gwvm3dkcik8dl9v74p654y1nr8";
-    })
-    (fetchpatch {
-      name = "0005-fix_system-slot_information_for_pcie_ssd.patch";
-      url = "https://git.savannah.gnu.org/cgit/dmidecode.git/patch/?id=fd08479625b5845e4d725ab628628f7ebfccc407";
-      sha256 = "07l61wvsw1d8g14zzf6zm7l0ri9kkqz8j5n4h116qwhg1p2k49y4";
-    })
-    (fetchpatch {
-      name = "0006-print_type_33_name_unconditionally.patch";
-      url = "https://git.savannah.gnu.org/cgit/dmidecode.git/patch/?id=65438a7ec0f4cddccf810136da6f280bd148af71";
-      sha256 = "0gqz576ccxys0c8217spf1qmw9lxi9xalw85jjqwsi2bj1k6vy4n";
-    })
-    (fetchpatch {
-      name = "0007-dont_choke_on_invalid_processor_voltage.patch";
-      url = "https://git.savannah.gnu.org/cgit/dmidecode.git/patch/?id=5bb7eb173b72256f70c6b3f3916d7a444be93340";
-      sha256 = "1dkg4lq9kn2g1w5raz1gssn6zqk078zjqbnh9i32f822f727syhp";
-    })
-    (fetchpatch {
-      name = "0008-fix_the_alignment_of_type_25_name.patch";
-      url = "https://git.savannah.gnu.org/cgit/dmidecode.git/patch/?id=557c3c373a9992d45d4358a6a2ccf53b03276f39";
-      sha256 = "18hc91pk7civyqrlilg3kn2nmp2warhh49xlbzrwqi7hgipyf12z";
-    })
+  makeFlags = [
+    "prefix=$(out)"
+    "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
-  makeFlags = [ "prefix=$(out)" ];
-
   meta = with lib; {
     homepage = "https://www.nongnu.org/dmidecode/";
     description = "A tool that reads information about your system's hardware from the BIOS according to the SMBIOS/DMI standard";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
   };
 }
diff --git a/pkgs/os-specific/linux/dmraid/default.nix b/pkgs/os-specific/linux/dmraid/default.nix
index c1e0dfc5ae4..fa26f38941b 100644
--- a/pkgs/os-specific/linux/dmraid/default.nix
+++ b/pkgs/os-specific/linux/dmraid/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, fetchpatch, lvm2 }:
 
 stdenv.mkDerivation rec {
-  name = "dmraid-1.0.0.rc16";
+  pname = "dmraid";
+  version = "1.0.0.rc16";
 
   src = fetchurl {
-    url = "https://people.redhat.com/~heinzm/sw/dmraid/src/old/${name}.tar.bz2";
+    url = "https://people.redhat.com/~heinzm/sw/dmraid/src/old/dmraid-${version}.tar.bz2";
     sha256 = "0m92971gyqp61darxbiri6a48jz3wq3gkp8r2k39320z0i6w8jgq";
   };
 
@@ -34,6 +35,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ lvm2 ];
 
+  # Hand-written Makefile does not have full dependencies to survive
+  # parallel build:
+  #   tools/dmraid.c:12:10: fatal error: dmraid/dmraid.h: No such file
+  enableParallelBuilding = false;
+
   meta = {
     description = "Old-style RAID configuration utility";
     longDescription = ''
diff --git a/pkgs/os-specific/linux/dmtcp/default.nix b/pkgs/os-specific/linux/dmtcp/default.nix
index 50124a2bf45..6315d361ed6 100644
--- a/pkgs/os-specific/linux/dmtcp/default.nix
+++ b/pkgs/os-specific/linux/dmtcp/default.nix
@@ -1,16 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, bash, perl, python2 }:
-
-# There are fixes for python3 compatibility on master
+{ lib, stdenv, fetchFromGitHub, bash, perl, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "dmtcp";
-  version = "unstable-2021-03-01";
+  version = "unstable-2022-02-28";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "f999adbb8e88fe452a0e57ceb43b6eed7b4409f9";
-    sha256 = "sha256-codCHQui3fGfUZSNq8GuH4ad/GjD6I/S9rX83o8oFPc=";
+    rev = "133687764c6742906006a1d247e3b83cd860fa1d";
+    hash = "sha256-9Vr8IhoeATCfyt7Lp7kYe/7e87mFX9KMNGTqxJgIztE=";
   };
 
   dontDisableStatic = true;
@@ -30,7 +28,7 @@ stdenv.mkDerivation rec {
     substituteInPlace test/autotest.py \
       --replace /bin/bash ${bash}/bin/bash \
       --replace /usr/bin/perl ${perl}/bin/perl \
-      --replace /usr/bin/python ${python2}/bin/python \
+      --replace /usr/bin/python ${python3.interpreter} \
       --replace "os.environ['USER']" "\"nixbld1\"" \
       --replace "os.getenv('USER')" "\"nixbld1\""
   '';
diff --git a/pkgs/os-specific/linux/dpdk-kmods/default.nix b/pkgs/os-specific/linux/dpdk-kmods/default.nix
index a188336cbe5..a3e4f666386 100644
--- a/pkgs/os-specific/linux/dpdk-kmods/default.nix
+++ b/pkgs/os-specific/linux/dpdk-kmods/default.nix
@@ -1,16 +1,26 @@
-{ lib, stdenv, fetchzip, kernel }:
+{ lib, stdenv, fetchzip, fetchpatch, kernel }:
 
 stdenv.mkDerivation rec {
   pname = "dpdk-kmods";
-  version = "2021-04-21";
+  version = "2022-08-29";
 
   src = fetchzip {
-    url = "http://git.dpdk.org/dpdk-kmods/snapshot/dpdk-kmods-e13d7af77a1bf98757f85c3c4083f6ee6d0d2372.tar.xz";
-    sha256 = "sha256-8ysWT3X3rIyUAo4/QbkX7cQq5iFeU18/BPsmmWugcIc=";
+    url = "https://git.dpdk.org/dpdk-kmods/snapshot/dpdk-kmods-4a589f7bed00fc7009c93d430bd214ac7ad2bb6b.tar.xz";
+    sha256 = "sha256-l9asJuw2nl63I1BxK6udy2pNunRiMJxyoXeg9V5+WgI=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://git.launchpad.net/ubuntu/+source/dpdk-kmods/plain/debian/patches/0001-support-linux-5.18.patch?id=9d628c02c169d8190bc2cb6afd81e4d364c382cd";
+      sha256 = "sha256-j4kpx1DOnmf5lFxOhaVFNT7prEy1jrJERX2NFaybTPU=";
+    })
+  ];
+
   hardeningDisable = [ "pic" ];
 
+  makeFlags = kernel.makeFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
   KSRC = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -18,10 +28,9 @@ stdenv.mkDerivation rec {
   preBuild = "cd linux/igb_uio";
 
   installPhase = ''
-    make -C ${KSRC} M=$(pwd) modules_install
+    make -C ${KSRC} M=$(pwd) modules_install $makeFlags
   '';
 
-  INSTALL_MOD_PATH = placeholder "out";
   enableParallelBuilding = true;
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/dpdk/default.nix b/pkgs/os-specific/linux/dpdk/default.nix
index ca8905e6240..c92f40e3935 100644
--- a/pkgs/os-specific/linux/dpdk/default.nix
+++ b/pkgs/os-specific/linux/dpdk/default.nix
@@ -1,25 +1,32 @@
 { stdenv, lib
 , kernel
 , fetchurl
-, pkg-config, meson, ninja
-, libbsd, numactl, libbpf, zlib, libelf, jansson, openssl, libpcap
-, doxygen, python3
+, pkg-config, meson, ninja, makeWrapper
+, libbsd, numactl, libbpf, zlib, libelf, jansson, openssl, libpcap, rdma-core
+, doxygen, python3, pciutils
 , withExamples ? []
-, shared ? false }:
+, shared ? false
+, machine ? (
+    if stdenv.isx86_64 then "nehalem"
+    else if stdenv.isAarch64 then "generic"
+    else null
+  )
+}:
 
 let
   mod = kernel != null;
-  dpdkVersion = "21.05";
-in stdenv.mkDerivation rec {
+  dpdkVersion = "23.07";
+in stdenv.mkDerivation {
   pname = "dpdk";
   version = "${dpdkVersion}" + lib.optionalString mod "-${kernel.version}";
 
   src = fetchurl {
     url = "https://fast.dpdk.org/rel/dpdk-${dpdkVersion}.tar.xz";
-    sha256 = "sha256-HhJJm0xfzbV8g+X+GE6mvs3ffPCSiTwsXvLvsO7BLws=";
+    sha256 = "sha256-4IYU6K65KUB9c9cWmZKJpE70A0NSJx8JOX7vkysjs9Y=";
   };
 
   nativeBuildInputs = [
+    makeWrapper
     doxygen
     meson
     ninja
@@ -31,16 +38,27 @@ in stdenv.mkDerivation rec {
   buildInputs = [
     jansson
     libbpf
-    libbsd
     libelf
     libpcap
     numactl
     openssl.dev
     zlib
+    python3
   ] ++ lib.optionals mod kernel.moduleBuildDependencies;
 
+  propagatedBuildInputs = [
+    # Propagated to support current DPDK users in nixpkgs which statically link
+    # with the framework (e.g. odp-dpdk).
+    rdma-core
+    # Requested by pkg-config.
+    libbsd
+  ];
+
   postPatch = ''
     patchShebangs config/arm buildtools
+  '' + lib.optionalString mod ''
+    # kernel_install_dir is hardcoded to `/lib/modules`; patch that.
+    sed -i "s,kernel_install_dir *= *['\"].*,kernel_install_dir = '$kmod/lib/modules/${kernel.modDirVersion}'," kernel/linux/meson.build
   '';
 
   mesonFlags = [
@@ -50,28 +68,27 @@ in stdenv.mkDerivation rec {
   ]
   # kni kernel driver is currently not compatble with 5.11
   ++ lib.optional (mod && kernel.kernelOlder "5.11") "-Ddisable_drivers=kni"
-  ++ lib.optional (!shared) "-Ddefault_library=static"
-  ++ lib.optional stdenv.isx86_64 "-Dmachine=nehalem"
-  ++ lib.optional mod "-Dkernel_dir=${placeholder "kmod"}/lib/modules/${kernel.modDirVersion}"
+  ++ [(if shared then "-Ddefault_library=shared" else "-Ddefault_library=static")]
+  ++ lib.optional (machine != null) "-Dmachine=${machine}"
+  ++ lib.optional mod "-Dkernel_dir=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ++ lib.optional (withExamples != []) "-Dexamples=${builtins.concatStringsSep "," withExamples}";
 
-  # dpdk meson script does not support separate kernel source and installion
-  # dirs (except via destdir), so we temporarily link the former into the latter.
-  preConfigure = lib.optionalString mod ''
-    mkdir -p $kmod/lib/modules/${kernel.modDirVersion}
-    ln -sf ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build \
-      $kmod/lib/modules/${kernel.modDirVersion}
-  '';
-
-  postBuild = lib.optionalString mod ''
-    rm -f $kmod/lib/modules/${kernel.modDirVersion}/build
-  '';
+  postInstall = ''
+    # Remove Sphinx cache files. Not only are they not useful, but they also
+    # contain store paths causing spurious dependencies.
+    rm -rf $out/share/doc/dpdk/html/.doctrees
 
-  postInstall = lib.optionalString (withExamples != []) ''
-    find examples -type f -executable -exec install {} $out/bin \;
+    wrapProgram $out/bin/dpdk-devbind.py \
+      --prefix PATH : "${lib.makeBinPath [ pciutils ]}"
+  '' + lib.optionalString (withExamples != []) ''
+    mkdir -p $examples/bin
+    find examples -type f -executable -exec install {} $examples/bin \;
   '';
 
-  outputs = [ "out" ] ++ lib.optional mod "kmod";
+  outputs =
+    [ "out" "doc" ]
+    ++ lib.optional mod "kmod"
+    ++ lib.optional (withExamples != []) "examples";
 
   meta = with lib; {
     description = "Set of libraries and drivers for fast packet processing";
@@ -79,5 +96,6 @@ in stdenv.mkDerivation rec {
     license = with licenses; [ lgpl21 gpl2 bsd2 ];
     platforms =  platforms.linux;
     maintainers = with maintainers; [ magenbluten orivej mic92 zhaofengli ];
+    broken = mod && kernel.isHardened;
   };
 }
diff --git a/pkgs/os-specific/linux/dracut/default.nix b/pkgs/os-specific/linux/dracut/default.nix
new file mode 100644
index 00000000000..c6bf684f7fc
--- /dev/null
+++ b/pkgs/os-specific/linux/dracut/default.nix
@@ -0,0 +1,114 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, gitUpdater
+, makeBinaryWrapper
+, pkg-config
+, asciidoc
+, libxslt
+, docbook_xsl
+, bash
+, kmod
+, binutils
+, bzip2
+, coreutils
+, cpio
+, findutils
+, gnugrep
+, gnused
+, gnutar
+, gzip
+, lz4
+, lzop
+, squashfsTools
+, util-linux
+, xz
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dracut";
+  version = "059";
+
+  src = fetchFromGitHub {
+    owner = "dracutdevs";
+    repo = "dracut";
+    rev = version;
+    hash = "sha256-zSyC2SnSQkmS/mDpBXG2DtVVanRRI9COKQJqYZZCPJM=";
+  };
+
+  strictDeps = true;
+
+  buildInputs = [
+    bash
+    kmod
+  ];
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    pkg-config
+    asciidoc
+    libxslt
+    docbook_xsl
+  ];
+
+  postPatch = ''
+    substituteInPlace dracut.sh \
+      --replace 'dracutbasedir="$dracutsysrootdir"/usr/lib/dracut' 'dracutbasedir="$dracutsysrootdir"'"$out/lib/dracut"
+    substituteInPlace lsinitrd.sh \
+      --replace 'dracutbasedir=/usr/lib/dracut' "dracutbasedir=$out/lib/dracut"
+
+    echo 'DRACUT_VERSION=${version}' >dracut-version.sh
+  '';
+
+  preConfigure = ''
+    patchShebangs ./configure
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/dracut --prefix PATH : ${lib.makeBinPath [
+      coreutils
+      util-linux
+    ]} --suffix DRACUT_PATH : ${lib.makeBinPath [
+      bash
+      binutils
+      coreutils
+      findutils
+      gnugrep
+      gnused
+      gnutar
+      stdenv.cc.libc  # for ldd command
+      util-linux
+    ]}
+    wrapProgram $out/bin/dracut-catimages --set PATH ${lib.makeBinPath [
+      coreutils
+      cpio
+      findutils
+      gzip
+    ]}
+    wrapProgram $out/bin/lsinitrd --set PATH ${lib.makeBinPath [
+      binutils
+      bzip2
+      coreutils
+      cpio
+      gnused
+      gzip
+      lz4
+      lzop
+      squashfsTools
+      util-linux
+      xz
+      zstd
+    ]}
+  '';
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    homepage = "https://github.com/dracutdevs/dracut/wiki";
+    description = "An event driven initramfs infrastructure";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ lilyinstarlight ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/drbd/default.nix b/pkgs/os-specific/linux/drbd/default.nix
index ae3e986e14a..0c5acd0ac06 100644
--- a/pkgs/os-specific/linux/drbd/default.nix
+++ b/pkgs/os-specific/linux/drbd/default.nix
@@ -1,48 +1,128 @@
-{ lib, stdenv, fetchurl, flex, systemd, perl }:
+{ lib
+, stdenv
+, docbook_xml_dtd_44
+, docbook_xml_dtd_45
+, docbook_xsl
+, asciidoctor
+, fetchurl
+, flex
+, kmod
+, libxslt
+, nixosTests
+, perl
+, systemd
+
+# drbd-utils are compiled twice, once with forOCF = true to extract
+# its OCF definitions for use in the ocf-resource-agents derivation,
+# then again with forOCF = false, where the ocf-resource-agents is
+# provided as the OCF_ROOT.
+, forOCF ? false
+, ocf-resource-agents
+}:
 
 stdenv.mkDerivation rec {
-  name = "drbd-8.4.4";
+  pname = "drbd";
+  version = "9.19.1";
 
   src = fetchurl {
-    url = "http://oss.linbit.com/drbd/8.4/${name}.tar.gz";
-    sha256 = "1w4889h1ak7gy9w33kd4fgjlfpgmp6hzfya16p1pkc13bjf22mm0";
+    url = "https://pkg.linbit.com/downloads/drbd/utils/${pname}-utils-${version}.tar.gz";
+    sha256 = "1l99kcrb0j85wxxmrdihpx9bk1a4sdi7wlp5m1x5l24k8ck1m5cf";
   };
 
-  patches = [ ./pass-force.patch ./fix-glibc-compilation.patch ];
+  nativeBuildInputs = [
+    flex
+    libxslt
+    docbook_xsl
+    asciidoctor
+  ];
 
-  nativeBuildInputs = [ flex ];
-  buildInputs = [ perl ];
+  buildInputs = [
+    perl
+    # perlPackages.Po4a used by ja documentation
+  ];
 
   configureFlags = [
-    "--without-distro"
-    "--without-pacemaker"
+    "--libdir=${placeholder "out"}/lib"
+    "--sbindir=${placeholder "out"}/bin"
     "--localstatedir=/var"
     "--sysconfdir=/etc"
+    "--without-distro"
   ];
 
-  preConfigure =
-    ''
-      export PATH=${systemd}/sbin:$PATH
-      substituteInPlace user/Makefile.in \
-        --replace /sbin '$(sbindir)'
-      substituteInPlace user/legacy/Makefile.in \
-        --replace '$(DESTDIR)/lib/drbd' '$(DESTDIR)$(LIBDIR)'
-      substituteInPlace user/drbdadm_usage_cnt.c --replace /lib/drbd $out/lib/drbd
-      substituteInPlace scripts/drbd.rules --replace /usr/sbin/drbdadm $out/sbin/drbdadm
-    '';
-
-  makeFlags = [ "SHELL=${stdenv.shell}" ];
+  makeFlags = [
+    "SOURCE_DATE_EPOCH=1"
+    "WANT_DRBD_REPRODUCIBLE_BUILD=1"
+  ] ++ lib.optional (!forOCF) "OCF_ROOT=${ocf-resource-agents}/usr/lib/ocf}";
 
   installFlags = [
-    "localstatedir=$(TMPDIR)/var"
-    "sysconfdir=$(out)/etc"
-    "INITDIR=$(out)/etc/init.d"
+    "prefix="
+    "DESTDIR=${placeholder "out"}"
+    "localstatedir=/var"
+    "DRBD_LIB_DIR=/var/lib"
+    "INITDIR=/etc/init.d"
+    "udevrulesdir=/etc/udev/rules.d"
+    "sysconfdir=/etc"
+    "sbindir=/bin"
+    "datadir="
+    "LIBDIR=/lib/drbd"
+    "mandir=/share/man"
   ];
 
+  postPatch = ''
+    patchShebangs .
+    substituteInPlace user/v84/drbdadm_usage_cnt.c \
+      --replace '"/lib/drbd");' \
+                '"${placeholder "out"}/lib/drbd");'
+    substituteInPlace user/v9/drbdsetup_linux.c \
+      --replace 'ret = system("/sbin/modprobe drbd");' \
+                'ret = system("${kmod}/bin/modprobe drbd");'
+    substituteInPlace user/v84/drbdsetup.c \
+      --replace 'system("/sbin/modprobe drbd")' \
+                'system("${kmod}/bin/modprobe drbd")'
+    substituteInPlace documentation/ra2refentry.xsl \
+      --replace "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" \
+                "${docbook_xml_dtd_44}/xml/dtd/docbook/docbookx.dtd"
+    function patch_docbook45() {
+      substituteInPlace $1 \
+        --replace "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" \
+                  "${docbook_xml_dtd_45}/xml/dtd/docbook/docbookx.dtd"
+    }
+    patch_docbook45 documentation/v9/drbd.conf.xml.in
+    patch_docbook45 documentation/v9/drbdsetup.xml.in
+    patch_docbook45 documentation/v84/drbdsetup.xml
+    patch_docbook45 documentation/v84/drbd.conf.xml
+    # The ja documentation is disabled because:
+    # make[1]: Entering directory '/build/drbd-utils-9.16.0/documentation/ja/v84'
+    # /nix/store/wyx2nn2pjcn50lc95c6qgsgm606rn0x2-perl5.32.1-po4a-0.62/bin/po4a-translate -f docbook -M utf-8 -L utf-8 -keep 0 -m ../../v84/drbdsetup.xml -p drbdsetup.xml.po -l drbdsetup.xml
+    # Use of uninitialized value $args[1] in sprintf at /nix/store/wyx2nn2pjcn50lc95c6qgsgm606rn0x2-perl5.32.1-po4a-0.62/lib/perl5/site_perl/Locale/Po4a/Common.pm line 134.
+    # Invalid po file drbdsetup.xml.po:
+    substituteInPlace Makefile.in \
+      --replace 'DOC_DIRS    := documentation/v9 documentation/ja/v9' \
+                'DOC_DIRS    := documentation/v9' \
+      --replace 'DOC_DIRS    += documentation/v84 documentation/ja/v84' \
+                'DOC_DIRS    += documentation/v84' \
+      --replace '$(MAKE) -C documentation/ja/v9 doc' \
+                "" \
+      --replace '$(MAKE) -C documentation/ja/v84 doc' \
+                ""
+    substituteInPlace user/v9/drbdtool_common.c \
+      --replace 'add_component_to_path("/lib/drbd");' \
+                'add_component_to_path("${placeholder "out"}/lib/drbd");'
+  '';
+
+  preConfigure = ''
+    export PATH=${systemd}/sbin:$PATH
+  '';
+
+  enableParallelBuilding = true;
+
+  passthru.tests.drbd = nixosTests.drbd;
+
   meta = with lib; {
-    homepage = "http://www.drbd.org/";
-    description = "Distributed Replicated Block Device, a distributed storage system for Linux";
-    license = licenses.gpl2;
+    homepage = "https://linbit.com/drbd/";
+    description = "Distributed Replicated Block Device, a distributed storage system for Linux (userspace utilities)";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ ryantm astro ];
   };
 }
diff --git a/pkgs/os-specific/linux/drbd/fix-glibc-compilation.patch b/pkgs/os-specific/linux/drbd/fix-glibc-compilation.patch
deleted file mode 100644
index 621a2dd995d..00000000000
--- a/pkgs/os-specific/linux/drbd/fix-glibc-compilation.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-diff --git a/user/drbdadm_adjust.c b/user/drbdadm_adjust.c
-index cb23270..3a751ca 100644
---- a/user/drbdadm_adjust.c
-+++ b/user/drbdadm_adjust.c
-@@ -29,6 +29,7 @@
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <sys/wait.h>
-+#include <sys/sysmacros.h>
- #include <unistd.h>
- #include <fcntl.h>
- 
-diff --git a/user/legacy/drbdadm_adjust.c b/user/legacy/drbdadm_adjust.c
-index c79163c..6990ffb 100644
---- a/user/legacy/drbdadm_adjust.c
-+++ b/user/legacy/drbdadm_adjust.c
-@@ -27,6 +27,7 @@
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <sys/wait.h>
-+#include <sys/sysmacros.h>
- #include <unistd.h>
- #include <fcntl.h>
- 
diff --git a/pkgs/os-specific/linux/drbd/pass-force.patch b/pkgs/os-specific/linux/drbd/pass-force.patch
deleted file mode 100644
index 8f0201100f7..00000000000
--- a/pkgs/os-specific/linux/drbd/pass-force.patch
+++ /dev/null
@@ -1,15 +0,0 @@
-Propagate the --force flag in the legacy drbdadm to drbdsetup.
-Otherwise "drbdadm primary --force" won't work as expected (the kernel
-will say "State change failed: Need access to UpToDate data").
-
-diff -ru -x '*~' drbd-8.4.0-orig/user/legacy/drbdadm_main.c drbd-8.4.0/user/legacy/drbdadm_main.c
---- drbd-8.4.0-orig/user/legacy/drbdadm_main.c	2011-07-07 06:55:39.000000000 -0400
-+++ drbd-8.4.0/user/legacy/drbdadm_main.c	2011-11-02 14:51:04.000000000 -0400
-@@ -1547,6 +1547,7 @@
- 	for (i = 0; i < soi; i++) {
- 		argv[NA(argc)] = setup_opts[i];
- 	}
-+	if (force) argv[NA(argc)] = "--force";
- 	argv[NA(argc)] = 0;
- 
- 	setenv("DRBD_RESOURCE", res->name, 1);
diff --git a/pkgs/os-specific/linux/dropwatch/default.nix b/pkgs/os-specific/linux/dropwatch/default.nix
index c2701c05719..470b5901870 100644
--- a/pkgs/os-specific/linux/dropwatch/default.nix
+++ b/pkgs/os-specific/linux/dropwatch/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dropwatch";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "nhorman";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0axx0zzrs7apqnl0r70jyvmgk7cs5wk185id479mapgngibwkyxy";
+    sha256 = "sha256-TbhgcX5WzuigP5/Mj5JuK7O/UKcu70D7dcOcvo4fxeQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/earlyoom/default.nix b/pkgs/os-specific/linux/earlyoom/default.nix
index 930e9381bb7..ad7468bac0f 100644
--- a/pkgs/os-specific/linux/earlyoom/default.nix
+++ b/pkgs/os-specific/linux/earlyoom/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, pandoc, installShellFiles, withManpage ? false }:
+{ lib, stdenv, fetchFromGitHub, pandoc, installShellFiles, withManpage ? false, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "earlyoom";
-  version = "1.6.2";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = "earlyoom";
     rev = "v${version}";
-    sha256 = "16iyn51xlrsbshc7p5xl2338yyfzknaqc538sa7mamgccqwgyvvq";
+    sha256 = "sha256-8YcT1TTlAet7F1U9Ginda4IApNqkudegOXqm8rnRGfc=";
   };
 
   nativeBuildInputs = lib.optionals withManpage [ pandoc installShellFiles ];
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
     installManPage earlyoom.1
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) earlyoom;
+  };
+
   meta = with lib; {
     description = "Early OOM Daemon for Linux";
     homepage = "https://github.com/rfjakob/earlyoom";
diff --git a/pkgs/os-specific/linux/ebtables/default.nix b/pkgs/os-specific/linux/ebtables/default.nix
index bca24d9c905..31a5dbd68f9 100644
--- a/pkgs/os-specific/linux/ebtables/default.nix
+++ b/pkgs/os-specific/linux/ebtables/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     "LOCALSTATEDIR=/var"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   preInstall = "mkdir -p $out/etc/sysconfig";
 
diff --git a/pkgs/os-specific/linux/edac-utils/default.nix b/pkgs/os-specific/linux/edac-utils/default.nix
index 63c539602f1..6171f8ed307 100644
--- a/pkgs/os-specific/linux/edac-utils/default.nix
+++ b/pkgs/os-specific/linux/edac-utils/default.nix
@@ -2,7 +2,8 @@
 , sysfsutils, dmidecode, kmod }:
 
 stdenv.mkDerivation {
-  name = "edac-utils-2015-01-07";
+  pname = "edac-utils";
+  version = "unstable-2015-01-07";
 
   src = fetchFromGitHub {
     owner = "grondo";
diff --git a/pkgs/os-specific/linux/ell/default.nix b/pkgs/os-specific/linux/ell/default.nix
index a43b9eff3c8..789a59f751f 100644
--- a/pkgs/os-specific/linux/ell/default.nix
+++ b/pkgs/os-specific/linux/ell/default.nix
@@ -3,18 +3,20 @@
 , autoreconfHook
 , pkg-config
 , dbus
+, sysctl
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "ell";
-  version = "0.41";
+  version = "0.59";
 
   outputs = [ "out" "dev" ];
 
   src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/libs/${pname}/${pname}.git";
+    url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     rev = version;
-    sha256 = "sha256-UCE+PgGmbePlOoAc8jXxCX6fHr16qf1AQMKxizfSTJM=";
+    hash = "sha256-uJcGYT+JSdz/XTyJb/VUyedmSKJW/4BbTM3fw3ebtIc=";
   };
 
   nativeBuildInputs = [
@@ -22,22 +24,32 @@ stdenv.mkDerivation rec {
     autoreconfHook
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     dbus
+    # required as the sysctl test works on some machines
+    sysctl
   ];
 
   enableParallelBuilding = true;
 
-  doCheck = true;
+  # tests sporadically fail on musl
+  doCheck = !stdenv.hostPlatform.isMusl;
+
+  passthru = {
+    updateScript = gitUpdater {
+      url = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
+    };
+  };
 
   meta = with lib; {
-    homepage = "https://01.org/ell";
+    homepage = "https://git.kernel.org/pub/scm/libs/ell/ell.git";
     description = "Embedded Linux Library";
     longDescription = ''
       The Embedded Linux* Library (ELL) provides core, low-level functionality for system daemons. It typically has no dependencies other than the Linux kernel, C standard library, and libdl (for dynamic linking). While ELL is designed to be efficient and compact enough for use on embedded Linux platforms, it is not limited to resource-constrained systems.
     '';
+    changelog = "https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ChangeLog?h=${version}";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ mic92 dtzWill maxeaubrey ];
+    maintainers = with maintainers; [ mic92 dtzWill amaxine ];
   };
 }
diff --git a/pkgs/os-specific/linux/ena/default.nix b/pkgs/os-specific/linux/ena/default.nix
index 1ff0b9a154a..b6ed869a71f 100644
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -1,33 +1,35 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
-  version = "2.5.0";
+  version = "2.8.9";
   name = "ena-${version}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "amzn";
     repo = "amzn-drivers";
     rev = "ena_linux_${version}";
-    sha256 = "sha256-uOf/1624UtjaZtrk7XyQpeUGdTNVDnzZJZMgU86i+SM=";
+    hash = "sha256-9Csrq9wM7Q99qPj7+NlnQgP6KcciNHMbAAb+Wg7eYAU=";
   };
 
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   # linux 3.12
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   configurePhase = ''
     runHook preConfigure
     cd kernel/linux/ena
+    export ENA_PHC_INCLUDE=1
     substituteInPlace Makefile --replace '/lib/modules/$(BUILD_KERNEL)' ${kernel.dev}/lib/modules/${kernel.modDirVersion}
     runHook postConfigure
   '';
 
   installPhase = ''
     runHook preInstall
-    strip -S ena.ko
+    $STRIP -S ena.ko
     dest=$out/lib/modules/${kernel.modDirVersion}/misc
     mkdir -p $dest
     cp ena.ko $dest/
@@ -39,8 +41,7 @@ stdenv.mkDerivation rec {
     description = "Amazon Elastic Network Adapter (ENA) driver for Linux";
     homepage = "https://github.com/amzn/amzn-drivers";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.eelco ];
+    maintainers = with maintainers; [ eelco sielicki ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.5";
   };
 }
diff --git a/pkgs/os-specific/linux/erofs-utils/default.nix b/pkgs/os-specific/linux/erofs-utils/default.nix
deleted file mode 100644
index 73e50c5740b..00000000000
--- a/pkgs/os-specific/linux/erofs-utils/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, fuse, libuuid, lz4 }:
-
-stdenv.mkDerivation rec {
-  pname = "erofs-utils";
-  version = "1.2.1";
-  outputs = [ "out" "man" ];
-
-  src = fetchgit {
-    url =
-      "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git";
-    rev = "v" + version;
-    sha256 = "1vb4mxsb59g29x7l22cffsqa8x743sra4j5zbmx89hjwpwm9vvcg";
-  };
-
-  buildInputs = [ autoreconfHook pkg-config fuse libuuid lz4 ];
-
-  configureFlags = [ "--enable-fuse" ];
-
-  meta = with lib; {
-    description = "Userspace utilities for linux-erofs file system";
-    license = with licenses; [ gpl2 ];
-    maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/error-inject/default.nix b/pkgs/os-specific/linux/error-inject/default.nix
new file mode 100644
index 00000000000..f4a54417217
--- /dev/null
+++ b/pkgs/os-specific/linux/error-inject/default.nix
@@ -0,0 +1,68 @@
+{ lib, stdenv, fetchgit
+, bison, flex, rasdaemon
+}:
+
+{
+  edac-inject = rasdaemon.inject;
+
+  mce-inject = stdenv.mkDerivation rec {
+    pname = "mce-inject";
+    version = "4cbe46321b4a81365ff3aafafe63967264dbfec5";
+
+    src = fetchgit {
+      url = "https://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git";
+      rev = version;
+      sha256 = "0gjapg2hrlxp8ssrnhvc19i3r1xpcnql7xv0zjgbv09zyha08g6z";
+    };
+
+    nativeBuildInputs = [ bison flex ];
+
+    makeFlags = [ "destdir=${placeholder "out"}" ];
+
+    postInstall = ''
+      mkdir $out/sbin
+      mv $out/usr/sbin/mce-inject $out/sbin/mce-inject
+
+      mkdir $out/test
+      cp test/* $out/test/.
+    '';
+
+    meta = with lib; {
+      description = "MCE error injection tool";
+      license = licenses.gpl2Only;
+      platforms = platforms.linux;
+      maintainers = [ maintainers.evils ];
+    };
+  };
+
+  aer-inject = stdenv.mkDerivation rec {
+    pname = "aer-inject";
+    version = "9bd5e2c7886fca72f139cd8402488a2235957d41";
+
+    src = fetchgit {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git";
+      rev = version;
+      sha256 = "0bh6mzpk2mr4xidkammmkfk21b4dbq793qjg25ryyxd1qv0c6cg4";
+    };
+
+    nativeBuildInputs = [ bison flex ];
+
+    # how is this necessary?
+    makeFlags = [ "DESTDIR=${placeholder "out"}" ];
+
+    postInstall = ''
+      mkdir $out/bin
+      mv $out/usr/local/aer-inject $out/bin/aer-inject
+
+      mkdir -p $out/examples
+      cp examples/* $out/examples/.
+    '';
+
+    meta = with lib; {
+      description = "PCIE AER error injection tool";
+      license = licenses.gpl2Only;
+      platforms = platforms.linux;
+      maintainers = [ maintainers.evils ];
+    };
+  };
+}
diff --git a/pkgs/os-specific/linux/esdm/default.nix b/pkgs/os-specific/linux/esdm/default.nix
new file mode 100644
index 00000000000..150e3b95b4f
--- /dev/null
+++ b/pkgs/os-specific/linux/esdm/default.nix
@@ -0,0 +1,129 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, protobufc
+, pkg-config
+, fuse3
+, meson
+, ninja
+, libselinux
+, jitterentropy
+, botan3
+, openssl
+, libkcapi
+
+# A more detailed explaination of the following meson build options can be found
+# in the source code of esdm.
+# A brief explanation is given.
+
+# general options
+, selinux ? false # enable selinux support
+, drngHashDrbg ? true  # set the default drng callback
+, drngChaCha20 ? false # set the default drng callback
+, ais2031 ? false # set the seeding strategy to be compliant with AIS 20/31
+, sp80090c ? false # set compliance with NIST SP800-90C
+, cryptoBackend ? "botan" # set backend for hash and drbg operations
+, linuxDevFiles ? true # enable linux /dev/random and /dev/urandom support
+, linuxGetRandom ? true # enable linux getrandom support
+, hashSha512 ? false # set the conditioning hash: SHA2-512
+, hashSha3_512 ? true # set the conditioning hash: SHA3-512
+, openSSLRandProvider ? true # build ESDM provider for OpenSSL 3.x
+, botanRng ? true # build ESDM class for Botan 3.x
+
+# client-related options (handle with care, consult source code and meson options)
+# leave as is if in doubt
+, connectTimeoutExponent ? 28 # (1 << EXPONENT nanoseconds)
+, rxTxTimeoutExponent ? 28 # (1 << EXPONENT nanoseconds)
+, reconnectAttempts ? 10 # how often to attempt unix socket connection before giving up
+
+# entropy sources
+, esJitterRng ? true # enable support for the entropy source: jitter rng (running in user space)
+, esJitterRngEntropyRate ? 256 # amount of entropy to account for jitter rng source
+, esJitterRngKernel ? true # enable support for the entropy source: jitter rng (running in kernel space)
+, esJitterRngKernelEntropyRate ? 256 # amount of entropy to account for kernel jitter rng source
+, esCPU ? true # enable support for the entropy source: cpu-based entropy
+, esCPUEntropyRate ? 8 # amount of entropy to account for cpu rng source
+, esKernel ? true # enable support for the entropy source: kernel-based entropy
+, esKernelEntropyRate ? 128 # amount of entropy to account for kernel-based source
+, esIRQ ? false # enable support for the entropy source: interrupt-based entropy
+, esIRQEntropyRate ? 256 # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
+, esSched ? false # enable support for the entropy source: scheduler-based entropy
+, esSchedEntropyRate ? 0 # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
+, esHwrand ? true # enable support for the entropy source: /dev/hwrng
+, esHwrandEntropyRate ? 128 # amount of entropy to account for /dev/hwrng-based sources
+}:
+
+assert drngHashDrbg != drngChaCha20;
+assert hashSha512 != hashSha3_512;
+assert cryptoBackend == "openssl" || cryptoBackend == "botan" || cryptoBackend == "builtin" "Unsupported ESDM crypto backend";
+
+stdenv.mkDerivation rec {
+  pname = "esdm";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "smuellerDD";
+    repo = "esdm";
+    rev = "v${version}";
+    sha256 = "sha256-q6TGL1agltV9CFfcA6hZszVwGIBBngs22ZqhQgc9FeM=";
+  };
+
+  nativeBuildInputs = [ meson pkg-config ninja ];
+  buildInputs = [ protobufc ]
+    ++ lib.optional (cryptoBackend == "botan" || botanRng) botan3
+    ++ lib.optional (cryptoBackend == "openssl" || openSSLRandProvider) openssl
+    ++ lib.optional selinux libselinux
+    ++ lib.optional esJitterRng jitterentropy
+    ++ lib.optional linuxDevFiles fuse3
+    ++ lib.optional esJitterRngKernel libkcapi;
+
+  mesonFlags = [
+    (lib.mesonBool "b_lto" false)
+    (lib.mesonBool "fips140" false)
+    (lib.mesonBool "ais2031" ais2031)
+    (lib.mesonBool "sp80090c" sp80090c)
+    (lib.mesonEnable "node" true) # multiple DRNGs
+    (lib.mesonOption "threading_max_threads" (toString 64))
+    (lib.mesonOption "crypto_backend" cryptoBackend)
+    (lib.mesonEnable "linux-devfiles" linuxDevFiles)
+    (lib.mesonEnable "linux-getrandom" linuxGetRandom)
+    (lib.mesonOption "client-connect-timeout-exponent" (toString connectTimeoutExponent))
+    (lib.mesonOption "client-rx-tx-timeout-exponent" (toString rxTxTimeoutExponent))
+    (lib.mesonOption "client-reconnect-attempts" (toString reconnectAttempts))
+    (lib.mesonEnable "es_jent" esJitterRng)
+    (lib.mesonOption "es_jent_entropy_rate" (toString esJitterRngEntropyRate))
+    (lib.mesonEnable "es_jent_kernel" esJitterRngKernel)
+    (lib.mesonOption "es_jent_kernel_entropy_rate" (toString esJitterRngKernelEntropyRate))
+    (lib.mesonEnable "es_cpu" esCPU)
+    (lib.mesonOption "es_cpu_entropy_rate" (toString esCPUEntropyRate))
+    (lib.mesonEnable "es_kernel" esKernel)
+    (lib.mesonOption "es_kernel_entropy_rate" (toString esKernelEntropyRate))
+    (lib.mesonEnable "es_irq" esIRQ)
+    (lib.mesonOption "es_irq_entropy_rate" (toString esIRQEntropyRate))
+    (lib.mesonEnable "es_sched" esSched)
+    (lib.mesonOption "es_sched_entropy_rate" (toString esSchedEntropyRate))
+    (lib.mesonEnable "es_hwrand" esHwrand)
+    (lib.mesonOption "es_hwrand_entropy_rate" (toString esHwrandEntropyRate))
+    (lib.mesonEnable "hash_sha512" hashSha512)
+    (lib.mesonEnable "hash_sha3_512" hashSha3_512)
+    (lib.mesonEnable "selinux" selinux)
+    (lib.mesonEnable "drng_hash_drbg" drngHashDrbg)
+    (lib.mesonEnable "drng_chacha20" drngChaCha20)
+    (lib.mesonEnable "openssl-rand-provider" openSSLRandProvider)
+    (lib.mesonEnable "botan-rng" botanRng)
+  ];
+
+  doCheck = true;
+
+  strictDeps = true;
+  mesonBuildType = "release";
+
+  meta = {
+    homepage = "https://www.chronox.de/esdm.html";
+    description = "Entropy Source and DRNG Manager in user space";
+    license = with lib.licenses; [ gpl2Only bsd3 ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ orichter thillux ];
+  };
+}
diff --git a/pkgs/os-specific/linux/ethq/default.nix b/pkgs/os-specific/linux/ethq/default.nix
new file mode 100644
index 00000000000..f966e285471
--- /dev/null
+++ b/pkgs/os-specific/linux/ethq/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, lib, fetchFromGitHub, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "ethq";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "isc-projects";
+    repo = "ethq";
+    rev = "refs/tags/v${builtins.replaceStrings ["."] ["_"] version}";
+    hash = "sha256-luvvNdH4kERAMy242kLCqlnGmfPjSjvoHa6J2J7BFi4=";
+  };
+
+  buildInputs = [ ncurses ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -m0755 ethq $out/bin/ethq
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Ethernet NIC Queue stats viewer";
+    homepage = "https://github.com/isc-projects/ethq";
+    license = licenses.mpl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
+  };
+}
diff --git a/pkgs/os-specific/linux/eudev/default.nix b/pkgs/os-specific/linux/eudev/default.nix
deleted file mode 100644
index c8562cc5f3c..00000000000
--- a/pkgs/os-specific/linux/eudev/default.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{lib, stdenv, fetchurl, pkg-config, glib, gperf, util-linux, kmod}:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="eudev";
-    version = "3.2.10";
-    name="${baseName}-${version}";
-    url="http://dev.gentoo.org/~blueness/eudev/eudev-${version}.tar.gz";
-    sha256 = "sha256-h7sCjUcP0bhRaTSbRMVdW3M3M9wtUN3xGW4CZyXq0DQ=";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    glib gperf util-linux kmod
-  ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit nativeBuildInputs buildInputs;
-  src = fetchurl {
-    inherit (s) url sha256;
-  };
-  patches = [
-  ];
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-  ];
-  makeFlags = [
-    "hwdb_bin=/var/lib/udev/hwdb.bin"
-    "udevrulesdir=/etc/udev/rules.d"
-    ];
-
-  preInstall = ''
-    # Disable install-exec-hook target as it conflicts with our move-sbin setup-hook
-    sed -i 's;$(MAKE) $(AM_MAKEFLAGS) install-exec-hook;$(MAKE) $(AM_MAKEFLAGS);g' src/udev/Makefile
-  '';
-
-  installFlags =
-    [
-    "localstatedir=$(TMPDIR)/var"
-    "sysconfdir=$(out)/etc"
-    "udevconfdir=$(out)/etc/udev"
-    "udevhwdbbin=$(out)/var/lib/udev/hwdb.bin"
-    "udevhwdbdir=$(out)/var/lib/udev/hwdb.d"
-    "udevrulesdir=$(out)/var/lib/udev/rules.d"
-    ];
-  enableParallelBuilding = true;
-  meta = {
-    inherit (s) version;
-    description = "An udev fork by Gentoo";
-    license = lib.licenses.gpl2Plus ;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
-    homepage = "https://www.gentoo.org/proj/en/eudev/";
-    downloadPage = "http://dev.gentoo.org/~blueness/eudev/";
-    updateWalker = true;
-  };
-}
diff --git a/pkgs/os-specific/linux/evdi/default.nix b/pkgs/os-specific/linux/evdi/default.nix
index 5eb31e9422d..bd34ac0db4d 100644
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -1,34 +1,32 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel, libdrm }:
+{ lib, stdenv, fetchFromGitHub, kernel, libdrm, python3 }:
 
+let
+  python3WithLibs = python3.withPackages (ps: with ps; [
+    pybind11
+  ]);
+in
 stdenv.mkDerivation rec {
   pname = "evdi";
-  version = "unstable-2021-06-11";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "DisplayLink";
     repo = pname;
-    rev = "65e12fca334f2f42396f4e8d16592d53cab34dd6";
-    sha256 = "sha256-81IfdYKadKT7vRdkmxzfGo4KHa4UJ8uJ0K6djQCr22U=";
+    rev = "v${version}";
+    hash = "sha256-em3Y56saB7K3Wr31Y0boc38xGb57gdveN0Cstgy8y20=";
   };
 
-  # Linux 5.13 support
-  # The patches break compilation for older kernels
-  patches = lib.optional (kernel.kernelAtLeast "5.13") [
-    (fetchpatch {
-      url = "https://github.com/DisplayLink/evdi/commit/c5f5441d0a115d2cfc8125b8bafaa05b2edc7938.patch";
-      sha256 = "sha256-tWYgBrRh3mXPebhUygOvJ07V87g9JU66hREriACfEVI=";
-    })
-    (fetchpatch {
-      url = "https://github.com/DisplayLink/evdi/commit/5f04d2e2df4cfd21dc15d31f1152c6a66fa48a78.patch";
-      sha256 = "sha256-690/eUiEVWvnT/YAVgKcLo86dgolF9giWRuPxXpL+eQ=";
-    })
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error"
+    "-Wno-error=discarded-qualifiers" # for Linux 4.19 compatibility
+    "-Wno-error=sign-compare"
   ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  buildInputs = [ kernel libdrm ];
+  buildInputs = [ kernel libdrm python3WithLibs ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KVER=${kernel.modDirVersion}"
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
@@ -40,12 +38,15 @@ stdenv.mkDerivation rec {
     install -Dm755 library/libevdi.so $out/lib/libevdi.so
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
+    changelog = "https://github.com/DisplayLink/evdi/releases/tag/v${version}";
     description = "Extensible Virtual Display Interface";
-    maintainers = with maintainers; [ eyjhb ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
     license = with licenses; [ lgpl21Only gpl2Only ];
     homepage = "https://www.displaylink.com/";
-    broken = kernel.kernelOlder "4.19" || stdenv.isAarch64;
+    broken = kernel.kernelOlder "4.19" || kernel.kernelAtLeast "6.6";
   };
 }
diff --git a/pkgs/os-specific/linux/eventstat/default.nix b/pkgs/os-specific/linux/eventstat/default.nix
index 55b00ab8719..2c139cd3c86 100644
--- a/pkgs/os-specific/linux/eventstat/default.nix
+++ b/pkgs/os-specific/linux/eventstat/default.nix
@@ -1,22 +1,28 @@
-{ stdenv, lib, fetchzip, ncurses }:
+{ stdenv, lib, fetchFromGitHub, ncurses }:
 
 stdenv.mkDerivation rec {
   pname = "eventstat";
-  version = "0.04.12";
-  src = fetchzip {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/eventstat/eventstat-${version}.tar.gz";
-    sha256 = "sha256-XBSs/jZodCpI9BHgAF8+bE23gRCr2uebYiMJxxB8T5E=";
+  version = "0.05.01";
+
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    hash = "sha256-raODDA1EKtZThFg0NV6EfrWj5mSQNaiekywfOfAvYXI=";
   };
+
   buildInputs = [ ncurses ];
-  installFlags = [ "DESTDIR=$(out)" ];
-  postInstall = ''
-    mv $out/usr/* $out
-    rm -r $out/usr
-  '';
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
+  ];
+
   meta = with lib; {
     description = "Simple monitoring of system events";
+    homepage = "https://github.com/ColinIanKing/eventstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/exfat/default.nix b/pkgs/os-specific/linux/exfat/default.nix
index 958bcdb9f16..3d2445df498 100644
--- a/pkgs/os-specific/linux/exfat/default.nix
+++ b/pkgs/os-specific/linux/exfat/default.nix
@@ -1,15 +1,6 @@
 { stdenv, lib, fetchFromGitHub, fetchpatch, kernel }:
 
-
-# Upstream build for kernel 4.1 is broken, 3.12 and below seems to be working
-assert lib.versionAtLeast kernel.version  "4.2" || lib.versionOlder kernel.version "4.0";
-
 stdenv.mkDerivation rec {
-  # linux kernel above 5.7 comes with its own exfat implementation https://github.com/arter97/exfat-linux/issues/27
-  # Assertion moved here due to some tests unintenionally triggering it,
-  # e.g. nixosTests.kernel-latest; it's unclear how/why so far.
-  assertion = assert lib.versionOlder kernel.version "5.8"; null;
-
   name = "exfat-nofuse-${version}-${kernel.version}";
   version = "2020-04-15";
 
@@ -27,7 +18,7 @@ stdenv.mkDerivation rec {
   makeFlags = [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
@@ -41,5 +32,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl2;
     maintainers = with lib.maintainers; [ makefu ];
     platforms = lib.platforms.linux;
+    broken = true;
   };
 }
diff --git a/pkgs/os-specific/linux/extrace/default.nix b/pkgs/os-specific/linux/extrace/default.nix
index 8a02d9c67b1..e4afe6f8503 100644
--- a/pkgs/os-specific/linux/extrace/default.nix
+++ b/pkgs/os-specific/linux/extrace/default.nix
@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "extrace";
-  version = "0.7";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "leahneukirchen";
     repo = "extrace";
     rev = "v${version}";
-    sha256 = "0acspj3djspfvgr3ng5b61qws6v2md6b0lc5qkby10mqnfpkvq85";
+    hash = "sha256-Jy/Ac3NcqBkW0kHyypMAVUGAQ41qWM96BbLAym06ogM=";
   };
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   postInstall = ''
     install -dm755 "$out/share/licenses/extrace/"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/leahneukirchen/extrace";
     description = "Trace exec() calls system-wide";
-    license = with licenses; [ gpl2 bsd2 ];
+    license = with licenses; [ gpl2Plus bsd2 ];
     platforms = platforms.linux;
     maintainers = [ maintainers.leahneukirchen ];
   };
diff --git a/pkgs/os-specific/linux/facetimehd/default.nix b/pkgs/os-specific/linux/facetimehd/default.nix
index 163001638cd..3bb656e8cb0 100644
--- a/pkgs/os-specific/linux/facetimehd/default.nix
+++ b/pkgs/os-specific/linux/facetimehd/default.nix
@@ -1,9 +1,9 @@
 { stdenv, lib, fetchFromGitHub, kernel }:
 
-# facetimehd is not supported for kernels older than 3.19";
-assert lib.versionAtLeast kernel.version "3.19";
+stdenv.mkDerivation rec {
+  name = "facetimehd-${version}-${kernel.version}";
+  version = "0.5.18";
 
-let
   # Note: When updating this revision:
   # 1. Also update pkgs/os-specific/linux/firmware/facetimehd-firmware/
   # 2. Test the module and firmware change via:
@@ -14,29 +14,11 @@ let
   #    e. see if the module loads back (apps using the camera won't
   #       recover and will have to be restarted) and the camera
   #       still works.
-  srcParams = if (lib.versionAtLeast kernel.version "4.8") then
-    { # Use mainline branch
-      version = "unstable-2020-04-16";
-      rev = "82626d4892eeb9eb704538bf0dc49a00725ff451";
-      sha256 = "118z6vjvhhcwvs4n3sgwwdagys9w718b8nkh6l9ic93732vv7cqx";
-    }
-  else
-    { # Use master branch (broken on 4.8)
-      version = "unstable-2016-05-02";
-      rev = "5a7083bd98b38ef3bd223f7ee531d58f4fb0fe7c";
-      sha256 = "0d455kajvn5xav9iilqy7s1qvsy4yb8vzjjxx7bvcgp7aj9ljvdp";
-    }
-  ;
-in
-
-stdenv.mkDerivation rec {
-  name = "facetimehd-${version}-${kernel.version}";
-  version = srcParams.version;
-
   src = fetchFromGitHub {
     owner = "patjak";
-    repo = "bcwc_pcie";
-    inherit (srcParams) rev sha256;
+    repo = "facetimehd";
+    rev = version;
+    sha256 = "sha256-UO8t2zrfdJlu4uzhhyWOuHIjJNVezIq3nUPGZeW/KJU=";
   };
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/fan2go/default.nix b/pkgs/os-specific/linux/fan2go/default.nix
new file mode 100644
index 00000000000..c7176183018
--- /dev/null
+++ b/pkgs/os-specific/linux/fan2go/default.nix
@@ -0,0 +1,31 @@
+{ buildGoModule, fetchFromGitHub, lib, lm_sensors }:
+
+buildGoModule rec {
+  pname = "fan2go";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "markusressel";
+    repo = pname;
+    rev = version;
+    hash = "sha256-w2Qwu3ZmBkoA86xa7V6pnIBAbfG9mtkAHePkQjefRW8=";
+  };
+
+  vendorHash = "sha256-6OEdl7ie0dTjXrG//Fvcg4ZyTW/mhrUievDljY2zi/4=";
+
+  postConfigure = ''
+    substituteInPlace vendor/github.com/md14454/gosensors/gosensors.go \
+      --replace '"/etc/sensors3.conf"' '"${lm_sensors}/etc/sensors3.conf"'
+  '';
+
+  CGO_CFLAGS = "-I ${lm_sensors}/include";
+  CGO_LDFLAGS = "-L ${lm_sensors}/lib";
+
+  meta = with lib; {
+    description = "A simple daemon providing dynamic fan speed control based on temperature sensors";
+    homepage = "https://github.com/markusressel/fan2go";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ mtoohey ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/fanctl/default.nix b/pkgs/os-specific/linux/fanctl/default.nix
new file mode 100644
index 00000000000..d8769b0f04d
--- /dev/null
+++ b/pkgs/os-specific/linux/fanctl/default.nix
@@ -0,0 +1,23 @@
+{ lib, fetchFromGitLab, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  version = "0.6.4";
+  pname = "fanctl";
+
+  src = fetchFromGitLab {
+    owner = "mcoffin";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-XmawybmqRJ9Lj6ii8TZBFwqdQZVp0pOLN4xiSLkU/bw=";
+  };
+
+  cargoSha256 = "sha256-tj00DXQEqC/8+3uzTMWcph+1fNTTVZLSJbV/5lLFkFs=";
+
+  meta = with lib; {
+    description = "Replacement for fancontrol with more fine-grained control interface in its config file";
+    homepage = "https://gitlab.com/mcoffin/fanctl";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ icewind1991 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/fanout/default.nix b/pkgs/os-specific/linux/fanout/default.nix
new file mode 100644
index 00000000000..3352f59a05f
--- /dev/null
+++ b/pkgs/os-specific/linux/fanout/default.nix
@@ -0,0 +1,37 @@
+{ lib, stdenv, fetchFromGitHub, kernel, kmod }:
+
+stdenv.mkDerivation rec {
+  pname = "fanout";
+  version = "unstable-2022-10-17-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "bob-linuxtoys";
+    repo = "fanout";
+    rev = "69b1cc69bf425d1a5f83b4e84d41272f1caa0144";
+    hash = "sha256-Q19c88KDFu0A6MejZgKYei9J2693EjRkKtR9hcRcHa0=";
+  };
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "modules_install" "INSTALL_MOD_PATH=$out modules_install"
+  '';
+
+  patches = [
+    ./remove_auto_mknod.patch
+  ];
+
+  hardeningDisable = [ "format" "pic" ];
+
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  meta = with lib; {
+    description = "Kernel-based publish-subscribe system";
+    homepage = "https://github.com/bob-linuxtoys/fanout";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ therishidesai ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch b/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch
new file mode 100644
index 00000000000..1f62e2b4633
--- /dev/null
+++ b/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch
@@ -0,0 +1,13 @@
+diff --git a/fanout.c b/fanout.c
+index f5d2a55..87125f4 100644
+--- a/fanout.c
++++ b/fanout.c
+@@ -13,7 +13,7 @@
+ /* Comment out to forgo the creation of /dev entries
+  * The companion udev rules 'fanout.rules' sets the special file mode
+  */
+-#define DEV_MKNOD
++// #define DEV_MKNOD
+ 
+ #include <linux/kernel.h>
+ #include <linux/module.h>
diff --git a/pkgs/os-specific/linux/fatrace/default.nix b/pkgs/os-specific/linux/fatrace/default.nix
index 2ae8bb2dca2..487ad533668 100644
--- a/pkgs/os-specific/linux/fatrace/default.nix
+++ b/pkgs/os-specific/linux/fatrace/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fatrace";
-  version = "0.16.3";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "martinpitt";
     repo = pname;
     rev = version;
-    sha256 = "sha256-w7leZPdmiTc+avihP203e6GLvbRzbCtNOJdF8MM2v68=";
+    sha256 = "sha256-MRHM+hyuRevK4L3u6dGw1S3O7w+BJBsprJVcSz6Q9xg=";
   };
 
   buildInputs = [ python3 which ];
diff --git a/pkgs/os-specific/linux/fbterm/default.nix b/pkgs/os-specific/linux/fbterm/default.nix
index 72e886b91f5..f762eca36be 100644
--- a/pkgs/os-specific/linux/fbterm/default.nix
+++ b/pkgs/os-specific/linux/fbterm/default.nix
@@ -1,61 +1,103 @@
-{stdenv, lib, fetchurl, gpm, freetype, fontconfig, pkg-config, ncurses, libx86}:
-let
-  s = # Generated upstream information
-  {
-    baseName="fbterm";
-    version="1.7.0";
-    name="fbterm-1.7.0";
-    hash="0pciv5by989vzvjxsv1jsv4bdp4m8j0nfbl29jm5fwi12w4603vj";
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/fbterm/fbterm-1.7.0.tar.gz";
-    sha256="0pciv5by989vzvjxsv1jsv4bdp4m8j0nfbl29jm5fwi12w4603vj";
-  };
-  buildInputs = [gpm freetype fontconfig ncurses]
-    ++ lib.optional (stdenv.isi686 || stdenv.isx86_64) libx86;
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  src = fetchurl {
-    inherit (s) url sha256;
+{ stdenv
+, autoreconfHook
+, fetchFromGitLab
+, fetchpatch
+, fetchurl
+, fontconfig
+, freetype
+, gpm
+, lib
+, ncurses
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  version = "1.7-2";
+  pname = "fbterm";
+
+  src = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "debian";
+    repo = pname;
+    rev = "debian/${version}";
+    hash = "sha256-vRUZgFpA1IkzkLzl7ImT+Yff5XqjFbUlkHmj/hd7XDE=";
   };
 
-  nativeBuildInputs = [ pkg-config ncurses ];
-  inherit buildInputs;
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    ncurses
+  ];
+  buildInputs = [
+    gpm
+    freetype
+    fontconfig
+    ncurses
+  ];
+
+  makeFlags = [
+    "AR:=$(AR)"
+  ];
 
-  preConfigure = ''
-    sed -e '/ifdef SYS_signalfd/atypedef long long loff_t;' -i src/fbterm.cpp
-    sed -e '/install-exec-hook:/,/^[^\t]/{d}; /.NOEXPORT/iinstall-exec-hook:\
-    ' -i src/Makefile.in
-    export HOME=$PWD;
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lfreetype"
+  # preConfigure = ''
+  #   sed -e '/ifdef SYS_signalfd/atypedef long long loff_t;' -i src/fbterm.cpp
+  #   sed -e '/install-exec-hook:/,/^[^\t]/{d}; /.NOEXPORT/iinstall-exec-hook:\
+  #   ' -i src/Makefile.in
+  #   export HOME=$PWD;
+  #   export NIX_LDFLAGS="$NIX_LDFLAGS -lfreetype"
+  # '';
+
+  preInstall = ''
+    export HOME=$PWD
   '';
-  preBuild = ''
+
+  postInstall =
+  let
+    fbtermrc = fetchurl {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fbtermrc?h=fbterm";
+      hash = "sha256-zNIfi2ZjEGc5PLdOIirKGTXESb5Wm5XBAI1sfHa31LY=";
+    };
+  in
+  ''
     mkdir -p "$out/share/terminfo"
     tic -a -v2 -o"$out/share/terminfo" terminfo/fbterm
-    makeFlagsArray+=("AR=$AR")
+
+    mkdir -p "$out/etc/fbterm"
+    cp "${fbtermrc}" "$out/etc/fbterm"
   '';
 
+  # Patches from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=fbterm
   patches = [
-    # fixes from Arch Linux package
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/glitsj16/fbterm-patched/d1fe03313be4654dd0a1c0bb5f51530732345134/gcc-6-build-fixes.patch";
-      sha256 = "1kl9fjnrri6pamjdl4jpkqxk5wxcf6jcchv5801xz8vxp4542m40";
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fbconfig.patch?h=fbterm";
+      hash = "sha256-skCdUqyMkkqxS1YUI7cofsfnNNo3SL/qe4WEIXlhm/s=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/color_palette.patch?h=fbterm";
+      hash = "sha256-SkWxzfapyBTtMpTXkiFHRAw8/uXw7cAWwg5Q3TqWlk8=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fbterm.patch?h=fbterm";
+      hash = "sha256-XNHBTGQGeaQPip2XgcKlr123VDwils2pnyiGqkBGhzU=";
+    })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/0001-Fix-build-with-gcc-6.patch?h=fbterm";
+      hash = "sha256-3d3zBvr5upICVVkd6tn63IhuB0sF67f62aKnf8KvOwg=";
     })
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/glitsj16/fbterm-patched/d1fe03313be4654dd0a1c0bb5f51530732345134/insertmode-fix.patch";
-      sha256 = "1bad9mqcfpqb94lpx23lsamlhplil73ahzin2xjva0gl3gr1038l";
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_ftbfs_crosscompile.patch?h=fbterm";
+      hash = "sha256-jv/FSG6dHR0jKjPXQIfqsvpiT/XYzwv/VwuV+qUSovM=";
     })
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/glitsj16/fbterm-patched/d1fe03313be4654dd0a1c0bb5f51530732345134/miscoloring-fix.patch";
-      sha256 = "1mjszji0jgs2jsagjp671fv0d1983wmxv009ff1jfhi9pbay6jd0";
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_ftbfs_epoll.patch?h=fbterm";
+      hash = "sha256-wkhfG0uY/5ZApcXTERkaKqz5IDpnilxUEcxull4645A=";
     })
-    ./select.patch
   ];
 
   meta = with lib; {
-    inherit (s) version;
     description = "Framebuffer terminal emulator";
-    homepage = "https://code.google.com/archive/p/fbterm/";
-    maintainers = [ maintainers.raskin ];
+    homepage = "https://salsa.debian.org/debian/fbterm";
+    maintainers = with maintainers; [ lovesegfault raskin ];
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index e23591168f6..3d44ad813a6 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -13,7 +13,7 @@
 , libxmlxx3
 , pkg-config
 , python3
-, sconsPackages
+, scons
 , which
 , wrapQtAppsHook
 }:
@@ -24,11 +24,11 @@ let
 in
 mkDerivation rec {
   pname = "ffado";
-  version = "2.4.3";
+  version = "2.4.7";
 
   src = fetchurl {
     url = "http://www.ffado.org/files/libffado-${version}.tgz";
-    sha256 = "08bygzv1k6ai0572gv66h7gfir5zxd9klfy74z2pxqp6s5hms58r";
+    sha256 = "0vsn3y52g6f77lqh9qfkd7dslmb7bbgy46cv5idynx4frqscc23s";
   };
 
   prePatch = ''
@@ -45,7 +45,7 @@ mkDerivation rec {
 
   nativeBuildInputs = [
     desktop-file-utils
-    sconsPackages.scons_3_1_2
+    scons
     pkg-config
     which
     python
diff --git a/pkgs/os-specific/linux/firejail/default.nix b/pkgs/os-specific/linux/firejail/default.nix
index 1a9b7e34f5a..64607c5653e 100644
--- a/pkgs/os-specific/linux/firejail/default.nix
+++ b/pkgs/os-specific/linux/firejail/default.nix
@@ -1,36 +1,58 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, which, xdg-dbus-proxy, nixosTests }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, pkg-config
+, libapparmor
+, which
+, xdg-dbus-proxy
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "firejail";
-  version = "0.9.66";
+  version = "0.9.72";
 
   src = fetchFromGitHub {
     owner = "netblue30";
     repo = "firejail";
     rev = version;
-    sha256 = "sha256-oKstTiGt0r4wePaZ9u1o78GZ1XWJ27aS0BdLxmfYk9Q=";
+    sha256 = "sha256-XAlb6SSyY2S1iWDaulIlghQ16OGvT/wBCog95/nxkog=";
   };
 
-  buildInputs = [ which ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libapparmor
+    which
+  ];
+
+  configureFlags = [
+    "--enable-apparmor"
+  ];
 
   patches = [
     # Adds the /nix directory when using an overlay.
     # Required to run any programs under this mode.
     ./mount-nix-dir-on-overlay.patch
+
     # By default fbuilder hardcodes the firejail binary to the install path.
     # On NixOS the firejail binary is a setuid wrapper available in $PATH.
     ./fbuilder-call-firejail-on-path.patch
   ];
 
   prePatch = ''
-    # Allow whitelisting ~/.nix-profile
-    substituteInPlace etc/firejail.config --replace \
-      '# follow-symlink-as-user yes' \
-      'follow-symlink-as-user no'
-
     # Fix the path to 'xdg-dbus-proxy' hardcoded in the 'common.h' file
     substituteInPlace src/include/common.h \
       --replace '/usr/bin/xdg-dbus-proxy' '${xdg-dbus-proxy}/bin/xdg-dbus-proxy'
+
+    # Workaround for regression introduced in 0.9.72 preventing usage of
+    # end-of-options indicator "--"
+    # See https://github.com/netblue30/firejail/issues/5659
+    substituteInPlace src/firejail/sandbox.c \
+      --replace " && !arg_doubledash" ""
   '';
 
   preConfigure = ''
@@ -59,7 +81,7 @@ stdenv.mkDerivation rec {
   # See https://github.com/netblue30/firejail/blob/e4cb6b42743ad18bd11d07fd32b51e8576239318/src/firejail/profile.c#L68-L83
   # for the profile file lookup implementation.
   postInstall = ''
-    for local in $(grep -Eh '^include.*local$' $out/etc/firejail/*.profile | awk '{print $2}' | sort | uniq)
+    for local in $(grep -Eh '^include.*local$' $out/etc/firejail/*{.inc,.profile} | awk '{print $2}' | sort | uniq)
     do
       echo "include /etc/firejail/$local" >$out/etc/firejail/$local
     done
diff --git a/pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patch b/pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patch
index 6016891655b..548bb80e7bf 100644
--- a/pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patch
+++ b/pkgs/os-specific/linux/firejail/fbuilder-call-firejail-on-path.patch
@@ -1,11 +1,11 @@
 --- a/src/fbuilder/build_profile.c
 +++ b/src/fbuilder/build_profile.c
-@@ -67,7 +67,7 @@
- 		errExit("asprintf");
- 
- 	char *cmdlist[] = {
--	  BINDIR "/firejail",
-+	  "firejail",
- 	  "--quiet",
- 	  "--noprofile",
- 	  "--caps.drop=all",
+@@ -48,7 +48,7 @@
+ 	// build command
+ 	char *cmd[len];
+ 	unsigned curr_len = 0;
+-	cmd[curr_len++] = BINDIR "/firejail";
++	cmd[curr_len++] = "firejail";
+ 	cmd[curr_len++] = "--quiet";
+ 	cmd[curr_len++] = "--noprofile";
+ 	cmd[curr_len++] = "--caps.drop=all";
diff --git a/pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patch b/pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patch
index 685314f9075..6493eb4fdf2 100644
--- a/pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patch
+++ b/pkgs/os-specific/linux/firejail/mount-nix-dir-on-overlay.patch
@@ -1,6 +1,6 @@
---- a/src/firejail/fs.c
-+++ b/src/firejail/fs.c
-@@ -1143,6 +1143,16 @@
+--- a/src/firejail/fs_overlayfs.c
++++ b/src/firejail/fs_overlayfs.c
+@@ -327,6 +327,16 @@
  		errExit("mounting /dev");
  	fs_logger("whitelist /dev");
  
@@ -17,7 +17,7 @@
  	// mount-bind run directory
  	if (arg_debug)
  		printf("Mounting /run\n");
-@@ -1201,6 +1211,7 @@
+@@ -384,6 +394,7 @@
  	free(odiff);
  	free(owork);
  	free(dev);
diff --git a/pkgs/os-specific/linux/firmware/ath9k/default.nix b/pkgs/os-specific/linux/firmware/ath9k/default.nix
new file mode 100644
index 00000000000..ab342d68c13
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/ath9k/default.nix
@@ -0,0 +1,154 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchFromGitHub
+, m4
+, cmake
+, perl
+, writeScript
+, enableUnstable ? false
+}:
+
+let
+  stableVersion = "1.4.0";
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ath9k-htc-blobless-firmware";
+  version = if enableUnstable then "unstable-2022-05-22" else stableVersion;
+
+  src = fetchFromGitHub ({
+    owner = "qca";
+    repo = "open-ath9k-htc-firmware";
+  } // (if enableUnstable then {
+    rev = "d856466a068afe4069335257c0d28295ff777d92";
+    hash = "sha256-9OE6qYGABeXjf1r/Depd+811EJ2e8I0Ni5ePHSOh9G4=";
+  } else {
+    rev = finalAttrs.version;
+    hash = "sha256-Q/A0ryIC5E1pt2Sh7o79gxHbe4OgdlrwflOWtxWSS5o=";
+  }));
+
+  postPatch = ''
+    patchShebangs target_firmware/firmware-crc.pl
+  '';
+
+  nativeBuildInputs = [ m4 cmake perl ];
+
+  env.NIX_CFLAGS_COMPILE = "-w";  # old libiberty emits fatal warnings
+
+  dontUseCmakeConfigure = true;
+  enableParallelBuilding = true;
+
+  # The firmware repository builds its own toolchain, with patches
+  # applied to the xtensa support in both gcc and binutils.
+  preBuild =
+    let
+      inherit (lib) toUpper splitString last listToAttrs pipe;
+      inherit (builtins) map;
+      urls-and-hashes = import (./. + "/urls-and-hashes-${finalAttrs.version}.nix");
+      make-links = pipe
+        [ "gcc" "binutils" "gmp" "mpfr" "mpc" ]
+        [ (map (vname: fetchurl rec {
+            url = urls-and-hashes."${(toUpper vname) + "_URL"}";
+            sha256 = urls-and-hashes."${(toUpper vname) + "_SUM"}" or "";
+            name = last (splitString "/" url);
+          }))
+          (map (v: "ln -sT ${v} toolchain/dl/${v.name}"))
+          (lib.concatStringsSep "\n")
+        ];
+    in ''
+      mkdir -p toolchain/dl
+      ${make-links}
+    '';
+
+  makeTargets = [ "toolchain" "firmware" ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt "$out/lib/firmware/ath9k_htc/" target_firmware/*.fw
+    # make symlinks so that firmware will be automatically found
+    ln -s htc_7010.fw "$out/lib/firmware/ath9k_htc/htc_7010-${stableVersion}.fw"
+    ln -s htc_9271.fw "$out/lib/firmware/ath9k_htc/htc_9271-${stableVersion}.fw"
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit (finalAttrs) src;
+    updateScript = writeScript "${finalAttrs.pname}-${finalAttrs.version}-updateScript" ''
+      nix-shell '<nixpkgs>' -A ${finalAttrs.pname}${lib.optionalString enableUnstable "-unstable"}.passthru.update \
+      > pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-${finalAttrs.version}.nix
+    '';
+    update = stdenv.mkDerivation {
+      name = "${finalAttrs.pname}-${finalAttrs.version}-update";
+      shellHook = ''
+        echo 'rec {'
+        echo '  BASEDIR="$NIX_BUILD_TOP";'
+        make --dry-run --print-data-base -f ${finalAttrs.src}/Makefile download \
+          | egrep    '^[A-Z]+_(VER|URL|SUM|DIR) = ' \
+          | sed 's_\([^ ]*\) = \(.*\)_\1 = "\2\";_' \
+          | tr \( \{ \
+          | tr \) \}
+      ''
+      # sha256 checksums were not added to upstream's Makefile until
+      # after the 1.4.0 release.  The following line is needed for
+      # the `enableUnstable==false` build but not for the
+      # `enableUnstable==true` build.  We can remove the lines below
+      # as soon as `enableUnstable==false` points to a version
+      # greater than 1.4.0.
+      + lib.optionalString (finalAttrs.version == "1.4.0") ''
+        echo 'GCC_SUM = "sha256-kuYcbcOgpEnmLXKjgYX9pVAWioZwLeoHEl69PsOZYoI=";'
+        echo 'MPFR_SUM = "sha256-e2bD8T3IOF8IJkyAWFPz4aju2rgHHVgvPmYZccms1f0=";'
+        echo 'MPC_SUM = "sha256-7VqBXP6lJdx3jfDLN0aLnBtVSq8w2TKLFDHKcFt0AP8=";'
+        echo 'GMP_SUM = "sha256-H1iKrMxBu5rtlG+f44Uhwm2LKQ0APF34B/ZWkPKq3sk=";'
+        echo 'BINUTILS_SUM = "sha256-KrLlsD4IbRLGKV+DGtrUaz4UEKOiNJM6Lo+sZssuehk=";'
+      '' + ''
+        echo '}'
+        exit
+      '';
+    };
+  };
+
+  meta = {
+    description = "Blobless, open source wifi firmware for ath9k_htc.ko";
+    longDescription = ''
+      Firmware for Qualcomm Atheros cards which use the ath9k_htc.ko
+      Linux driver, supporting 802.11 abgn on both 2.4ghz and 5ghz
+      bands, 3x3-antenna MIMO, up to 600mbit/sec.
+
+      Most devices which use this driver are based on the Qualcomm
+      Atheros AR9271 chip, which is a PCIe device.  If your device
+      is connected via USB, it will also include a Qualcomm Atheros
+      AR7010, which bridges from a USB gadget interface to a PCIe
+      host interface.  This repository includes the firmware for
+      both chips.
+
+      This firmware is completely open source with no blobs, which
+      is quite rare in the wifi world.  Wifi chips have their own
+      dedicated general-purpose CPUs.  This source code allows you
+      to see what those CPUs are doing and modify their behavior.
+    '';
+    license = with lib.licenses; [ # see NOTICE.txt for details
+      bsd3                # almost everything; "the ClearBSD licence"
+      gpl2ClasspathPlus   # **/*cmnos_printf.c, only three files
+      mit                 # **/xtos, **/xtensa
+    ];
+
+    # release 1.4.0 vendors a GMP which uses an ancient version of
+    # autotools that does not work on aarch64 or powerpc.
+    # However, enableUnstable (unreleased upstream) works.
+    /*
+    # disabled until #195294 is merged
+    badPlatforms =
+      with lib.systems.inspect.patterns;
+      lib.optionals (!enableUnstable && lib.versionOlder finalAttrs.version "1.4.1") [
+        isAarch64
+        isPower64
+      ];
+    */
+
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    homepage = "http://lists.infradead.org/mailman/listinfo/ath9k_htc_fw";
+    downloadPage = "https://github.com/qca/open-ath9k-htc-firmware";
+    changelog = "https://github.com/qca/open-ath9k-htc-firmware/tags";
+  };
+})
diff --git a/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix b/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix
new file mode 100644
index 00000000000..d67669c93b3
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix
@@ -0,0 +1,26 @@
+rec {
+  BASEDIR="$NIX_BUILD_TOP";
+BINUTILS_URL = "https://ftp.gnu.org/gnu/binutils/binutils-${BINUTILS_VER}.tar.bz2";
+DL_DIR = "${TOOLCHAIN_DIR}/dl";
+GMP_URL = "https://ftp.gnu.org/gnu/gmp/gmp-${GMP_VER}.tar.bz2";
+GCC_URL = "https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/gcc-${GCC_VER}.tar.bz2";
+BINUTILS_DIR = "binutils-${BINUTILS_VER}";
+GCC_VER = "4.7.4";
+MPFR_URL = "https://ftp.gnu.org/gnu/mpfr/mpfr-${MPFR_VER}.tar.bz2";
+MPC_VER = "1.0.1";
+GMP_DIR = "gmp-${GMP_VER}";
+MPC_URL = "https://ftp.gnu.org/gnu/mpc/mpc-${MPC_VER}.tar.gz";
+GCC_DIR = "gcc-${GCC_VER}";
+MPFR_DIR = "mpfr-${MPFR_VER}";
+MPC_DIR = "mpc-${MPC_VER}";
+MPFR_VER = "3.1.1";
+GMP_VER = "5.0.5";
+BINUTILS_VER = "2.23.1";
+BUILD_DIR = "${TOOLCHAIN_DIR}/build";
+TOOLCHAIN_DIR = "${BASEDIR}/toolchain";
+GCC_SUM = "sha256-kuYcbcOgpEnmLXKjgYX9pVAWioZwLeoHEl69PsOZYoI=";
+MPFR_SUM = "sha256-e2bD8T3IOF8IJkyAWFPz4aju2rgHHVgvPmYZccms1f0=";
+MPC_SUM = "sha256-7VqBXP6lJdx3jfDLN0aLnBtVSq8w2TKLFDHKcFt0AP8=";
+GMP_SUM = "sha256-H1iKrMxBu5rtlG+f44Uhwm2LKQ0APF34B/ZWkPKq3sk=";
+BINUTILS_SUM = "sha256-KrLlsD4IbRLGKV+DGtrUaz4UEKOiNJM6Lo+sZssuehk=";
+}
diff --git a/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix b/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix
new file mode 100644
index 00000000000..4234f91ef97
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix
@@ -0,0 +1,26 @@
+rec {
+  BASEDIR="$NIX_BUILD_TOP";
+BINUTILS_URL = "https://ftp.gnu.org/gnu/binutils/binutils-${BINUTILS_VER}.tar.bz2";
+DL_DIR = "${TOOLCHAIN_DIR}/dl";
+GMP_SUM = "f51c99cb114deb21a60075ffb494c1a210eb9d7cb729ed042ddb7de9534451ea";
+GMP_URL = "https://ftp.gnu.org/gnu/gmp/gmp-${GMP_VER}.tar.bz2";
+GCC_URL = "https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/gcc-${GCC_VER}.tar.gz";
+BINUTILS_DIR = "binutils-${BINUTILS_VER}";
+GCC_VER = "10.2.0";
+MPFR_URL = "https://ftp.gnu.org/gnu/mpfr/mpfr-${MPFR_VER}.tar.bz2";
+MPC_VER = "1.1.0";
+GMP_DIR = "gmp-${GMP_VER}";
+MPC_URL = "https://ftp.gnu.org/gnu/mpc/mpc-${MPC_VER}.tar.gz";
+GCC_DIR = "gcc-${GCC_VER}";
+MPC_SUM = "6985c538143c1208dcb1ac42cedad6ff52e267b47e5f970183a3e75125b43c2e";
+GCC_SUM = "27e879dccc639cd7b0cc08ed575c1669492579529b53c9ff27b0b96265fa867d";
+BINUTILS_SUM = "7d24660f87093670738e58bcc7b7b06f121c0fcb0ca8fc44368d675a5ef9cff7";
+MPFR_DIR = "mpfr-${MPFR_VER}";
+MPC_DIR = "mpc-${MPC_VER}";
+MPFR_VER = "4.1.0";
+GMP_VER = "6.2.0";
+BINUTILS_VER = "2.35";
+BUILD_DIR = "${TOOLCHAIN_DIR}/build";
+MPFR_SUM = "feced2d430dd5a97805fa289fed3fc8ff2b094c02d05287fd6133e7f1f0ec926";
+TOOLCHAIN_DIR = "${BASEDIR}/toolchain";
+}
diff --git a/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix b/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
index 79de65fcb98..fe7a3e9ae40 100644
--- a/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
+++ b/pkgs/os-specific/linux/firmware/b43-firmware-cutter/default.nix
@@ -1,16 +1,20 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "b43-fwcutter-019";
+  pname = "b43-fwcutter";
+  version = "019";
 
   src = fetchurl {
-    url = "https://bues.ch/b43/fwcutter/${name}.tar.bz2";
+    url = "https://bues.ch/b43/fwcutter/b43-fwcutter-${version}.tar.bz2";
     sha256 = "1ki1f5fy3yrw843r697f8mqqdz0pbsbqnvg4yzkhibpn1lqqbsnn";
   };
 
   patches = [ ./no-root-install.patch ];
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [
+    "PREFIX=$(out)"
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
 
   meta = {
     description = "Firmware extractor for cards supported by the b43 kernel module";
diff --git a/pkgs/os-specific/linux/firmware/b43-firmware/5.1.138.nix b/pkgs/os-specific/linux/firmware/b43-firmware/5.1.138.nix
index 42444d784d5..a5683a1ce53 100644
--- a/pkgs/os-specific/linux/firmware/b43-firmware/5.1.138.nix
+++ b/pkgs/os-specific/linux/firmware/b43-firmware/5.1.138.nix
@@ -1,8 +1,8 @@
-{ lib, stdenv, fetchurl, b43FirmwareCutter }:
+{ lib, stdenvNoCC, fetchurl, b43FirmwareCutter }:
 
 let version = "5.100.138"; in
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = "b43-firmware";
   inherit version;
 
@@ -11,9 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0vz4ka8gycf72gmnaq61k8rh8y17j1wm2k3fidxvcqjvmix0drzi";
   };
 
-  buildInputs = [ b43FirmwareCutter ];
-
-  phases = [ "unpackPhase" "installPhase" ];
+  nativeBuildInputs = [ b43FirmwareCutter ];
 
   installPhase = ''
     mkdir -p $out/lib/firmware
@@ -22,8 +20,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Firmware for cards supported by the b43 kernel module";
-    homepage = "http://wireless.kernel.org/en/users/Drivers/b43";
+    homepage = "https://wireless.wiki.kernel.org/en/users/drivers/b43";
     license = lib.licenses.unfree;
   };
 }
-
diff --git a/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix b/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix
index c0226065ea2..e117db45b18 100644
--- a/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix
+++ b/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchurl, b43FirmwareCutter }:
+{ lib, stdenvNoCC, fetchurl, b43FirmwareCutter }:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "b43-firmware";
   version = "6.30.163.46";
 
@@ -9,20 +9,18 @@ stdenv.mkDerivation rec {
     sha256 = "0baw6gcnrhxbb447msv34xg6rmlcj0gm3ahxwvdwfcvq4xmknz50";
   };
 
-  buildInputs = [ b43FirmwareCutter ];
-
-  phases = [ "unpackPhase" "installPhase" ];
+  nativeBuildInputs = [ b43FirmwareCutter ];
 
   sourceRoot = ".";
 
   installPhase = ''
-    mkdir $out
-    b43-fwcutter -w $out *.wl_apsta.o
+    mkdir -p $out/lib/firmware
+    b43-fwcutter -w $out/lib/firmware *.wl_apsta.o
   '';
 
   meta = with lib; {
     description = "Firmware for cards supported by the b43 kernel module";
-    homepage = "http://wireless.kernel.org/en/users/Drivers/b43";
+    homepage = "https://wireless.wiki.kernel.org/en/users/drivers/b43";
     downloadPage = "http://www.lwfinger.com/b43-firmware";
     license = licenses.unfree;
   };
diff --git a/pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix b/pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix
index a0985cad0db..073d443bee4 100644
--- a/pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/broadcom-bt-firmware/default.nix
@@ -1,9 +1,6 @@
-{ lib, stdenv, fetchurl, cabextract, bt-fw-converter }:
+{ lib, stdenvNoCC, fetchurl, cabextract, bt-fw-converter }:
 
-# Kernels between 4.2 and 4.7 will not work with
-# this packages as they expect the firmware to be named "BCM.hcd"
-# see: https://github.com/NixOS/nixpkgs/pull/25478#issuecomment-299034865
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "broadcom-bt-firmware";
   version = "12.0.1.1012";
 
diff --git a/pkgs/os-specific/linux/firmware/facetimehd-calibration/default.nix b/pkgs/os-specific/linux/firmware/facetimehd-calibration/default.nix
new file mode 100644
index 00000000000..ca678268872
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/facetimehd-calibration/default.nix
@@ -0,0 +1,62 @@
+{ lib, stdenvNoCC, fetchurl, unrar-wrapper, pkgs }:
+
+let
+
+  version = "5.1.5769";
+
+
+  # Described on https://github.com/patjak/facetimehd/wiki/Extracting-the-sensor-calibration-files
+
+  # From the wiki page, range extracted with binwalk:
+  zipUrl = "https://download.info.apple.com/Mac_OS_X/031-30890-20150812-ea191174-4130-11e5-a125-930911ba098f/bootcamp${version}.zip";
+  zipRange = "2338085-3492508"; # the whole download is 518MB, this deflate stream is 1.2MB
+
+  # CRC and length from the ZIP entry header (not strictly necessary, but makes it extract cleanly):
+  gzFooter = ''\x51\x1f\x86\x78\xcf\x5b\x12\x00'';
+
+  # Also from the wiki page:
+  calibrationFiles = [
+    { file = "1771_01XX.dat"; offset = "1644880"; size = "19040"; }
+    { file = "1871_01XX.dat"; offset = "1606800"; size = "19040"; }
+    { file = "1874_01XX.dat"; offset = "1625840"; size = "19040"; }
+    { file = "9112_01XX.dat"; offset = "1663920"; size = "33060"; }
+  ];
+
+in
+
+stdenvNoCC.mkDerivation {
+
+  pname = "facetimehd-calibration";
+  inherit version;
+  src = fetchurl {
+    url = zipUrl;
+    sha256 = "1dzyv457fp6d8ly29sivqn6llwj5ydygx7p8kzvdnsp11zvid2xi";
+    curlOpts = "-r ${zipRange}";
+  };
+
+  dontUnpack = true;
+  dontInstall = true;
+
+  buildInputs = [ unrar-wrapper ];
+
+  buildPhase = ''
+    { printf '\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x00'
+      cat $src
+      printf '${gzFooter}'
+    } | zcat > AppleCamera64.exe
+    unrar x AppleCamera64.exe AppleCamera.sys
+
+    mkdir -p $out/lib/firmware/facetimehd
+  '' + lib.concatMapStrings ({file, offset, size}: ''
+    dd bs=1 skip=${offset} count=${size} if=AppleCamera.sys of=$out/lib/firmware/facetimehd/${file}
+  '') calibrationFiles;
+
+  meta = with lib; {
+    description = "facetimehd calibration";
+    homepage = "https://support.apple.com/kb/DL1837";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ alexshpilkin womfoo grahamc ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+
+}
diff --git a/pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix b/pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix
index 1c3d8fbbaf7..6679f1f19e7 100644
--- a/pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/facetimehd-firmware/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cpio, xz, pkgs }:
+{ lib, stdenvNoCC, fetchurl, cpio, xz, pkgs }:
 
 let
 
@@ -33,7 +33,7 @@ let
 
 in
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
 
   pname = "facetimehd-firmware";
   inherit version;
diff --git a/pkgs/os-specific/linux/firmware/firmware-manager/Cargo.lock b/pkgs/os-specific/linux/firmware/firmware-manager/Cargo.lock
new file mode 100644
index 00000000000..db5008fda79
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-manager/Cargo.lock
@@ -0,0 +1,4125 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "addr2line"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a76fd60b23679b7d19bd066031410fb7e458ccc5e958eb5c325888ce4baedc97"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+
+[[package]]
+name = "aho-corasick"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67fc08ce920c31afb70f013dcce1bfc3a3195de6a228474e45e1f145b36f8d04"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstream"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ca84f3628370c59db74ee214b3263d58f9aadd9b4fe7e711fd87dc452b7f163"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is-terminal",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41ed9a86bf92ae6580e0a31281f65a1b1d867c0cc68d5346e2ae128dddfa6a7d"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e765fd216e48e067936442276d1d57399e37bce53c264d6fefbe298080cb57ee"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca11d4be1bab0c8bc8734a9aa7bf4ee8316d462a08c6ac5052f888fef5b494b"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180abfa45703aebe0093f79badacc01b8fd4ea2e35118747e5811127f926e188"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.71"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c7d0618f0e0b7e8ff11427422b64564d5fb0be1940354bfe2e0529b18a9d9b8"
+
+[[package]]
+name = "apply"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f47b57fc4521e3cae26a4d45b5227f8fadee4c345be0fefd8d5d1711afb8aeb9"
+
+[[package]]
+name = "arc-swap"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bddcadddf5e9015d310179a59bb28c4d4b9920ad0f11e8e14dbadf654890c9a6"
+
+[[package]]
+name = "async-broadcast"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c48ccdbf6ca6b121e0f586cbc0e73ae440e56c67c30fa0873b4e110d9c26d2b"
+dependencies = [
+ "event-listener",
+ "futures-core",
+]
+
+[[package]]
+name = "async-channel"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf46fee83e5ccffc220104713af3292ff9bc7c64c7de289f66dae8e38d826833"
+dependencies = [
+ "concurrent-queue",
+ "event-listener",
+ "futures-core",
+]
+
+[[package]]
+name = "async-executor"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fa3dc5f2a8564f07759c008b9109dc0d39de92a88d5588b8a5036d286383afb"
+dependencies = [
+ "async-lock",
+ "async-task",
+ "concurrent-queue",
+ "fastrand",
+ "futures-lite",
+ "slab",
+]
+
+[[package]]
+name = "async-fs"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "279cf904654eeebfa37ac9bb1598880884924aab82e290aa65c9e77a0e142e06"
+dependencies = [
+ "async-lock",
+ "autocfg",
+ "blocking",
+ "futures-lite",
+]
+
+[[package]]
+name = "async-io"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fc5b45d93ef0529756f812ca52e44c221b35341892d3dcc34132ac02f3dd2af"
+dependencies = [
+ "async-lock",
+ "autocfg",
+ "cfg-if",
+ "concurrent-queue",
+ "futures-lite",
+ "log",
+ "parking",
+ "polling",
+ "rustix",
+ "slab",
+ "socket2",
+ "waker-fn",
+]
+
+[[package]]
+name = "async-lock"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa24f727524730b077666307f2734b4a1a1c57acb79193127dcc8914d5242dd7"
+dependencies = [
+ "event-listener",
+]
+
+[[package]]
+name = "async-recursion"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e97ce7de6cf12de5d7226c73f5ba9811622f4db3a5b91b55c53e987e5f91cba"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "async-task"
+version = "4.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc7ab41815b3c653ccd2978ec3255c81349336702dfdf62ee6f7069b12a3aae"
+
+[[package]]
+name = "async-trait"
+version = "0.1.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ccdd8f2a161be9bd5c023df56f1b2a0bd1d83872ae53b71a84a12c9bf6e842"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "atk"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c3d816ce6f0e2909a96830d6911c2aff044370b1ef92d7f267b43bae5addedd"
+dependencies = [
+ "atk-sys",
+ "bitflags",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "atk-sys"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58aeb089fb698e06db8089971c7ee317ab9644bade33383f63631437b03aafb6"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1181e1e0d1fce796a03db1ae795d67167da795f9cf4a39c37589e85ef57f26d3"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "backtrace"
+version = "0.3.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233d376d6d185f2a3093e58f283f60f880315b6c60075b01f36b3b85154564ca"
+dependencies = [
+ "addr2line",
+ "cc",
+ "cfg-if",
+ "libc",
+ "miniz_oxide 0.6.2",
+ "object",
+ "rustc-demangle",
+]
+
+[[package]]
+name = "base32"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23ce669cd6c8588f79e15cf450314f9638f967fc5770ff1c7c1deb0925ea7cfa"
+
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
+[[package]]
+name = "base64"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a4ddaa51a5bc52a6948f74c06d20aaaddb71924eab79b8c97a8c556e942d6a"
+
+[[package]]
+name = "better-panic"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fa9e1d11a268684cbd90ed36370d7577afb6c62d912ddff5c15fc34343e5036"
+dependencies = [
+ "backtrace",
+ "console",
+]
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "block"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d8c1fef690941d3e7788d328517591fecc684c084084702d6ff1641e993699a"
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "blocking"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77231a1c8f801696fc0123ec6150ce92cffb8e164a02afb9c8ddee0e9b65ad65"
+dependencies = [
+ "async-channel",
+ "async-lock",
+ "async-task",
+ "atomic-waker",
+ "fastrand",
+ "futures-lite",
+ "log",
+]
+
+[[package]]
+name = "buildchain"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e4ba006f08f732ddc25f629c349fbb89c67e6c90a4764ce04534d32a1940b0"
+dependencies = [
+ "base32",
+ "clap 3.2.25",
+ "lxd",
+ "plain",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2 0.10.6",
+ "sodalite",
+ "tempdir",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b1ce199063694f33ffb7dd4e0ee620741495c32833cde5aa08f02a0bf96f0c8"
+
+[[package]]
+name = "byteorder"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
+
+[[package]]
+name = "bytes"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89b2fd2a0dcf38d7971e2194b6b6eebab45ae01067456a7fd93d5547a61b70be"
+
+[[package]]
+name = "cairo-rs"
+version = "0.15.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c76ee391b03d35510d9fa917357c7f1855bd9a6659c95a1b392e33f49b3369bc"
+dependencies = [
+ "bitflags",
+ "cairo-sys-rs",
+ "glib",
+ "libc",
+ "thiserror",
+]
+
+[[package]]
+name = "cairo-sys-rs"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c55d429bef56ac9172d25fecb85dc8068307d17acd74b377866b7a1ef25d3c8"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "cascade"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d499b43edbf784dd81e16f0395f5b4350a35b477da8a074251087adefc11cb52"
+
+[[package]]
+name = "cc"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+
+[[package]]
+name = "cdylib-link-lines"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a317db7ea5b455731e51d7f632762716fa5c0b1098dcaa6221e55e2386d170f2"
+dependencies = [
+ "serde",
+ "serde_derive",
+ "toml 0.5.11",
+]
+
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8790cf1286da485c72cf5fc7aeba308438800036ec67d89425924c4807268c9"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+dependencies = [
+ "atty",
+ "bitflags",
+ "clap_derive",
+ "clap_lex 0.2.4",
+ "indexmap",
+ "once_cell",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap"
+version = "4.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a1f23fa97e1d1641371b51f35535cb26959b8e27ab50d167a8b996b5bada819"
+dependencies = [
+ "clap_builder",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fdc5d93c358224b4d6867ef1356d740de2303e9892edc06c5340daeccd96bab"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "bitflags",
+ "clap_lex 0.4.1",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae6371b8bdc8b7d3959e9cf7b22d4435ef3e79e138688421ec654acf8c81b008"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-error",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a2dd5a6fe8c6e3502f568a6353e5273bbb15193ad9a89e457b9970798efbea1"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+
+[[package]]
+name = "combine"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35ed6e9d84f0b51a7f52daf1c7d71dd136fd7a3f41a8462b8cdb8c78d920fad4"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
+[[package]]
+name = "commoncrypto"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d056a8586ba25a1e4d61cb090900e495952c7886786fc55f909ab2f819b69007"
+dependencies = [
+ "commoncrypto-sys",
+]
+
+[[package]]
+name = "commoncrypto-sys"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fed34f46747aa73dfaa578069fd8279d2818ade2b55f38f22a9401c7f4083e2"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62ec6771ecfa0762d24683ee5a32ad78487a3d3afdc0fb8cae19d2c5deb50b7c"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "console"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d79fbe8970a77e3e34151cc13d3b3e248aa0faaecb9f6091fa07ebefe5ad60"
+dependencies = [
+ "encode_unicode",
+ "lazy_static",
+ "libc",
+ "windows-sys 0.42.0",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e496a50fda8aacccc86d7529e2c1e0892dbd0f898a6b5645b5561b89c3210efa"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e4c1eaa2012c47becbbad2ab175484c2a84d1185b566fb2cc5b8707343dfe58"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c063cd8cc95f5c377ed0d4b49a4b21f632396ff690e8470c29b3359b346984b"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "crypto-hash"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a77162240fd97248d19a564a565eb563a3f592b386e4136fb300909e67dddca"
+dependencies = [
+ "commoncrypto",
+ "hex 0.3.2",
+ "openssl",
+ "winapi",
+]
+
+[[package]]
+name = "dashmap"
+version = "5.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "907076dfda823b0b36d2a1bb5f90c96660a5bbcd7729e10727f07858f22c4edc"
+dependencies = [
+ "cfg-if",
+ "hashbrown",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "dbus"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48b5f0f36f1eebe901b0e6bee369a77ed3396334bf3f09abd46454a576f71819"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bb21987b9fb1613058ba3843121dd18b163b254d8a6e797e144cbac14d96d1b"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "winapi",
+]
+
+[[package]]
+name = "dbus-crossroads"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a816e8ae3382c7b1bccfa6f2778346ee5b13f80e0eccf80cf8f2912af73995a"
+dependencies = [
+ "dbus 0.9.7",
+]
+
+[[package]]
+name = "derivative"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common",
+]
+
+[[package]]
+name = "dirs-next"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98cf8ebf19c3d1b223e151f99a4f9f0690dca41414773390fc824184ac833e1"
+dependencies = [
+ "cfg-if",
+ "dirs-sys-next",
+]
+
+[[package]]
+name = "dirs-sys-next"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ebda144c4fe02d1f7ea1a7d9641b6fc6b580adcfa024ae48797ecdeb6825b4d"
+dependencies = [
+ "libc",
+ "redox_users",
+ "winapi",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bf95dc3f046b9da4f2d51833c0d3547d8564ef6910f5c1ed130306a75b92886"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "ecflash"
+version = "0.1.0"
+source = "git+https://github.com/system76/ecflash.git?branch=stable#ee9d69d4edf3bee6b2fb6dddb021bb58ee3bbbbb"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "either"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+
+[[package]]
+name = "encode_unicode"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071a31f4ee85403370b58aca746f01041ede6f0da2730960ad001edc2b71b394"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "enum_derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "406ac2a8c9eedf8af9ee1489bee9e50029278a6456c740f7454cf8a158abc816"
+
+[[package]]
+name = "enumflags2"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c041f5090df68b32bcd905365fd51769c8b9d553fe87fde0b683534f10c01bd2"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e9a1f9f7d83e59740248a6e14ecf93929ade55027844dfcea78beafccc15745"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+dependencies = [
+ "errno-dragonfly",
+ "libc",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "errno-dragonfly"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
+[[package]]
+name = "failure"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d32e9bd16cc02eae7db7ef620b392808b89f6a5e16bb3497d159c6b92a0f4f86"
+dependencies = [
+ "backtrace",
+ "failure_derive",
+]
+
+[[package]]
+name = "failure_derive"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa4da3c766cd7a0db8242e326e9e4e081edd567072893ed320008189715366a4"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "synstructure",
+]
+
+[[package]]
+name = "fastrand"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51093e27b0797c359783294ca4f0a911c270184cb10f85783b118614a1501be"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "fern"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9f0c14694cbd524c8720dd69b0e3179344f04ebb5f90f2e4a440c6ea3b2f1ee"
+dependencies = [
+ "log",
+]
+
+[[package]]
+name = "field-offset"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3cf3a800ff6e860c863ca6d4b16fd999db8b752819c1606884047b73e468535"
+dependencies = [
+ "memoffset 0.8.0",
+ "rustc_version",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cbc844cecaee9d4443931972e1289c8ff485cb4cc2767cb03ca139ed6885153"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.2.16",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "find-crate"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59a98bbaacea1c0eb6a0876280051b892eb73594fd90cf3b20e9c817029c57d2"
+dependencies = [
+ "toml 0.5.11",
+]
+
+[[package]]
+name = "firmware-manager"
+version = "0.1.5"
+dependencies = [
+ "apply",
+ "better-panic",
+ "dashmap",
+ "futures",
+ "fwupd-dbus",
+ "human-sort",
+ "i18n-embed",
+ "i18n-embed-fl",
+ "log",
+ "once_cell",
+ "rust-embed",
+ "shrinkwraprs",
+ "slotmap",
+ "system76-firmware-daemon",
+ "thiserror",
+ "tokio",
+ "tokio-udev",
+ "users",
+ "xdg",
+]
+
+[[package]]
+name = "firmware-manager-gtk"
+version = "0.1.5"
+dependencies = [
+ "better-panic",
+ "cascade",
+ "clap 4.2.5",
+ "fern",
+ "firmware-manager",
+ "gdk",
+ "gio",
+ "glib",
+ "gtk",
+ "html2md",
+ "i18n-embed",
+ "i18n-embed-fl",
+ "log",
+ "once_cell",
+ "rust-embed",
+ "shrinkwraprs",
+ "slotmap",
+ "upower_dbus",
+ "yansi",
+]
+
+[[package]]
+name = "firmware-manager-gtk-ffi"
+version = "0.1.5"
+dependencies = [
+ "cdylib-link-lines",
+ "firmware-manager-gtk",
+ "glib",
+ "gtk",
+ "gtk-sys",
+ "i18n-embed",
+ "i18n-embed-fl",
+ "once_cell",
+ "rust-embed",
+]
+
+[[package]]
+name = "firmware-manager-notify"
+version = "0.1.5"
+dependencies = [
+ "firmware-manager",
+ "fomat-macros",
+ "i18n-embed",
+ "i18n-embed-fl",
+ "notify-rust",
+ "once_cell",
+ "rust-embed",
+]
+
+[[package]]
+name = "flate2"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b9429470923de8e8cbd4d2dc513535400b4b3fef0319fb5c4e1f520a7bef743"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide 0.7.1",
+]
+
+[[package]]
+name = "fluent"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61f69378194459db76abd2ce3952b790db103ceb003008d3d50d97c41ff847a7"
+dependencies = [
+ "fluent-bundle",
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-bundle"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e242c601dec9711505f6d5bbff5bedd4b61b2469f2e8bb8e57ee7c9747a87ffd"
+dependencies = [
+ "fluent-langneg",
+ "fluent-syntax",
+ "intl-memoizer",
+ "intl_pluralrules",
+ "rustc-hash",
+ "self_cell",
+ "smallvec",
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-langneg"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c4ad0989667548f06ccd0e306ed56b61bd4d35458d54df5ec7587c0e8ed5e94"
+dependencies = [
+ "unic-langid",
+]
+
+[[package]]
+name = "fluent-syntax"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0abed97648395c902868fee9026de96483933faa54ea3b40d652f7dfe61ca78"
+dependencies = [
+ "thiserror",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "fomat-macros"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f722aa875298d34a0ebb6004699f6f4ea830d36dec8ac2effdbbc840248a096"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "freedesktop-desktop-entry"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8f6c340bead95f07434f2432ab52ce048f290d93e42e3c63f416a364801e4bf"
+dependencies = [
+ "markup",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "futf"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df420e2e84819663797d1ec6544b13c5be84629e7bb00dc960d6917db2987843"
+dependencies = [
+ "mac",
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23342abe12aba583913b2e62f22225ff9c950774065e4bfb61a19cd9770fec40"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "955518d47e09b25bbebc7a18df10b81f0c766eaf4c4f1cccef2fca5f2a4fb5f2"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bca583b7e26f571124fe5b7561d49cb2868d79116cfa0eefce955557c6fee8c"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccecee823288125bd88b4d7f565c9e58e41858e47ab72e8ea2d64e93624386e0"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fff74096e71ed47f8e023204cfd0aa1289cd54ae5430a9523be060cdb849964"
+
+[[package]]
+name = "futures-lite"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49a9d51ce47660b1e808d3c990b4709f2f415d928835a17dfd16991515c46bce"
+dependencies = [
+ "fastrand",
+ "futures-core",
+ "futures-io",
+ "memchr",
+ "parking",
+ "pin-project-lite",
+ "waker-fn",
+]
+
+[[package]]
+name = "futures-macro"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89ca545a94061b6365f2c7355b4b32bd20df3ff95f02da9329b34ccc3bd6ee72"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f43be4fe21a13b9781a69afa4985b0f6ee0e1afab2c6f454a8cf30e2b2237b6e"
+
+[[package]]
+name = "futures-task"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76d3d132be6c0e6aa1534069c705a74a5997a356c0dc2f86a47765e5617c5b65"
+
+[[package]]
+name = "futures-util"
+version = "0.3.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "fwupd-dbus"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "740e23cb282f6e8e1aaa26b04553cdf04dbe9c6c18b94a8bdd7da0cc75c4c225"
+dependencies = [
+ "base64 0.13.1",
+ "bitflags",
+ "cascade",
+ "crypto-hash",
+ "dbus 0.9.7",
+ "hex-view",
+ "log",
+ "shrinkwraprs",
+ "thiserror",
+ "ureq",
+ "url",
+ "xdg",
+ "zbus",
+]
+
+[[package]]
+name = "gdk"
+version = "0.15.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6e05c1f572ab0e1f15be94217f0dc29088c248b14f792a5ff0af0d84bcda9e8"
+dependencies = [
+ "bitflags",
+ "cairo-rs",
+ "gdk-pixbuf",
+ "gdk-sys",
+ "gio",
+ "glib",
+ "libc",
+ "pango",
+]
+
+[[package]]
+name = "gdk-pixbuf"
+version = "0.15.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad38dd9cc8b099cceecdf41375bb6d481b1b5a7cd5cd603e10a69a9383f8619a"
+dependencies = [
+ "bitflags",
+ "gdk-pixbuf-sys",
+ "gio",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "gdk-pixbuf-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "140b2f5378256527150350a8346dbdb08fadc13453a7a2d73aecd5fab3c402a7"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gdk-sys"
+version = "0.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32e7a08c1e8f06f4177fb7e51a777b8c1689f743a7bc11ea91d44d2226073a88"
+dependencies = [
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c85e1d9ab2eadba7e5040d4e09cbd6d072b76a557ad64e797c2cb9d4da21d7e4"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "gimli"
+version = "0.27.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad0a93d233ebf96623465aad4046a8d3aa4da22d4f4beba5388838c8a434bbb4"
+
+[[package]]
+name = "gio"
+version = "0.15.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68fdbc90312d462781a395f7a16d96a2b379bb6ef8cd6310a2df272771c4283b"
+dependencies = [
+ "bitflags",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "gio-sys",
+ "glib",
+ "libc",
+ "once_cell",
+ "thiserror",
+]
+
+[[package]]
+name = "gio-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32157a475271e2c4a023382e9cab31c4584ee30a97da41d3c4e9fdd605abcf8d"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+ "winapi",
+]
+
+[[package]]
+name = "glib"
+version = "0.15.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edb0306fbad0ab5428b0ca674a23893db909a98582969c9b537be4ced78c505d"
+dependencies = [
+ "bitflags",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-task",
+ "glib-macros",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "once_cell",
+ "smallvec",
+ "thiserror",
+]
+
+[[package]]
+name = "glib-macros"
+version = "0.15.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10c6ae9f6fa26f4fb2ac16b528d138d971ead56141de489f8111e259b9df3c4a"
+dependencies = [
+ "anyhow",
+ "heck 0.4.1",
+ "proc-macro-crate",
+ "proc-macro-error",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef4b192f8e65e9cf76cbf4ea71fa8e3be4a0e18ffe3d68b8da6836974cc5bad4"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gobject-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d57ce44246becd17153bd035ab4d32cfee096a657fc01f2231c9278378d1e0a"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk"
+version = "0.15.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92e3004a2d5d6d8b5057d2b57b3712c9529b62e82c77f25c1fecde1fd5c23bd0"
+dependencies = [
+ "atk",
+ "bitflags",
+ "cairo-rs",
+ "field-offset",
+ "futures-channel",
+ "gdk",
+ "gdk-pixbuf",
+ "gio",
+ "glib",
+ "gtk-sys",
+ "gtk3-macros",
+ "libc",
+ "once_cell",
+ "pango",
+ "pkg-config",
+]
+
+[[package]]
+name = "gtk-sys"
+version = "0.15.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5bc2f0587cba247f60246a0ca11fe25fb733eabc3de12d1965fc07efab87c84"
+dependencies = [
+ "atk-sys",
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk3-macros"
+version = "0.15.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "684c0456c086e8e7e9af73ec5b84e35938df394712054550e81558d21c44ab0d"
+dependencies = [
+ "anyhow",
+ "proc-macro-crate",
+ "proc-macro-error",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17f8a914c2987b688368b5138aa05321db91f4090cf26118185672ad588bce21"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fed44880c466736ef9a5c5b5facefb5ed0785676d0c02d612db14e54f0d84286"
+
+[[package]]
+name = "hex"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "805026a5d0141ffc30abb3be3173848ad46a1b1664fe632428479619a3644d77"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hex-view"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494e16c9fe4dd02a88f3fe9ec0f27e38045691ea0ceb11603670f220ff5ca97f"
+
+[[package]]
+name = "home"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5444c27eef6923071f7ebcc33e3444508466a76f7a2b93da00ed6e19f30c1ddb"
+dependencies = [
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "html2md"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be92446e11d68f5d71367d571c229d09ced1f24ab6d08ea0bff329d5f6c0b2a3"
+dependencies = [
+ "html5ever",
+ "jni",
+ "lazy_static",
+ "markup5ever_rcdom",
+ "percent-encoding",
+ "regex",
+]
+
+[[package]]
+name = "html5ever"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bea68cab48b8459f17cf1c944c67ddc572d272d9f2b274140f223ecb1da4a3b7"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "http"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd6effc99afb63425aff9b05836f029929e345a6148a14b7ecd5ab67af944482"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+dependencies = [
+ "bytes",
+ "http",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+
+[[package]]
+name = "httpdate"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+
+[[package]]
+name = "human-sort"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "140a09c9305e6d5e557e2ed7cbc68e05765a7d4213975b87cb04920689cc6219"
+
+[[package]]
+name = "hyper"
+version = "0.14.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab302d72a6f11a3b910431ff93aae7e773078c769f0a3ef15fb9ec692ed147d4"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+dependencies = [
+ "bytes",
+ "hyper",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+]
+
+[[package]]
+name = "i18n-config"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d9f93ceee6543011739bc81699b5e0cf1f23f3a80364649b6d80de8636bc8df"
+dependencies = [
+ "log",
+ "serde",
+ "serde_derive",
+ "thiserror",
+ "toml 0.5.11",
+ "unic-langid",
+]
+
+[[package]]
+name = "i18n-embed"
+version = "0.13.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2653dd1a8be0726315603f1c180b29f90e5b2a58f8b943d949d5170d9ad81101"
+dependencies = [
+ "arc-swap",
+ "fluent",
+ "fluent-langneg",
+ "fluent-syntax",
+ "i18n-embed-impl",
+ "intl-memoizer",
+ "lazy_static",
+ "locale_config",
+ "log",
+ "parking_lot",
+ "rust-embed",
+ "thiserror",
+ "unic-langid",
+ "walkdir",
+]
+
+[[package]]
+name = "i18n-embed-fl"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b5809e2295beeb55013705c3b947cbbe83b8cadf3c73a1e6dca06381927212a"
+dependencies = [
+ "dashmap",
+ "find-crate",
+ "fluent",
+ "fluent-syntax",
+ "i18n-config",
+ "i18n-embed",
+ "lazy_static",
+ "proc-macro-error",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "strsim",
+ "syn 1.0.109",
+ "unic-langid",
+]
+
+[[package]]
+name = "i18n-embed-impl"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0db2330e035808eb064afb67e6743ddce353763af3e0f2bdfc2476e00ce76136"
+dependencies = [
+ "find-crate",
+ "i18n-config",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "index-fixed"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161ceaf2f41b6cd3f6502f5da085d4ad4393a51e0c70ed2fce1d5698d798fae"
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "intl-memoizer"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c310433e4a310918d6ed9243542a6b83ec1183df95dff8f23f87bb88a264a66f"
+dependencies = [
+ "type-map",
+ "unic-langid",
+]
+
+[[package]]
+name = "intl_pluralrules"
+version = "7.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "078ea7b7c29a2b4df841a7f6ac8775ff6074020c6776d48491ce2268e068f972"
+dependencies = [
+ "unic-langid",
+]
+
+[[package]]
+name = "io-lifetimes"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c66c74d2ae7e79a5a8f7ac924adbe38ee42a859c6539ad869eb51f0b52dc220"
+dependencies = [
+ "hermit-abi 0.3.1",
+ "libc",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12b6ee2129af8d4fb011108c73d99a1b83a85977f23b82460c0ae2e25bb4b57f"
+
+[[package]]
+name = "is-terminal"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adcf93614601c8129ddf72e2d5633df827ba6551541c6d8c59520a371475be1f"
+dependencies = [
+ "hermit-abi 0.3.1",
+ "io-lifetimes",
+ "rustix",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "itertools"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f56a2d0bc861f9165be4eb3442afd3c236d8a98afd426f65d92324ae1091a484"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "453ad9f582a441959e5f0d088b02ce04cfe8d51a8eaf077f12ac6d3e94164ca6"
+
+[[package]]
+name = "jni"
+version = "0.19.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6df18c2e3db7e453d3c6ac5b3e9d5182664d28788126d39b91f2d1e22b017ec"
+dependencies = [
+ "cesu8",
+ "combine",
+ "jni-sys",
+ "log",
+ "thiserror",
+ "walkdir",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
+
+[[package]]
+name = "js-sys"
+version = "0.3.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "445dde2150c55e483f3d8416706b97ec8e8237c307e5b7b4b8dd15e6af2a0730"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.142"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a987beff54b60ffa6d51982e1aa1146bc42f19bd26be28b0586f252fccf5317"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06085512b750d640299b79be4bad3d2fa90a9c00b1fd9e1b46364f66f0485c72"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libudev-sys"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c8469b4a23b962c1396b9b451dda50ef5b283e8dd309d69033475fa9b334324"
+dependencies = [
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b64f40e5e03e0d54f03845c8197d0291253cdbedfb1cb46b13c2c117554a9f4c"
+
+[[package]]
+name = "locale_config"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d2c35b16f4483f6c26f0e4e9550717a2f6575bcd6f12a53ff0c490a94a6934"
+dependencies = [
+ "lazy_static",
+ "objc",
+ "objc-foundation",
+ "regex",
+ "winapi",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435011366fe56583b16cf956f9df0095b405b82d76425bc8981c0e22e60ec4df"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "lxd"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918a314b8eb7d4e19c3d154b4069b12aa37c25a68bae4f2c2a69f50bf47c7c5a"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "mac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4"
+
+[[package]]
+name = "mac-notification-sys"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e72d50edb17756489e79d52eb146927bec8eba9dd48faadf9ef08bca3791ad5"
+dependencies = [
+ "cc",
+ "dirs-next",
+ "objc-foundation",
+ "objc_id",
+ "time",
+]
+
+[[package]]
+name = "malloc_buf"
+version = "0.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62bb907fe88d54d8d9ce32a3cceab4218ed2f6b7d35617cafe9adf84e43919cb"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "markup"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "360ec4d83ae8c3150530220fd89e0c5dba54cfc8d7675695f1fdc3581880dce9"
+dependencies = [
+ "markup-proc-macro",
+]
+
+[[package]]
+name = "markup-proc-macro"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba9c3711ed5187a843aaa960eb78db98f64d76ea22a47c204ca2affb3904bb92"
+dependencies = [
+ "proc-macro2 0.4.30",
+ "quote 0.6.13",
+ "syn 0.15.44",
+]
+
+[[package]]
+name = "markup5ever"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a2629bb1404f3d34c2e921f21fd34ba00b206124c81f65c50b43b6aaefeb016"
+dependencies = [
+ "log",
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+ "tendril",
+]
+
+[[package]]
+name = "markup5ever_rcdom"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9521dd6750f8e80ee6c53d65e2e4656d7de37064f3a7a5d2d11d05df93839c2"
+dependencies = [
+ "html5ever",
+ "markup5ever",
+ "tendril",
+ "xml5ever",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5de893c32cde5f383baa4c04c5d6dbdd735cfd4a794b0debdb2bb1b421da5ff4"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "memoffset"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d61c719bcfbcf5d62b3a09efa6088de8c54bc0bfcd3ea7ae39fcc186108b8de1"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b275950c28b37e794e8c55d88aeb5e139d0ce23fdbbeda68f8d7174abdf9e8fa"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "miniz_oxide"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
+dependencies = [
+ "adler",
+]
+
+[[package]]
+name = "mio"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8067b404fe97c70829f082dec8bcf4f71225d7eaea1d8645349cb76fa06205cc"
+dependencies = [
+ "libc",
+ "log",
+ "miow",
+ "ntapi",
+ "winapi",
+]
+
+[[package]]
+name = "mio"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b9d9a46eff5b4ff64b45a9e316a6d1e0bc719ef429cbec4dc630684212bfdf9"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "miow"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9f1c5b025cda876f66ef43a113f91ebc9f4ccef34843000e0adf6ebbab84e21"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4a24736216ec316047a1fc4252e27dabb04218aa4a3f37c6e7ddbf1f9782b54"
+
+[[package]]
+name = "nix"
+version = "0.26.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfdda3d196821d6af13126e40375cdf7da646a96114af134d5f417a9a1dc8e1a"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "libc",
+ "memoffset 0.7.1",
+ "static_assertions",
+]
+
+[[package]]
+name = "notify-rust"
+version = "4.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2bfa211d18e360f08e36c364308f394b5eb23a6629150690e109a916dc6f610e"
+dependencies = [
+ "dbus 0.9.7",
+ "log",
+ "mac-notification-sys",
+ "tauri-winrt-notification",
+]
+
+[[package]]
+name = "ntapi"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28774a7fd2fbb4f0babd8237ce554b73af68021b5f695a3cebd6c59bac0980f"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+dependencies = [
+ "hermit-abi 0.2.6",
+ "libc",
+]
+
+[[package]]
+name = "objc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "915b1b472bc21c53464d6c8461c9d3af805ba1ef837e1cac254428f4a77177b1"
+dependencies = [
+ "malloc_buf",
+]
+
+[[package]]
+name = "objc-foundation"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1add1b659e36c9607c7aab864a76c7a4c2760cd0cd2e120f3fb8b952c7e22bf9"
+dependencies = [
+ "block",
+ "objc",
+ "objc_id",
+]
+
+[[package]]
+name = "objc_id"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c92d4ddb4bd7b50d730c215ff871754d0da6b2178849f8a2a2ab69712d0c073b"
+dependencies = [
+ "objc",
+]
+
+[[package]]
+name = "object"
+version = "0.30.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea86265d3d3dcb6a27fc51bd29a4bf387fae9d2986b823079d4986af253eb439"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7e5500299e16ebb147ae15a00a942af264cf3688f47923b8fc2cd5858f23ad3"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+
+[[package]]
+name = "openssl"
+version = "0.10.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01b8574602df80f7b85fdfc5392fa884a4e3b3f4f35402c070ab34c3d3f78d56"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.87"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e17f59264b2809d77ae94f0e1ebabc434773f370d6ca667bd223ea10e06cc7e"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "os_str_bytes"
+version = "6.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ceedf44fb00f2d1984b0bc98102627ce622e083e49a5bacdb3e514fa4238e267"
+
+[[package]]
+name = "pango"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e4045548659aee5313bde6c582b0d83a627b7904dd20dc2d9ef0895d414e4f"
+dependencies = [
+ "bitflags",
+ "glib",
+ "libc",
+ "once_cell",
+ "pango-sys",
+]
+
+[[package]]
+name = "pango-sys"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2a00081cde4661982ed91d80ef437c20eacaf6aa1a5962c0279ae194662c3aa"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "parking"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "14f2252c834a40ed9bb5422029649578e63aa341ac401f74e719dd1afda8394e"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9069cbb9f99e3a5083476ccb29ceb1de18b9118cafa53e90c9551235de2b9521"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall 0.2.16",
+ "smallvec",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
+
+[[package]]
+name = "phf"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
+dependencies = [
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fb1c3a8bc4dd4e5cfce29b44ffc14bedd2ee294559a294e2a4d4c9e9a6a13cd"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
+dependencies = [
+ "phf_shared",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "polling"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b2d323e8ca7996b3e23126511a523f7e62924d93ecd5ae73b333815b0eb3dce"
+dependencies = [
+ "autocfg",
+ "bitflags",
+ "cfg-if",
+ "concurrent-queue",
+ "libc",
+ "log",
+ "pin-project-lite",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "0.4.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf3d2011ab5c909338f7887f4fc896d35932e29146c12c8d01da6b22a80ba759"
+dependencies = [
+ "unicode-xid 0.1.0",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b63bdb0cd06f1f4dedf69b254734f9b45af66e4a031e42a7480257d9898b435"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quick-xml"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11bafc859c6815fbaffbbbf4229ecb767ac913fecb27f9ad4343662e9ef099ea"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "quote"
+version = "0.6.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ce23b6b870e8f94f81fb0a363d65d86675884b34a09043c81e5562f11c1f8e1"
+dependencies = [
+ "proc-macro2 0.4.30",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4424af4bf778aae2051a77b60283332f386554255d722233d09fbfc7e30da2fc"
+dependencies = [
+ "proc-macro2 1.0.56",
+]
+
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+dependencies = [
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.3.1",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b033d837a7cf162d7993aded9304e30a83213c648b6e389db233191f891e5c2b"
+dependencies = [
+ "getrandom",
+ "redox_syscall 0.2.16",
+ "thiserror",
+]
+
+[[package]]
+name = "regex"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af83e617f331cc6ae2da5443c602dfa5af81e517212d9d611a5b3ba1777b5370"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5996294f19bd3aae0453a862ad728f60e6600695733dd5df01da90c54363a3c"
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.11.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13293b639a097af28fc8a90f22add145a9c954e49d77da06263d58cf44d5fb91"
+dependencies = [
+ "base64 0.21.0",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-tls",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "winreg",
+]
+
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin",
+ "untrusted",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "rust-embed"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b68543d5527e158213414a92832d2aab11a84d2571a5eb021ebe22c43aab066"
+dependencies = [
+ "rust-embed-impl",
+ "rust-embed-utils",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-impl"
+version = "6.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d4e0f0ced47ded9a68374ac145edd65a6c1fa13a96447b873660b2a568a0fd7"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "rust-embed-utils",
+ "syn 1.0.109",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-embed-utils"
+version = "7.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512b0ab6853f7e14e3c8754acb43d6f748bb9ced66aa5915a6553ac8213f7731"
+dependencies = [
+ "sha2 0.10.6",
+ "walkdir",
+]
+
+[[package]]
+name = "rust-lzma"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "895dc04daeaeee338bb96e229797902ed3f0675bfc59d5b42e0f0b0c13ac54da"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa0f585226d2e68097d4f95d113b15b83a82e819ab25717ec0590d9584ef366"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.37.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8bbfc1d1c7c40c01715f47d71444744a81669ca84e8b63e25a55e169b1f86433"
+dependencies = [
+ "bitflags",
+ "errno",
+ "io-lifetimes",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.20.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fff78fc74d175294f4e83b28343315ffcfb114b156f0185e9741cb5570f50e2f"
+dependencies = [
+ "log",
+ "ring",
+ "sct",
+ "webpki",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91339c0467de62360649f8d3e185ca8de4224ff281f66000de5eb2a77a79041"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "713cfb06c7059f3588fb8044c0fad1d09e3c01d225e25b9220dbfdcf16dbb1b3"
+dependencies = [
+ "windows-sys 0.42.0",
+]
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "sct"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d53dcdb7c9f8158937a7981b48accfd39a43af418591a5d008c7b22b5e1b7ca4"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a332be01508d814fed64bf28f798a146d73792121129962fdf335bb3c49a4254"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31c9bb296072e961fcbd8853511dd39c2d8be2deb1e17c6860b1d30732b323b4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "self_cell"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ef965a420fe14fdac7dd018862966a4c14094f900e1650bbc71ddd7d580c8af"
+
+[[package]]
+name = "semver"
+version = "1.0.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bebd363326d05ec3e2f532ab7660680f3b02130d780c299bca73469d521bc0ed"
+
+[[package]]
+name = "serde"
+version = "1.0.160"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb2f3770c8bce3bcda7e149193a069a0f4365bda1fa5cd88e03bca26afc1216c"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.160"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291a097c63d8497e00160b166a967a4a79c64f3facdd01cbd7502231688d77df"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.96"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "057d394a50403bcac12672b2b18fb387ab6d289d957dab67dd201875391e52f1"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_repr"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcec881020c684085e55a25f7fd888954d56609ef363479dc5a1305eb0d40cab"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0efd8caf556a6cebd3b285caf480045fcc1ac04f6bd786b09a6f11af30c4fcf4"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f04293dc80c3993519f2d7f6f511707ee7094fe0c6d3406feb330cdb3540eba3"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "shrinkwraprs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e63e6744142336dfb606fe2b068afa2e1cca1ee6a5d8377277a92945d81fa331"
+dependencies = [
+ "bitflags",
+ "itertools",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bd3e3206899af3f8b12af284fafc038cc1dc2b41d1b89dd17297221c5d225de"
+
+[[package]]
+name = "slab"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6528351c9bc8ab22353f9d776db39a20288e8d6c37ef8cfe3317cf875eecfc2d"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "slotmap"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1e08e261d0e8f5c43123b7adf3e4ca1690d655377ac93a03b2c9d3e98de1342"
+dependencies = [
+ "version_check",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a507befe795404456341dfab10cef66ead4c041f62b8b11bbb92bffe5d0953e0"
+
+[[package]]
+name = "socket2"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64a4a911eed85daf18834cfaa86a79b7d266ff93ff5ba14005426219480ed662"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "sodalite"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41784a359d15c58bba298cccb7f30a847a1a42d0620c9bdaa0aa42fdb3c280e0"
+dependencies = [
+ "index-fixed",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "string_cache"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91138e76242f575eb1d3b38b4f1362f10d3a43f47d182a5b359af488a02293b"
+dependencies = [
+ "new_debug_unreachable",
+ "once_cell",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb30289b722be4ff74a408c3cc27edeaad656e06cb1fe8fa9231fa59c728988"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+]
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "strum"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7ac893c7d471c8a21f31cfe213ec4f6d9afeed25537c772e08ef3f005f8729e"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "339f799d8b549e3744c7ac7feb216383e4005d94bdb22561b3ab8f3b808ae9fb"
+dependencies = [
+ "heck 0.3.3",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "syn"
+version = "0.15.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ca4b3b69a77cbe1ffc9e198781b7acb0c7365a883670e8f1c1bc66fba79a5c5"
+dependencies = [
+ "proc-macro2 0.4.30",
+ "quote 0.6.13",
+ "unicode-xid 0.1.0",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a34fcf3e8b60f57e6a14301a2e916d323af98b0ea63c599441eec8558660c822"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "unicode-ident",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f36bdaa60a83aca3921b5259d5400cbf5e90fc51931376a9bd4a0eb79aa7210f"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "unicode-xid 0.2.4",
+]
+
+[[package]]
+name = "system-deps"
+version = "6.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0fe581ad25d11420b873cf9aedaca0419c2b411487b134d4d21065f3d092055"
+dependencies = [
+ "cfg-expr",
+ "heck 0.4.1",
+ "pkg-config",
+ "toml 0.7.3",
+ "version-compare",
+]
+
+[[package]]
+name = "system76-firmware"
+version = "1.0.51"
+source = "git+https://github.com/pop-os/system76-firmware#c3d5323647a0853c4d28e4f7148a4a96f63dbb3a"
+dependencies = [
+ "anyhow",
+ "bincode",
+ "buildchain",
+ "clap 3.2.25",
+ "ecflash",
+ "libc",
+ "plain",
+ "rust-lzma",
+ "serde",
+ "serde_json",
+ "sha2 0.9.9",
+ "system76_ectool",
+ "tar",
+ "tempdir",
+ "uuid",
+]
+
+[[package]]
+name = "system76-firmware-daemon"
+version = "0.1.0"
+source = "git+https://github.com/pop-os/system76-firmware#c3d5323647a0853c4d28e4f7148a4a96f63dbb3a"
+dependencies = [
+ "dbus 0.9.7",
+ "dbus-crossroads",
+ "enum_derive",
+ "libc",
+ "serde",
+ "serde_json",
+ "shrinkwraprs",
+ "system76-firmware",
+ "thiserror",
+]
+
+[[package]]
+name = "system76_ectool"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c957fdd329e017031dbd261ff48fad01296660a9c237942c226cff064bd0610a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d779dc6aeff029314570f666ec83f19df7280bb36ef338442cfa8c604021b80"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd1ba337640d60c3e96bc6f0638a939b9c9a7f2c316a1598c279828b3d1dc8c5"
+
+[[package]]
+name = "tauri-winrt-notification"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c58de036c4d2e20717024de2a3c4bf56c301f07b21bc8ef9b57189fce06f1f3b"
+dependencies = [
+ "quick-xml",
+ "strum",
+ "windows",
+]
+
+[[package]]
+name = "tempdir"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
+dependencies = [
+ "rand 0.4.6",
+ "remove_dir_all",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9fbec84f381d5795b08656e4912bec604d162bff9291d6189a78f4c8ab87998"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "redox_syscall 0.3.5",
+ "rustix",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "tendril"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d24a120c5fc464a3458240ee02c299ebcb9d67b5249c8848b09d639dca8d7bb0"
+dependencies = [
+ "futf",
+ "mac",
+ "utf-8",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+
+[[package]]
+name = "thiserror"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978c9a314bd8dc99be594bc3c175faaa9794be04a5a5e153caba6915336cebac"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9456a42c5b0d803c8cd86e73dd7cc9edd429499f37a3550d286d5e86720569f"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "time"
+version = "0.3.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd0cbfecb4d19b5ea75bb31ad904eb5b9fa13f21079c3b92017ebdf4999a5890"
+dependencies = [
+ "serde",
+ "time-core",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e153e1f1acaef8acc537e68b44906d2db6436e2b35ac2c6b42640fff91f00fd"
+
+[[package]]
+name = "tinystr"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ac3f5b6856e931e15e07b478e98c8045239829a65f9156d4fa7e7788197a5ef"
+dependencies = [
+ "displaydoc",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3c786bf8134e5a3a166db9b29ab8f48134739014a3eca7bc6bfa95d673b136f"
+dependencies = [
+ "autocfg",
+ "bytes",
+ "libc",
+ "mio 0.8.6",
+ "num_cpus",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-udev"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "246ffebae60acd93eb0056bac967cad807c7aa09916fabceac50479ad1f53e64"
+dependencies = [
+ "futures-core",
+ "mio 0.7.14",
+ "tokio",
+ "udev",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "806fe8c2c87eccc8b3267cbae29ed3ab2d0bd37fca70ab622e46aaa9375ddb7d"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "toml"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4f7f0dd8d50a853a531c426359045b1998f04219d88799810762cd4ad314234"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b403acf6f2bb0859c93c7f0d967cb4a75a7ac552100f9322faf64dc047669b21"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab8ed2edee10b50132aed5f331333428b011c99402b5a534154ed15746f9622"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.19.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "239410c8609e8125456927e6707163a3b1fdb40561e4b803bc041f466ccfdc13"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
+]
+
+[[package]]
+name = "tools"
+version = "0.1.0"
+dependencies = [
+ "clap 4.2.5",
+ "freedesktop-desktop-entry",
+]
+
+[[package]]
+name = "tower-service"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+
+[[package]]
+name = "tracing"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+dependencies = [
+ "cfg-if",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f57e3ca2a01450b1a921183a9c9cbfda207fd822cef4ccb00a65402cbba7a74"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 2.0.15",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24eb03ba0eab1fd845050058ce5e616558e8f8d8fca633e6b163fe25c797213a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
+
+[[package]]
+name = "type-map"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6d3364c5e96cb2ad1603037ab253ddd34d7fb72a58bdddf4b7350760fc69a46"
+dependencies = [
+ "rustc-hash",
+]
+
+[[package]]
+name = "typenum"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+
+[[package]]
+name = "udev"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c960764f7e816eed851a96c364745d37f9fe71a2e7dba79fbd40104530b5dd0"
+dependencies = [
+ "libc",
+ "libudev-sys",
+ "mio 0.8.6",
+ "pkg-config",
+]
+
+[[package]]
+name = "uds_windows"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce65604324d3cce9b966701489fbd0cf318cb1f7bd9dd07ac9a4ee6fb791930d"
+dependencies = [
+ "tempfile",
+ "winapi",
+]
+
+[[package]]
+name = "unic-langid"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "398f9ad7239db44fd0f80fe068d12ff22d78354080332a5077dc6f52f14dcf2f"
+dependencies = [
+ "unic-langid-impl",
+]
+
+[[package]]
+name = "unic-langid-impl"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e35bfd2f2b8796545b55d7d3fd3e89a0613f68a0d1c8bc28cb7ff96b411a35ff"
+dependencies = [
+ "serde",
+ "tinystr",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5464a87b239f13a63a501f2701565754bae92d243d4bb7eb12f6d57d2269bf4"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
+
+[[package]]
+name = "unicode-xid"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc72304796d0818e357ead4e000d19c9c174ab23dc11093ac919054d20a6a7fc"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f962df74c8c05a667b5ee8bcf162993134c104e96440b663c8daa176dc772d8c"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "upower_dbus"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8121b555fe6fd748fb4bb147f7b31b5ea17d006633183447e0d89e19d9aa9b7"
+dependencies = [
+ "dbus 0.6.5",
+ "failure",
+ "failure_derive",
+]
+
+[[package]]
+name = "ureq"
+version = "2.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "338b31dd1314f68f3aabf3ed57ab922df95ffcd902476ca7ba3c4ce7b908c46d"
+dependencies = [
+ "base64 0.13.1",
+ "flate2",
+ "log",
+ "once_cell",
+ "rustls",
+ "url",
+ "webpki",
+ "webpki-roots",
+]
+
+[[package]]
+name = "url"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
+[[package]]
+name = "users"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24cc0f6d6f267b73e5a2cadf007ba8f9bc39c6a6f9666f8cf25ea809a153b032"
+dependencies = [
+ "libc",
+ "log",
+]
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version-compare"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "579a42fc0b8e0c63b76519a339be31bed574929511fa53c1a3acae26eb258f29"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "waker-fn"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d5b2c62b4012a3e1eca5a7e077d13b3bf498c4073e33ccd58626607748ceeca"
+
+[[package]]
+name = "walkdir"
+version = "2.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36df944cda56c7d8d8b7496af378e6b16de9284591917d307c9b4d313c44e698"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ce8a968cb1cd110d136ff8b819a556d6fb6d919363c61534f6860c7eb172ba0"
+dependencies = [
+ "log",
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31f8dcbc21f30d9b8f2ea926ecb58f6b91192c17e9d33594b3df58b2007ca53b"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95ce90fd5bcc06af55a641a86428ee4229e44e07033963a2290a8e241607ccb9"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f219e0d211ba40266969f6dbdd90636da12f75bee4fc9d6c23d1260dadb51454"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c21f77c0bedc37fd5dc21f897894a5ca01e7bb159884559461862ae90c0b4c5"
+dependencies = [
+ "quote 1.0.26",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2aff81306fcac3c7515ad4e177f521b5c9a15f2b08f4e32d823066102f35a5f6"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.84"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0046fef7e28c3804e5e38bfa31ea2a0f73905319b677e57ebe37e49358989b5d"
+
+[[package]]
+name = "web-sys"
+version = "0.3.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e33b99f4b23ba3eec1a53ac264e35a755f00e966e0065077d6027c0f575b0b97"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
+dependencies = [
+ "ring",
+ "untrusted",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.22.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c71e40d7d2c34a5106301fb632274ca37242cd0c9d3e64dbece371a40a2d87"
+dependencies = [
+ "webpki",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1c4bd0a50ac6020f65184721f758dba47bb9fbc2133df715ec74a237b26794a"
+dependencies = [
+ "windows_aarch64_msvc 0.39.0",
+ "windows_i686_gnu 0.39.0",
+ "windows_i686_msvc 0.39.0",
+ "windows_x86_64_gnu 0.39.0",
+ "windows_x86_64_msvc 0.39.0",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.0",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b1eb6f0cd7c80c79759c929114ef071b87354ce476d9d94271031c0497adfd5"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.0",
+ "windows_aarch64_msvc 0.48.0",
+ "windows_i686_gnu 0.48.0",
+ "windows_i686_msvc 0.48.0",
+ "windows_x86_64_gnu 0.48.0",
+ "windows_x86_64_gnullvm 0.48.0",
+ "windows_x86_64_msvc 0.48.0",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91ae572e1b79dba883e0d315474df7305d12f569b400fcf90581b06062f7e1bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec7711666096bd4096ffa835238905bb33fb87267910e154b18b44eaabb340f2"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2ef27e0d7bdfcfc7b868b317c1d32c641a6fe4629c171b8928c7b08d98d7cf3"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "763fc57100a5f7042e3057e7e8d9bdd7860d330070251a73d003563a3bb49e1b"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622a1962a7db830d6fd0a69683c80a18fda201879f0f447f065a3b7467daa241"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7bc7cbfe58828921e10a9f446fcaaf649204dcfe6c1ddd712c5eebae6bda1106"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4542c6e364ce21bf45d69fdd2a8e455fa38d316158cfd43b3ac1c5b1b19f8e00"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6868c165637d653ae1e8dc4d82c25d4f97dd6605eaa8d784b5c6e0ab2a252b65"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2b8a661f7628cbd23440e50b05d705db3686f894fc9580820623656af974b1"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7896dbc1f41e08872e9d5e8f8baa8fdd2677f29468c4e156210174edc7f7b953"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e4d40883ae9cae962787ca76ba76390ffa29214667a111db9e0a1ad8377e809"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
+
+[[package]]
+name = "winnow"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61de7bac303dc551fe038e2b3cef0f571087a47571ea6e79a87692ac99b99699"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "xattr"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "xdg"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "688597db5a750e9cad4511cb94729a078e274308099a0382b5b8203bbc767fee"
+dependencies = [
+ "home",
+]
+
+[[package]]
+name = "xdg-home"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2769203cd13a0c6015d515be729c526d041e9cf2c0cc478d57faee85f40c6dcd"
+dependencies = [
+ "nix",
+ "winapi",
+]
+
+[[package]]
+name = "xml5ever"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4034e1d05af98b51ad7214527730626f019682d797ba38b51689212118d8e650"
+dependencies = [
+ "log",
+ "mac",
+ "markup5ever",
+]
+
+[[package]]
+name = "yansi"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09041cd90cf85f7f8b2df60c646f853b7f535ce68f85244eb6731cf89fa498ec"
+
+[[package]]
+name = "zbus"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29242fa5ec5693629ae74d6eb1f69622a9511f600986d6d9779bccf36ac316e3"
+dependencies = [
+ "async-broadcast",
+ "async-executor",
+ "async-fs",
+ "async-io",
+ "async-lock",
+ "async-recursion",
+ "async-task",
+ "async-trait",
+ "byteorder",
+ "derivative",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "hex 0.4.3",
+ "nix",
+ "once_cell",
+ "ordered-stream",
+ "rand 0.8.5",
+ "serde",
+ "serde_repr",
+ "sha1",
+ "static_assertions",
+ "tracing",
+ "uds_windows",
+ "winapi",
+ "xdg-home",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "537793e26e9af85f774801dc52c6f6292352b2b517c5cf0449ffd3735732a53a"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "regex",
+ "syn 1.0.109",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f34f314916bd89bdb9934154627fab152f4f28acdda03e7c4c68181b214fe7e3"
+dependencies = [
+ "serde",
+ "static_assertions",
+ "zvariant",
+]
+
+[[package]]
+name = "zvariant"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46fe4914a985446d6fd287019b5fceccce38303d71407d9e6e711d44954a05d8"
+dependencies = [
+ "byteorder",
+ "enumflags2",
+ "libc",
+ "serde",
+ "static_assertions",
+ "zvariant_derive",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34c20260af4b28b3275d6676c7e2a6be0d4332e8e0aba4616d34007fd84e462a"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53b22993dbc4d128a17a3b6c92f1c63872dd67198537ee728d8b5d7c40640a8b"
+dependencies = [
+ "proc-macro2 1.0.56",
+ "quote 1.0.26",
+ "syn 1.0.109",
+]
diff --git a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
index ee36ab57442..af455e7ef61 100644
--- a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
@@ -1,32 +1,54 @@
-{ rustPlatform, lib, fetchFromGitHub, xz, pkg-config, openssl, dbus, glib, udev, cairo, pango, atk, gdk-pixbuf, gtk3, wrapGAppsHook }:
-rustPlatform.buildRustPackage rec {
+{ lib
+, stdenv
+, rustPlatform
+, fetchFromGitHub
+, cargo
+, pkg-config
+, rustc
+, openssl
+, udev
+, gtk3
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
   pname = "firmware-manager";
-  version = "0.1.2";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
     rev = version;
-    sha256 = "sha256-aKatdjHa/k7j48upkR1O6PFxCUfJYE3KhhzZ9Ohe0Jc=";
+    hash = "sha256-Q+LJJ4xK583fAcwuOFykt6GKT0rVJgmTt+zUX4o4Tm4=";
   };
 
-  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
-
-  buildInputs = [ xz openssl dbus glib udev cairo pango atk gdk-pixbuf gtk3 ];
-
-  depsExtraArgs.postPatch = "make prefix='$(out)' toml-gen";
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "ecflash-0.1.0" = "sha256-W613wbW54R65/rs6oiPAH/qov2OVEjMMszpUJdX4TxI=";
+      "system76-firmware-1.0.51" = "sha256-+GPz7uKygGnFUptQEGYWkEdHgxBc65kLZqpwZqtwets=";
+    };
+  };
 
   postPatch = ''
-    sed -i 's|etc|$(prefix)/etc|' Makefile
+    substituteInPlace Makefile --replace '$(DESTDIR)/etc' '$(DESTDIR)$(prefix)/etc'
   '';
 
-  buildPhase = "make prefix='$(out)'";
-
-  installPhase = "make prefix='$(out)' install";
-
-  cargoSha256 = "sha256-BUo77ERHvuc8IkDdU3Z/gZZicNHT26IbAgEBnVM3O4U=";
-
-  doCheck = false;
+  nativeBuildInputs = [
+    cargo
+    rustc
+    pkg-config
+    rustPlatform.cargoSetupHook
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    openssl
+    gtk3
+    udev
+  ];
+
+  makeFlags = [ "prefix=$(out)" ];
 
   meta = {
     description = "Graphical frontend for firmware management";
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
new file mode 100644
index 00000000000..460ac0ad17b
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, writeText
+, flutter
+, fetchFromGitHub
+}:
+
+flutter.buildFlutterApplication rec {
+  pname = "firmware-updater";
+  version = "unstable-2023-09-17";
+
+  pubspecLockFile = ./pubspec.lock;
+  depsListFile = ./deps.json;
+  vendorHash = "sha256-5xd9ppnWleKVA69DJWVdY+rZziu4dQBCu16I0ivD8kE=";
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "firmware-updater";
+    rev = "855999da8d3d0c9930e06f2d296d82b55aeff79e";
+    hash = "sha256-tIeEuHl+sCKd756NYPmxXiV1Sg2m9W0eGUtM/Iskeu8=";
+  };
+
+  postPatch = ''
+    rm -f pubspec.lock
+    ln -s "${writeText "${pname}-overrides.yaml" (builtins.toJSON {
+      dependency_overrides = {
+        yaru = "^1.1.0";
+        yaru_icons = "^2.2.1";
+        yaru_widgets = "^3.1.0";
+        mockito = "^5.4.2";
+        test_api = "^0.6.1";
+      };
+    })}" pubspec_overrides.yaml
+  '';
+
+  meta = with lib; {
+    description = "Firmware Updater for Linux";
+    homepage = "https://github.com/canonical/firmware-updater";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/deps.json b/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
new file mode 100644
index 00000000000..702ddfd8c09
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/deps.json
@@ -0,0 +1,1616 @@
+[
+  {
+    "name": "firmware_updater",
+    "version": "0.0.0",
+    "kind": "root",
+    "source": "root",
+    "dependencies": [
+      "collection",
+      "dbus",
+      "dio",
+      "file",
+      "flutter",
+      "flutter_html",
+      "flutter_localizations",
+      "freezed_annotation",
+      "fwupd",
+      "gtk",
+      "handy_window",
+      "meta",
+      "path",
+      "provider",
+      "safe_change_notifier",
+      "ubuntu_logger",
+      "ubuntu_service",
+      "ubuntu_session",
+      "ubuntu_test",
+      "upower",
+      "yaru",
+      "yaru_colors",
+      "yaru_icons",
+      "yaru_widgets",
+      "build_runner",
+      "flutter_lints",
+      "flutter_test",
+      "freezed",
+      "integration_test",
+      "melos",
+      "mockito",
+      "test_api"
+    ]
+  },
+  {
+    "name": "test_api",
+    "version": "0.6.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "boolean_selector",
+      "collection",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "term_glyph",
+    "version": "1.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "string_scanner",
+    "version": "1.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "source_span",
+    "version": "1.10.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "path",
+      "term_glyph"
+    ]
+  },
+  {
+    "name": "path",
+    "version": "1.8.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "collection",
+    "version": "1.17.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stream_channel",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "async",
+    "version": "2.11.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "meta",
+    "version": "1.9.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "stack_trace",
+    "version": "1.11.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "boolean_selector",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "mockito",
+    "version": "5.4.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "build",
+      "code_builder",
+      "collection",
+      "dart_style",
+      "matcher",
+      "meta",
+      "path",
+      "source_gen",
+      "test_api"
+    ]
+  },
+  {
+    "name": "source_gen",
+    "version": "1.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "build",
+      "dart_style",
+      "glob",
+      "path",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "yaml",
+    "version": "3.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "glob",
+    "version": "2.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "file",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "file",
+    "version": "6.1.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "dart_style",
+    "version": "2.3.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "args",
+      "path",
+      "pub_semver",
+      "source_span"
+    ]
+  },
+  {
+    "name": "pub_semver",
+    "version": "2.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "args",
+    "version": "2.4.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "analyzer",
+    "version": "5.13.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "_fe_analyzer_shared",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "meta",
+      "package_config",
+      "path",
+      "pub_semver",
+      "source_span",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "watcher",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "package_config",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path"
+    ]
+  },
+  {
+    "name": "crypto",
+    "version": "3.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "typed_data",
+    "version": "1.3.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "convert",
+    "version": "3.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "typed_data"
+    ]
+  },
+  {
+    "name": "_fe_analyzer_shared",
+    "version": "61.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "build",
+    "version": "2.4.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "convert",
+      "crypto",
+      "glob",
+      "logging",
+      "meta",
+      "package_config",
+      "path"
+    ]
+  },
+  {
+    "name": "logging",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "matcher",
+    "version": "0.12.16",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "meta",
+      "stack_trace",
+      "term_glyph",
+      "test_api"
+    ]
+  },
+  {
+    "name": "code_builder",
+    "version": "4.5.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "built_value",
+      "collection",
+      "matcher",
+      "meta"
+    ]
+  },
+  {
+    "name": "built_value",
+    "version": "8.6.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "collection",
+      "fixnum",
+      "meta"
+    ]
+  },
+  {
+    "name": "fixnum",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "built_collection",
+    "version": "5.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "melos",
+    "version": "3.1.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "ansi_styles",
+      "args",
+      "cli_launcher",
+      "cli_util",
+      "collection",
+      "conventional_commit",
+      "file",
+      "glob",
+      "graphs",
+      "http",
+      "meta",
+      "mustache_template",
+      "path",
+      "platform",
+      "pool",
+      "prompts",
+      "pub_semver",
+      "pub_updater",
+      "pubspec",
+      "string_scanner",
+      "yaml",
+      "yaml_edit"
+    ]
+  },
+  {
+    "name": "yaml_edit",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "pubspec",
+    "version": "2.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "pub_semver",
+      "yaml",
+      "uri"
+    ]
+  },
+  {
+    "name": "uri",
+    "version": "1.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "matcher",
+      "quiver"
+    ]
+  },
+  {
+    "name": "quiver",
+    "version": "3.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "matcher"
+    ]
+  },
+  {
+    "name": "pub_updater",
+    "version": "0.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "http",
+      "json_annotation",
+      "process",
+      "pub_semver"
+    ]
+  },
+  {
+    "name": "process",
+    "version": "4.2.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "file",
+      "path",
+      "platform"
+    ]
+  },
+  {
+    "name": "platform",
+    "version": "3.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "json_annotation",
+    "version": "4.8.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "http",
+    "version": "1.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "http_parser",
+      "meta"
+    ]
+  },
+  {
+    "name": "http_parser",
+    "version": "4.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "source_span",
+      "string_scanner",
+      "typed_data"
+    ]
+  },
+  {
+    "name": "prompts",
+    "version": "2.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "charcode",
+      "io"
+    ]
+  },
+  {
+    "name": "io",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path",
+      "string_scanner"
+    ]
+  },
+  {
+    "name": "charcode",
+    "version": "1.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "pool",
+    "version": "1.5.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "stack_trace"
+    ]
+  },
+  {
+    "name": "mustache_template",
+    "version": "2.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "graphs",
+    "version": "2.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "conventional_commit",
+    "version": "0.6.0+1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "cli_util",
+    "version": "0.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "cli_launcher",
+    "version": "0.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "path",
+      "yaml"
+    ]
+  },
+  {
+    "name": "ansi_styles",
+    "version": "0.3.2+1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "integration_test",
+    "version": "0.0.0",
+    "kind": "dev",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "flutter_driver",
+      "flutter_test",
+      "path",
+      "vm_service",
+      "async",
+      "boolean_selector",
+      "characters",
+      "clock",
+      "collection",
+      "fake_async",
+      "file",
+      "matcher",
+      "material_color_utilities",
+      "meta",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "sync_http",
+      "term_glyph",
+      "test_api",
+      "vector_math",
+      "web",
+      "webdriver"
+    ]
+  },
+  {
+    "name": "webdriver",
+    "version": "3.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "matcher",
+      "path",
+      "stack_trace",
+      "sync_http"
+    ]
+  },
+  {
+    "name": "sync_http",
+    "version": "0.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "web",
+    "version": "0.1.4-beta",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "vector_math",
+    "version": "2.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "material_color_utilities",
+    "version": "0.5.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection"
+    ]
+  },
+  {
+    "name": "fake_async",
+    "version": "1.3.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "collection"
+    ]
+  },
+  {
+    "name": "clock",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "characters",
+    "version": "1.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "vm_service",
+    "version": "11.7.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_test",
+    "version": "0.0.0",
+    "kind": "dev",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "test_api",
+      "matcher",
+      "path",
+      "fake_async",
+      "clock",
+      "stack_trace",
+      "vector_math",
+      "async",
+      "boolean_selector",
+      "characters",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "source_span",
+      "stream_channel",
+      "string_scanner",
+      "term_glyph",
+      "web"
+    ]
+  },
+  {
+    "name": "flutter",
+    "version": "0.0.0",
+    "kind": "direct",
+    "source": "sdk",
+    "dependencies": [
+      "characters",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "vector_math",
+      "web",
+      "sky_engine"
+    ]
+  },
+  {
+    "name": "sky_engine",
+    "version": "0.0.99",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_driver",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "file",
+      "flutter",
+      "flutter_test",
+      "fuchsia_remote_debug_protocol",
+      "path",
+      "meta",
+      "vm_service",
+      "webdriver",
+      "async",
+      "boolean_selector",
+      "characters",
+      "clock",
+      "collection",
+      "matcher",
+      "material_color_utilities",
+      "platform",
+      "process",
+      "source_span",
+      "stack_trace",
+      "stream_channel",
+      "string_scanner",
+      "sync_http",
+      "term_glyph",
+      "test_api",
+      "vector_math",
+      "web"
+    ]
+  },
+  {
+    "name": "fuchsia_remote_debug_protocol",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "process",
+      "vm_service",
+      "file",
+      "meta",
+      "path",
+      "platform"
+    ]
+  },
+  {
+    "name": "freezed",
+    "version": "2.4.1",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "build",
+      "build_config",
+      "collection",
+      "meta",
+      "source_gen",
+      "freezed_annotation",
+      "json_annotation"
+    ]
+  },
+  {
+    "name": "freezed_annotation",
+    "version": "2.4.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "json_annotation",
+      "meta"
+    ]
+  },
+  {
+    "name": "build_config",
+    "version": "1.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "json_annotation",
+      "path",
+      "pubspec_parse",
+      "yaml"
+    ]
+  },
+  {
+    "name": "pubspec_parse",
+    "version": "1.2.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "checked_yaml",
+      "collection",
+      "json_annotation",
+      "pub_semver",
+      "yaml"
+    ]
+  },
+  {
+    "name": "checked_yaml",
+    "version": "2.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation",
+      "source_span",
+      "yaml"
+    ]
+  },
+  {
+    "name": "flutter_lints",
+    "version": "2.0.2",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "lints"
+    ]
+  },
+  {
+    "name": "lints",
+    "version": "2.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "build_runner",
+    "version": "2.4.6",
+    "kind": "dev",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "args",
+      "async",
+      "build",
+      "build_config",
+      "build_daemon",
+      "build_resolvers",
+      "build_runner_core",
+      "code_builder",
+      "collection",
+      "crypto",
+      "dart_style",
+      "frontend_server_client",
+      "glob",
+      "graphs",
+      "http_multi_server",
+      "io",
+      "js",
+      "logging",
+      "meta",
+      "mime",
+      "package_config",
+      "path",
+      "pool",
+      "pub_semver",
+      "pubspec_parse",
+      "shelf",
+      "shelf_web_socket",
+      "stack_trace",
+      "stream_transform",
+      "timing",
+      "watcher",
+      "web_socket_channel",
+      "yaml"
+    ]
+  },
+  {
+    "name": "web_socket_channel",
+    "version": "2.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "crypto",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "timing",
+    "version": "1.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "json_annotation"
+    ]
+  },
+  {
+    "name": "stream_transform",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "shelf_web_socket",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "shelf",
+      "stream_channel",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "shelf",
+    "version": "1.4.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection",
+      "http_parser",
+      "path",
+      "stack_trace",
+      "stream_channel"
+    ]
+  },
+  {
+    "name": "mime",
+    "version": "1.0.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "js",
+    "version": "0.6.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "http_multi_server",
+    "version": "3.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async"
+    ]
+  },
+  {
+    "name": "frontend_server_client",
+    "version": "3.2.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "path"
+    ]
+  },
+  {
+    "name": "build_runner_core",
+    "version": "7.2.8",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "build",
+      "build_config",
+      "build_resolvers",
+      "collection",
+      "convert",
+      "crypto",
+      "glob",
+      "graphs",
+      "json_annotation",
+      "logging",
+      "meta",
+      "path",
+      "package_config",
+      "pool",
+      "timing",
+      "watcher",
+      "yaml"
+    ]
+  },
+  {
+    "name": "build_resolvers",
+    "version": "2.2.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "analyzer",
+      "async",
+      "build",
+      "collection",
+      "crypto",
+      "graphs",
+      "logging",
+      "package_config",
+      "path",
+      "pool",
+      "pub_semver",
+      "stream_transform",
+      "yaml"
+    ]
+  },
+  {
+    "name": "build_daemon",
+    "version": "4.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "built_collection",
+      "built_value",
+      "http_multi_server",
+      "logging",
+      "path",
+      "pool",
+      "shelf",
+      "shelf_web_socket",
+      "stream_transform",
+      "watcher",
+      "web_socket_channel"
+    ]
+  },
+  {
+    "name": "yaru_widgets",
+    "version": "3.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "yaru",
+      "yaru_icons",
+      "yaru_window"
+    ]
+  },
+  {
+    "name": "yaru_window",
+    "version": "0.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "yaru_window_linux",
+      "yaru_window_manager",
+      "yaru_window_platform_interface",
+      "yaru_window_web"
+    ]
+  },
+  {
+    "name": "yaru_window_web",
+    "version": "0.0.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "yaru_window_platform_interface"
+    ]
+  },
+  {
+    "name": "yaru_window_platform_interface",
+    "version": "0.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "meta",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "plugin_platform_interface",
+    "version": "2.1.5",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "flutter_web_plugins",
+    "version": "0.0.0",
+    "kind": "transitive",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "characters",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "vector_math",
+      "web"
+    ]
+  },
+  {
+    "name": "yaru_window_manager",
+    "version": "0.1.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_web_plugins",
+      "window_manager",
+      "yaru_window_platform_interface"
+    ]
+  },
+  {
+    "name": "window_manager",
+    "version": "0.3.6",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "path",
+      "screen_retriever"
+    ]
+  },
+  {
+    "name": "screen_retriever",
+    "version": "0.1.9",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "yaru_window_linux",
+    "version": "0.1.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "plugin_platform_interface"
+    ]
+  },
+  {
+    "name": "yaru_icons",
+    "version": "2.2.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "yaru",
+    "version": "1.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "flutter",
+      "gtk",
+      "platform"
+    ]
+  },
+  {
+    "name": "gtk",
+    "version": "2.1.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "ffi",
+      "flutter",
+      "meta"
+    ]
+  },
+  {
+    "name": "ffi",
+    "version": "2.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "yaru_colors",
+    "version": "0.1.7",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "flutter",
+      "meta",
+      "yaru_color_generator"
+    ]
+  },
+  {
+    "name": "yaru_color_generator",
+    "version": "0.1.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta"
+    ]
+  },
+  {
+    "name": "upower",
+    "version": "0.7.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "dbus"
+    ]
+  },
+  {
+    "name": "dbus",
+    "version": "0.7.8",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "ffi",
+      "meta",
+      "xml"
+    ]
+  },
+  {
+    "name": "xml",
+    "version": "6.3.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "meta",
+      "petitparser"
+    ]
+  },
+  {
+    "name": "petitparser",
+    "version": "5.4.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta"
+    ]
+  },
+  {
+    "name": "ubuntu_test",
+    "version": "0.1.0-beta.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_html",
+      "flutter_markdown",
+      "flutter_svg",
+      "flutter_test",
+      "mockito",
+      "test_api",
+      "ubuntu_localizations",
+      "yaru_test"
+    ]
+  },
+  {
+    "name": "yaru_test",
+    "version": "0.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "flutter_test",
+      "yaru",
+      "yaru_widgets",
+      "yaru_window_platform_interface"
+    ]
+  },
+  {
+    "name": "ubuntu_localizations",
+    "version": "0.3.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "diacritic",
+      "flutter",
+      "flutter_localizations",
+      "intl"
+    ]
+  },
+  {
+    "name": "intl",
+    "version": "0.18.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "clock",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "flutter_localizations",
+    "version": "0.0.0",
+    "kind": "direct",
+    "source": "sdk",
+    "dependencies": [
+      "flutter",
+      "intl",
+      "characters",
+      "clock",
+      "collection",
+      "material_color_utilities",
+      "meta",
+      "path",
+      "vector_math",
+      "web"
+    ]
+  },
+  {
+    "name": "diacritic",
+    "version": "0.1.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "flutter_svg",
+    "version": "2.0.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "vector_graphics",
+      "vector_graphics_codec",
+      "vector_graphics_compiler"
+    ]
+  },
+  {
+    "name": "vector_graphics_compiler",
+    "version": "1.1.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "meta",
+      "path_parsing",
+      "xml",
+      "vector_graphics_codec"
+    ]
+  },
+  {
+    "name": "vector_graphics_codec",
+    "version": "1.1.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "path_parsing",
+    "version": "1.0.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "vector_math",
+      "meta"
+    ]
+  },
+  {
+    "name": "vector_graphics",
+    "version": "1.1.7",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "vector_graphics_codec"
+    ]
+  },
+  {
+    "name": "flutter_markdown",
+    "version": "0.6.17+1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter",
+      "markdown",
+      "meta",
+      "path"
+    ]
+  },
+  {
+    "name": "markdown",
+    "version": "7.1.1",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "args",
+      "meta"
+    ]
+  },
+  {
+    "name": "flutter_html",
+    "version": "3.0.0-beta.2",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "html",
+      "csslib",
+      "collection",
+      "list_counter",
+      "flutter"
+    ]
+  },
+  {
+    "name": "list_counter",
+    "version": "1.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": []
+  },
+  {
+    "name": "csslib",
+    "version": "0.17.3",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "source_span"
+    ]
+  },
+  {
+    "name": "html",
+    "version": "0.15.4",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "csslib",
+      "source_span"
+    ]
+  },
+  {
+    "name": "ubuntu_session",
+    "version": "0.0.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "dbus",
+      "meta"
+    ]
+  },
+  {
+    "name": "ubuntu_service",
+    "version": "0.2.4",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "get_it",
+      "meta"
+    ]
+  },
+  {
+    "name": "get_it",
+    "version": "7.6.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "async",
+      "collection"
+    ]
+  },
+  {
+    "name": "ubuntu_logger",
+    "version": "0.0.3",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "logging",
+      "logging_appenders",
+      "path"
+    ]
+  },
+  {
+    "name": "logging_appenders",
+    "version": "1.0.2",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "meta",
+      "logging",
+      "dio",
+      "intl",
+      "clock"
+    ]
+  },
+  {
+    "name": "dio",
+    "version": "4.0.6",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "http_parser",
+      "path"
+    ]
+  },
+  {
+    "name": "safe_change_notifier",
+    "version": "0.2.0",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "provider",
+    "version": "6.0.5",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "collection",
+      "flutter",
+      "nested"
+    ]
+  },
+  {
+    "name": "nested",
+    "version": "1.0.0",
+    "kind": "transitive",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "handy_window",
+    "version": "0.3.1",
+    "kind": "direct",
+    "source": "hosted",
+    "dependencies": [
+      "flutter"
+    ]
+  },
+  {
+    "name": "fwupd",
+    "version": "0.2.2",
+    "kind": "direct",
+    "source": "git",
+    "dependencies": [
+      "collection",
+      "dbus",
+      "meta"
+    ]
+  }
+]
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock b/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
new file mode 100644
index 00000000000..99d5d74560b
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/pubspec.lock
@@ -0,0 +1,1079 @@
+# Generated by pub
+# See https://dart.dev/tools/pub/glossary#lockfile
+packages:
+  _fe_analyzer_shared:
+    dependency: transitive
+    description:
+      name: _fe_analyzer_shared
+      sha256: ae92f5d747aee634b87f89d9946000c2de774be1d6ac3e58268224348cd0101a
+      url: "https://pub.dev"
+    source: hosted
+    version: "61.0.0"
+  analyzer:
+    dependency: transitive
+    description:
+      name: analyzer
+      sha256: ea3d8652bda62982addfd92fdc2d0214e5f82e43325104990d4f4c4a2a313562
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.13.0"
+  ansi_styles:
+    dependency: transitive
+    description:
+      name: ansi_styles
+      sha256: "9c656cc12b3c27b17dd982b2cc5c0cfdfbdabd7bc8f3ae5e8542d9867b47ce8a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.2+1"
+  args:
+    dependency: transitive
+    description:
+      name: args
+      sha256: eef6c46b622e0494a36c5a12d10d77fb4e855501a91c1b9ef9339326e58f0596
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.2"
+  async:
+    dependency: transitive
+    description:
+      name: async
+      sha256: "947bfcf187f74dbc5e146c9eb9c0f10c9f8b30743e341481c1e2ed3ecc18c20c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.11.0"
+  boolean_selector:
+    dependency: transitive
+    description:
+      name: boolean_selector
+      sha256: "6cfb5af12253eaf2b368f07bacc5a80d1301a071c73360d746b7f2e32d762c66"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  build:
+    dependency: transitive
+    description:
+      name: build
+      sha256: "80184af8b6cb3e5c1c4ec6d8544d27711700bc3e6d2efad04238c7b5290889f0"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.1"
+  build_config:
+    dependency: transitive
+    description:
+      name: build_config
+      sha256: bf80fcfb46a29945b423bd9aad884590fb1dc69b330a4d4700cac476af1708d1
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  build_daemon:
+    dependency: transitive
+    description:
+      name: build_daemon
+      sha256: "5f02d73eb2ba16483e693f80bee4f088563a820e47d1027d4cdfe62b5bb43e65"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.0"
+  build_resolvers:
+    dependency: transitive
+    description:
+      name: build_resolvers
+      sha256: "6c4dd11d05d056e76320b828a1db0fc01ccd376922526f8e9d6c796a5adbac20"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.2.1"
+  build_runner:
+    dependency: "direct dev"
+    description:
+      name: build_runner
+      sha256: "10c6bcdbf9d049a0b666702cf1cee4ddfdc38f02a19d35ae392863b47519848b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.6"
+  build_runner_core:
+    dependency: transitive
+    description:
+      name: build_runner_core
+      sha256: "30859c90e9ddaccc484f56303931f477b1f1ba2bab74aa32ed5d6ce15870f8cf"
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.2.8"
+  built_collection:
+    dependency: transitive
+    description:
+      name: built_collection
+      sha256: "376e3dd27b51ea877c28d525560790aee2e6fbb5f20e2f85d5081027d94e2100"
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.1.1"
+  built_value:
+    dependency: transitive
+    description:
+      name: built_value
+      sha256: ff627b645b28fb8bdb69e645f910c2458fd6b65f6585c3a53e0626024897dedf
+      url: "https://pub.dev"
+    source: hosted
+    version: "8.6.2"
+  characters:
+    dependency: transitive
+    description:
+      name: characters
+      sha256: "04a925763edad70e8443c99234dc3328f442e811f1d8fd1a72f1c8ad0f69a605"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.0"
+  charcode:
+    dependency: transitive
+    description:
+      name: charcode
+      sha256: fb98c0f6d12c920a02ee2d998da788bca066ca5f148492b7085ee23372b12306
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.1"
+  checked_yaml:
+    dependency: transitive
+    description:
+      name: checked_yaml
+      sha256: feb6bed21949061731a7a75fc5d2aa727cf160b91af9a3e464c5e3a32e28b5ff
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.3"
+  cli_launcher:
+    dependency: transitive
+    description:
+      name: cli_launcher
+      sha256: "5e7e0282b79e8642edd6510ee468ae2976d847a0a29b3916e85f5fa1bfe24005"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  cli_util:
+    dependency: transitive
+    description:
+      name: cli_util
+      sha256: b8db3080e59b2503ca9e7922c3df2072cf13992354d5e944074ffa836fba43b7
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.4.0"
+  clock:
+    dependency: transitive
+    description:
+      name: clock
+      sha256: cb6d7f03e1de671e34607e909a7213e31d7752be4fb66a86d29fe1eb14bfb5cf
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  code_builder:
+    dependency: transitive
+    description:
+      name: code_builder
+      sha256: "4ad01d6e56db961d29661561effde45e519939fdaeb46c351275b182eac70189"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.5.0"
+  collection:
+    dependency: "direct main"
+    description:
+      name: collection
+      sha256: f092b211a4319e98e5ff58223576de6c2803db36221657b46c82574721240687
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.17.2"
+  conventional_commit:
+    dependency: transitive
+    description:
+      name: conventional_commit
+      sha256: dec15ad1118f029c618651a4359eb9135d8b88f761aa24e4016d061cd45948f2
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.0+1"
+  convert:
+    dependency: transitive
+    description:
+      name: convert
+      sha256: "0f08b14755d163f6e2134cb58222dd25ea2a2ee8a195e53983d57c075324d592"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.1"
+  crypto:
+    dependency: transitive
+    description:
+      name: crypto
+      sha256: ff625774173754681d66daaf4a448684fb04b78f902da9cb3d308c19cc5e8bab
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.3"
+  csslib:
+    dependency: transitive
+    description:
+      name: csslib
+      sha256: "831883fb353c8bdc1d71979e5b342c7d88acfbc643113c14ae51e2442ea0f20f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.17.3"
+  dart_style:
+    dependency: transitive
+    description:
+      name: dart_style
+      sha256: "1efa911ca7086affd35f463ca2fc1799584fb6aa89883cf0af8e3664d6a02d55"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.2"
+  dbus:
+    dependency: "direct main"
+    description:
+      name: dbus
+      sha256: "6f07cba3f7b3448d42d015bfd3d53fe12e5b36da2423f23838efc1d5fb31a263"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.8"
+  diacritic:
+    dependency: transitive
+    description:
+      name: diacritic
+      sha256: a84e03ec2779375fb86430dbe9d8fba62c68376f2499097a5f6e75556babe706
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.4"
+  dio:
+    dependency: "direct main"
+    description:
+      name: dio
+      sha256: "7d328c4d898a61efc3cd93655a0955858e29a0aa647f0f9e02d59b3bb275e2e8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.6"
+  fake_async:
+    dependency: transitive
+    description:
+      name: fake_async
+      sha256: "511392330127add0b769b75a987850d136345d9227c6b94c96a04cf4a391bf78"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.1"
+  ffi:
+    dependency: transitive
+    description:
+      name: ffi
+      sha256: "7bf0adc28a23d395f19f3f1eb21dd7cfd1dd9f8e1c50051c069122e6853bc878"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  file:
+    dependency: "direct main"
+    description:
+      name: file
+      sha256: "1b92bec4fc2a72f59a8e15af5f52cd441e4a7860b49499d69dfa817af20e925d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.1.4"
+  fixnum:
+    dependency: transitive
+    description:
+      name: fixnum
+      sha256: "25517a4deb0c03aa0f32fd12db525856438902d9c16536311e76cdc57b31d7d1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  flutter:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_driver:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_html:
+    dependency: "direct main"
+    description:
+      name: flutter_html
+      sha256: "02ad69e813ecfc0728a455e4bf892b9379983e050722b1dce00192ee2e41d1ee"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.0-beta.2"
+  flutter_lints:
+    dependency: "direct dev"
+    description:
+      name: flutter_lints
+      sha256: "2118df84ef0c3ca93f96123a616ae8540879991b8b57af2f81b76a7ada49b2a4"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.2"
+  flutter_localizations:
+    dependency: "direct main"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_markdown:
+    dependency: transitive
+    description:
+      name: flutter_markdown
+      sha256: "2b206d397dd7836ea60035b2d43825c8a303a76a5098e66f42d55a753e18d431"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.17+1"
+  flutter_svg:
+    dependency: transitive
+    description:
+      name: flutter_svg
+      sha256: "8c5d68a82add3ca76d792f058b186a0599414f279f00ece4830b9b231b570338"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.7"
+  flutter_test:
+    dependency: "direct dev"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  flutter_web_plugins:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  freezed:
+    dependency: "direct dev"
+    description:
+      name: freezed
+      sha256: "2df89855fe181baae3b6d714dc3c4317acf4fccd495a6f36e5e00f24144c6c3b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.1"
+  freezed_annotation:
+    dependency: "direct main"
+    description:
+      name: freezed_annotation
+      sha256: c3fd9336eb55a38cc1bbd79ab17573113a8deccd0ecbbf926cca3c62803b5c2d
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.1"
+  frontend_server_client:
+    dependency: transitive
+    description:
+      name: frontend_server_client
+      sha256: "408e3ca148b31c20282ad6f37ebfa6f4bdc8fede5b74bc2f08d9d92b55db3612"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.0"
+  fuchsia_remote_debug_protocol:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  fwupd:
+    dependency: "direct main"
+    description:
+      path: "."
+      ref: refresh-property-cache
+      resolved-ref: "22f96d558fb3b72b682758a7b55f39002cd217c2"
+      url: "https://github.com/d-loose/fwupd.dart"
+    source: git
+    version: "0.2.2"
+  get_it:
+    dependency: transitive
+    description:
+      name: get_it
+      sha256: "529de303c739fca98cd7ece5fca500d8ff89649f1bb4b4e94fb20954abcd7468"
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.6.0"
+  glob:
+    dependency: transitive
+    description:
+      name: glob
+      sha256: "0e7014b3b7d4dac1ca4d6114f82bf1782ee86745b9b42a92c9289c23d8a0ab63"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.2"
+  graphs:
+    dependency: transitive
+    description:
+      name: graphs
+      sha256: aedc5a15e78fc65a6e23bcd927f24c64dd995062bcd1ca6eda65a3cff92a4d19
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.1"
+  gtk:
+    dependency: "direct main"
+    description:
+      name: gtk
+      sha256: e8ce9ca4b1df106e4d72dad201d345ea1a036cc12c360f1a7d5a758f78ffa42c
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  handy_window:
+    dependency: "direct main"
+    description:
+      name: handy_window
+      sha256: "458a9f7d4ae23816e8f33c76596f943a04e7eff13d864e0867f3b40f1647d63d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  html:
+    dependency: transitive
+    description:
+      name: html
+      sha256: "3a7812d5bcd2894edf53dfaf8cd640876cf6cef50a8f238745c8b8120ea74d3a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.15.4"
+  http:
+    dependency: transitive
+    description:
+      name: http
+      sha256: "759d1a329847dd0f39226c688d3e06a6b8679668e350e2891a6474f8b4bb8525"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  http_multi_server:
+    dependency: transitive
+    description:
+      name: http_multi_server
+      sha256: "97486f20f9c2f7be8f514851703d0119c3596d14ea63227af6f7a481ef2b2f8b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.1"
+  http_parser:
+    dependency: transitive
+    description:
+      name: http_parser
+      sha256: "2aa08ce0341cc9b354a498388e30986515406668dbcc4f7c950c3e715496693b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.0.2"
+  integration_test:
+    dependency: "direct dev"
+    description: flutter
+    source: sdk
+    version: "0.0.0"
+  intl:
+    dependency: transitive
+    description:
+      name: intl
+      sha256: "3bc132a9dbce73a7e4a21a17d06e1878839ffbf975568bc875c60537824b0c4d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.18.1"
+  io:
+    dependency: transitive
+    description:
+      name: io
+      sha256: "2ec25704aba361659e10e3e5f5d672068d332fc8ac516421d483a11e5cbd061e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  js:
+    dependency: transitive
+    description:
+      name: js
+      sha256: f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.7"
+  json_annotation:
+    dependency: transitive
+    description:
+      name: json_annotation
+      sha256: b10a7b2ff83d83c777edba3c6a0f97045ddadd56c944e1a23a3fdf43a1bf4467
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.8.1"
+  lints:
+    dependency: transitive
+    description:
+      name: lints
+      sha256: "0a217c6c989d21039f1498c3ed9f3ed71b354e69873f13a8dfc3c9fe76f1b452"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  list_counter:
+    dependency: transitive
+    description:
+      name: list_counter
+      sha256: c447ae3dfcd1c55f0152867090e67e219d42fe6d4f2807db4bbe8b8d69912237
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.2"
+  logging:
+    dependency: transitive
+    description:
+      name: logging
+      sha256: "04094f2eb032cbb06c6f6e8d3607edcfcb0455e2bb6cbc010cb01171dcb64e6d"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.1"
+  logging_appenders:
+    dependency: transitive
+    description:
+      name: logging_appenders
+      sha256: c2ea00fb779a81e995943f1e3e6e6969d463de3882d134d78ad58e76f2b6f1b1
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.2"
+  markdown:
+    dependency: transitive
+    description:
+      name: markdown
+      sha256: acf35edccc0463a9d7384e437c015a3535772e09714cf60e07eeef3a15870dcd
+      url: "https://pub.dev"
+    source: hosted
+    version: "7.1.1"
+  matcher:
+    dependency: transitive
+    description:
+      name: matcher
+      sha256: "1803e76e6653768d64ed8ff2e1e67bea3ad4b923eb5c56a295c3e634bad5960e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.12.16"
+  material_color_utilities:
+    dependency: transitive
+    description:
+      name: material_color_utilities
+      sha256: "9528f2f296073ff54cb9fee677df673ace1218163c3bc7628093e7eed5203d41"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.5.0"
+  melos:
+    dependency: "direct dev"
+    description:
+      name: melos
+      sha256: "3f22f6cc629d72acf3acc8a7f8563384550290fa30790efa328c9cf606aa17d7"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.1"
+  meta:
+    dependency: "direct main"
+    description:
+      name: meta
+      sha256: "3c74dbf8763d36539f114c799d8a2d87343b5067e9d796ca22b5eb8437090ee3"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.9.1"
+  mime:
+    dependency: transitive
+    description:
+      name: mime
+      sha256: e4ff8e8564c03f255408decd16e7899da1733852a9110a58fe6d1b817684a63e
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  mockito:
+    dependency: "direct dev"
+    description:
+      name: mockito
+      sha256: "7d5b53bcd556c1bc7ffbe4e4d5a19c3e112b7e925e9e172dd7c6ad0630812616"
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.4.2"
+  mustache_template:
+    dependency: transitive
+    description:
+      name: mustache_template
+      sha256: a46e26f91445bfb0b60519be280555b06792460b27b19e2b19ad5b9740df5d1c
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  nested:
+    dependency: transitive
+    description:
+      name: nested
+      sha256: "03bac4c528c64c95c722ec99280375a6f2fc708eec17c7b3f07253b626cd2a20"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  package_config:
+    dependency: transitive
+    description:
+      name: package_config
+      sha256: "1c5b77ccc91e4823a5af61ee74e6b972db1ef98c2ff5a18d3161c982a55448bd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  path:
+    dependency: "direct main"
+    description:
+      name: path
+      sha256: "8829d8a55c13fc0e37127c29fedf290c102f4e40ae94ada574091fe0ff96c917"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.8.3"
+  path_parsing:
+    dependency: transitive
+    description:
+      name: path_parsing
+      sha256: e3e67b1629e6f7e8100b367d3db6ba6af4b1f0bb80f64db18ef1fbabd2fa9ccf
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.1"
+  petitparser:
+    dependency: transitive
+    description:
+      name: petitparser
+      sha256: cb3798bef7fc021ac45b308f4b51208a152792445cce0448c9a4ba5879dd8750
+      url: "https://pub.dev"
+    source: hosted
+    version: "5.4.0"
+  platform:
+    dependency: transitive
+    description:
+      name: platform
+      sha256: "4a451831508d7d6ca779f7ac6e212b4023dd5a7d08a27a63da33756410e32b76"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.0"
+  plugin_platform_interface:
+    dependency: transitive
+    description:
+      name: plugin_platform_interface
+      sha256: "43798d895c929056255600343db8f049921cbec94d31ec87f1dc5c16c01935dd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.5"
+  pool:
+    dependency: transitive
+    description:
+      name: pool
+      sha256: "20fe868b6314b322ea036ba325e6fc0711a22948856475e2c2b6306e8ab39c2a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.5.1"
+  process:
+    dependency: transitive
+    description:
+      name: process
+      sha256: "53fd8db9cec1d37b0574e12f07520d582019cb6c44abf5479a01505099a34a09"
+      url: "https://pub.dev"
+    source: hosted
+    version: "4.2.4"
+  prompts:
+    dependency: transitive
+    description:
+      name: prompts
+      sha256: "3773b845e85a849f01e793c4fc18a45d52d7783b4cb6c0569fad19f9d0a774a1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.0.0"
+  provider:
+    dependency: "direct main"
+    description:
+      name: provider
+      sha256: cdbe7530b12ecd9eb455bdaa2fcb8d4dad22e80b8afb4798b41479d5ce26847f
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.0.5"
+  pub_semver:
+    dependency: transitive
+    description:
+      name: pub_semver
+      sha256: "40d3ab1bbd474c4c2328c91e3a7df8c6dd629b79ece4c4bd04bee496a224fb0c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.4"
+  pub_updater:
+    dependency: transitive
+    description:
+      name: pub_updater
+      sha256: b06600619c8c219065a548f8f7c192b3e080beff95488ed692780f48f69c0625
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  pubspec:
+    dependency: transitive
+    description:
+      name: pubspec
+      sha256: f534a50a2b4d48dc3bc0ec147c8bd7c304280fff23b153f3f11803c4d49d927e
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.3.0"
+  pubspec_parse:
+    dependency: transitive
+    description:
+      name: pubspec_parse
+      sha256: c63b2876e58e194e4b0828fcb080ad0e06d051cb607a6be51a9e084f47cb9367
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.3"
+  quiver:
+    dependency: transitive
+    description:
+      name: quiver
+      sha256: b1c1ac5ce6688d77f65f3375a9abb9319b3cb32486bdc7a1e0fdf004d7ba4e47
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.2.1"
+  safe_change_notifier:
+    dependency: "direct main"
+    description:
+      name: safe_change_notifier
+      sha256: e69034655ea33aa7dce3c5bb33cf12fc7c07a0ce7d59b7291fd030b70d059570
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.0"
+  screen_retriever:
+    dependency: transitive
+    description:
+      name: screen_retriever
+      sha256: "6ee02c8a1158e6dae7ca430da79436e3b1c9563c8cf02f524af997c201ac2b90"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.9"
+  shelf:
+    dependency: transitive
+    description:
+      name: shelf
+      sha256: ad29c505aee705f41a4d8963641f91ac4cee3c8fad5947e033390a7bd8180fa4
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.4.1"
+  shelf_web_socket:
+    dependency: transitive
+    description:
+      name: shelf_web_socket
+      sha256: "9ca081be41c60190ebcb4766b2486a7d50261db7bd0f5d9615f2d653637a84c1"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.4"
+  sky_engine:
+    dependency: transitive
+    description: flutter
+    source: sdk
+    version: "0.0.99"
+  source_gen:
+    dependency: transitive
+    description:
+      name: source_gen
+      sha256: fc0da689e5302edb6177fdd964efcb7f58912f43c28c2047a808f5bfff643d16
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.4.0"
+  source_span:
+    dependency: transitive
+    description:
+      name: source_span
+      sha256: "53e943d4206a5e30df338fd4c6e7a077e02254531b138a15aec3bd143c1a8b3c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.10.0"
+  stack_trace:
+    dependency: transitive
+    description:
+      name: stack_trace
+      sha256: c3c7d8edb15bee7f0f74debd4b9c5f3c2ea86766fe4178eb2a18eb30a0bdaed5
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.11.0"
+  stream_channel:
+    dependency: transitive
+    description:
+      name: stream_channel
+      sha256: "83615bee9045c1d322bbbd1ba209b7a749c2cbcdcb3fdd1df8eb488b3279c1c8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  stream_transform:
+    dependency: transitive
+    description:
+      name: stream_transform
+      sha256: "14a00e794c7c11aa145a170587321aedce29769c08d7f58b1d141da75e3b1c6f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.0"
+  string_scanner:
+    dependency: transitive
+    description:
+      name: string_scanner
+      sha256: "556692adab6cfa87322a115640c11f13cb77b3f076ddcc5d6ae3c20242bedcde"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.0"
+  sync_http:
+    dependency: transitive
+    description:
+      name: sync_http
+      sha256: "7f0cd72eca000d2e026bcd6f990b81d0ca06022ef4e32fb257b30d3d1014a961"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.1"
+  term_glyph:
+    dependency: transitive
+    description:
+      name: term_glyph
+      sha256: a29248a84fbb7c79282b40b8c72a1209db169a2e0542bce341da992fe1bc7e84
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.2.1"
+  test_api:
+    dependency: "direct overridden"
+    description:
+      name: test_api
+      sha256: "5c2f730018264d276c20e4f1503fd1308dfbbae39ec8ee63c5236311ac06954b"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.6.1"
+  timing:
+    dependency: transitive
+    description:
+      name: timing
+      sha256: "70a3b636575d4163c477e6de42f247a23b315ae20e86442bebe32d3cabf61c32"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.1"
+  typed_data:
+    dependency: transitive
+    description:
+      name: typed_data
+      sha256: facc8d6582f16042dd49f2463ff1bd6e2c9ef9f3d5da3d9b087e244a7b564b3c
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.3.2"
+  ubuntu_localizations:
+    dependency: transitive
+    description:
+      name: ubuntu_localizations
+      sha256: a75e87b9f1c3dc678f69a943eb4cee8ccbd5b0db64d491750325950e311adab0
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.4"
+  ubuntu_logger:
+    dependency: "direct main"
+    description:
+      name: ubuntu_logger
+      sha256: f6d663e5b9c33e90a7a77a2f15b7f76e90be1dd98a94b6640d7bd74db262060f
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.0.3"
+  ubuntu_service:
+    dependency: "direct main"
+    description:
+      name: ubuntu_service
+      sha256: f6ad4dfb099af41e750c59aad00d67a96e22df00f4962d2e25d56ae3db78be49
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.2.4"
+  ubuntu_session:
+    dependency: "direct main"
+    description:
+      name: ubuntu_session
+      sha256: ce79fdd31faf7982b061b2e4a1cdd0815baf3b6b976e9c16c72609749511f3a1
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.0.4"
+  ubuntu_test:
+    dependency: "direct main"
+    description:
+      name: ubuntu_test
+      sha256: "2361b741808a11d95c64a50666151d536133e75cade17b8feccca1e67364be88"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.0-beta.6"
+  upower:
+    dependency: "direct main"
+    description:
+      name: upower
+      sha256: cf042403154751180affa1d15614db7fa50234bc2373cd21c3db666c38543ebf
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.7.0"
+  uri:
+    dependency: transitive
+    description:
+      name: uri
+      sha256: "889eea21e953187c6099802b7b4cf5219ba8f3518f604a1033064d45b1b8268a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.0.0"
+  vector_graphics:
+    dependency: transitive
+    description:
+      name: vector_graphics
+      sha256: "670f6e07aca990b4a2bcdc08a784193c4ccdd1932620244c3a86bb72a0eac67f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.7"
+  vector_graphics_codec:
+    dependency: transitive
+    description:
+      name: vector_graphics_codec
+      sha256: "7451721781d967db9933b63f5733b1c4533022c0ba373a01bdd79d1a5457f69f"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.7"
+  vector_graphics_compiler:
+    dependency: transitive
+    description:
+      name: vector_graphics_compiler
+      sha256: "80a13c613c8bde758b1464a1755a7b3a8f2b6cec61fbf0f5a53c94c30f03ba2e"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.7"
+  vector_math:
+    dependency: transitive
+    description:
+      name: vector_math
+      sha256: "80b3257d1492ce4d091729e3a67a60407d227c27241d6927be0130c98e741803"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.4"
+  vm_service:
+    dependency: transitive
+    description:
+      name: vm_service
+      sha256: c620a6f783fa22436da68e42db7ebbf18b8c44b9a46ab911f666ff09ffd9153f
+      url: "https://pub.dev"
+    source: hosted
+    version: "11.7.1"
+  watcher:
+    dependency: transitive
+    description:
+      name: watcher
+      sha256: "3d2ad6751b3c16cf07c7fca317a1413b3f26530319181b37e3b9039b84fc01d8"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  web:
+    dependency: transitive
+    description:
+      name: web
+      sha256: dc8ccd225a2005c1be616fe02951e2e342092edf968cf0844220383757ef8f10
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.4-beta"
+  web_socket_channel:
+    dependency: transitive
+    description:
+      name: web_socket_channel
+      sha256: d88238e5eac9a42bb43ca4e721edba3c08c6354d4a53063afaa568516217621b
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.4.0"
+  webdriver:
+    dependency: transitive
+    description:
+      name: webdriver
+      sha256: "3c923e918918feeb90c4c9fdf1fe39220fa4c0e8e2c0fffaded174498ef86c49"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.0.2"
+  window_manager:
+    dependency: transitive
+    description:
+      name: window_manager
+      sha256: "6ee795be9124f90660ea9d05e581a466de19e1c89ee74fc4bf528f60c8600edd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.3.6"
+  xml:
+    dependency: transitive
+    description:
+      name: xml
+      sha256: "5bc72e1e45e941d825fd7468b9b4cc3b9327942649aeb6fc5cdbf135f0a86e84"
+      url: "https://pub.dev"
+    source: hosted
+    version: "6.3.0"
+  yaml:
+    dependency: transitive
+    description:
+      name: yaml
+      sha256: "75769501ea3489fca56601ff33454fe45507ea3bfb014161abc3b43ae25989d5"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.2"
+  yaml_edit:
+    dependency: transitive
+    description:
+      name: yaml_edit
+      sha256: "1579d4a0340a83cf9e4d580ea51a16329c916973bffd5bd4b45e911b25d46bfd"
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.1.1"
+  yaru:
+    dependency: "direct main"
+    description:
+      name: yaru
+      sha256: "24047f0de452784840a326874192d26cb5ebd8cf5eac7864086e5bc9272a28db"
+      url: "https://pub.dev"
+    source: hosted
+    version: "1.1.0"
+  yaru_color_generator:
+    dependency: transitive
+    description:
+      name: yaru_color_generator
+      sha256: "78b96cefc4eef763e4786f891ce336cdd55ef8edc55494c4bea2bc9d10ef9c96"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.0"
+  yaru_colors:
+    dependency: "direct main"
+    description:
+      name: yaru_colors
+      sha256: "42814cafa3c4a6876962559ae9d8b9ff088a59635e649e4eae86d35905496063"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.7"
+  yaru_icons:
+    dependency: "direct main"
+    description:
+      name: yaru_icons
+      sha256: cbb0b5945f407116fd8a1fbe7265e7ffa0d568249d496343a69cb5c55360bba1
+      url: "https://pub.dev"
+    source: hosted
+    version: "2.2.1"
+  yaru_test:
+    dependency: transitive
+    description:
+      name: yaru_test
+      sha256: "9396269fbe026bb9c398b9d4308c76982090ddeca102e4846bd4ba595333ff0a"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.4"
+  yaru_widgets:
+    dependency: "direct main"
+    description:
+      name: yaru_widgets
+      sha256: "482a71ef5566c6cb4135272f0041bf8a9c35729bf9079b0d304eedfa2fa0cc0c"
+      url: "https://pub.dev"
+    source: hosted
+    version: "3.1.0"
+  yaru_window:
+    dependency: transitive
+    description:
+      name: yaru_window
+      sha256: "55c8f039d13aaa1b211a8cf0b7731ae2fdcac9b1be1e0994eb14ad1d17fecaf7"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.3"
+  yaru_window_linux:
+    dependency: transitive
+    description:
+      name: yaru_window_linux
+      sha256: c45606cf75880ae6427bbe176dc5313356f16c876c7013a19aeee782882c40c2
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.3"
+  yaru_window_manager:
+    dependency: transitive
+    description:
+      name: yaru_window_manager
+      sha256: "2d358263d19ae6598df21d6d8c0d25e75c79a82f459b63b0013a13e395c48b23"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.2"
+  yaru_window_platform_interface:
+    dependency: transitive
+    description:
+      name: yaru_window_platform_interface
+      sha256: e9f8cd34e207d7f7b771ae70dee347ed974cee06b981819c4181b3e474e52254
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.1.2"
+  yaru_window_web:
+    dependency: transitive
+    description:
+      name: yaru_window_web
+      sha256: "3ff30758a330d7626d54643df0cca6c179782f401aba7752da9cc0d60c9a6f74"
+      url: "https://pub.dev"
+    source: hosted
+    version: "0.0.3"
+sdks:
+  dart: ">=3.1.0-185.0.dev <4.0.0"
+  flutter: ">=3.10.0"
diff --git a/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
new file mode 100644
index 00000000000..a8adefc6346
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/fwupd-efi/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchFromGitHub
+, substituteAll
+, pkg-config
+, meson
+, ninja
+, gnu-efi
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fwupd-efi";
+  version = "1.3";
+
+  src = fetchurl {
+    url = "https://people.freedesktop.org/~hughsient/releases/${pname}-${version}.tar.xz";
+    sha256 = "sha256-1Ys04TwhWYZ8ORJgr04kGO6/lI1I36sC6kcrVoP/r1k=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    gnu-efi
+  ];
+
+  postPatch = ''
+    patchShebangs \
+      efi/generate_binary.py \
+      efi/generate_sbat.py
+  '';
+
+  mesonFlags = [
+    "-Defi-includedir=${gnu-efi}/include/efi"
+    "-Defi-libdir=${gnu-efi}/lib"
+    "-Defi-ldsdir=${gnu-efi}/lib"
+    "-Defi_sbat_distro_id=nixos"
+    "-Defi_sbat_distro_summary=NixOS"
+    "-Defi_sbat_distro_pkgname=${pname}"
+    "-Defi_sbat_distro_version=${version}"
+    "-Defi_sbat_distro_url=https://search.nixos.org/packages?channel=unstable&show=fwupd-efi&from=0&size=50&sort=relevance&query=fwupd-efi"
+  ];
+
+  meta = with lib; {
+    homepage = "https://fwupd.org/";
+    maintainers = with maintainers; [ amaxine ];
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
index cd42f2f44e2..4e95ccea8dc 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,85 +1,105 @@
+diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
+index b0ff5b106..13ac380d0 100644
+--- a/data/bios-settings.d/meson.build
++++ b/data/bios-settings.d/meson.build
+@@ -1,5 +1,5 @@
+ if build_standalone and host_machine.system() == 'linux'
+ install_data('README.md',
+-  install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d')
++  install_dir: join_paths(sysconfdir_install, 'fwupd', 'bios-settings.d')
+ )
+ endif
 diff --git a/data/meson.build b/data/meson.build
-index 50154569..f8058a8e 100644
+index e13da4adf..6858c240f 100644
 --- a/data/meson.build
 +++ b/data/meson.build
-@@ -17,7 +17,7 @@ endif
- 
+@@ -26,7 +26,7 @@ endif
+
  if build_standalone
-   install_data(['daemon.conf'],
--    install_dir : join_paths(sysconfdir, 'fwupd')
-+    install_dir : join_paths(sysconfdir_install, 'fwupd')
+   install_data(['fwupd.conf'],
+-    install_dir: join_paths(sysconfdir, 'fwupd'),
++    install_dir: join_paths(sysconfdir_install, 'fwupd'),
+     install_mode: 'rw-r-----',
    )
- endif
- 
+   plugin_quirks += files([
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 94bb0b6f..1ea6a9ac 100644
+index 3649fecea..c3462744b 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
-@@ -3,24 +3,23 @@ install_data([
+@@ -12,13 +12,13 @@ install_data([
      'GPG-KEY-Linux-Foundation-Firmware',
      'GPG-KEY-Linux-Vendor-Firmware-Service',
    ],
--  install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
-+  install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd')
+-  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
++  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
  )
- 
  install_data([
      'GPG-KEY-Linux-Foundation-Metadata',
      'GPG-KEY-Linux-Vendor-Firmware-Service',
    ],
--  install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+  install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
+-  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
++  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
  )
- 
+ endif
+
+@@ -26,11 +26,11 @@ if supported_pkcs7
  install_data([
      'LVFS-CA.pem',
    ],
--  install_dir : join_paths(sysconfdir, 'pki', 'fwupd')
-+  install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd')
+-  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
++  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
  )
  install_data([
      'LVFS-CA.pem',
    ],
--  install_dir : join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+  install_dir : join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
+-  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
++  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
  )
--
+ endif
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index 826a3c1d..b78db663 100644
+index c20a1a05e..5354bac7f 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
-@@ -3,7 +3,7 @@ if build_daemon and get_option('lvfs')
-       'lvfs.conf',
-       'lvfs-testing.conf',
-     ],
--    install_dir : join_paths(sysconfdir, 'fwupd', 'remotes.d')
-+    install_dir : join_paths(sysconfdir_install, 'fwupd', 'remotes.d')
+@@ -15,14 +15,14 @@ if build_standalone and get_option('lvfs') != 'false'
+     output: 'lvfs.conf',
+     configuration: con3,
+     install: true,
+-    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
++    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
+   )
+   configure_file(
+     input: 'lvfs-testing.conf',
+     output: 'lvfs-testing.conf',
+     configuration: con3,
+     install: true,
+-    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
++    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
    )
    i18n.merge_file(
      input: 'lvfs.metainfo.xml',
-@@ -37,12 +37,12 @@ configure_file(
-   output : 'vendor.conf',
-   configuration : con2,
+@@ -56,12 +56,12 @@ configure_file(
+   output: 'vendor.conf',
+   configuration: con2,
    install: true,
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
  configure_file(
-   input : 'vendor-directory.conf',
-   output : 'vendor-directory.conf',
-   configuration : con2,
+   input: 'vendor-directory.conf',
+   output: 'vendor-directory.conf',
+   configuration: con2,
    install: true,
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index b075ca89..8d504d3c 100644
+index ca6ccdf92..0a3097d90 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -194,6 +194,12 @@ endif
+@@ -195,6 +195,12 @@ endif
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
- 
+
 +if get_option('sysconfdir_install') != ''
 +  sysconfdir_install = join_paths(prefix, get_option('sysconfdir_install'))
 +else
@@ -87,75 +107,32 @@ index b075ca89..8d504d3c 100644
 +endif
 +
  diffcmd = find_program('diff')
- gio = dependency('gio-2.0', version : '>= 2.45.8')
- giounix = dependency('gio-unix-2.0', version : '>= 2.45.8', required: false)
+ gio = dependency('gio-2.0', version: '>= 2.68.0')
+ giounix = dependency('gio-unix-2.0', version: '>= 2.68.0', required: false)
+
 diff --git a/meson_options.txt b/meson_options.txt
-index bc76c0ab..8a67d012 100644
+index 877891126..986d0ee31 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -1,3 +1,4 @@
-+option('sysconfdir_install', type: 'string', value: '', description: 'sysconfdir to use during installation')
- option('build', type : 'combo', choices : ['all', 'standalone', 'library'], value : 'all', description : 'build type')
- option('agent', type : 'boolean', value : true, description : 'enable the fwupd agent')
- option('consolekit', type : 'boolean', value : true, description : 'enable ConsoleKit support')
-diff --git a/plugins/dell-esrt/meson.build b/plugins/dell-esrt/meson.build
-index ed4eee70..76dbdb1d 100644
---- a/plugins/dell-esrt/meson.build
-+++ b/plugins/dell-esrt/meson.build
-@@ -37,5 +37,5 @@ configure_file(
-   output : 'dell-esrt.conf',
-   configuration : con2,
-   install: true,
--  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
- )
-diff --git a/plugins/redfish/meson.build b/plugins/redfish/meson.build
-index 205d1394..3223f404 100644
---- a/plugins/redfish/meson.build
-+++ b/plugins/redfish/meson.build
-@@ -27,7 +27,7 @@ shared_module('fu_plugin_redfish',
- )
- 
- install_data(['redfish.conf'],
--  install_dir:  join_paths(sysconfdir, 'fwupd')
-+  install_dir:  join_paths(sysconfdir_install, 'fwupd')
- )
- 
- if get_option('tests')
-diff --git a/plugins/thunderbolt/meson.build b/plugins/thunderbolt/meson.build
-index 6b2368fb..2bd06fed 100644
---- a/plugins/thunderbolt/meson.build
-+++ b/plugins/thunderbolt/meson.build
-@@ -31,7 +31,7 @@ fu_plugin_thunderbolt = shared_module('fu_plugin_thunderbolt',
- )
- 
- install_data(['thunderbolt.conf'],
--  install_dir:  join_paths(sysconfdir, 'fwupd')
-+  install_dir:  join_paths(sysconfdir_install, 'fwupd')
- )
- # we use functions from 2.52 in the tests
- if get_option('tests') and umockdev.found() and gio.version().version_compare('>= 2.52')
+@@ -1,3 +1,8 @@
++option('sysconfdir_install',
++  type: 'string',
++  value: '',
++  description: 'sysconfdir to use during installation'
++)
+ option('build',
+   type: 'combo',
+   choices: [
 diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
-index 0b793a07..ebd3e5ea 100644
+index eb196c21e..c9a29f680 100644
 --- a/plugins/uefi-capsule/meson.build
 +++ b/plugins/uefi-capsule/meson.build
-@@ -97,7 +97,7 @@ if get_option('man')
- endif
- 
- install_data(['uefi_capsule.conf'],
--  install_dir:  join_paths(sysconfdir, 'fwupd')
-+  install_dir:  join_paths(sysconfdir_install, 'fwupd')
- )
- 
- if get_option('tests')
-diff --git a/plugins/upower/meson.build b/plugins/upower/meson.build
-index 290a3eb6..9ab2f452 100644
---- a/plugins/upower/meson.build
-+++ b/plugins/upower/meson.build
-@@ -23,5 +23,5 @@ shared_module('fu_plugin_upower',
- )
- 
- install_data(['upower.conf'],
--  install_dir:  join_paths(sysconfdir, 'fwupd')
-+  install_dir:  join_paths(sysconfdir_install, 'fwupd')
- )
+@@ -20,7 +20,7 @@ if host_machine.system() == 'linux'
+     output: '35_fwupd',
+     configuration: con2,
+     install: true,
+-    install_dir: join_paths(sysconfdir, 'grub.d')
++    install_dir: join_paths(sysconfdir_install, 'grub.d')
+   )
+ elif host_machine.system() == 'freebsd'
+   backend_srcs += 'fu-uefi-backend-freebsd.c'
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 24e23f2b7e9..f4914d84327 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -1,38 +1,35 @@
 # Updating? Keep $out/etc synchronized with passthru keys
 
-{ lib, stdenv
-, fetchurl
+{ stdenv
+, lib
 , fetchFromGitHub
-, substituteAll
-, gtk-doc
+, gi-docgen
 , pkg-config
 , gobject-introspection
 , gettext
 , libgudev
+, libdrm
 , polkit
 , libxmlb
+, glib
 , gusb
 , sqlite
 , libarchive
+, libredirect
 , curl
-, help2man
 , libjcat
-, libxslt
 , elfutils
-, libsmbios
 , efivar
-, gnu-efi
 , valgrind
 , meson
 , libuuid
 , colord
-, docbook_xml_dtd_43
-, docbook-xsl-nons
 , ninja
-, gcab
 , gnutls
+, protobufc
 , python3
-, wrapGAppsHook
+, wrapGAppsNoGuiHook
+, ensureNewerSourcesForZipFilesHook
 , json-glib
 , bash-completion
 , shared-mime-info
@@ -40,33 +37,33 @@
 , vala
 , makeFontsConf
 , freefont_ttf
-, cairo
-, freetype
-, fontconfig
 , pango
 , tpm2-tss
 , bubblewrap
 , efibootmgr
 , flashrom
 , tpm2-tools
+, fwupd-efi
 , nixosTests
 , runCommand
+, unstableGitUpdater
+, modemmanager
+, libqmi
+, libmbim
+, libcbor
+, xz
+, enableFlashrom ? false
+, enablePassim ? false
 }:
 
 let
   python = python3.withPackages (p: with p; [
+    jinja2
     pygobject3
-    pycairo
-    pillow
     setuptools
   ]);
 
-  installedTestsPython = python3.withPackages (p: with p; [
-    pygobject3
-    requests
-  ]);
-
-  isx86 = stdenv.isx86_64 || stdenv.isi686;
+  isx86 = stdenv.hostPlatform.isx86;
 
   # Dell isn't supported on Aarch64
   haveDell = isx86;
@@ -80,192 +77,238 @@ let
   # # Currently broken on Aarch64
   # haveFlashrom = isx86;
   # Experimental
-  haveFlashrom = false;
-
-  runPythonCommand = name: buildCommandPython: runCommand name {
-    nativeBuildInputs = [ python3 ];
-      inherit buildCommandPython;
-  } ''
-    exec python3 -c "$buildCommandPython"
-  '';
-
-  self = stdenv.mkDerivation rec {
-    pname = "fwupd";
-    version = "1.5.7";
-
-    # libfwupd goes to lib
-    # daemon, plug-ins and libfwupdplugin go to out
-    # CLI programs go to out
-    outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
+  haveFlashrom = isx86 && enableFlashrom;
+
+  runPythonCommand =
+    name:
+    buildCommandPython:
+
+    runCommand
+      name
+      {
+        nativeBuildInputs = [ python3 ];
+        inherit buildCommandPython;
+      }
+      ''
+        exec python3 -c "$buildCommandPython"
+      '';
 
-    src = fetchurl {
-      url = "https://people.freedesktop.org/~hughsient/releases/fwupd-${version}.tar.xz";
-      sha256 = "16isrrv6zhdgccbfnz7km5g1cnvfnip7aiidkfhf5dlnrnyb2sxh";
+  test-firmware =
+    let
+      version = "unstable-2022-04-02";
+      src = fetchFromGitHub {
+        name = "fwupd-test-firmware-${version}";
+        owner = "fwupd";
+        repo = "fwupd-test-firmware";
+        rev = "39954e434d63e20e85870dd1074818f48a0c08b7";
+        hash = "sha256-d4qG3fKyxkfN91AplRYqARFz+aRr+R37BpE450bPxi0=";
+        passthru = {
+          inherit src version; # For update script
+          updateScript = unstableGitUpdater {
+            url = "${test-firmware.meta.homepage}.git";
+          };
+        };
+      };
+    in
+    src // {
+      meta = src.meta // {
+        # For update script
+        position =
+          let
+            pos = builtins.unsafeGetAttrPos "updateScript" test-firmware;
+          in
+          pos.file + ":" + toString pos.line;
+      };
     };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fwupd";
+  version = "1.9.7";
+
+  # libfwupd goes to lib
+  # daemon, plug-ins and libfwupdplugin go to out
+  # CLI programs go to out
+  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
+
+  src = fetchFromGitHub {
+    owner = "fwupd";
+    repo = "fwupd";
+    rev = finalAttrs.version;
+    hash = "sha256-NhVCIjkwoTZptctIrkU9HgXzjr+KCUZfEKcjoYgAEdM=";
+  };
 
-    patches = [
-      # Do not try to create useless paths in /var.
-      ./fix-paths.patch
-
-      # Allow installing
-      ./add-option-for-installation-sysconfdir.patch
-
-      # Install plug-ins and libfwupdplugin to out,
-      # they are not really part of the library.
-      ./install-fwupdplugin-to-out.patch
-
-      # Installed tests are installed to different output
-      # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
-      (substituteAll {
-        src = ./installed-tests-path.patch;
-        # Needs a different set of modules than po/make-images.
-        inherit installedTestsPython;
-      })
-    ];
-
-    nativeBuildInputs = [
-      meson
-      ninja
-      gtk-doc
-      pkg-config
-      gobject-introspection
-      gettext
-      shared-mime-info
-      valgrind
-      gcab
-      gnutls
-      docbook_xml_dtd_43
-      docbook-xsl-nons
-      help2man
-      libxslt
-      python
-      wrapGAppsHook
-      vala
-    ];
-
-    buildInputs = [
-      polkit
-      libxmlb
-      gusb
-      sqlite
-      libarchive
-      curl
-      elfutils
-      gnu-efi
-      libgudev
-      colord
-      libjcat
-      libuuid
-      json-glib
-      umockdev
-      bash-completion
-      cairo
-      freetype
-      fontconfig
-      pango
-      tpm2-tss
-      efivar
-    ] ++ lib.optionals haveDell [
-      libsmbios
-    ];
-
-    mesonFlags = [
-      "-Dgtkdoc=true"
-      "-Dplugin_dummy=true"
-      # We are building the official releases.
-      "-Dsupported_build=true"
-      # Would dlopen libsoup to preserve compatibility with clients linking against older fwupd.
-      # https://github.com/fwupd/fwupd/commit/173d389fa59d8db152a5b9da7cc1171586639c97
-      "-Dsoup_session_compat=false"
-      "-Dudevdir=lib/udev"
-      "-Dsystemd_root_prefix=${placeholder "out"}"
-      "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-      "-Defi-libdir=${gnu-efi}/lib"
-      "-Defi-ldsdir=${gnu-efi}/lib"
-      "-Defi-includedir=${gnu-efi}/include/efi"
-      "-Defi_sbat_distro_id=nixos"
-      "-Defi_sbat_distro_summary=NixOS"
-      "-Defi_sbat_distro_pkgname=fwupd"
-      "-Defi_sbat_distro_version=${version}"
-      "-Defi_sbat_distro_url=https://search.nixos.org/packages?channel=unstable&show=fwupd&from=0&size=50&sort=relevance&query=fwupd"
-      "--localstatedir=/var"
-      "--sysconfdir=/etc"
-      "-Dsysconfdir_install=${placeholder "out"}/etc"
-
-      # We do not want to place the daemon into lib (cyclic reference)
-      "--libexecdir=${placeholder "out"}/libexec"
-      # Our builder only adds $lib/lib to rpath but some things link
-      # against libfwupdplugin which is in $out/lib.
-      "-Dc_link_args=-Wl,-rpath,${placeholder "out"}/lib"
-    ] ++ lib.optionals (!haveDell) [
-      "-Dplugin_dell=false"
-      "-Dplugin_synaptics=false"
-    ] ++ lib.optionals (!haveRedfish) [
-      "-Dplugin_redfish=false"
-    ] ++ lib.optionals haveFlashrom [
-      "-Dplugin_flashrom=true"
-    ] ++ lib.optionals (!haveMSR) [
-      "-Dplugin_msr=false"
-    ];
-
-    # TODO: wrapGAppsHook wraps efi capsule even though it is not ELF
-    dontWrapGApps = true;
-
-    # /etc/os-release not available in sandbox
-    # doCheck = true;
+  patches = [
+    # Since /etc is the domain of NixOS, not Nix,
+    # we cannot install files there.
+    # Let’s install the files to $prefix/etc
+    # while still reading them from /etc.
+    # NixOS module for fwupd will take take care of copying the files appropriately.
+    ./add-option-for-installation-sysconfdir.patch
+
+    # Install plug-ins and libfwupdplugin to $out output,
+    # they are not really part of the library.
+    ./install-fwupdplugin-to-out.patch
+
+    # Installed tests are installed to different output
+    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
+    ./installed-tests-path.patch
+
+    # EFI capsule is located in fwupd-efi now.
+    ./efi-app-path.patch
+  ];
+
+  nativeBuildInputs = [
+    # required for firmware zipping
+    ensureNewerSourcesForZipFilesHook
+    meson
+    ninja
+    gi-docgen
+    pkg-config
+    gobject-introspection
+    gettext
+    shared-mime-info
+    valgrind
+    gnutls
+    protobufc # for protoc
+    python
+    wrapGAppsNoGuiHook
+    vala
+  ];
+
+  buildInputs = [
+    polkit
+    libxmlb
+    gusb
+    sqlite
+    libarchive
+    libdrm
+    curl
+    elfutils
+    libgudev
+    colord
+    libjcat
+    libuuid
+    json-glib
+    umockdev
+    bash-completion
+    pango
+    tpm2-tss
+    efivar
+    fwupd-efi
+    protobufc
+    modemmanager
+    libmbim
+    libcbor
+    libqmi
+    xz # for liblzma
+  ] ++ lib.optionals haveFlashrom [
+    flashrom
+  ];
+
+  mesonFlags = [
+    "-Ddocs=enabled"
+    "-Dplugin_dummy=true"
+    # We are building the official releases.
+    "-Dsupported_build=enabled"
+    "-Dlaunchd=disabled"
+    "-Dudevdir=lib/udev"
+    "-Dsystemd_root_prefix=${placeholder "out"}"
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+    "-Dsysconfdir_install=${placeholder "out"}/etc"
+    "-Defi_os_dir=nixos"
+    "-Dplugin_modem_manager=enabled"
+    # We do not want to place the daemon into lib (cyclic reference)
+    "--libexecdir=${placeholder "out"}/libexec"
+  ] ++ lib.optionals (!enablePassim) [
+    "-Dpassim=disabled"
+  ] ++ lib.optionals (!haveDell) [
+    "-Dplugin_synaptics_mst=disabled"
+  ] ++ lib.optionals (!haveRedfish) [
+    "-Dplugin_redfish=disabled"
+  ] ++ lib.optionals (!haveFlashrom) [
+    "-Dplugin_flashrom=disabled"
+  ] ++ lib.optionals (!haveMSR) [
+    "-Dplugin_msr=disabled"
+  ];
+
+  # TODO: wrapGAppsHook wraps efi capsule even though it is not ELF
+  dontWrapGApps = true;
+
+  doCheck = true;
+
+  # Environment variables
+
+  # Fontconfig error: Cannot load default config file
+  FONTCONFIG_FILE =
+    let
+      fontsConf = makeFontsConf {
+        fontDirectories = [ freefont_ttf ];
+      };
+    in
+    fontsConf;
+
+  # error: “PolicyKit files are missing”
+  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
+  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
+
+  # Phase hooks
+
+  postPatch = ''
+    patchShebangs \
+      contrib/generate-version-script.py \
+      contrib/generate-man.py \
+      po/test-deps
+
+    substituteInPlace data/installed-tests/fwupdmgr-p2p.sh \
+      --replace "gdbus" ${glib.bin}/bin/gdbus
+
+    # tests fail with: Failed to load SMBIOS: neither SMBIOS or DT found
+    sed -i 's/test(.*)//' plugins/lenovo-thinklmi/meson.build
+    sed -i 's/test(.*)//' plugins/mtd/meson.build
+    # fails on amd cpu
+    sed -i 's/test(.*)//' libfwupdplugin/meson.build
+    # in nixos test tries to chmod 0777 $out/share/installed-tests/fwupd/tests/redfish.conf
+    sed -i "s/get_option('tests')/false/" plugins/redfish/meson.build
+
+    # Device tests use device emulation and need to download emulation data from
+    # the internet, which does not work on our test VMs.
+    # It's probably better to disable these tests for NixOS by setting
+    # the device-tests directory to /dev/null.
+    # For more info on device emulation, see:
+    #   https://github.com/fwupd/fwupd/blob/eeeac4e9ba8a6513428b456a551bffd95d533e50/docs/device-emulation.md
+    substituteInPlace data/installed-tests/meson.build \
+      --replace "join_paths(datadir, 'fwupd', 'device-tests')" "'/dev/null'"
+  '';
 
-    # Environment variables
+  preBuild = ''
+    # jcat-tool at buildtime requires a home directory
+    export HOME="$(mktemp -d)"
+  '';
 
-    # Fontconfig error: Cannot load default config file
-    FONTCONFIG_FILE =
-      let
-        fontsConf = makeFontsConf {
-          fontDirectories = [ freefont_ttf ];
-        };
-      in fontsConf;
-
-    # error: “PolicyKit files are missing”
-    # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
-    PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
-
-    # Phase hooks
-
-    postPatch = ''
-      patchShebangs \
-        contrib/get-version.py \
-        contrib/generate-version-script.py \
-        meson_post_install.sh \
-        plugins/uefi-capsule/efi/generate_sbat.py \
-        plugins/uefi-capsule/efi/generate_binary.py \
-        po/make-images \
-        po/make-images.sh \
-        po/test-deps
-    '';
+  preCheck = ''
+    addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
 
-    preCheck = ''
-      addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
-    '';
+    echo "12345678901234567890123456789012" > machine-id
+    export NIX_REDIRECTS=/etc/machine-id=$(realpath machine-id) \
+    LD_PRELOAD=${libredirect}/lib/libredirect.so
+  '';
 
-    postInstall =
-      let
-        testFw = fetchFromGitHub {
-          owner = "fwupd";
-          repo = "fwupd-test-firmware";
-          rev = "c13bfb26cae5f4f115dd4e08f9f00b3cb9acc25e";
-          sha256 = "US81i7mtLEe85KdWz5r+fQTk61IhqjVkzykBaBPuKL4=";
-        };
-      in ''
-        # These files have weird licenses so they are shipped separately.
-        cp --recursive --dereference "${testFw}/installed-tests/tests" "$installedTests/libexec/installed-tests/fwupd"
-      '';
+  postInstall = ''
+    # These files have weird licenses so they are shipped separately.
+    cp --recursive --dereference "${test-firmware}/installed-tests/tests" "$installedTests/libexec/installed-tests/fwupd"
+  '';
 
-    preFixup = let
+  preFixup =
+    let
       binPath = [
         efibootmgr
         bubblewrap
         tpm2-tools
-      ] ++ lib.optional haveFlashrom flashrom;
-    in ''
+      ];
+    in
+    ''
       gappsWrapperArgs+=(
         --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
         # See programs reached with fu_common_find_program_in_path in source
@@ -273,52 +316,56 @@ let
       )
     '';
 
+  postFixup = ''
     # Since we had to disable wrapGAppsHook, we need to wrap the executables manually.
-    postFixup = ''
-      find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
-        | while IFS= read -r -d ''' file; do
-        if [[ "$file" != *.efi ]]; then
-          echo "Wrapping program $file"
-          wrapGApp "$file"
-        fi
-      done
-    '';
+    find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
+      | while IFS= read -r -d ''' file; do
+      if [[ "$file" != *.efi ]]; then
+        echo "Wrapping program $file"
+        wrapGApp "$file"
+      fi
+    done
+
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
 
-    separateDebugInfo = true;
-
-    passthru = {
-      filesInstalledToEtc = [
-        "fwupd/daemon.conf"
-        "fwupd/remotes.d/lvfs-testing.conf"
-        "fwupd/remotes.d/lvfs.conf"
-        "fwupd/remotes.d/vendor.conf"
-        "fwupd/remotes.d/vendor-directory.conf"
-        "fwupd/thunderbolt.conf"
-        "fwupd/upower.conf"
-        "fwupd/uefi_capsule.conf"
-        "pki/fwupd/GPG-KEY-Hughski-Limited"
-        "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
-        "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
-        "pki/fwupd/LVFS-CA.pem"
-        "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
-        "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
-        "pki/fwupd-metadata/LVFS-CA.pem"
-      ] ++ lib.optionals haveDell [
-        "fwupd/remotes.d/dell-esrt.conf"
-      ] ++ lib.optionals haveRedfish [
-        "fwupd/redfish.conf"
-      ];
+  separateDebugInfo = true;
+
+  passthru = {
+    filesInstalledToEtc = [
+      "fwupd/bios-settings.d/README.md"
+      "fwupd/fwupd.conf"
+      "fwupd/remotes.d/lvfs-testing.conf"
+      "fwupd/remotes.d/lvfs.conf"
+      "fwupd/remotes.d/vendor.conf"
+      "fwupd/remotes.d/vendor-directory.conf"
+      "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
+      "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd/LVFS-CA.pem"
+      "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
+      "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd-metadata/LVFS-CA.pem"
+      "grub.d/35_fwupd"
+    ];
 
-      # DisabledPlugins key in fwupd/daemon.conf
-      defaultDisabledPlugins = [
-        "test"
-        "test_ble"
-        "invalid"
-      ];
+    # DisabledPlugins key in fwupd/daemon.conf
+    defaultDisabledPlugins = [
+      "test"
+      "test_ble"
+    ];
+
+    # For updating.
+    inherit test-firmware;
 
-      tests = let
+    # For downstream consumers that need the fwupd-efi this was built with.
+    inherit fwupd-efi;
+
+    tests =
+      let
         listToPy = list: "[${lib.concatMapStringsSep ", " (f: "'${f}'") list}]";
-      in {
+      in
+      {
         installedTests = nixosTests.installed-tests.fwupd;
 
         passthruMatches = runPythonCommand "fwupd-test-passthru-matches" ''
@@ -327,29 +374,27 @@ let
           import os
           import pathlib
 
-          etc = '${self}/etc'
+          etc = '${finalAttrs.finalPackage}/etc'
           package_etc = set(itertools.chain.from_iterable([[os.path.relpath(os.path.join(prefix, file), etc) for file in files] for (prefix, dirs, files) in os.walk(etc)]))
-          passthru_etc = set(${listToPy passthru.filesInstalledToEtc})
+          passthru_etc = set(${listToPy finalAttrs.passthru.filesInstalledToEtc})
           assert len(package_etc - passthru_etc) == 0, f'fwupd package contains the following paths in /etc that are not listed in passthru.filesInstalledToEtc: {package_etc - passthru_etc}'
           assert len(passthru_etc - package_etc) == 0, f'fwupd package lists the following paths in passthru.filesInstalledToEtc that are not contained in /etc: {passthru_etc - package_etc}'
 
           config = configparser.RawConfigParser()
-          config.read('${self}/etc/fwupd/daemon.conf')
+          config.read('${finalAttrs.finalPackage}/etc/fwupd/fwupd.conf')
           package_disabled_plugins = config.get('fwupd', 'DisabledPlugins').rstrip(';').split(';')
-          passthru_disabled_plugins = ${listToPy passthru.defaultDisabledPlugins}
+          passthru_disabled_plugins = ${listToPy finalAttrs.passthru.defaultDisabledPlugins}
           assert package_disabled_plugins == passthru_disabled_plugins, f'Default disabled plug-ins in the package {package_disabled_plugins} do not match those listed in passthru.defaultDisabledPlugins {passthru_disabled_plugins}'
 
           pathlib.Path(os.getenv('out')).touch()
         '';
       };
-    };
-
-    meta = with lib; {
-      homepage = "https://fwupd.org/";
-      maintainers = with maintainers; [ jtojnar ];
-      license = licenses.lgpl21Plus;
-      platforms = platforms.linux;
-    };
   };
 
-in self
+  meta = with lib; {
+    homepage = "https://fwupd.org/";
+    maintainers = with maintainers; [ rvdp ];
+    license = licenses.lgpl21Plus;
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch b/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
new file mode 100644
index 00000000000..f9e65a10e65
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
@@ -0,0 +1,13 @@
+diff --git a/meson.build b/meson.build
+index b18108c74..7e674b4d2 100644
+--- a/meson.build
++++ b/meson.build
+@@ -404,7 +404,7 @@ endif
+
+ # EFI
+ if build_standalone
+-  efi_app_location = join_paths(libexecdir, 'fwupd', 'efi')
++  efi_app_location = join_paths(dependency('fwupd-efi').get_variable(pkgconfig: 'prefix'), 'libexec', 'fwupd', 'efi')
+   conf.set_quoted('EFI_APP_LOCATION', efi_app_location)
+   if host_cpu == 'x86'
+     EFI_MACHINE_TYPE_NAME = 'ia32'
diff --git a/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch b/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
deleted file mode 100644
index 474b250097d..00000000000
--- a/pkgs/os-specific/linux/firmware/fwupd/fix-paths.patch
+++ /dev/null
@@ -1,8 +0,0 @@
-diff --git a/data/builder/meson.build b/data/builder/meson.build
-index c7a430c0..e69de29b 100644
---- a/data/builder/meson.build
-+++ b/data/builder/meson.build
-@@ -1,3 +0,0 @@
--install_data('README.md',
--  install_dir : join_paths(localstatedir, 'lib', 'fwupd', 'builder')
--)
diff --git a/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch b/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
index 347b6862146..e6269ae840b 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
@@ -1,37 +1,14 @@
-diff --git a/libfwupdplugin/meson.build b/libfwupdplugin/meson.build
-index 0abcd45c..51cbc912 100644
---- a/libfwupdplugin/meson.build
-+++ b/libfwupdplugin/meson.build
-@@ -114,7 +114,8 @@
-   ],
-   link_args : vflag,
-   link_depends : fwupdplugin_mapfile,
--  install : true
-+  install : true,
-+  install_dir : bindir / '..' / 'lib',
- )
- 
- fwupdplugin_pkgg = import('pkgconfig')
-@@ -167,7 +168,8 @@
-       'GUsb-1.0',
-       fwupd_gir[0],
-     ],
--    install : true
-+    install : true,
-+    install_dir_typelib : bindir / '..' / 'lib' / 'girepository-1.0',
-   )
-   gnome.generate_vapi('fwupdplugin',
-     sources : fwupd_gir[0],
 diff --git a/meson.build b/meson.build
-index b1a523d2..00125997 100644
+index 9ae278b66..7cddf1a0d 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -389,7 +389,7 @@
+@@ -507,7 +507,7 @@ if build_standalone
  if host_machine.system() == 'windows'
-   plugin_dir = 'fwupd-plugins-3'
+   libdir_pkg = 'fwupd-@0@'.format(fwupd_version)
  else
--  plugin_dir = join_paths(libdir, 'fwupd-plugins-3')
-+  plugin_dir = join_paths(bindir, '..', 'lib', 'fwupd-plugins-3')
+-  libdir_pkg = join_paths(libdir, 'fwupd-@0@'.format(fwupd_version))
++  libdir_pkg = join_paths(prefix, 'lib', 'fwupd-@0@'.format(fwupd_version))
  endif
- conf.set_quoted('FWUPD_PLUGINDIR', plugin_dir)
+ conf.set_quoted('FWUPD_LIBDIR_PKG', libdir_pkg)
  endif
+
diff --git a/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch b/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
index d8f1a533b82..2954f89e14c 100644
--- a/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
+++ b/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
@@ -1,29 +1,19 @@
-diff --git a/data/device-tests/hardware.py b/data/device-tests/hardware.py
-index 7f1e1907..10fee1b8 100755
---- a/data/device-tests/hardware.py
-+++ b/data/device-tests/hardware.py
-@@ -1,4 +1,4 @@
--#!/usr/bin/python3
-+#!@installedTestsPython@/bin/python3
- # pylint: disable=wrong-import-position,too-many-locals,unused-argument,wrong-import-order
- #
- # Copyright (C) 2017 Richard Hughes <richard@hughsie.com>
 diff --git a/data/installed-tests/meson.build b/data/installed-tests/meson.build
-index adadbcdd..1b51bb9c 100644
+index dfce86b1c..5e34c4fa6 100644
 --- a/data/installed-tests/meson.build
 +++ b/data/installed-tests/meson.build
-@@ -65,5 +65,5 @@ configure_file(
-   output : 'fwupd-tests.conf',
-   configuration : con2,
+@@ -86,5 +86,5 @@ configure_file(
+   output: 'fwupd-tests.conf',
+   configuration: con2,
    install: true,
 -  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
 +  install_dir: join_paths(get_option('installed_test_prefix'), 'etc', 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index 772b7bbe..f59302cd 100644
+index ca6ccdf92..36b1b47b0 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -177,8 +177,8 @@ else
+@@ -188,8 +188,8 @@ else
    datadir = join_paths(prefix, get_option('datadir'))
    sysconfdir = join_paths(prefix, get_option('sysconfdir'))
    localstatedir = join_paths(prefix, get_option('localstatedir'))
@@ -31,18 +21,29 @@ index 772b7bbe..f59302cd 100644
 -  installed_test_datadir = join_paths(datadir, 'installed-tests', meson.project_name())
 +  installed_test_bindir = join_paths(get_option('installed_test_prefix'), 'libexec', 'installed-tests', meson.project_name())
 +  installed_test_datadir = join_paths(get_option('installed_test_prefix'), 'share', 'installed-tests', meson.project_name())
+   daemon_dir = join_paths(libexecdir, 'fwupd')
  endif
  mandir = join_paths(prefix, get_option('mandir'))
- localedir = join_paths(prefix, get_option('localedir'))
+@@ -497,6 +497,7 @@ gnome = import('gnome')
+ i18n = import('i18n')
+ 
+ conf.set_quoted('FWUPD_PREFIX', prefix)
++conf.set_quoted('FWUPD_INSTALLED_TEST_PREFIX', get_option('installed_test_prefix'))
+ conf.set_quoted('FWUPD_BINDIR', bindir)
+ conf.set_quoted('FWUPD_LIBDIR', libdir)
+ conf.set_quoted('FWUPD_LIBEXECDIR', libexecdir)
 diff --git a/meson_options.txt b/meson_options.txt
-index 0a0e2853..5f68d78b 100644
+index 877891126..bfc5d1afd 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -25,6 +26,7 @@ option('plugin_coreboot', type : 'boolean', value : true, description : 'enable
- option('systemd', type : 'boolean', value : true, description : 'enable systemd support')
- option('systemd_root_prefix', type: 'string', value: '', description: 'Directory to base systemd’s installation directories on')
- option('elogind', type : 'boolean', value : false, description : 'enable elogind support')
-+option('installed_test_prefix', type: 'string', description: 'Prefix for installed tests')
- option('tests', type : 'boolean', value : true, description : 'enable tests')
- option('tpm', type : 'boolean', value : true, description : 'enable TPM support')
- option('udevdir', type: 'string', value: '', description: 'Directory for udev rules')
+@@ -452,6 +452,10 @@ option('elogind',
+     'false': 'disabled',
+   },
+ )
++option('installed_test_prefix',
++  type: 'string',
++  description: 'Prefix for installed tests'
++)
+ option('tests',
+   type: 'boolean',
+   value: true,
diff --git a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
index c9b1d7c5f0a..af9a44b92f4 100644
--- a/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/intel2200BGFirmware/default.nix
@@ -1,23 +1,30 @@
-{ lib, fetchzip }:
+{ stdenvNoCC
+, lib
+, fetchurl }:
 
-let version = "3.1"; in
+stdenvNoCC.mkDerivation rec {
+  pname = "intel2200BGFirmware";
+  version = "3.1";
 
-fetchzip {
-  name = "intel2200BGFirmware-${version}";
-  url = "https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-${version}.tgz/eaba788643c7cc7483dd67ace70f6e99/ipw2200-fw-${version}.tgz";
-  sha256 = "0zjyjndyc401pn5x5lgypxdal21n82ymi3vbb2ja1b89yszj432b";
+  src = fetchurl {
+    url = "https://src.fedoraproject.org/repo/pkgs/ipw2200-firmware/ipw2200-fw-${version}.tgz/eaba788643c7cc7483dd67ace70f6e99/ipw2200-fw-${version}.tgz";
+    hash = "sha256-xoGMEcGMwDDVX/g/ZLK62P7vSF53QvhPlKYdgRpiWL0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
 
-  postFetch = ''
-    tar -xzvf $downloadedFile --strip-components=1
     install -D -m644 ipw2200-bss.fw     $out/lib/firmware/ipw2200-bss.fw
     install -D -m644 ipw2200-ibss.fw    $out/lib/firmware/ipw2200-ibss.fw
     install -D -m644 ipw2200-sniffer.fw $out/lib/firmware/ipw2200-sniffer.fw
     install -D -m644 LICENSE.ipw2200-fw $out/share/doc/intel2200BGFirmware/LICENSE
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Firmware for Intel 2200BG cards";
-    homepage = "http://ipw2200.sourceforge.net/firmware.php";
+    homepage = "https://ipw2200.sourceforge.net/firmware.php";
     license = licenses.unfreeRedistributableFirmware;
     maintainers = with maintainers; [ sternenseemann ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
new file mode 100644
index 00000000000..a4bbd6d2bb6
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/ipu6-camera-bins/default.nix
@@ -0,0 +1,79 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoPatchelfHook
+, expat
+, zlib
+
+# Pick one of
+# - ipu6 (Tiger Lake)
+# - ipu6ep (Alder Lake)
+, ipuVersion ? "ipu6"
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "${ipuVersion}-camera-bin";
+  version = "unstable-2023-02-08";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ipu6-camera-bins";
+    rev = "276859fc6de83918a32727d676985ec40f31af2b";
+    hash = "sha256-QnedM2UBbGyd2wIF762Mi+VkDZYtC6MifK4XGGxlUzw=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/${ipuVersion}";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    stdenv.cc.cc.lib
+    expat
+    zlib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp --no-preserve=mode --recursive \
+      lib \
+      include \
+      $out/
+
+    install -m 0644 -D ../LICENSE $out/share/doc/LICENSE
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    for pcfile in $out/lib/pkgconfig/*.pc; do
+      substituteInPlace $pcfile \
+        --replace 'exec_prefix=/usr' 'exec_prefix=''${prefix}' \
+        --replace 'prefix=/usr' "prefix=$out" \
+        --replace 'libdir=/usr/lib' 'libdir=''${prefix}/lib' \
+        --replace 'includedir=/usr/include' 'includedir=''${prefix}/include'
+    done
+  '';
+
+  passthru = {
+    inherit ipuVersion;
+  };
+
+  meta = let
+    generation = {
+      ipu6 = "Tiger Lake";
+      ipu6ep = "Alder Lake";
+    }.${ipuVersion};
+  in with lib; {
+    description = "${generation} IPU firmware and proprietary image processing libraries";
+    homepage = "https://github.com/intel/ipu6-camera-bins";
+    license = licenses.issl;
+    sourceProvenance = with sourceTypes; [
+      binaryFirmware
+    ];
+    maintainers = with maintainers; [
+      hexa
+    ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix b/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
new file mode 100644
index 00000000000..fb2f940ddce
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/ivsc-firmware/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation {
+  pname = "ivsc-firmware";
+  version = "unstable-2022-11-02";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ivsc-firmware";
+    rev = "29c5eff4cdaf83e90ef2dcd2035a9cdff6343430";
+    hash = "sha256-GuD1oTnDEs0HslJjXx26DkVQIe0eS+js4UoaTDa77ME=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/firmware/vsc
+    cp --no-preserve=mode --recursive ./firmware/* $out/lib/firmware/vsc/
+    install -D ./LICENSE $out/share/doc
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Firmware binaries for the Intel Vision Sensing Controller";
+    homepage = "https://github.com/intel/ivsc-firmware";
+    license = licenses.issl;
+    sourceProvenance = with sourceTypes; [
+      binaryFirmware
+    ];
+    maintainers = with maintainers; [
+      hexa
+    ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/firmware/libreelec-dvb-firmware/default.nix b/pkgs/os-specific/linux/firmware/libreelec-dvb-firmware/default.nix
new file mode 100644
index 00000000000..9579ff11c73
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/libreelec-dvb-firmware/default.nix
@@ -0,0 +1,31 @@
+{ stdenvNoCC, fetchFromGitHub, lib}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "libreelec-dvb-firmware";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    repo = "dvb-firmware";
+    owner = "LibreElec";
+    rev = version;
+    sha256 = "1xnfl4gp6d81gpdp86v5xgcqiqz2nf1i43sb3a4i5jqs8kxcap2k";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    cp -rv firmware $out/lib
+    find $out/lib \( -name 'README.*' -or -name 'LICEN[SC]E.*' -or -name '*.txt' \) | xargs rm
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "DVB firmware from LibreELEC";
+    homepage = "https://github.com/LibreELEC/dvb-firmware";
+    license = licenses.unfreeRedistributableFirmware;
+    maintainers = with maintainers; [ kittywitch ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index 4293f53e47d..283e04b4754 100644
--- a/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -1,15 +1,27 @@
-{ stdenvNoCC, fetchgit, lib }:
+let
+  source = import ./source.nix;
+in {
+  stdenvNoCC,
+  fetchzip,
+  lib,
+  rdfind,
+  which,
+}:
 
 stdenvNoCC.mkDerivation rec {
-  pname = "firmware-linux-nonfree";
-  version = "2021-07-16";
+  pname = "linux-firmware";
+  version = source.version;
 
-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
-    rev = "refs/tags/" + lib.replaceStrings ["-"] [""] version;
-    sha256 = "185pnaqf2qmhbcdvvldmbar09zgaxhh3h8x9bxn6079bcdpaskn6";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${source.revision}.tar.gz";
+    hash = source.sourceHash;
   };
 
+  nativeBuildInputs = [
+    rdfind
+    which
+  ];
+
   installFlags = [ "DESTDIR=$(out)" ];
 
   # Firmware blobs do not need fixing and should not be modified
@@ -17,7 +29,7 @@ stdenvNoCC.mkDerivation rec {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "0g470hj2ylpviijfpjqzsndn2k8kkscj27wqwk51xlk8cr3mrahb";
+  outputHash = source.outputHash;
 
   meta = with lib; {
     description = "Binary firmware collection packaged by kernel.org";
@@ -28,5 +40,8 @@ stdenvNoCC.mkDerivation rec {
     priority = 6; # give precedence to kernel firmware
   };
 
-  passthru = { inherit version; };
+  passthru = {
+    inherit version;
+    updateScript = ./update.sh;
+  };
 }
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
new file mode 100644
index 00000000000..afe371a8887
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -0,0 +1,6 @@
+{
+  version = "20231111";
+  revision = "20231111";
+  sourceHash = "sha256-S9Xkj2CbamHxqjTDfqRJu91MNrSntxrQ7HYyhvdH6Jo=";
+  outputHash = "sha256-Qrz9fSHUQf0Gl8pfol4yfe95sD8DQV/+riT1NCFussQ=";
+}
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
new file mode 100755
index 00000000000..4b28d6e1374
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(dirname "$(readlink -f "$0")")" || exit
+
+repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
+
+# step 1: figure out the latest version from the tags
+if [ -z "${1:-}" ]; then
+  revision="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
+  version=$revision
+else
+  revision=$1
+  if [ -z "${2:-}" ]; then
+    version="unstable-$(date "+%Y-%m-%d")"
+  else
+    version=$2
+  fi
+fi
+
+# step 2: prefetch the source tarball
+snapshotUrl="$repo/snapshot/linux-firmware-$revision.tar.gz"
+hash="$(nix-prefetch-url --unpack "$snapshotUrl")"
+sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
+
+# step 3: rebuild as a non-FO derivation to get the right hash
+cat > source.nix << EOF
+{
+  version = "$version";
+  revision = "$revision";
+  sourceHash = "$sriHash";
+  outputHash = null;
+}
+EOF
+
+outPath="$(nix --experimental-features "nix-command flakes" build ".#linux-firmware" --no-link --print-out-paths)"
+outHash="$(nix --experimental-features nix-command hash path "$outPath")"
+
+# step 4: generate the final file
+cat > source.nix << EOF
+# This file is autogenerated! Run ./update.sh to regenerate.
+{
+  version = "$version";
+  revision = "$revision";
+  sourceHash = "$sriHash";
+  outputHash = "$outHash";
+}
+EOF
diff --git a/pkgs/os-specific/linux/firmware/openelec-dvb-firmware/default.nix b/pkgs/os-specific/linux/firmware/openelec-dvb-firmware/default.nix
deleted file mode 100644
index 4ef9370c844..00000000000
--- a/pkgs/os-specific/linux/firmware/openelec-dvb-firmware/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation rec {
-  pname = "openelec-dvb-firmware";
-  version = "0.0.51";
-
-  src = fetchurl {
-    url = "https://github.com/OpenELEC/dvb-firmware/archive/${version}.tar.gz";
-    sha256 = "cef3ce537d213e020af794cecf9de207e2882c375ceda39102eb6fa2580bad8d";
-  };
-
-  installPhase = ''
-    runHook preInstall
-
-    DESTDIR="$out" ./install
-    find $out \( -name 'README.*' -or -name 'LICEN[SC]E.*' -or -name '*.txt' \) | xargs rm
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "DVB firmware from OpenELEC";
-    homepage = "https://github.com/OpenELEC/dvb-firmware";
-    license = licenses.unfreeRedistributableFirmware;
-    platforms = platforms.linux;
-    priority = 7;
-  };
-}
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
index e6a03ef7df5..428fbf9dc90 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi-wireless/default.nix
@@ -1,23 +1,23 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = "raspberrypi-wireless-firmware";
-  version = "2021-01-28";
+  version = "unstable-2023-05-04";
 
   srcs = [
     (fetchFromGitHub {
       name = "bluez-firmware";
       owner = "RPi-Distro";
       repo = "bluez-firmware";
-      rev = "e7fd166981ab4bb9a36c2d1500205a078a35714d";
-      sha256 = "1dkg8mzn7n4afi50ibrda2s33nw2qj52jjjdv9w560q601gms47b";
+      rev = "9556b08ace2a1735127894642cc8ea6529c04c90";
+      hash = "sha256-gKGK0XzNrws5REkKg/JP6SZx3KsJduu53SfH3Dichkc=";
     })
     (fetchFromGitHub {
       name = "firmware-nonfree";
       owner = "RPi-Distro";
       repo = "firmware-nonfree";
-      rev = "83938f78ca2d5a0ffe0c223bb96d72ccc7b71ca5";
-      sha256 = "1l4zz86y2hjyvdwjy75abyjwh3wqknd71y3vh1iw5nd0hws8ranp";
+      rev = "2b465a10b04555b7f45b3acb85959c594922a3ce";
+      hash = "sha256-9UgB8f2AaxG7S5Px46jOP9wUeO1VXKB0uJiPWh32oDI=";
     })
   ];
 
@@ -28,20 +28,28 @@ stdenv.mkDerivation {
   dontFixup = true;
 
   installPhase = ''
+    runHook preInstall
     mkdir -p "$out/lib/firmware/brcm"
 
     # Wifi firmware
-    for filename in firmware-nonfree/brcm/brcmfmac434??-sdio.*; do
-      cp "$filename" "$out/lib/firmware/brcm"
-    done
+    cp -rv "$NIX_BUILD_TOP/firmware-nonfree/debian/config/brcm80211/." "$out/lib/firmware/"
 
     # Bluetooth firmware
-    cp bluez-firmware/broadcom/*.hcd "$out/lib/firmware/brcm"
-  '';
+    cp -rv "$NIX_BUILD_TOP/bluez-firmware/broadcom/." "$out/lib/firmware/brcm"
+
+    # brcmfmac43455-stdio.bin is a symlink to the non-existent path: ../cypress/cyfmac43455-stdio.bin.
+    # See https://github.com/RPi-Distro/firmware-nonfree/issues/26
+    ln -s "./cyfmac43455-sdio-standard.bin" "$out/lib/firmware/cypress/cyfmac43455-sdio.bin"
 
-  outputHashMode = "recursive";
-  outputHashAlgo = "sha256";
-  outputHash = "0a54gyrq6jfxxvimaa4yjfiyfwf7wv58v0a32l74yrzyarr3ldby";
+    pushd $out/lib/firmware/brcm &>/dev/null
+    # Symlinks for Zero 2W
+    ln -s "./brcmfmac43436-sdio.bin" "$out/lib/firmware/brcm/brcmfmac43430b0-sdio.raspberrypi,model-zero-2-w.bin"
+    ln -s "./brcmfmac43436-sdio.txt" "$out/lib/firmware/brcm/brcmfmac43430b0-sdio.raspberrypi,model-zero-2-w.txt"
+    ln -s "./brcmfmac43436-sdio.clm_blob" "$out/lib/firmware/brcm/brcmfmac43430b0-sdio.clm_blob"
+    popd &>/dev/null
+
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Firmware for builtin Wifi/Bluetooth devices in the Raspberry Pi 3+ and Zero W";
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix b/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
index 52fa4266577..72c6f623554 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
@@ -1,20 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config }:
+{ lib, stdenv, fetchFromGitHub }:
 
 let
   inherit (lib) optionals;
 in
 stdenv.mkDerivation {
   pname = "raspberrypi-armstubs";
-  version = "2020-10-08";
+  version = "unstable-2022-07-11";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "tools";
-    rev = "fc0e73c13865450e95edd046200e42a6e52d8256";
-    sha256 = "1g6ikpjcrm5x0rk5aiwjdd8grf997qkvgamcrdxy6k9ln746h25s";
+    rev = "439b6198a9b340de5998dd14a26a0d9d38a6bcac";
+    hash = "sha512-KMHgj73eXHT++IE8DbCsFeJ87ngc9R3XxMUJy4Z3s4/MtMeB9zblADHkyJqz9oyeugeJTrDtuVETPBRo7M4Y8A==";
   };
 
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString [
     "-march=armv8-a+crc"
   ];
 
@@ -37,13 +37,15 @@ stdenv.mkDerivation {
   ;
 
   installPhase = ''
+    runHook preInstall
     mkdir -vp $out/
     cp -v *.bin $out/
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Firmware related ARM stubs for the Raspberry Pi";
-    homepage = https://github.com/raspberrypi/tools;
+    homepage = "https://github.com/raspberrypi/tools";
     license = licenses.bsd3;
     platforms = [ "armv6l-linux" "armv7l-linux" "aarch64-linux" ];
     maintainers = with maintainers; [ samueldr ];
diff --git a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
index 6a826f63966..46f05c4029b 100644
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -3,18 +3,18 @@
 stdenvNoCC.mkDerivation rec {
   # NOTE: this should be updated with linux_rpi
   pname = "raspberrypi-firmware";
-  version = "1.20210303";
+  version = "1.20230405";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "firmware";
     rev = version;
-    sha256 = "0pgiw93hq4gfph5dnwbi8w59g0f7yhmagwzam971k529mh5yl86m";
+    hash = "sha256-UtUd1MbsrDFxd/1C3eOAMDKPZMx+kSMFYOJP+Kc6IU8=";
   };
 
   installPhase = ''
-    mkdir -p $out/share/raspberrypi/boot
-    cp -R boot/* $out/share/raspberrypi/boot
+    mkdir -p $out/share/raspberrypi/
+    mv boot "$out/share/raspberrypi/"
   '';
 
   dontConfigure = true;
@@ -26,5 +26,8 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/raspberrypi/firmware";
     license = licenses.unfreeRedistributableFirmware; # See https://github.com/raspberrypi/firmware/blob/master/boot/LICENCE.broadcom
     maintainers = with maintainers; [ dezgeg ];
+    # Hash mismatch on source, mystery.
+    # Maybe due to https://github.com/NixOS/nix/issues/847
+    broken = stdenvNoCC.isDarwin;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/rt5677/default.nix b/pkgs/os-specific/linux/firmware/rt5677/default.nix
index f5d84179fd2..47e0068cc34 100644
--- a/pkgs/os-specific/linux/firmware/rt5677/default.nix
+++ b/pkgs/os-specific/linux/firmware/rt5677/default.nix
@@ -1,15 +1,15 @@
-{ lib, stdenv, fetchgit }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "rt5677-firmware";
 
-  src = fetchgit {
-    url = "https://github.com/raphael/linux-samus";
+  src = fetchFromGitHub {
+    owner = "raphael";
+    repo = "linux-samus";
     rev = "995de6c2093797905fbcd79f1a3625dd3f50be37";
-    sha256 = "0a6lz9wadm47cmva136q6wd0lw03bmymf9ispnzb091a7skwacry";
+    sha256 = "sha256-PjPFpz4qJLC+vTomV31dA3AKGjfYjKB2ZYfUpnj61Cg=";
   };
 
-
   installPhase = ''
     mkdir -p $out/lib/firmware
     cp ./firmware/rt5677_elf_vad $out/lib/firmware
diff --git a/pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix b/pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix
index 34c2b683ea4..53f32ac31f9 100644
--- a/pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/rtl8192su-firmware/default.nix
@@ -1,7 +1,8 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 with lib;
-stdenv.mkDerivation {
-  name = "rtl8192su-unstable-2016-10-05";
+stdenvNoCC.mkDerivation {
+  pname = "rtl8192su";
+  version = "unstable-2016-10-05";
 
   src = fetchFromGitHub {
     owner = "chunkeey";
@@ -10,7 +11,7 @@ stdenv.mkDerivation {
     sha256 = "0j3c35paapq1icmxq0mg7pm2xa2m69q7bkfmwgq99d682yr2cb5l";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
+  dontBuild = true;
 
   installPhase = ''
     for i in rtl8192sfw.bin \
diff --git a/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix b/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix
deleted file mode 100644
index 36580d4b1b9..00000000000
--- a/pkgs/os-specific/linux/firmware/rtl8723bs-firmware/default.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ lib, stdenv, linuxPackages }:
-with lib;
-stdenv.mkDerivation {
-  name = "rtl8723bs-firmware-${linuxPackages.rtl8723bs.version}";
-  inherit (linuxPackages.rtl8723bs) src;
-
-  phases = [ "unpackPhase" "installPhase" ];
-
-  installPhase = ''
-    mkdir -p                "$out/lib/firmware/rtlwifi"
-    cp rtl8723bs_nic.bin    "$out/lib/firmware/rtlwifi"
-    cp rtl8723bs_wowlan.bin "$out/lib/firmware/rtlwifi"
-  '';
-
-  meta = with lib; {
-    description = "Firmware for RealTek 8723bs";
-    homepage = "https://github.com/hadess/rtl8723bs";
-    license = licenses.unfreeRedistributableFirmware;
-    maintainers = with maintainers; [ elitak ];
-    platforms = with platforms; linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/firmware/rtl8761b-firmware/default.nix b/pkgs/os-specific/linux/firmware/rtl8761b-firmware/default.nix
index f2dd36a0e06..c3fbe79537c 100644
--- a/pkgs/os-specific/linux/firmware/rtl8761b-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/rtl8761b-firmware/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenvNoCC, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   name = "rtl8761b-firmware";
 
   src = fetchFromGitHub {
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Firmware for Realtek RTL8761b";
     license = licenses.unfreeRedistributableFirmware;
-    maintainers = with maintainers; [ edibopp ];
+    maintainers = with maintainers; [ milibopp ];
     platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/rtw89-firmware/default.nix b/pkgs/os-specific/linux/firmware/rtw89-firmware/default.nix
deleted file mode 100644
index 8e71770df9c..00000000000
--- a/pkgs/os-specific/linux/firmware/rtw89-firmware/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ stdenvNoCC, lib, linuxPackages }:
-
-stdenvNoCC.mkDerivation {
-  pname = "rtw89-firmware";
-  inherit (linuxPackages.rtw89) version src;
-
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/lib/firmware/rtw89
-    cp *.bin $out/lib/firmware/rtw89
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "Driver for Realtek 8852AE, an 802.11ax device";
-    homepage = "https://github.com/lwfinger/rtw89";
-    license = licenses.unfreeRedistributableFirmware;
-    maintainers = with maintainers; [ tvorog ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index 2409d9b1aba..2f33a139c9d 100644
--- a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -1,29 +1,34 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib
+, fetchurl
+, stdenvNoCC
+}:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "1.7";
+  version = "2.2.6";
 
-  src = fetchFromGitHub {
-    owner = "thesofproject";
-    repo = "sof-bin";
-    rev = "v${version}";
-    sha256 = "sha256-Z0Z4HLsIIuW8E1kFNhAECmzj1HkJVfbEw13B8V7PZLk=";
+  src = fetchurl {
+    url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-v${version}.tar.gz";
+    sha256 = "sha256-kyLCp2NtAoRcOyaYTVirj3jWP/THZtCEwxlqWF4ACQU=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
 
   installPhase = ''
-    mkdir -p $out/lib/firmware/intel/
-    cp -a sof-v${version} $out/lib/firmware/intel/sof
-    cp -a sof-tplg-v${version} $out/lib/firmware/intel/sof-tplg
+    runHook preInstall
+    mkdir -p $out/lib/firmware/intel
+    cp -av sof-v${version} $out/lib/firmware/intel/sof
+    cp -av sof-tplg-v${version} $out/lib/firmware/intel/sof-tplg
+    runHook postInstall
   '';
 
   meta = with lib; {
+    changelog = "https://github.com/thesofproject/sof-bin/releases/tag/v${version}";
     description = "Sound Open Firmware";
     homepage = "https://www.sofproject.org/";
     license = with licenses; [ bsd3 isc ];
     maintainers = with maintainers; [ lblasc evenbrenden hmenke ];
     platforms = with platforms; linux;
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
 }
diff --git a/pkgs/os-specific/linux/firmware/system76-firmware/Cargo.lock b/pkgs/os-specific/linux/firmware/system76-firmware/Cargo.lock
new file mode 100644
index 00000000000..3ac385d816e
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/system76-firmware/Cargo.lock
@@ -0,0 +1,1551 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "anyhow"
+version = "1.0.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cb2f989d18dd141ab8ae82f64d1a8cdd37e0840f73a406896cf5e99502fab61"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "base32"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23ce669cd6c8588f79e15cf450314f9638f967fc5770ff1c7c1deb0925ea7cfa"
+
+[[package]]
+name = "base64"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a4ddaa51a5bc52a6948f74c06d20aaaddb71924eab79b8c97a8c556e942d6a"
+
+[[package]]
+name = "bincode"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "block-buffer"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4152116fd6e9dadb291ae18fc1ec3575ed6d84c29642d97890f4b4a3417297e4"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cce20737498f97b993470a6e536b8523f0af7892a4f928cceb1ac5e52ebe7e"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "buildchain"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1e4ba006f08f732ddc25f629c349fbb89c67e6c90a4764ce04534d32a1940b0"
+dependencies = [
+ "base32",
+ "clap",
+ "lxd",
+ "plain",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2 0.10.6",
+ "sodalite",
+ "tempdir",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d261e256854913907f67ed06efbc3338dfe6179796deefc1ff763fc1aee5535"
+
+[[package]]
+name = "bytes"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfb24e866b15a1af2a1b663f10c6b6b8f397a84aadb828f12e5b289ec23a3a3c"
+
+[[package]]
+name = "cc"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clap"
+version = "3.2.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71655c45cb9845d3270c9d6df84ebe72b4dad3c2ba3f7023ad47c144e4e473a5"
+dependencies = [
+ "atty",
+ "bitflags",
+ "clap_derive",
+ "clap_lex",
+ "indexmap",
+ "once_cell",
+ "strsim",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea0c8bce528c4be4da13ea6fead8965e95b6073585a2f05204bd8f4119f82a65"
+dependencies = [
+ "heck",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "194a7a9e6de53fa55116934067c844d9d749312f75c6f6d0980e8c252f8c2146"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5827cebf4670468b8772dd191856768aedcb1b0278a04f989f7766351917b9dc"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "28d997bd5e24a5928dd43e46dc529867e207907fe0b239c3477d924f7f2ca320"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bb21987b9fb1613058ba3843121dd18b163b254d8a6e797e144cbac14d96d1b"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "winapi",
+]
+
+[[package]]
+name = "dbus-crossroads"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a816e8ae3382c7b1bccfa6f2778346ee5b13f80e0eccf80cf8f2912af73995a"
+dependencies = [
+ "dbus",
+]
+
+[[package]]
+name = "digest"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3dd60d1080a57a05ab032377049e0591415d2b31afd7028356dbf3cc6dcb066"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "digest"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8168378f4e5023e7218c89c891c0fd8ecdb5e5e4f18cb78f38cf245dd021e76f"
+dependencies = [
+ "block-buffer 0.10.3",
+ "crypto-common",
+]
+
+[[package]]
+name = "ecflash"
+version = "0.1.0"
+source = "git+https://github.com/system76/ecflash.git?branch=stable#ee9d69d4edf3bee6b2fb6dddb021bb58ee3bbbbb"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "either"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fcaabb2fef8c910e7f4c7ce9f67a1283a1715879a7c230ca9d6d1ae31f16d91"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9852635589dc9f9ea1b6fe9f05b50ef208c85c834a562f0c6abb1c475736ec2b"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "enum_derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "406ac2a8c9eedf8af9ee1489bee9e50029278a6456c740f7454cf8a158abc816"
+
+[[package]]
+name = "fastrand"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a407cfaa3385c4ae6b23e84623d48c2798d06e3e6a1878f7f59f17b3f86499"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "filetime"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e884668cd0c7480504233e951174ddc3b382f7c2666e3b7310b5c4e7b0c37f9"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "windows-sys",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9c384f161156f5260c24a097c56119f9be8c798586aecc13afbcbe7b7e26bf8"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ba265a92256105f45b719605a571ffe2d1f0fea3807304b522c1d778f79eed"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04909a7a7e4633ae6c4a9ab280aeb86da1236243a77b694a49eacd659a4bd3ac"
+
+[[package]]
+name = "futures-io"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00f5fb52a06bdcadeb54e8d3671f8888a39697dcb0b81b23b55174030427f4eb"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39c15cf1a4aa79df40f1bb462fb39676d0ad9e366c2a33b590d7c66f4f81fcf9"
+
+[[package]]
+name = "futures-task"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ffb393ac5d9a6eaa9d3fdf37ae2776656b706e200c8e16b1bdb227f5198e6ea"
+
+[[package]]
+name = "futures-util"
+version = "0.3.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "197676987abd2f9cadff84926f410af1c183608d36641465df73ae8211dc65d6"
+dependencies = [
+ "futures-core",
+ "futures-io",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bff49e947297f3312447abdca79f45f4738097cc82b06e72054d2223f601f1b9"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c05aeb6a22b8f62540c194aac980f2115af067bfe15a0734d7277a768d396b31"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f9f29bc9dda355256b2916cf526ab02ce0aeaaaf2bad60d65ef3f12f11dd0f4"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "heck"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee512640fe35acbfb4bb779db6f0d80704c2cacfa2e39b601ef3e3f47d1ae4c7"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "http"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75f43d41e26995c17e71ee126451dd3941010b0514a81a9d11f3b341debc2399"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
+dependencies = [
+ "bytes",
+ "http",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d897f394bad6a705d5f4104762e116a75639e470d80901eed05a860a95cb1904"
+
+[[package]]
+name = "httpdate"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
+
+[[package]]
+name = "hyper"
+version = "0.14.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "034711faac9d2166cb1baf1a2fb0b60b1f277f8492fd72176c17f3515e1abd3c"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+dependencies = [
+ "bytes",
+ "hyper",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+]
+
+[[package]]
+name = "idna"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e14ddfc70884202db2244c223200c204c2bda1bc6e0998d11b5e024d657209e6"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "index-fixed"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161ceaf2f41b6cd3f6502f5da085d4ad4393a51e0c70ed2fce1d5698d798fae"
+
+[[package]]
+name = "indexmap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1885e79c1fc4b10f0e172c475f458b7f7b93061064d98c3293e98c5ba0c8b399"
+dependencies = [
+ "autocfg",
+ "hashbrown",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30e22bd8629359895450b59ea7a776c850561b96a3b1d31321c1949d9e6c9146"
+
+[[package]]
+name = "itertools"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f56a2d0bc861f9165be4eb3442afd3c236d8a98afd426f65d92324ae1091a484"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fad582f4b9e86b6caa621cabeb0963332d92eea04729ab12892c2533951e6440"
+
+[[package]]
+name = "js-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49409df3e3bf0856b916e2ceaca09ee28e6871cf7d9ce97a692cacfdb2a25a47"
+dependencies = [
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "201de327520df007757c1f0adce6e827fe8562fbc28bfd9c15571c66ca1f5f79"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2264f9d90a9b4e60a2dc722ad899ea0374f03c2e96e755fe22a8f551d4d5fb3c"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "log"
+version = "0.4.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abb12e687cfb44aa40f41fc3978ef76448f9b6038cad6aef4259d3c095a2382e"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "lxd"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918a314b8eb7d4e19c3d154b4069b12aa37c25a68bae4f2c2a69f50bf47c7c5a"
+dependencies = [
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "mime"
+version = "0.3.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a60c7ce501c71e03a9c9c0d35b861413ae925bd979cc7a4e30d060069aaac8d"
+
+[[package]]
+name = "mio"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d732bc30207a6423068df043e3d02e0735b155ad7ce1a6f76fe2baa5b158de"
+dependencies = [
+ "libc",
+ "log",
+ "wasi",
+ "windows-sys",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07226173c32f2926027b63cce4bcd8076c3552846cbe7925f3aaffeac0a3b92e"
+dependencies = [
+ "lazy_static",
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fac9e2da13b5eb447a6ce3d392f23a29d8694bff781bf03a16cd9ac8697593b"
+dependencies = [
+ "hermit-abi 0.2.6",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f61fba1741ea2b3d6a1e3178721804bb716a68a6aeba1149b5d52e3d464ea66"
+
+[[package]]
+name = "opaque-debug"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
+
+[[package]]
+name = "openssl"
+version = "0.10.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b102428fd03bc5edf97f62620f7298614c45cedf287c271e7ed450bbaf83f2e1"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b501e44f11665960c7e7fcf062c7d96a14ade4aa98116c004b2e37b5be7d736c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.80"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23bbbf7854cd45b83958ebe919f0e8e516793727652e27fda10a8384cfc790b7"
+dependencies = [
+ "autocfg",
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "os_str_bytes"
+version = "6.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b7820b9daea5457c9f21c69448905d723fbd21136ccf521748f23fd49e723ee"
+
+[[package]]
+name = "percent-encoding"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "478c572c3d73181ff3c2539045f6eb99e5491218eae919370993b890cdbdd98e"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0a7ae3ac2f1173085d398531c705756c94a4c56843785df85a60c1a0afac116"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ac9a59f73473f1b8d852421e59e64809f025994837ef743615c6d0c5b305160"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.50"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ef7d57beacfaf2d8aee5937dab7b7f28de3cb8b1828479bb5de2a7106f2bae2"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8856d8364d252a14d474036ea1358d63c9e6965c8e5c1885c18f73d70bff9c7b"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+dependencies = [
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.3.1",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb5a58c1855b4b6819d59012155603f0b22ad30cad752600aadfcb695265519a"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21eed90ec8570952d53b772ecf8f206aa1ec9a3d76b2521c56c42973f2d91ee9"
+dependencies = [
+ "base64",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-tls",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "winreg",
+]
+
+[[package]]
+name = "rust-lzma"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "895dc04daeaeee338bb96e229797902ed3f0675bfc59d5b42e0f0b0c13ac54da"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4b9743ed687d4b4bcedf9ff5eaa7398495ae14e61cba0a295704edbc7decde"
+
+[[package]]
+name = "schannel"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "713cfb06c7059f3588fb8044c0fad1d09e3c01d225e25b9220dbfdcf16dbb1b3"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a332be01508d814fed64bf28f798a146d73792121129962fdf335bb3c49a4254"
+dependencies = [
+ "bitflags",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31c9bb296072e961fcbd8853511dd39c2d8be2deb1e17c6860b1d30732b323b4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.152"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb7d1f0d3021d347a83e556fc4683dea2ea09d87bccdf88ff5c12545d89d5efb"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.152"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af487d118eecd09402d70a5d72551860e788df87b464af30e5ea6a38c75c541e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877c235533714907a8c2464236f5c4b2a17262ef1bd71f38f35ea592c8da6883"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha2"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d58a1e1bf39749807d89cf2d98ac2dfa0ff1cb3faa38fbb64dd88ac8013d800"
+dependencies = [
+ "block-buffer 0.9.0",
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.9.0",
+ "opaque-debug",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82e6b795fe2e3b1e845bafcb27aa35405c4d47cdfc92af5fc8d3002f76cebdc0"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest 0.10.6",
+]
+
+[[package]]
+name = "shrinkwraprs"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e63e6744142336dfb606fe2b068afa2e1cca1ee6a5d8377277a92945d81fa331"
+dependencies = [
+ "bitflags",
+ "itertools",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4614a76b2a8be0058caa9dbbaf66d988527d86d003c11a94fbd335d7661edcef"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "socket2"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02e2d2db9033d13a1567121ddd7a095ee144db4e1ca1b1bda3419bc0da294ebd"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "sodalite"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41784a359d15c58bba298cccb7f30a847a1a42d0620c9bdaa0aa42fdb3c280e0"
+dependencies = [
+ "index-fixed",
+]
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "syn"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f4064b5b16e03ae50984a5a8ed5d4f8803e6bc1fd170a3cda91a1be4b18e3f5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "system76-firmware"
+version = "1.0.50"
+dependencies = [
+ "anyhow",
+ "bincode",
+ "buildchain",
+ "clap",
+ "ecflash",
+ "libc",
+ "plain",
+ "rust-lzma",
+ "serde",
+ "serde_json",
+ "sha2 0.9.9",
+ "system76_ectool",
+ "tar",
+ "tempdir",
+ "uuid",
+]
+
+[[package]]
+name = "system76-firmware-daemon"
+version = "0.1.0"
+dependencies = [
+ "dbus",
+ "dbus-crossroads",
+ "enum_derive",
+ "libc",
+ "serde",
+ "serde_json",
+ "shrinkwraprs",
+ "system76-firmware",
+ "thiserror",
+]
+
+[[package]]
+name = "system76_ectool"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c957fdd329e017031dbd261ff48fad01296660a9c237942c226cff064bd0610a"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "tar"
+version = "0.4.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d779dc6aeff029314570f666ec83f19df7280bb36ef338442cfa8c604021b80"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
+[[package]]
+name = "tempdir"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
+dependencies = [
+ "rand 0.4.6",
+ "remove_dir_all",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be55cf8942feac5c765c2c993422806843c9a9a45d4d5c407ad6dd2ea95eb9b6"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "textwrap"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "222a222a5bfe1bba4a77b45ec488a741b3cb8872e5e499451fd7d0129c9c7c3d"
+
+[[package]]
+name = "thiserror"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a9cd18aa97d5c45c6603caea1da6628790b37f7a34b6ca89522331c5180fed0"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fb327af4685e4d03fa8cbcf1716380da910eeb2bb8be417e7f9fd3fb164f36f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
+
+[[package]]
+name = "tokio"
+version = "1.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8e00990ebabbe4c14c08aca901caed183ecd5c09562a12c824bb53d3c3fd3af"
+dependencies = [
+ "autocfg",
+ "bytes",
+ "libc",
+ "memchr",
+ "mio",
+ "num_cpus",
+ "pin-project-lite",
+ "socket2",
+ "windows-sys",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7d995660bd2b7f8c1568414c1126076c13fbb725c40112dc0120b78eb9b717b"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bb2e075f03b3d66d8d8785356224ba688d2906a371015e225beeb65ca92c740"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "tower-service"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6bc1c9ce2b5135ac7f93c72918fc37feb872bdc6a5533a8b85eb4b86bfdae52"
+
+[[package]]
+name = "tracing"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+dependencies = [
+ "cfg-if",
+ "pin-project-lite",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24eb03ba0eab1fd845050058ce5e616558e8f8d8fca633e6b163fe25c797213a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
+
+[[package]]
+name = "typenum"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "497961ef93d974e23eb6f433eb5fe1b7930b659f06d12dec6fc44a8f554c0bba"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d54675592c1dbefd78cbd98db9bacd89886e1ca50692a0692baefffdeb92dd58"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84a22b9f218b40614adcb3f4ff08b703773ad44fa9423e4e0d346d5db86e4ebc"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "url"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d68c799ae75762b8c3fe375feb6600ef5602c883c5d21eb51c09f22b83c4643"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "want"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ce8a968cb1cd110d136ff8b819a556d6fb6d919363c61534f6860c7eb172ba0"
+dependencies = [
+ "log",
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaf9f5aceeec8be17c128b2e93e031fb8a4d469bb9c4ae2d7dc1888b26887268"
+dependencies = [
+ "cfg-if",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8ffb332579b0557b52d268b91feab8df3615f265d5270fec2a8c95b17c1142"
+dependencies = [
+ "bumpalo",
+ "log",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23639446165ca5a5de86ae1d8896b737ae80319560fbaa4c2887b7da6e7ebd7d"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "052be0f94026e6cbc75cdefc9bae13fd6052cdcaf532fa6c45e7ae33a1e6c810"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07bc0c051dc5f23e307b13285f9d75df86bfdf816c5721e573dec1f9b8aa193c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c38c045535d93ec4f0b4defec448e4291638ee608530863b1e2ba115d4fff7f"
+
+[[package]]
+name = "web-sys"
+version = "0.3.60"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcda906d8be16e728fd5adc5b729afad4e444e106ab28cd1c7256e54fa61510f"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-sys"
+version = "0.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9864e83243fdec7fc9c5444389dcbbfd258f745e7853198f365e3c4968a608"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c8b1b673ffc16c47a9ff48570a9d85e25d265735c503681332589af6253c6c7"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de3887528ad530ba7bdbb1faa8275ec7a1155a45ffa57c37993960277145d640"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf4d1122317eddd6ff351aa852118a2418ad4214e6613a50e0191f7004372605"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1040f221285e17ebccbc2591ffdc2d44ee1f9186324dd3e84e99ac68d699c45"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "628bfdf232daa22b0d64fdb62b09fcc36bb01f05a3939e20ab73aaf9470d0463"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "447660ad36a13288b1db4d4248e857b510e8c3a225c822ba4fb748c0aafecffd"
+
+[[package]]
+name = "winreg"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80d0f4e272c85def139476380b12f9ac60926689dd2e01d4923222f40580869d"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "xattr"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc"
+dependencies = [
+ "libc",
+]
diff --git a/pkgs/os-specific/linux/firmware/system76-firmware/default.nix b/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
index ca750d89cc5..d28372a465d 100644
--- a/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
@@ -2,13 +2,13 @@
 rustPlatform.buildRustPackage rec {
   pname = "system76-firmware";
   # Check Makefile when updating, make sure postInstall matches make install
-  version = "1.0.24";
+  version = "1.0.50";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Poe18HKEQusvN3WF4ZAV1WCvU8/3HKpHEqDsfDO62V0=";
+    sha256 = "sha256-nLbDhs+FxIcoVK66bwUAxAubikic5NT8yOA/mH/irgQ=";
   };
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
@@ -17,7 +17,12 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "--workspace" ];
 
-  cargoSha256 = "sha256-gGw3zpxLxQZ3rglpDERO0fSxBOez1Q10Fljis6nyB/4=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "ecflash-0.1.0" = "sha256-W613wbW54R65/rs6oiPAH/qov2OVEjMMszpUJdX4TxI=";
+    };
+  };
 
   # Purposefully don't install systemd unit file, that's for NixOS
   postInstall = ''
diff --git a/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix b/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix
new file mode 100644
index 00000000000..44458518943
--- /dev/null
+++ b/pkgs/os-specific/linux/firmware/xow_dongle-firmware/default.nix
@@ -0,0 +1,34 @@
+{ stdenvNoCC, lib, fetchurl, cabextract }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "xow_dongle-firmware";
+  version = "2017-07";
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  src = fetchurl {
+    url = "http://download.windowsupdate.com/c/msdownload/update/driver/drvs/2017/07/1cd6a87c-623f-4407-a52d-c31be49e925c_e19f60808bdcbfbd3c3df6be3e71ffc52e43261e.cab";
+    sha256 = "013g1zngxffavqrk5jy934q3bdhsv6z05ilfixdn8dj0zy26lwv5";
+  };
+
+  nativeBuildInputs = [ cabextract ];
+
+  sourceRoot = ".";
+
+  unpackCmd = ''
+    cabextract -F FW_ACC_00U.bin ${src}
+  '';
+
+  installPhase = ''
+    install -Dm644 FW_ACC_00U.bin ${placeholder "out"}/lib/firmware/xow_dongle.bin
+  '';
+
+  meta = with lib; {
+    description = "Xbox One wireless dongle firmware";
+    homepage = "https://www.xbox.com/en-NZ/accessories/adapters/wireless-adapter-windows";
+    license = licenses.unfree;
+    maintainers = with lib.maintainers; [ rhysmdnz ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/firmware/zd1211/default.nix b/pkgs/os-specific/linux/firmware/zd1211/default.nix
index 15e53557126..6b86277ebc6 100644
--- a/pkgs/os-specific/linux/firmware/zd1211/default.nix
+++ b/pkgs/os-specific/linux/firmware/zd1211/default.nix
@@ -1,19 +1,25 @@
-{ lib, fetchzip }:
+{ stdenvNoCC
+, lib
+, fetchurl
+}:
 
-let
+stdenvNoCC.mkDerivation rec {
   pname = "zd1211-firmware";
   version = "1.5";
-in fetchzip rec {
-  name = "${pname}-${version}";
-  url = "mirror://sourceforge/zd1211/${name}.tar.bz2";
 
-  postFetch = ''
-    tar -xjvf $downloadedFile
+  src = fetchurl {
+    url = "mirror://sourceforge/zd1211/${pname}-${version}.tar.bz2";
+    hash = "sha256-8R04ENf3KDOZf2NFhKWG3M7XGjU/llq/gQYuxDHQKxI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/lib/firmware/zd1211
-    cp zd1211-firmware/* $out/lib/firmware/zd1211
-  '';
+    cp * $out/lib/firmware/zd1211
 
-  sha256 = "0sj2zl3r0549mjz37xy6iilm1hm7ak5ax02gwrn81r5yvphqzd52";
+    runHook postInstall
+  '';
 
   meta = {
     description = "Firmware for the ZyDAS ZD1211(b) 802.11a/b/g USB WLAN chip";
diff --git a/pkgs/os-specific/linux/fnotifystat/default.nix b/pkgs/os-specific/linux/fnotifystat/default.nix
index baa92decd9f..fabfd47bca1 100644
--- a/pkgs/os-specific/linux/fnotifystat/default.nix
+++ b/pkgs/os-specific/linux/fnotifystat/default.nix
@@ -1,22 +1,30 @@
-{ stdenv, lib, fetchurl }:
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
 
 stdenv.mkDerivation rec {
   pname = "fnotifystat";
-  version = "0.02.07";
-  src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/fnotifystat/fnotifystat-${version}.tar.gz";
-    sha256 = "0ipfg2gymbgx7bqlx1sq5p2y89k5j18iqnb0wa27n5s3kh9sh8w0";
+  version = "0.02.10";
+
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    hash = "sha256-bcb1kSpNZV7eTcEIcaoiqxB68kTc0TGFMIr1Aehy/Rc=";
   };
-  installFlags = [ "DESTDIR=$(out)" ];
-  postInstall = ''
-    mv $out/usr/* $out
-    rm -r $out/usr
-  '';
+
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
+  ];
+
   meta = with lib; {
     description = "File activity monitoring tool";
-    homepage = "https://kernel.ubuntu.com/~cking/fnotifystat/";
-    license = licenses.gpl2;
+    homepage = "https://github.com/ColinIanKing/fnotifystat";
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ womfoo ];
+    maintainers = with maintainers; [ womfoo dtzWill ];
   };
 }
diff --git a/pkgs/os-specific/linux/forkstat/default.nix b/pkgs/os-specific/linux/forkstat/default.nix
index 09c9c660285..c8a3276f5d8 100644
--- a/pkgs/os-specific/linux/forkstat/default.nix
+++ b/pkgs/os-specific/linux/forkstat/default.nix
@@ -1,20 +1,25 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "forkstat";
-  version = "0.02.16";
-  src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/forkstat/forkstat-${version}.tar.xz";
-    sha256 = "1rrzvlws9725dy2jq5k4zfv669ngrb2klhla6wvir8nwh53jms4w";
+  version = "0.03.01";
+
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    hash = "sha256-T7O+PIWmFC4wi4nnmNsAH8H0SazixBoCx5ZdBV2wL+E=";
   };
-  installFlags = [ "DESTDIR=$(out)" ];
-  postInstall = ''
-    mv $out/usr/* $out
-    rm -r $out/usr
-  '';
+
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
+  ];
+
   meta = with lib; {
     description = "Process fork/exec/exit monitoring tool";
-    homepage = "https://kernel.ubuntu.com/~cking/forkstat/";
+    homepage = "https://github.com/ColinIanKing/forkstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ womfoo ];
diff --git a/pkgs/os-specific/linux/forktty/default.nix b/pkgs/os-specific/linux/forktty/default.nix
index c2e49399582..7dc1f0c3b2e 100644
--- a/pkgs/os-specific/linux/forktty/default.nix
+++ b/pkgs/os-specific/linux/forktty/default.nix
@@ -1,36 +1,29 @@
-{lib, stdenv, fetchurl}:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="forktty";
-    version="1.3";
-    name="${baseName}-${version}";
-    hash="0nd55zdqly6nl98k9lc7j751x86cw9hayx1qn0725f22r1x3j5zb";
-    url="http://sunsite.unc.edu/pub/linux/utils/terminal/forktty-1.3.tgz";
-    sha256="0nd55zdqly6nl98k9lc7j751x86cw9hayx1qn0725f22r1x3j5zb";
-  };
-  buildInputs = [
-  ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
+{ lib, stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "forktty";
+  version = "1.3";
+
   src = fetchurl {
-    inherit (s) url sha256;
+    url = "mirror://ibiblioPubLinux/utils/terminal/${pname}-${version}.tgz";
+    hash = "sha256-6xc5eshCuCIOsDh0r2DizKAeypGH0TRRotZ4itsvpVk=";
   };
+
   preBuild = ''
     sed -e s@/usr/bin/ginstall@install@g -i Makefile
   '';
+
   preInstall = ''
     mkdir -p "$out/bin"
     mkdir -p "$out/share/man/man8"
   '';
+
   makeFlags = [ "prefix=$(out)" "manprefix=$(out)/share/" ];
-  meta = {
-    inherit (s) version;
+
+  meta = with lib; {
     description = "Tool to detach from controlling TTY and attach to another";
-    license = lib.licenses.gpl2 ;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/forktty/default.upstream b/pkgs/os-specific/linux/forktty/default.upstream
deleted file mode 100644
index 45cb775a0ae..00000000000
--- a/pkgs/os-specific/linux/forktty/default.upstream
+++ /dev/null
@@ -1,2 +0,0 @@
-url http://sunsite.unc.edu/pub/linux/utils/terminal/
-version_link 'forktty.*tgz'
diff --git a/pkgs/os-specific/linux/freeipa/default.nix b/pkgs/os-specific/linux/freeipa/default.nix
new file mode 100644
index 00000000000..99d8527fc1d
--- /dev/null
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@@ -0,0 +1,172 @@
+{ stdenv
+, lib
+, fetchurl
+, pkg-config
+, autoconf
+, automake
+, kerberos
+, openldap
+, popt
+, sasl
+, curl
+, xmlrpc_c
+, ding-libs
+, p11-kit
+, gettext
+, nspr
+, nss
+, _389-ds-base
+, svrcore
+, libuuid
+, talloc
+, tevent
+, samba
+, libunistring
+, libverto
+, libpwquality
+, systemd
+, python3
+, bind
+, sssd
+, jre
+, rhino
+, lesscpy
+, jansson
+, runtimeShell
+}:
+
+let
+  pathsPy = ./paths.py;
+
+  pythonInputs = with python3.pkgs; [
+    six
+    python-ldap
+    dnspython
+    netaddr
+    netifaces
+    gssapi
+    dogtag-pki
+    pyasn1
+    sssd
+    cffi
+    lxml
+    dbus-python
+    cryptography
+    python-memcached
+    qrcode
+    pyusb
+    yubico
+    setuptools
+    jinja2
+    augeas
+    samba
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "freeipa";
+  version = "4.11.0";
+
+  src = fetchurl {
+    url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
+    sha256 = "sha256-l/e2Dq/ako41QWEZyJCD+PA44PzTnzC8B7jYAm/Tt6Q=";
+  };
+
+  nativeBuildInputs = [
+    python3.pkgs.wrapPython
+    jre
+    rhino
+    lesscpy
+    automake
+    autoconf
+    gettext
+    pkg-config
+  ];
+
+  buildInputs = [
+    kerberos
+    openldap
+    popt
+    sasl
+    curl
+    xmlrpc_c
+    ding-libs
+    p11-kit
+    python3
+    nspr
+    nss
+    _389-ds-base
+    svrcore
+    libuuid
+    talloc
+    tevent
+    samba
+    libunistring
+    libverto
+    systemd
+    bind
+    libpwquality
+    jansson
+  ] ++ pythonInputs;
+
+  postPatch = ''
+    patchShebangs makeapi makeaci install/ui/util
+
+    substituteInPlace ipaplatform/setup.py \
+      --replace 'ipaplatform.debian' 'ipaplatform.nixos'
+
+    substituteInPlace ipasetup.py.in \
+      --replace 'int(v)' 'int(v.replace("post", ""))'
+
+    substituteInPlace client/ipa-join.c \
+      --replace /usr/sbin/ipa-getkeytab $out/bin/ipa-getkeytab
+
+    cp -r ipaplatform/{fedora,nixos}
+    substitute ${pathsPy} ipaplatform/nixos/paths.py \
+      --subst-var out \
+      --subst-var-by bind ${bind.dnsutils} \
+      --subst-var-by curl ${curl} \
+      --subst-var-by kerberos ${kerberos}
+  '';
+
+  NIX_CFLAGS_COMPILE = "-I${_389-ds-base}/include/dirsrv";
+  pythonPath = pythonInputs;
+
+  # Building and installing the server fails with silent Rhino errors, skipping
+  # for now. Need a newer Rhino version.
+  #buildFlags = [ "client" "server" ]
+
+  configureFlags = [
+    "--with-systemdsystemunitdir=$out/lib/systemd/system"
+    "--with-ipaplatform=nixos"
+    "--disable-server"
+  ];
+
+  postInstall = ''
+    echo "
+     #!${runtimeShell}
+     echo 'ipa-client-install is not available on NixOS. Please see security.ipa, instead.'
+     exit 1
+    " > $out/sbin/ipa-client-install
+  '';
+
+  postFixup = ''
+    wrapPythonPrograms
+    rm -rf $out/etc/ipa $out/var/lib/ipa-client/sysrestore
+  '';
+
+  meta = with lib; {
+    description = "Identity, Policy and Audit system";
+    longDescription = ''
+      IPA is an integrated solution to provide centrally managed Identity (users,
+      hosts, services), Authentication (SSO, 2FA), and Authorization
+      (host access control, SELinux user roles, services). The solution provides
+      features for further integration with Linux based clients (SUDO, automount)
+      and integration with Active Directory based infrastructures (Trusts).
+    '';
+    homepage = "https://www.freeipa.org/";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.s1341 ];
+    platforms = platforms.linux;
+    mainProgram = "ipa";
+  };
+}
diff --git a/pkgs/os-specific/linux/freeipa/paths.py b/pkgs/os-specific/linux/freeipa/paths.py
new file mode 100644
index 00000000000..36c0cc0c740
--- /dev/null
+++ b/pkgs/os-specific/linux/freeipa/paths.py
@@ -0,0 +1,13 @@
+from ipaplatform.fedora.paths import FedoraPathNamespace
+
+class NixOSPathNamespace(FedoraPathNamespace):
+    SBIN_IPA_JOIN = "@out@/bin/ipa-join"
+    IPA_GETCERT = "@out@/bin/ipa-getcert"
+    IPA_RMKEYTAB = "@out@/bin/ipa-rmkeytab"
+    IPA_GETKEYTAB = "@out@/bin/ipa-getkeytab"
+    NSUPDATE = "@bind@/bin/nsupdate"
+    BIN_CURL = "@curl@/bin/curl"
+    KINIT = "@kerberos@/bin/kinit"
+    KDESTROY = "@kerberos@/bin/kdestroy"
+
+paths = NixOSPathNamespace()
diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
index 7528fae6bdd..fd925ab654f 100644
--- a/pkgs/os-specific/linux/fscrypt/default.nix
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -4,13 +4,13 @@
 
 buildGoModule rec {
   pname = "fscrypt";
-  version = "0.3.0";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fscrypt";
     rev = "v${version}";
-    sha256 = "1zdadi9f7wj6kgmmk9zlkpdm1lb3gfiscg9gkqqdql2si7y6g2nq";
+    hash = "sha256-4Im3YWhLs5Q+o4DtpSuSMuKtKqXaICL9/EB0q5um6mQ=";
   };
 
   postPatch = ''
@@ -19,7 +19,7 @@ buildGoModule rec {
       --replace "/usr/local" "$out"
   '';
 
-  vendorSha256 = "0yak221mlyfacvlsaq9g3xiyk94n94vqgkbaji8d21pi8hhr38m6";
+  vendorHash = "sha256-APW0XM6fTQOCw4tE1NA5VNN3fBUmsvn99NqqJnB3Q0s=";
 
   doCheck = false;
 
@@ -27,11 +27,15 @@ buildGoModule rec {
   buildInputs = [ pam ];
 
   buildPhase = ''
+    runHook preBuild
     make
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
     make install
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/fscryptctl/default.nix b/pkgs/os-specific/linux/fscryptctl/default.nix
index bd1b414f4cb..2a2a9b41c9c 100644
--- a/pkgs/os-specific/linux/fscryptctl/default.nix
+++ b/pkgs/os-specific/linux/fscryptctl/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
       documentation for filesystem encryption before using fscryptctl.
     '';
     inherit (src.meta) homepage;
-    changelog = "https://github.com/google/fscryptctl/releases/tag/v{version}";
+    changelog = "https://github.com/google/fscryptctl/releases/tag/v${version}";
     license = licenses.asl20;
     platforms = platforms.linux;
     maintainers = with maintainers; [ primeos ];
diff --git a/pkgs/os-specific/linux/fscryptctl/legacy.nix b/pkgs/os-specific/linux/fscryptctl/legacy.nix
deleted file mode 100644
index 64a409fb58b..00000000000
--- a/pkgs/os-specific/linux/fscryptctl/legacy.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{ lib, stdenv, fetchFromGitHub }:
-
-# Don't use this for anything important!
-# TODO: Drop fscryptctl-experimental after the NixOS 21.03/21.05 release.
-
-stdenv.mkDerivation rec {
-  pname = "fscryptctl";
-  version = "0.1.0";
-
-  goPackagePath = "github.com/google/fscrypt";
-
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "fscryptctl";
-    rev = "v${version}";
-    sha256 = "1853hlpklisbqnkb7a921dsf0vp2nr2im26zpmrs592cnpsvk3hb";
-  };
-
-  makeFlags = [ "DESTDIR=$(out)/bin" ];
-
-  meta = with lib; {
-    description = "Small C tool for Linux filesystem encryption";
-    longDescription = ''
-      fscryptctl is a low-level tool written in C that handles raw keys and
-      manages policies for Linux filesystem encryption, specifically the
-      "fscrypt" kernel interface which is supported by the ext4, f2fs, and
-      UBIFS filesystems.
-      fscryptctl is mainly intended for embedded systems which can't use the
-      full-featured fscrypt tool, or for testing or experimenting with the
-      kernel interface to Linux filesystem encryption. fscryptctl does not
-      handle key generation, key stretching, key wrapping, or PAM integration.
-      Most users should use the fscrypt tool instead, which supports these
-      features and generally is much easier to use.
-      As fscryptctl is intended for advanced users, you should read the kernel
-      documentation for filesystem encryption before using fscryptctl.
-    '';
-    inherit (src.meta) homepage;
-    license = licenses.asl20;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos ];
-    knownVulnerabilities = [ ''
-      fscryptctl version 1.0.0 was released and now uses v2 encryption
-      policies. fscryptctl-experimental will remain at version 0.1.0 which
-      still supports the v1 encryption policies. Please try to switch from the
-      "fscryptctl-experimental" package to "fscryptctl". The v1 encryption
-      policies can be insecure, are hard to use correctly, and have different
-      semantics from v2 policies (which is why they are no longer supported in
-      fscryptctl 1.0.0+).
-    '' ];
-  };
-}
diff --git a/pkgs/os-specific/linux/fsverity-utils/default.nix b/pkgs/os-specific/linux/fsverity-utils/default.nix
new file mode 100644
index 00000000000..c5bed075338
--- /dev/null
+++ b/pkgs/os-specific/linux/fsverity-utils/default.nix
@@ -0,0 +1,51 @@
+{ stdenv
+, lib
+, fetchgit
+, openssl
+, enableShared ? !stdenv.hostPlatform.isStatic
+, enableManpages ? false
+, pandoc
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fsverity-utils";
+  version = "1.5";
+
+  outputs = [ "out" "lib" "dev" ] ++ lib.optional enableManpages "man";
+
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/fsverity-utils.git";
+    rev = "v${version}";
+    sha256 = "sha256-ygBOkp2PBe8Z2ak6SXEJ6HHuT4NRKmIsbJDHcY+h8PQ=";
+  };
+
+  patches = lib.optionals (!enableShared) [
+    ./remove-dynamic-libs.patch
+  ];
+
+  enableParallelBuilding = true;
+  strictDeps = true;
+
+  nativeBuildInputs = lib.optional enableManpages pandoc;
+  buildInputs = [ openssl ];
+
+  makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ] ++ lib.optional enableShared "USE_SHARED_LIB=1";
+
+  doCheck = true;
+
+  installTargets = [ "install" ] ++ lib.optional enableManpages "install-man";
+
+  postInstall = ''
+    mkdir -p $lib
+    mv $out/lib $lib/lib
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.kernel.org/doc/html/latest/filesystems/fsverity.html#userspace-utility";
+    changelog = "https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/fsverity-utils.git/tree/NEWS.md";
+    description = "A set of userspace utilities for fs-verity";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jk ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/fsverity-utils/remove-dynamic-libs.patch b/pkgs/os-specific/linux/fsverity-utils/remove-dynamic-libs.patch
new file mode 100644
index 00000000000..95635cbccdb
--- /dev/null
+++ b/pkgs/os-specific/linux/fsverity-utils/remove-dynamic-libs.patch
@@ -0,0 +1,27 @@
+diff --git a/Makefile b/Makefile
+index 2304a21..697ccd4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -149,13 +149,11 @@ libfsverity.so.$(SOVERSION):$(SHARED_LIB_OBJ)
+ 	$(QUIET_CCLD) $(CC) -o $@ -Wl,-soname=$@ -shared $+ \
+ 		$(CFLAGS) $(LDFLAGS) $(LDLIBS)
+ 
+-DEFAULT_TARGETS += libfsverity.so.$(SOVERSION)
+ 
+ # Create the symlink libfsverity.so => libfsverity.so.$(SOVERSION)
+ libfsverity.so:libfsverity.so.$(SOVERSION)
+ 	$(QUIET_LN) ln -sf $+ $@
+ 
+-DEFAULT_TARGETS += libfsverity.so
+ 
+ ##############################################################################
+ 
+@@ -263,8 +261,6 @@ install:all
+ 	install -d $(DESTDIR)$(LIBDIR)/pkgconfig $(DESTDIR)$(INCDIR) $(DESTDIR)$(BINDIR)
+ 	install -m755 $(FSVERITY) $(DESTDIR)$(BINDIR)
+ 	install -m644 libfsverity.a $(DESTDIR)$(LIBDIR)
+-	install -m755 libfsverity.so.$(SOVERSION) $(DESTDIR)$(LIBDIR)
+-	ln -sf libfsverity.so.$(SOVERSION) $(DESTDIR)$(LIBDIR)/libfsverity.so
+ 	install -m644 include/libfsverity.h $(DESTDIR)$(INCDIR)
+ 	sed -e "s|@PREFIX@|$(PREFIX)|" \
+ 		-e "s|@LIBDIR@|$(LIBDIR)|" \
diff --git a/pkgs/os-specific/linux/fswebcam/default.nix b/pkgs/os-specific/linux/fswebcam/default.nix
index 18cdc21f0b6..678e0d42841 100644
--- a/pkgs/os-specific/linux/fswebcam/default.nix
+++ b/pkgs/os-specific/linux/fswebcam/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, libv4l, gd }:
 
 stdenv.mkDerivation rec {
-  name = "fswebcam-20200725";
+  pname = "fswebcam";
+  version = "20200725";
 
   src = fetchurl {
-    url = "https://www.sanslogic.co.uk/fswebcam/files/${name}.tar.gz";
+    url = "https://www.sanslogic.co.uk/fswebcam/files/fswebcam-${version}.tar.gz";
     sha256 = "1dazsrcaw9s30zz3jpxamk9lkff5dkmflp1s0jjjvdbwa0k6k6ii";
   };
 
diff --git a/pkgs/os-specific/linux/fuse/common.nix b/pkgs/os-specific/linux/fuse/common.nix
index 5adb1b5355a..f4b8bfc5661 100644
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -1,4 +1,4 @@
-{ version, sha256Hash }:
+{ version, hash }:
 
 { lib, stdenv, fetchFromGitHub, fetchpatch
 , fusePackages, util-linux, gettext, shadow
@@ -17,21 +17,27 @@ in stdenv.mkDerivation rec {
     owner = "libfuse";
     repo = "libfuse";
     rev = "${pname}-${version}";
-    sha256 = sha256Hash;
+    inherit hash;
   };
 
   preAutoreconf = "touch config.rpath";
 
   patches =
     lib.optional
-      (!isFuse3 && stdenv.isAarch64)
+      (!isFuse3 && (stdenv.isAarch64 || stdenv.hostPlatform.isLoongArch64))
       (fetchpatch {
         url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
         sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa";
       })
     ++ (if isFuse3
       then [ ./fuse3-install.patch ./fuse3-Do-not-set-FUSERMOUNT_DIR.patch ]
-      else [ ./fuse2-Do-not-set-FUSERMOUNT_DIR.patch ]);
+      else [
+        ./fuse2-Do-not-set-FUSERMOUNT_DIR.patch
+        (fetchpatch {
+          url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-fs/fuse/files/fuse-2.9.9-closefrom-glibc-2-34.patch?id=8a970396fca7aca2d5a761b8e7a8242f1eef14c9";
+          sha256 = "sha256-ELYBW/wxRcSMssv7ejCObrpsJHtOPJcGq33B9yHQII4=";
+        })
+      ]);
 
   nativeBuildInputs = if isFuse3
     then [ meson ninja pkg-config ]
@@ -42,6 +48,7 @@ in stdenv.mkDerivation rec {
   mesonFlags = lib.optionals isFuse3 [
     "-Dudevrulesdir=/udev/rules.d"
     "-Duseroot=false"
+    "-Dinitscriptdir="
   ];
 
   preConfigure = ''
@@ -66,7 +73,7 @@ in stdenv.mkDerivation rec {
       ./makeconf.sh
     '');
 
-  checkInputs = [ which ] ++ (with python3Packages; [ python pytest ]);
+  nativeCheckInputs = [ which ] ++ (with python3Packages; [ python pytest ]);
 
   checkPhase = ''
     python3 -m pytest test/
@@ -92,7 +99,7 @@ in stdenv.mkDerivation rec {
       provides the reference implementation for communicating with the FUSE
       kernel module.
     '';
-    inherit (src.meta) homepage;
+    homepage = "https://github.com/libfuse/libfuse";
     changelog = "https://github.com/libfuse/libfuse/releases/tag/fuse-${version}";
     platforms = platforms.linux;
     license = with licenses; [ gpl2Only lgpl21Only ];
diff --git a/pkgs/os-specific/linux/fuse/default.nix b/pkgs/os-specific/linux/fuse/default.nix
index b060b908284..f692c2fb41c 100644
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -7,11 +7,11 @@ let
 in {
   fuse_2 = mkFuse {
     version = "2.9.9";
-    sha256Hash = "1yxxvm58c30pc022nl1wlg8fljqpmwnchkywic3r74zirvlcq23n";
+    hash = "sha256-dgjM6M7xk5MHi9xPyCyvF0vq0KM8UCsEYBcMhkrdvfs=";
   };
 
   fuse_3 = mkFuse {
-    version = "3.10.4";
-    sha256Hash = "1ml4bs4wx5dbz5xpnd5g8b9avmn7g7jvf16fbdlk0da8il0qd2rx";
+    version = "3.16.2";
+    hash = "sha256-QO9s+IkR0rkqIYNqt2IYST6AVBkCr56jcuuz5nKJuA4=";
   };
 }
diff --git a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
index 903f30325df..582d3eb0dec 100644
--- a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
@@ -1,12 +1,13 @@
+diff --git a/lib/meson.build b/lib/meson.build
 --- a/lib/meson.build
 +++ b/lib/meson.build
 @@ -37,8 +37,7 @@ libfuse = library('fuse3', libfuse_sources, version: meson.project_version(),
                    soversion: '3', include_directories: include_dirs,
                    dependencies: deps, install: true,
                    link_depends: 'fuse_versionscript',
--                  c_args: [ '-DFUSE_USE_VERSION=35',
+-                  c_args: [ '-DFUSE_USE_VERSION=312',
 -                            '-DFUSERMOUNT_DIR="@0@"'.format(fusermount_path) ],
-+                  c_args: [ '-DFUSE_USE_VERSION=35' ],
++                  c_args: [ '-DFUSE_USE_VERSION=312' ],
                    link_args: ['-Wl,--version-script,' + meson.current_source_dir()
                                + '/fuse_versionscript' ])
  
diff --git a/pkgs/os-specific/linux/fuse/fuse3-install.patch b/pkgs/os-specific/linux/fuse/fuse3-install.patch
index 147bcb439fb..769e3088664 100644
--- a/pkgs/os-specific/linux/fuse/fuse3-install.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-install.patch
@@ -1,18 +1,20 @@
---- a/util/install_helper.sh	2019-07-10 12:00:15.984840142 +0200
-+++ b/util/install_helper.sh	2019-07-10 12:28:56.343011401 +0200
-@@ -37,10 +37,10 @@
- fi
+--- a/util/install_helper.sh	2023-08-26 22:12:11.028651669 +0200
++++ b/util/install_helper.sh	2023-08-26 22:38:03.165058694 +0200
+@@ -39,12 +39,12 @@
  
- install -D -m 644 "${MESON_SOURCE_ROOT}/util/udev.rules" \
+ if [ "${udevrulesdir}" != "" ]; then
+     install -D -m 644 "${MESON_SOURCE_ROOT}/util/udev.rules" \
 -        "${DESTDIR}${udevrulesdir}/99-fuse3.rules"
 +        "${sysconfdir}${udevrulesdir}/99-fuse3.rules"
+ fi
  
- install -D -m 755 "${MESON_SOURCE_ROOT}/util/init_script" \
--        "${DESTDIR}/etc/init.d/fuse3"
-+        "${sysconfdir}/init.d/fuse3"
- 
+ if [ "$initscriptdir" != "" ]; then
+     install -D -m 755 "${MESON_SOURCE_ROOT}/util/init_script" \
+-            "${DESTDIR}${initscriptdir}/fuse3"
++            "${sysconfdir}${initscriptdir}/fuse3"
  
- if test -x /usr/sbin/update-rc.d && test -z "${DESTDIR}"; then
+     if test -x /usr/sbin/update-rc.d && test -z "${DESTDIR}"; then
+         /usr/sbin/update-rc.d fuse3 start 34 S . start 41 0 6 . || /bin/true
 diff --git a/util/meson.build b/util/meson.build
 index aa0e734..06d4378 100644
 --- a/util/meson.build
diff --git a/pkgs/os-specific/linux/fw-ectool/default.nix b/pkgs/os-specific/linux/fw-ectool/default.nix
new file mode 100644
index 00000000000..a73cc1896ec
--- /dev/null
+++ b/pkgs/os-specific/linux/fw-ectool/default.nix
@@ -0,0 +1,41 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, pkg-config
+, hostname
+}:
+
+stdenv.mkDerivation {
+  pname = "fw-ectool";
+  version = "unstable-2022-12-03";
+
+  src = fetchFromGitHub {
+    owner = "DHowett";
+    repo = "fw-ectool";
+    rev = "54c140399bbc3e6a3dce6c9f842727c4128367be";
+    hash = "sha256-2teJFz4zcA+USpbVPXMEIHLdmMLem8ik7YrmrSxr/n0=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    hostname
+  ];
+
+  buildPhase = ''
+    patchShebangs util
+    make out=out utils
+  '';
+
+  installPhase = ''
+    install -D out/util/ectool $out/bin/ectool
+  '';
+
+  meta = with lib; {
+    description = "EC-Tool adjusted for usage with framework embedded controller";
+    homepage = "https://github.com/DHowett/framework-ec";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.mkg20001 ];
+    platforms = platforms.linux;
+    mainProgram = "ectool";
+  };
+}
diff --git a/pkgs/os-specific/linux/fwts/default.nix b/pkgs/os-specific/linux/fwts/default.nix
index 1b5a0e3bdff..43f7ed5cb3a 100644
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -1,23 +1,29 @@
-{ lib, stdenv, fetchzip, autoreconfHook, pkg-config, glib, libtool, pcre
-, json_c, flex, bison, dtc, pciutils, dmidecode, iasl, libbsd }:
+{ lib, stdenv, fetchzip, autoreconfHook, pkg-config, gnumake42, glib, pcre
+, json_c, flex, bison, dtc, pciutils, dmidecode, acpica-tools, libbsd }:
 
 stdenv.mkDerivation rec {
   pname = "fwts";
-  version = "20.11.00";
+  version = "23.07.00";
 
   src = fetchzip {
-    url = "http://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
-    sha256 = "0s8iz6c9qhyndcsjscs3qail2mzfywpbiys1x232igm5kl089vvr";
+    url = "https://fwts.ubuntu.com/release/${pname}-V${version}.tar.gz";
+    sha256 = "sha256-Fo5qdb0eT8taYfPAf5LQu0toNXcoVjNoDgeeAlUfbs4=";
     stripRoot = false;
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config libtool ];
-  buildInputs = [ glib pcre json_c flex bison dtc pciutils dmidecode iasl libbsd ];
+  # fails with make 4.4
+  nativeBuildInputs = [ autoreconfHook pkg-config gnumake42 ];
+  buildInputs = [ glib pcre json_c flex bison dtc pciutils dmidecode acpica-tools libbsd ];
 
   postPatch = ''
-    substituteInPlace src/lib/include/fwts_binpaths.h --replace "/usr/bin/lspci"      "${pciutils}/bin/lspci"
-    substituteInPlace src/lib/include/fwts_binpaths.h --replace "/usr/sbin/dmidecode" "${dmidecode}/bin/dmidecode"
-    substituteInPlace src/lib/include/fwts_binpaths.h --replace "/usr/bin/iasl"       "${iasl}/bin/iasl"
+    substituteInPlace src/lib/include/fwts_binpaths.h \
+      --replace "/usr/bin/lspci"      "${pciutils}/bin/lspci" \
+      --replace "/usr/sbin/dmidecode" "${dmidecode}/bin/dmidecode" \
+      --replace "/usr/bin/iasl"       "${acpica-tools}/bin/iasl"
+
+    substituteInPlace src/lib/src/fwts_devicetree.c \
+                      src/devicetree/dt_base/dt_base.c \
+      --replace "dtc -I" "${dtc}/bin/dtc -I"
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/fwts/module.nix b/pkgs/os-specific/linux/fwts/module.nix
index 737d3316e21..a4083d27546 100644
--- a/pkgs/os-specific/linux/fwts/module.nix
+++ b/pkgs/os-specific/linux/fwts/module.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   inherit (fwts) src;
 
-  sourceRoot = "source/efi_runtime";
+  sourceRoot = "${src.name}/efi_runtime";
 
   postPatch = ''
     substituteInPlace Makefile --replace \
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [ "pic" ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "INSTALL_MOD_PATH=${placeholder "out"}"
   ];
 
diff --git a/pkgs/os-specific/linux/fxload/default.nix b/pkgs/os-specific/linux/fxload/default.nix
index 3255c992f86..e8b9d0648bd 100644
--- a/pkgs/os-specific/linux/fxload/default.nix
+++ b/pkgs/os-specific/linux/fxload/default.nix
@@ -1,36 +1,31 @@
-{lib, stdenv, fetchurl}:
+{ lib
+, stdenv
+, libusb1
+}:
 
-stdenv.mkDerivation {
-  name = "fxload-2002_04_11";
+stdenv.mkDerivation rec {
+  pname = "fxload";
+  version = libusb1.version;
+  dontUnpack = true;
+  dontBuild = true;
+  dontConfigure = true;
+  dontInstall = true;
+  dontPatch = true;
+  dontPatchELF = true;
 
-  src = fetchurl {
-    url = "mirror://sourceforge/linux-hotplug/fxload-2002_04_11.tar.gz";
-    sha256 = "1hql93bp3dxrv1p67nc63xsbqwljyynm997ysldrc3n9ifi6s48m";
-  };
-
-  patches = [
-    # Will be needed after linux-headers is updated to >= 2.6.21.
-    (fetchurl {
-      url = "http://sources.gentoo.org/viewcvs.py/*checkout*/gentoo-x86/sys-apps/fxload/files/fxload-20020411-linux-headers-2.6.21.patch?rev=1.1";
-      sha256 = "0ij0c8nr1rbyl5wmyv1cklhkxglvsqz32h21cjw4bjm151kgmk7p";
-    })
-  ];
-
-  preBuild = ''
-    substituteInPlace Makefile --replace /usr /
-    makeFlagsArray=(INSTALL=install prefix=$out)
+  # fxload binary exist inside the `examples/bin` directory of `libusb1`
+  postFixup = ''
+    mkdir -p $out/bin
+    ln -s ${passthru.libusb}/examples/bin/fxload $out/bin/fxload
   '';
 
-  preInstall = ''
-    mkdir -p $out/sbin
-    mkdir -p $out/share/man/man8
-    mkdir -p $out/share/usb
-  '';
+  passthru.libusb = libusb1.override { withExamples = true; };
 
   meta = with lib; {
-    homepage = "http://linux-hotplug.sourceforge.net/?selected=usb";
-    description = "Tool to upload firmware to Cypress EZ-USB microcontrollers";
-    license = licenses.gpl2;
+    homepage = "https://github.com/libusb/libusb";
+    description = "Tool to upload firmware to into an21, fx, fx2, fx2lp and fx3 ez-usb devices";
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
+    maintainers = with maintainers; [ realsnick ];
   };
 }
diff --git a/pkgs/os-specific/linux/g15daemon/default.nix b/pkgs/os-specific/linux/g15daemon/default.nix
index 118a17c4c8f..823f523db24 100644
--- a/pkgs/os-specific/linux/g15daemon/default.nix
+++ b/pkgs/os-specific/linux/g15daemon/default.nix
@@ -79,6 +79,11 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ libg15 libg15render ];
 
+  # Workaround build failure on -fno-common toolchains like upstream gcc-10:
+  #  ld: g15_plugins.o:/build/g15daemon-1.9.5.3/g15daemon/./g15daemon.h:218:
+  #   multiple definition of `lcdlist_mutex'; utility_funcs.o:g15daemon.h:218: first defined here
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
+
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/os-specific/linux/game-devices-udev-rules/default.nix b/pkgs/os-specific/linux/game-devices-udev-rules/default.nix
new file mode 100644
index 00000000000..daaf23db6ce
--- /dev/null
+++ b/pkgs/os-specific/linux/game-devices-udev-rules/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitea
+, bash
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "game-devices-udev-rules";
+  version = "0.22";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "fabiscafe";
+    repo = "game-devices-udev";
+    rev = finalAttrs.version;
+    hash = "sha256-1aOb8pJxB+/PM7spcvZcy/cwdEolHQ4+lwBLij+6iDk=";
+  };
+
+  postInstall = ''
+    install -Dm444 -t "$out/lib/udev/rules.d" *.rules
+    substituteInPlace $out/lib/udev/rules.d/71-powera-controllers.rules \
+    --replace "/bin/sh" "${bash}/bin/bash"
+  '';
+
+  meta = with lib; {
+    description = "Udev rules to make supported controllers available with user-grade permissions";
+    homepage = "https://codeberg.org/fabiscafe/game-devices-udev";
+    license = licenses.mit;
+    longDescription = ''
+      These udev rules are intended to be used as a package under 'services.udev.packages'.
+      They will not be activated if installed as 'environment.systemPackages' or 'users.user.<user>.packages'.
+
+      Additionally, you may need to enable 'hardware.uinput'.
+    '';
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ keenanweaver ];
+  };
+})
diff --git a/pkgs/os-specific/linux/gasket/default.nix b/pkgs/os-specific/linux/gasket/default.nix
new file mode 100644
index 00000000000..c0790ae6a27
--- /dev/null
+++ b/pkgs/os-specific/linux/gasket/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, lib, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "gasket";
+  version = "1.0-18";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "gasket-driver";
+    rev = "97aeba584efd18983850c36dcf7384b0185284b3";
+    sha256 = "pJwrrI7jVKFts4+bl2xmPIAD01VKFta2SRuElerQnTo=";
+  };
+
+  makeFlags = [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(PWD)"
+  ];
+  buildFlags = [ "modules" ];
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  sourceRoot = "${src.name}/src";
+  hardeningDisable = [ "pic" "format" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  meta = with lib; {
+    description = "The Coral Gasket Driver allows usage of the Coral EdgeTPU on Linux systems.";
+    homepage = "https://github.com/google/gasket-driver";
+    license = licenses.gpl2;
+    maintainers = [ lib.maintainers.kylehendricks ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix b/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
index ab2e099d970..1f0265207df 100644
--- a/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
+++ b/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
@@ -8,18 +8,18 @@ let
   kerneldir = "lib/modules/${kernel.modDirVersion}";
 in stdenv.mkDerivation rec {
   pname = "gcadapter-oc-kmod";
-  version = "1.4";
+  version = "unstable-2021-12-11";
 
   src = fetchFromGitHub {
     owner = "HannesMann";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "1nqhj3vqq9rnj37cnm2c4867mnxkr8di3i036shcz44h9qmy9d40";
+    rev = "d4ddf15deb74c51dbdfc814d481ef127c371f444";
+    sha256 = "sha256-bHA1611rcO8/d48b1CHsiurEt3/n+5WErtHXAU7Eh1o=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNEL_SOURCE_DIR=${kernel.dev}/${kerneldir}/build"
     "INSTALL_MOD_PATH=$(out)"
   ];
diff --git a/pkgs/os-specific/linux/gobi_loader/default.nix b/pkgs/os-specific/linux/gobi_loader/default.nix
index b7972007719..2b251242119 100644
--- a/pkgs/os-specific/linux/gobi_loader/default.nix
+++ b/pkgs/os-specific/linux/gobi_loader/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
     substituteInPlace 60-gobi.rules --replace "/lib/firmware" "/run/current-system/firmware"
   '';
 
-  makeFlags = "prefix=${placeholder "out"}";
+  makeFlags = [ "prefix=${placeholder "out"}" ];
 
   meta = with lib; {
     description = "Firmware loader for Qualcomm Gobi USB chipsets";
diff --git a/pkgs/os-specific/linux/gogoclient/config-paths.patch b/pkgs/os-specific/linux/gogoclient/config-paths.patch
deleted file mode 100644
index 88358038bc7..00000000000
--- a/pkgs/os-specific/linux/gogoclient/config-paths.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-diff -urN gogoc-1_2-RELEASE/gogoc-tsp/conf/gogoc.conf.in gogoc-1_2-RELEASE-fix/gogoc-tsp/conf/gogoc.conf.in
---- gogoc-1_2-RELEASE/gogoc-tsp/conf/gogoc.conf.in	2009-11-20 17:53:12.000000000 +0100
-+++ gogoc-1_2-RELEASE-fix/gogoc-tsp/conf/gogoc.conf.in	2012-02-25 15:16:12.758849219 +0100
-@@ -224,7 +224,7 @@
- #
- #   broker_list=<file_name>
- #  
--broker_list=tsp-broker-list.txt
-+broker_list=/var/lib/gogoc/tsp-broker-list.txt
- 
- #
- # Last Server Used File Name:
-@@ -234,7 +234,7 @@
- #
- #   last_server=<file_name>
- #
--last_server=tsp-last-server.txt
-+last_server=/var/lib/gogoc/tsp-last-server.txt
- 
- #
- # Always Use Last Known Working Server:
-@@ -294,7 +294,7 @@
- #
- #   log_filename=<file_name>
- #
--log_filename=gogoc.log
-+log_filename=/var/log/gogoc.log
- 
- #
- # Log File Rotation:
-@@ -313,7 +313,7 @@
- #
- #   log_rotation=<yes|no>
- #
--log_rotation=yes
-+log_rotation=no
- 
- #
- # Log File Rotation Size:
diff --git a/pkgs/os-specific/linux/gogoclient/default.nix b/pkgs/os-specific/linux/gogoclient/default.nix
deleted file mode 100644
index 83ac93fbf71..00000000000
--- a/pkgs/os-specific/linux/gogoclient/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{lib, stdenv, fetchurl, openssl, nettools, iproute2, sysctl}:
-
-let baseName = "gogoclient";
-    version  = "1.2";
-in
-
-stdenv.mkDerivation rec {
-  name = "${baseName}-${version}";
-
-  src = fetchurl {
-    #url = "http://gogo6.com/downloads/gogoc-1_2-RELEASE.tar.gz";
-    url = "https://src.fedoraproject.org/repo/pkgs/gogoc/gogoc-1_2-RELEASE.tar.gz/41177ed683cf511cc206c7782c37baa9/gogoc-1_2-RELEASE.tar.gz";
-    sha256 = "a0ef45c0bd1fc9964dc8ac059b7d78c12674bf67ef641740554e166fa99a2f49";
-  };
-  patches = [./gcc46-include-fix.patch ./config-paths.patch ];
-  makeFlags = ["target=linux"];
-  installFlags = ["installdir=$(out)"];
-
-  hardeningDisable = [ "format" ];
-
-  buildInputs = [openssl];
-
-  preFixup = ''
-    mkdir -p $out/share/${name}
-    chmod 444 $out/bin/gogoc.conf
-    mv $out/bin/gogoc.conf $out/share/${name}/gogoc.conf.sample
-    rm $out/bin/gogoc.conf.sample
-
-    substituteInPlace "$out/template/linux.sh" \
-      --replace "/sbin/ifconfig" "${nettools}/bin/ifconfig" \
-      --replace "/sbin/route"    "${nettools}/bin/route" \
-      --replace "/sbin/ip"       "${iproute2}/sbin/ip" \
-      --replace "/sbin/sysctl"   "${sysctl}/bin/sysctl"
-    sed -i -e 's/^.*Exec \$route -A.*$/& metric 128/' $out/template/linux.sh
-  '';
-
-  meta = with lib; {
-    homepage = "https://ipv6.ernet.in/Tunnel_broker";
-    description = "Client to connect to the Freenet6 IPv6 tunnel broker service";
-    maintainers = [ maintainers.bluescreen303 ];
-    license = licenses.bsd3;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/gogoclient/gcc46-include-fix.patch b/pkgs/os-specific/linux/gogoclient/gcc46-include-fix.patch
deleted file mode 100644
index 22ecad187d6..00000000000
--- a/pkgs/os-specific/linux/gogoclient/gcc46-include-fix.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-diff -urN gogoc-1_2-RELEASE/gogoc-messaging/src/clientmsgsender.cc gogoc-1_2-RELEASE-fix/gogoc-messaging/src/clientmsgsender.cc
---- gogoc-1_2-RELEASE/gogoc-messaging/src/clientmsgsender.cc	2009-11-20 17:34:55.000000000 +0100
-+++ gogoc-1_2-RELEASE-fix/gogoc-messaging/src/clientmsgsender.cc	2012-02-25 15:06:20.764698284 +0100
-@@ -15,6 +15,7 @@
- // **************************************************************************
- #include <gogocmessaging/clientmsgsender.h>
- #include <assert.h>
-+#include <stddef.h>
- 
- 
- namespace gogocmessaging
-diff -urN gogoc-1_2-RELEASE/gogoc-messaging/src/servermsgsender.cc gogoc-1_2-RELEASE-fix/gogoc-messaging/src/servermsgsender.cc
---- gogoc-1_2-RELEASE/gogoc-messaging/src/servermsgsender.cc	2009-11-20 17:34:56.000000000 +0100
-+++ gogoc-1_2-RELEASE-fix/gogoc-messaging/src/servermsgsender.cc	2012-02-25 15:06:36.722740288 +0100
-@@ -15,6 +15,7 @@
- // **************************************************************************
- #include <gogocmessaging/servermsgsender.h>
- #include <assert.h>
-+#include <stddef.h>
- 
- 
- namespace gogocmessaging
diff --git a/pkgs/os-specific/linux/google-authenticator/default.nix b/pkgs/os-specific/linux/google-authenticator/default.nix
index ce90a1d432f..fcf75ac7821 100644
--- a/pkgs/os-specific/linux/google-authenticator/default.nix
+++ b/pkgs/os-specific/linux/google-authenticator/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, lib, fetchurl, autoreconfHook, pam, qrencode }:
+{ stdenv, lib, fetchFromGitHub, autoreconfHook, pam, qrencode }:
 
 stdenv.mkDerivation rec {
   pname = "google-authenticator-libpam";
   version = "1.09";
 
-  src = fetchurl {
-    url = "https://github.com/google/google-authenticator-libpam/archive/${version}.tar.gz";
-    sha256 = "0dyhgizl2jcrnfn5sxipxawqrbr6qgjh7aggw8fz3hix861pj7db";
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "google-authenticator-libpam";
+    rev = version;
+    hash = "sha256-DS0h6FWMNKnSSj039bH6iyWrERa5M7LBSkbyig6pyxY=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/os-specific/linux/greetd/default.nix b/pkgs/os-specific/linux/greetd/default.nix
deleted file mode 100644
index 6f305c5d6eb..00000000000
--- a/pkgs/os-specific/linux/greetd/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{ rustPlatform
-, lib
-, fetchFromSourcehut
-, pam
-, scdoc
-, installShellFiles
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "greetd";
-  version = "0.7.0";
-
-  src = fetchFromSourcehut {
-    owner = "~kennylevinsen";
-    repo = pname;
-    rev = version;
-    sha256 = "b+S3fuJ8gjnSQzLHl3Bs9iO/Un2ynggAplz01GjJvFI=";
-  };
-
-  cargoHash = "sha256-YSC7osyBPwx+lo7P1ftI72mRWeQlDc2srRPzTFqVTxM=";
-
-  nativeBuildInputs = [
-    scdoc
-    installShellFiles
-  ];
-
-  buildInputs = [
-    pam
-  ];
-
-  postInstall = ''
-    for f in man/*; do
-      scdoc < "$f" > "$(sed 's/-\([0-9]\)\.scd$/.\1/' <<< "$f")"
-      rm "$f"
-    done
-    installManPage man/*
-  '';
-
-  meta = with lib; {
-    description = "Minimal and flexible login manager daemon";
-    longDescription = ''
-      greetd is a minimal and flexible login manager daemon
-      that makes no assumptions about what you want to launch.
-      Comes with agreety, a simple, text-based greeter.
-    '';
-    homepage = "https://kl.wtf/projects/greetd/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/gt/default.nix b/pkgs/os-specific/linux/gt/default.nix
new file mode 100644
index 00000000000..85897b72585
--- /dev/null
+++ b/pkgs/os-specific/linux/gt/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, lib, fetchFromGitHub, cmake, bash-completion, pkg-config, libconfig
+, asciidoc
+, libusbgx
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gt";
+  version = "unstable-2022-05-08";
+
+  src = fetchFromGitHub {
+    owner = "linux-usb-gadgets";
+    repo = "gt";
+    rev = "7f9c45d98425a27444e49606ce3cf375e6164e8e";
+    sha256 = "sha256-km4U+t4Id2AZx6GpH24p2WNmvV5RVjJ14sy8tWLCQsk=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/source";
+
+  preConfigure = ''
+    cmakeFlagsArray+=("-DBASH_COMPLETION_COMPLETIONSDIR=$out/share/bash-completions/completions")
+  '';
+
+  nativeBuildInputs = [ cmake pkg-config asciidoc ];
+
+  buildInputs = [ bash-completion libconfig libusbgx];
+
+  meta = {
+    description = "Linux command line tool for setting up USB gadgets using configfs";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ lheckemann ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/os-specific/linux/gtkgreet/default.nix b/pkgs/os-specific/linux/gtkgreet/default.nix
deleted file mode 100644
index 7ab7c01475b..00000000000
--- a/pkgs/os-specific/linux/gtkgreet/default.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-{ stdenv
-, lib
-, fetchFromSourcehut
-, pkg-config
-, cmake
-, meson
-, ninja
-, gtk3
-, gtk-layer-shell
-, json_c
-, scdoc
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gtkgreet";
-  version = "0.7";
-
-  src = fetchFromSourcehut {
-    owner = "~kennylevinsen";
-    repo = pname;
-    rev = version;
-    sha256 = "ms+2FdtzzNlmlzNxFhu4cpX5H+5H+9ZOtZ0p8uVA3lo=";
-  };
-
-  nativeBuildInputs = [
-    pkg-config
-    meson
-    ninja
-    cmake
-  ];
-
-  buildInputs = [
-    gtk3
-    gtk-layer-shell
-    json_c
-    scdoc
-  ];
-
-  mesonFlags = [
-    "-Dlayershell=enabled"
-  ];
-
-  meta = with lib; {
-    description = "GTK based greeter for greetd, to be run under cage or similar";
-    homepage = "https://git.sr.ht/~kennylevinsen/gtkgreet";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/guvcview/default.nix b/pkgs/os-specific/linux/guvcview/default.nix
index 04eccaf0243..6e073662c4e 100644
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -5,7 +5,7 @@
 , pkg-config
 , portaudio
 , SDL2
-, ffmpeg
+, ffmpeg_4
 , udev
 , libusb1
 , libv4l
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     SDL2
     alsa-lib
-    ffmpeg
+    ffmpeg_4
     libusb1
     libv4l
     portaudio
@@ -70,7 +70,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A simple interface for devices supported by the linux UVC driver";
-    homepage = "http://guvcview.sourceforge.net";
+    homepage = "https://guvcview.sourceforge.net";
     maintainers = [ maintainers.coconnor ];
     license = licenses.gpl3;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/hd-idle/default.nix b/pkgs/os-specific/linux/hd-idle/default.nix
index 3e4b0815146..13cb397b179 100644
--- a/pkgs/os-specific/linux/hd-idle/default.nix
+++ b/pkgs/os-specific/linux/hd-idle/default.nix
@@ -1,24 +1,28 @@
-{ lib, stdenv, fetchurl }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
-stdenv.mkDerivation rec {
-  name = "hd-idle-1.05";
+buildGoModule rec {
+  pname = "hd-idle";
+  version = "1.21";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/project/hd-idle/${name}.tgz";
-    sha256 = "031sm996s0rhy3z91b9xvyimsj2yd2fhsww2al2hxda5s5wzxzjf";
+  src = fetchFromGitHub {
+    owner = "adelolmo";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-WHJcysTN9LHI1WnDuFGTyTirxXirpLpJIeNDj4sZGY0=";
   };
 
-  prePatch = ''
-    substituteInPlace Makefile \
-      --replace "-g root -o root" ""
-  '';
+  vendorHash = null;
+
+  nativeBuildInputs = [ installShellFiles ];
 
-  installFlags = [ "TARGET_DIR=$(out)" ];
+  postInstall = ''
+    installManPage debian/hd-idle.8
+  '';
 
   meta = with lib; {
     description = "Spins down external disks after a period of idle time";
-    homepage = "http://hd-idle.sourceforge.net/";
-    license = licenses.gpl2Plus;
+    homepage = "https://github.com/adelolmo/hd-idle";
+    license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.rycee ];
   };
diff --git a/pkgs/os-specific/linux/hdapsd/default.nix b/pkgs/os-specific/linux/hdapsd/default.nix
index 39f69ef0144..959fa9ac6e8 100644
--- a/pkgs/os-specific/linux/hdapsd/default.nix
+++ b/pkgs/os-specific/linux/hdapsd/default.nix
@@ -1,8 +1,8 @@
 { lib, stdenv, fetchurl }:
 
-let version = "20141203"; in
-stdenv.mkDerivation {
-  name = "hdapsd-"+version;
+stdenv.mkDerivation rec {
+  pname = "hdapsd";
+  version = "20141203";
 
   src = fetchurl {
     url = "https://github.com/evgeni/hdapsd/releases/download/${version}/hdapsd-${version}.tar.gz";
diff --git a/pkgs/os-specific/linux/hdparm/default.nix b/pkgs/os-specific/linux/hdparm/default.nix
index 300bb499f85..12938dbac89 100644
--- a/pkgs/os-specific/linux/hdparm/default.nix
+++ b/pkgs/os-specific/linux/hdparm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hdparm";
-  version = "9.62";
+  version = "9.65";
 
   src = fetchurl {
     url = "mirror://sourceforge/hdparm/hdparm-${version}.tar.gz";
-    sha256 = "sha256-LA+ddc2+2pKKJaEozT0LcSBEXsCRDAsp1MEDjtG+d38=";
+    sha256 = "sha256-0Ukp+RDQYJMucX6TgkJdR8LnFEI1pTcT1VqU995TWks=";
   };
 
   preBuild = ''
diff --git a/pkgs/os-specific/linux/health-check/default.nix b/pkgs/os-specific/linux/health-check/default.nix
index 694d4565d96..9e85281ea4c 100644
--- a/pkgs/os-specific/linux/health-check/default.nix
+++ b/pkgs/os-specific/linux/health-check/default.nix
@@ -1,12 +1,14 @@
-{ stdenv, lib, fetchurl, json_c, libbsd }:
+{ stdenv, lib, fetchFromGitHub, json_c, libbsd }:
 
 stdenv.mkDerivation rec {
   pname = "health-check";
-  version = "0.03.05";
+  version = "0.03.11";
 
-  src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1qxmkdl4pa043yg4kq5ffapm0c2cmm64h3v2c3xhnx0ad5pbhy5z";
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    hash = "sha256-QLa/7kA0juefzOba7ELopDmOVfiGJReo4LCfhnxW1tk=";
   };
 
   buildInputs = [ json_c libbsd ];
@@ -16,11 +18,12 @@ stdenv.mkDerivation rec {
   installFlags = [
     "BINDIR=${placeholder "out"}/bin"
     "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
   meta = with lib; {
     description = "Process monitoring tool";
-    homepage = "https://kernel.ubuntu.com/~cking/health-check/";
+    homepage = "https://github.com/ColinIanKing/health-check";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ dtzWill ];
diff --git a/pkgs/os-specific/linux/hid-ite8291r3/default.nix b/pkgs/os-specific/linux/hid-ite8291r3/default.nix
new file mode 100644
index 00000000000..d4f69c734ac
--- /dev/null
+++ b/pkgs/os-specific/linux/hid-ite8291r3/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "hid-ite8291r3";
+  version = "unstable-2022-06-01";
+
+  src = fetchFromGitHub {
+    owner = "pobrn";
+    repo = "hid-ite8291r3";
+    rev = "48e04cb96517f8574225ebabb286775feb942ef5";
+    hash = "sha256-/69vvVbAVULDW8rwDYSj5706vrqJ6t4s/T6s3vmG9wk=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "VERSION=${version}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D hid-ite8291r3.ko -t $out/lib/modules/${kernel.modDirVersion}/extra
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Linux driver for the ITE 8291 RGB keyboard backlight controller";
+    homepage = "https://github.com/pobrn/hid-ite8291r3/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ aacebedo ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.9";
+  };
+}
diff --git a/pkgs/os-specific/linux/hid-nintendo/default.nix b/pkgs/os-specific/linux/hid-nintendo/default.nix
deleted file mode 100644
index 321f96d0d36..00000000000
--- a/pkgs/os-specific/linux/hid-nintendo/default.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, kernel }:
-
-stdenv.mkDerivation rec {
-  pname = "hid-nintendo";
-  version = "3.1";
-
-  src = fetchFromGitHub {
-    owner = "nicman23";
-    repo = "dkms-hid-nintendo";
-    rev = version;
-    sha256 = "sha256-IanH3yHfkQhqtKvKD8lh+muc9yX8XJ5bfdy1Or8Vd5g=";
-  };
-
-  setSourceRoot = ''
-    export sourceRoot=$(pwd)/source/src
-  '';
-
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  makeFlags = [
-    "-C"
-    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    "M=$(sourceRoot)"
-  ];
-
-  buildFlags = [ "modules" ];
-  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
-  installTargets = [ "modules_install" ];
-
-  meta = with lib; {
-    description = "A Nintendo HID kernel module";
-    homepage = "https://github.com/nicman23/dkms-hid-nintendo";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.rencire ];
-    platforms = platforms.linux;
-    broken = versionOlder kernel.version "4.14";
-  };
-}
diff --git a/pkgs/os-specific/linux/hid-tmff2/default.nix b/pkgs/os-specific/linux/hid-tmff2/default.nix
new file mode 100644
index 00000000000..ac297c78e10
--- /dev/null
+++ b/pkgs/os-specific/linux/hid-tmff2/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, lib, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation {
+  pname = "hid-tmff2";
+  # https://github.com/Kimplul/hid-tmff2/blob/ca168637fbfb085ebc9ade0c47fa0653dac5d25b/dkms/dkms-install.sh#L12
+  version = "0.81";
+
+  src = fetchFromGitHub {
+    owner = "Kimplul";
+    repo = "hid-tmff2";
+    rev = "ca168637fbfb085ebc9ade0c47fa0653dac5d25b";
+    hash = "sha256-Nm5m5xjwJGy+ia4nTkvPZynIxUj6MVGGbSNmIcIpziM=";
+    # For hid-tminit. Source: https://github.com/scarburato/hid-tminit
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installFlags = [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  postPatch = "sed -i '/depmod -A/d' Makefile";
+
+  meta = with lib; {
+    description = "A linux kernel module for Thrustmaster T300RS, T248 and TX(experimental)";
+    homepage = "https://github.com/Kimplul/hid-tmff2";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.rayslash ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index 5d4edc4f7e7..e4b41f3a0c8 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libnl, openssl, sqlite ? null }:
+{ lib, stdenv, fetchurl, pkg-config, libnl, openssl, sqlite ? null }:
 
 stdenv.mkDerivation rec {
   pname = "hostapd";
-  version = "2.9";
+  version = "2.10";
 
   src = fetchurl {
     url = "https://w1.fi/releases/${pname}-${version}.tar.gz";
-    sha256 = "1mrbvg4v7vm7mknf0n29mf88k3s4a4qj6r4d51wq8hmjj1m7s7c8";
+    sha256 = "sha256-IG58eZtnhXLC49EgMCOHhLxKn4IyOwFWtMlGbxSYkV0=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,50 +16,28 @@ stdenv.mkDerivation rec {
     (fetchurl {
       # Note: fetchurl seems to be unhappy with openwrt git
       # server's URLs containing semicolons. Using the github mirror instead.
-      url = "https://raw.githubusercontent.com/openwrt/openwrt/master/package/network/services/hostapd/patches/300-noscan.patch";
-      sha256 = "04wg4yjc19wmwk6gia067z99gzzk9jacnwxh5wyia7k5wg71yj5k";
-    })
-    # AP mode PMF disconnection protection bypass (CVE.2019-16275), can be removed >= 2.10
-    # https://w1.fi/security/2019-7/
-    (fetchurl {
-      name = "CVE-2019-16275.patch";
-      url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
-      sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
-    })
-    # Fixes for UPnP SUBSCRIBE misbehavior in hostapd WPS AP (CVE-2020-12695), can be removed >= 2.10
-    # https://w1.fi/security/2020-1/
-    (fetchurl {
-      name = "CVE-2020-12695_0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch";
-      url = "https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch";
-      sha256 = "1mrbhicqb34jlw1nid5hk2vnjbvfhvp7r5iblaj4l6vgc6fmp6id";
-    })
-    (fetchurl {
-      name = "CVE-2020-12695_0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch";
-      url = "https://w1.fi/security/2020-1/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch";
-      sha256 = "1pk08b06b24is50bis3rr56xjd3b5kxdcdk8bx39n9vna9db7zj9";
-    })
-    (fetchurl {
-      name = "CVE-2020-12695_0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch";
-      url = "https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch";
-      sha256 = "12npqp2skgrj934wwkqicgqksma0fxz09di29n1b5fm5i4njl8d8";
-    })
-    # In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
-    (fetchpatch {
-      name = "CVE-2021-30004.patch";
-      url = "https://w1.fi/cgit/hostap/patch/?id=a0541334a6394f8237a4393b7372693cd7e96f15";
-      sha256 = "1gbhlz41x1ar1hppnb76pqxj6vimiypy7c4kq6h658637s4am3xg";
+      url = "https://raw.githubusercontent.com/openwrt/openwrt/eefed841b05c3cd4c65a78b50ce0934d879e6acf/package/network/services/hostapd/patches/300-noscan.patch";
+      sha256 = "08p5frxhpq1rp2nczkscapwwl8g9nc4fazhjpxic5bcbssc3sb00";
     })
   ];
 
   outputs = [ "out" "man" ];
 
+  # Based on hostapd's defconfig. Only differences are tracked.
   extraConfig = ''
+    # Use epoll(7) instead of select(2) on linux
+    CONFIG_ELOOP_EPOLL=y
+
+    # Drivers
     CONFIG_DRIVER_WIRED=y
-    CONFIG_LIBNL32=y
+    CONFIG_DRIVER_NONE=y
+
+    # Integrated EAP server
     CONFIG_EAP_SIM=y
     CONFIG_EAP_AKA=y
     CONFIG_EAP_AKA_PRIME=y
     CONFIG_EAP_PAX=y
+    CONFIG_EAP_PSK=y
     CONFIG_EAP_PWD=y
     CONFIG_EAP_SAKE=y
     CONFIG_EAP_GPSK=y
@@ -68,28 +46,48 @@ stdenv.mkDerivation rec {
     CONFIG_EAP_IKEV2=y
     CONFIG_EAP_TNC=y
     CONFIG_EAP_EKE=y
-    CONFIG_RADIUS_SERVER=y
-    CONFIG_IEEE80211R=y
-    CONFIG_IEEE80211N=y
-    CONFIG_IEEE80211AC=y
-    CONFIG_FULL_DYNAMIC_VLAN=y
-    CONFIG_VLAN_NETLINK=y
+
     CONFIG_TLS=openssl
     CONFIG_TLSV11=y
     CONFIG_TLSV12=y
-    CONFIG_INTERNETWORKING=y
+
+    CONFIG_SAE=y
+    CONFIG_SAE_PK=y
+
+    CONFIG_OWE=y
+    CONFIG_OCV=y
+
+    # TKIP is considered insecure and upstream support will be removed in the future
+    CONFIG_NO_TKIP=y
+
+    # Misc
+    CONFIG_RADIUS_SERVER=y
+    CONFIG_FULL_DYNAMIC_VLAN=y
+    CONFIG_VLAN_NETLINK=y
+    CONFIG_GETRANDOM=y
+    CONFIG_INTERWORKING=y
     CONFIG_HS20=y
+    CONFIG_FST=y
+    CONFIG_FST_TEST=y
     CONFIG_ACS=y
-    CONFIG_GETRANDOM=y
-    CONFIG_SAE=y
+    CONFIG_WNM=y
+    CONFIG_MBO=y
+
+    CONFIG_IEEE80211R=y
+    CONFIG_IEEE80211W=y
+    CONFIG_IEEE80211N=y
+    CONFIG_IEEE80211AC=y
+    CONFIG_IEEE80211AX=y
   '' + lib.optionalString (sqlite != null) ''
     CONFIG_SQLITE=y
   '';
 
+  passAsFile = [ "extraConfig" ];
+
   configurePhase = ''
     cd hostapd
     cp -v defconfig .config
-    echo "$extraConfig" >> .config
+    cat $extraConfigPath >> .config
     cat -n .config
     substituteInPlace Makefile --replace /usr/local $out
     export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config --cflags libnl-3.0)"
@@ -102,11 +100,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://hostap.epitest.fi";
-    repositories.git = "git://w1.fi/hostap.git";
+    homepage = "https://w1.fi/hostapd/";
     description = "A user space daemon for access point and authentication servers";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ phreedom ninjatrappeur hexa ];
+    maintainers = with maintainers; [ hexa ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index f700bf035de..5bfdf61dff6 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,29 +2,28 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.347";
+  version = "0.376";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "19kmz25zq6qqs67ppqhws4mh3qf6zrp55cpyxyw36q95yjdcqp21";
+    hash = "sha256-M1uBamN09XepOembDAcHXO/UvnM9s/OiN+eNzChF5Tw=";
   };
 
-  preConfigure = "patchShebangs ./configure";
+  postPatch = ''
+    patchShebangs ./configure
+  '';
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
 
-  outputHashMode = "recursive";
-  outputHashAlgo = "sha256";
-  outputHash = "0haaczd6pi9q2vdlvbwn7100sb87zsy64z94xhpbmlari4vzjmz0";
-
   meta = {
     homepage = "https://github.com/vcrhonek/hwdata";
     description = "Hardware Database, including Monitors, pci.ids, usb.ids, and video cards";
     license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ pedrohlc ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/os-specific/linux/hyperv-daemons/default.nix b/pkgs/os-specific/linux/hyperv-daemons/default.nix
index a659908a7a0..12033063c16 100644
--- a/pkgs/os-specific/linux/hyperv-daemons/default.nix
+++ b/pkgs/os-specific/linux/hyperv-daemons/default.nix
@@ -73,9 +73,9 @@ in stdenv.mkDerivation {
   buildCommand = ''
     system=$lib/lib/systemd/system
 
-    install -Dm444 ${service "fcopy" "file copy (FCOPY)" "hv_fcopy" } $system/hv-fcopy.service
-    install -Dm444 ${service "kvp"   "key-value pair (KVP)"     ""  } $system/hv-kvp.service
-    install -Dm444 ${service "vss"   "volume shadow copy (VSS)" ""  } $system/hv-vss.service
+    install -Dm444 ${service "fcopy" "file copy (FCOPY)"        "hv_fcopy" } $system/hv-fcopy.service
+    install -Dm444 ${service "kvp"   "key-value pair (KVP)"     "hv_kvp"   } $system/hv-kvp.service
+    install -Dm444 ${service "vss"   "volume shadow copy (VSS)" "hv_vss"   } $system/hv-vss.service
 
     cat > $system/hyperv-daemons.target <<EOF
     [Unit]
diff --git a/pkgs/os-specific/linux/i2c-tools/default.nix b/pkgs/os-specific/linux/i2c-tools/default.nix
index 5c05ca6082e..556bc2d8978 100644
--- a/pkgs/os-specific/linux/i2c-tools/default.nix
+++ b/pkgs/os-specific/linux/i2c-tools/default.nix
@@ -7,19 +7,22 @@
 
 stdenv.mkDerivation rec {
   pname = "i2c-tools";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/utils/i2c-tools/i2c-tools.git";
     rev = "v${version}";
-    sha256 = "0vqrbp10klr7ylarr6cy1q7nafiqaky4iq5my5dqy101h93vg4pg";
+    sha256 = "sha256-HlmIocum+HZEKNiS5BUwEIswRfTMUhD1vCPibAuAK0Q=";
   };
 
   buildInputs = [ perl ];
 
   postPatch = ''
-    substituteInPlace eeprom/decode-edid --replace "/usr/sbin/parse-edid" "${read-edid}/bin/parse-edid"
-    substituteInPlace stub/i2c-stub-from-dump --replace "/sbin/" ""
+    substituteInPlace eeprom/decode-edid \
+      --replace "/usr/sbin/parse-edid" "${read-edid}/bin/parse-edid"
+
+    substituteInPlace stub/i2c-stub-from-dump \
+      --replace "/sbin/" ""
   '';
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
@@ -27,7 +30,7 @@ stdenv.mkDerivation rec {
   outputs = [ "out" "man" ];
 
   postInstall = ''
-    rm -rf $out/include # Installs include/linux/i2c-dev.h that conflics with kernel headers
+    rm -rf $out/include/linux/i2c-dev.h # conflics with kernel headers
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/i7z/default.nix b/pkgs/os-specific/linux/i7z/default.nix
index 2e00e9eedc3..9af2aba3d80 100644
--- a/pkgs/os-specific/linux/i7z/default.nix
+++ b/pkgs/os-specific/linux/i7z/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "i7z";
-  version = "0.27.3";
+  version = "0.27.4";
 
   src = fetchFromGitHub {
     owner = "DimitryAndric";
     repo = "i7z";
     rev = "v${version}";
-    sha256 = "0l8wz0ffb27nkwchc606js652spk8masy3kjmzh7ygipwsary5ds";
+    sha256 = "00c4ng30ry88hcya4g1i9dngiqmz3cs31x7qh1a10nalxn1829xy";
   };
 
   buildInputs = [ ncurses ] ++ lib.optional withGui qtbase;
@@ -49,7 +49,6 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A better i7 (and now i3, i5) reporting tool for Linux";
     homepage = "https://github.com/DimitryAndric/i7z";
-    repositories.git = "https://github.com/DimitryAndric/i7z.git";
     license = licenses.gpl2;
     maintainers = with maintainers; [ bluescreen303 ];
     # broken on ARM
diff --git a/pkgs/os-specific/linux/i810switch/default.nix b/pkgs/os-specific/linux/i810switch/default.nix
index ffca983a35e..3a202ca08e9 100644
--- a/pkgs/os-specific/linux/i810switch/default.nix
+++ b/pkgs/os-specific/linux/i810switch/default.nix
@@ -1,9 +1,8 @@
 { lib, stdenv, fetchurl, pciutils }:
 
 stdenv.mkDerivation {
-  name = "i810switch-0.6.5";
-
-  phases = "unpackPhase installPhase";
+  pname = "i810switch";
+  version = "0.6.5";
 
   installPhase = "
     sed -i -e 's+/usr++' Makefile
@@ -17,10 +16,11 @@ stdenv.mkDerivation {
     sha256 = "d714840e3b14e1fa9c432c4be0044b7c008d904dece0d611554655b979cad4c3";
   };
 
-  meta = {
+  meta = with lib; {
     description = "A utility for switching between the LCD and external VGA display on Intel graphics cards";
     homepage = "http://www16.plala.or.jp/mano-a-mano/i810switch.html";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
+    maintainers = with maintainers; [ ];
+    license = licenses.gpl2;
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ifmetric/default.nix b/pkgs/os-specific/linux/ifmetric/default.nix
index f5d55db5e41..d4672b9be21 100644
--- a/pkgs/os-specific/linux/ifmetric/default.nix
+++ b/pkgs/os-specific/linux/ifmetric/default.nix
@@ -32,5 +32,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.anna328p ];
     platforms = platforms.linux;
+    mainProgram = "ifmetric";
   };
 }
diff --git a/pkgs/os-specific/linux/iio-sensor-proxy/default.nix b/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
index 5f44622c512..3da9396d618 100644
--- a/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
+++ b/pkgs/os-specific/linux/iio-sensor-proxy/default.nix
@@ -1,51 +1,60 @@
-{ lib, stdenv, fetchFromGitLab, autoconf-archive, gettext, libtool, intltool, autoconf, automake
-, glib, gtk3, gtk-doc, libgudev, pkg-config, systemd }:
+{ lib
+, stdenv
+, fetchFromGitLab
+, glib
+, cmake
+, libxml2
+, meson
+, ninja
+, pkg-config
+, libgudev
+, systemd
+, polkit
+}:
 
 stdenv.mkDerivation rec {
   pname = "iio-sensor-proxy";
-  version = "3.0";
+  version = "3.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
-    owner  = "hadess";
-    repo   = pname;
-    rev    = version;
-    sha256 = "0ngbz1vkbjci3ml6p47jh6c6caipvbkm8mxrc8ayr6vc2p9l1g49";
+    owner = "hadess";
+    repo = pname;
+    rev = version;
+    hash = "sha256-pFu+nJzj45s7yIKoLWLeiv2AT5vLf6JpdWWQ0JZfnvY=";
   };
 
-  configurePhase = ''
-    runHook preConfigure
-
-    ./autogen.sh --prefix=$out \
-      --with-udevrulesdir=$out/lib/udev/rules.d \
-      --with-systemdsystemunitdir=$out/lib/systemd/system
-
-    runHook postConfigure
+  postPatch = ''
+    # upstream meson.build currently doesn't have an option to change the default polkit dir
+    substituteInPlace data/meson.build \
+      --replace 'polkit_policy_directory' "'$out/share/polkit-1/actions'"
   '';
 
   buildInputs = [
-    glib
-    gtk3
-    gtk-doc
     libgudev
     systemd
+    polkit
   ];
 
   nativeBuildInputs = [
-    autoconf
-    autoconf-archive
-    automake
-    gettext
-    intltool
-    libtool
+    meson
+    cmake
+    glib
+    libxml2
+    ninja
     pkg-config
   ];
 
+  mesonFlags = [
+    (lib.mesonOption "udevrulesdir" "${placeholder "out"}/lib/udev/rules.d")
+    (lib.mesonOption "systemdsystemunitdir" "${placeholder "out"}/lib/systemd/system")
+  ];
+
   meta = with lib; {
     description = "Proxy for sending IIO sensor data to D-Bus";
-    homepage = "https://github.com/hadess/iio-sensor-proxy";
-    license = licenses.gpl3 ;
-    maintainers = with maintainers; [ peterhoeg ];
+    homepage = "https://gitlab.freedesktop.org/hadess/iio-sensor-proxy";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ _999eagle ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ima-evm-utils/default.nix b/pkgs/os-specific/linux/ima-evm-utils/default.nix
index 14ddc21bb6b..34889783034 100644
--- a/pkgs/os-specific/linux/ima-evm-utils/default.nix
+++ b/pkgs/os-specific/linux/ima-evm-utils/default.nix
@@ -1,27 +1,46 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, openssl, attr, keyutils, asciidoc, libxslt, docbook_xsl }:
+{ lib
+, stdenv
+, fetchgit
+, autoreconfHook
+, pkg-config
+, openssl
+, keyutils
+, asciidoc
+, libxslt
+, docbook_xsl
+}:
 
 stdenv.mkDerivation rec {
   pname = "ima-evm-utils";
-  version = "1.1";
+  version = "1.5";
 
   src = fetchgit {
     url = "git://git.code.sf.net/p/linux-ima/ima-evm-utils";
     rev = "v${version}";
-    sha256 = "1dhfw6d9z4dv82q9zg2g025hgr179kamz9chy7v5w9b71aam8jf8";
+    sha256 = "sha256-WPBG7v29JHZ+ZGeLgA2gtLzZmaG0Xdvpq+BZ6NriY+A=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ openssl attr keyutils asciidoc libxslt ];
+  strictDeps = true;
 
-  patches = [ ./xattr.patch ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    asciidoc
+    libxslt
+  ];
 
-  buildPhase = "make prefix=$out MANPAGE_DOCBOOK_XSL=${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
+  buildInputs = [
+    openssl
+    keyutils
+  ];
+
+  env.MANPAGE_DOCBOOK_XSL = "${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
 
   meta = {
     description = "evmctl utility to manage digital signatures of the Linux kernel integrity subsystem (IMA/EVM)";
     homepage = "https://sourceforge.net/projects/linux-ima/";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ tstrobel ];
+    maintainers = with lib.maintainers; [ nickcao ];
   };
 }
diff --git a/pkgs/os-specific/linux/ima-evm-utils/xattr.patch b/pkgs/os-specific/linux/ima-evm-utils/xattr.patch
deleted file mode 100644
index 2d27570a578..00000000000
--- a/pkgs/os-specific/linux/ima-evm-utils/xattr.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-commit 6aea54d2ad2287b3e8894c262ee895f3d4a60516
-Author: André Draszik <git@andred.net>
-Date:   Mon Oct 17 12:45:32 2016 +0100
-
-    evmctl: use correct include for xattr.h
-    
-    The xattr API/ABI is provided by both the c-library, as well as by the
-    libattr package. The c-library's header file is sys/xattr.h, whereas
-    libattr's header file can be found in attr/xattr.h.
-    
-    Given none of the code here *links* against the libattr.so shared library, it
-    is wrong to *compile* against libattr's API (header file).
-    
-    Doing so avoids confusion as to which xattr.h is used as the least problem,
-    and potential ABI differences as the worst problem due the mismatching header
-    file used.
-    
-    So make sure we compile and link against the same thing, the c-library in
-    both cases.
-    
-    Signed-off-by: André Draszik <git@andred.net>
-    Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
-
-diff --git a/configure.ac b/configure.ac
-index 0497eb7..a5b4288 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -30,7 +30,7 @@ AC_SUBST(OPENSSL_LIBS)
- AC_CHECK_HEADER(unistd.h)
- AC_CHECK_HEADERS(openssl/conf.h)
- 
--AC_CHECK_HEADERS(attr/xattr.h, , [AC_MSG_ERROR([attr/xattr.h header not found. You need the libattr development package.])])
-+AC_CHECK_HEADERS(sys/xattr.h, , [AC_MSG_ERROR([sys/xattr.h header not found. You need the c-library development package.])])
- AC_CHECK_HEADERS(keyutils.h, , [AC_MSG_ERROR([keyutils.h header not found. You need the libkeyutils development package.])])
- 
- #debug support - yes for a while
-diff --git a/packaging/ima-evm-utils.spec b/packaging/ima-evm-utils.spec
-index a11a27a..63388d2 100644
---- a/packaging/ima-evm-utils.spec
-+++ b/packaging/ima-evm-utils.spec
-@@ -11,7 +11,6 @@ BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root
- BuildRequires:    autoconf
- BuildRequires:    automake
- BuildRequires:    openssl-devel
--BuildRequires:    libattr-devel
- BuildRequires:    keyutils-libs-devel
- 
- %description
-diff --git a/packaging/ima-evm-utils.spec.in b/packaging/ima-evm-utils.spec.in
-index 7ca6c6f..65c32f9 100644
---- a/packaging/ima-evm-utils.spec.in
-+++ b/packaging/ima-evm-utils.spec.in
-@@ -11,7 +11,6 @@ BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root
- BuildRequires:    autoconf
- BuildRequires:    automake
- BuildRequires:    openssl-devel
--BuildRequires:    libattr-devel
- BuildRequires:    keyutils-libs-devel
- 
- %description
-diff --git a/src/evmctl.c b/src/evmctl.c
-index 2ffee78..3fbcd33 100644
---- a/src/evmctl.c
-+++ b/src/evmctl.c
-@@ -49,7 +49,7 @@
- #include <stdint.h>
- #include <string.h>
- #include <dirent.h>
--#include <attr/xattr.h>
-+#include <sys/xattr.h>
- #include <linux/xattr.h>
- #include <getopt.h>
- #include <keyutils.h>
diff --git a/pkgs/os-specific/linux/intel-cmt-cat/default.nix b/pkgs/os-specific/linux/intel-cmt-cat/default.nix
new file mode 100644
index 00000000000..62e6149b6f1
--- /dev/null
+++ b/pkgs/os-specific/linux/intel-cmt-cat/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  version = "23.11";
+  pname = "intel-cmt-cat";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "intel-cmt-cat";
+    rev = "v${version}";
+    sha256 = "sha256-/OSU/7QR8NAjcAIo+unVQfORvCH5VpjfRn5sIrCxwbE=";
+  };
+
+  enableParallelBuilding = true;
+
+  makeFlags = [ "PREFIX=$(out)" "NOLDCONFIG=y" ];
+
+  meta = with lib; {
+    description = "User space software for Intel(R) Resource Director Technology";
+    homepage = "https://github.com/intel/intel-cmt-cat";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ arkivm ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 980b1fad0df..dacfb76eb9a 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -1,42 +1,48 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, patchelf
 , cmake
 , pkg-config
-
 , intel-gmmlib
 , intel-graphics-compiler
+, level-zero
 , libva
 }:
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "20.34.17727";
+  version = "23.30.26918.20";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "19scbbr6jf3yp2v7z8xyzzm01g44jym7xfkf1dz64d5nhvjw6ig5";
+    hash = "sha256-dEznHRgAcJa/BBTD/AWJHlA7fNj2IXHHrYcKM4M+/1o=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ intel-gmmlib intel-graphics-compiler libva ];
+  buildInputs = [ intel-gmmlib intel-graphics-compiler libva level-zero ];
 
   cmakeFlags = [
     "-DSKIP_UNIT_TESTS=1"
-
     "-DIGC_DIR=${intel-graphics-compiler}"
     "-DOCL_ICD_VENDORDIR=${placeholder "out"}/etc/OpenCL/vendors"
-
     # The install script assumes this path is relative to CMAKE_INSTALL_PREFIX
     "-DCMAKE_INSTALL_LIBDIR=lib"
   ];
 
+  outputs = [ "out" "drivers" ];
+
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
   postInstall = ''
     # Avoid clash with intel-ocl
     mv $out/etc/OpenCL/vendors/intel.icd $out/etc/OpenCL/vendors/intel-neo.icd
+
+    mkdir -p $drivers/lib
+    mv -t $drivers/lib $out/lib/libze_intel*
   '';
 
   postFixup = ''
@@ -45,10 +51,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage    = "https://github.com/intel/compute-runtime";
+    homepage = "https://github.com/intel/compute-runtime";
     description = "Intel Graphics Compute Runtime for OpenCL. Replaces Beignet for Gen8 (Broadwell) and beyond";
-    license     = licenses.mit;
-    platforms   = platforms.linux;
-    maintainers = with maintainers; [ gloaming ];
+    license = licenses.mit;
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
   };
 }
diff --git a/pkgs/os-specific/linux/intel-ocl/default.nix b/pkgs/os-specific/linux/intel-ocl/default.nix
index 06cb18b2377..b1451421d69 100644
--- a/pkgs/os-specific/linux/intel-ocl/default.nix
+++ b/pkgs/os-specific/linux/intel-ocl/default.nix
@@ -5,7 +5,12 @@ stdenv.mkDerivation rec {
   version = "5.0-63503";
 
   src = fetchzip {
-    url = "https://registrationcenter-download.intel.com/akdlm/irc_nas/11396/SRB5.0_linux64.zip";
+    # https://github.com/NixOS/nixpkgs/issues/166886
+    urls = [
+      "https://registrationcenter-download.intel.com/akdlm/irc_nas/11396/SRB5.0_linux64.zip"
+      "http://registrationcenter-download.intel.com/akdlm/irc_nas/11396/SRB5.0_linux64.zip"
+      "https://web.archive.org/web/20190526190814/http://registrationcenter-download.intel.com/akdlm/irc_nas/11396/SRB5.0_linux64.zip"
+    ];
     sha256 = "0qbp63l74s0i80ysh9ya8x7r79xkddbbz4378nms9i7a0kprg9p2";
     stripRoot = false;
   };
@@ -65,9 +70,9 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Official OpenCL runtime for Intel CPUs";
-    homepage    = "https://software.intel.com/en-us/articles/opencl-drivers";
-    license     = lib.licenses.unfree;
-    platforms   = [ "x86_64-linux" ];
+    homepage = "https://software.intel.com/en-us/articles/opencl-drivers";
+    license = lib.licenses.unfree;
+    platforms = [ "x86_64-linux" ];
     maintainers = [ lib.maintainers.kierdavis ];
   };
 }
diff --git a/pkgs/os-specific/linux/intel-speed-select/default.nix b/pkgs/os-specific/linux/intel-speed-select/default.nix
index 89b4feff7a5..2caad335d57 100644
--- a/pkgs/os-specific/linux/intel-speed-select/default.nix
+++ b/pkgs/os-specific/linux/intel-speed-select/default.nix
@@ -16,5 +16,6 @@ stdenv.mkDerivation {
     homepage = "https://www.kernel.org/";
     license = licenses.gpl2;
     platforms = [ "i686-linux" "x86_64-linux" ]; # x86-specific
+    broken = kernel.kernelAtLeast "5.18";
   };
 }
diff --git a/pkgs/os-specific/linux/iomelt/default.nix b/pkgs/os-specific/linux/iomelt/default.nix
index 860a7b44632..0084a397d07 100644
--- a/pkgs/os-specific/linux/iomelt/default.nix
+++ b/pkgs/os-specific/linux/iomelt/default.nix
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "A simple yet effective way to benchmark disk IO in Linux systems";
     homepage    = "http://www.iomelt.com";
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
     license = licenses.artistic2;
     platforms   = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/ioport/default.nix b/pkgs/os-specific/linux/ioport/default.nix
index 543495ec2af..6da154648fc 100644
--- a/pkgs/os-specific/linux/ioport/default.nix
+++ b/pkgs/os-specific/linux/ioport/default.nix
@@ -1,12 +1,16 @@
 { lib, stdenv, perl, fetchurl }:
 
-stdenv.mkDerivation {
-  name = "ioport-1.2";
+stdenv.mkDerivation rec {
+  pname = "ioport";
+  version = "1.2";
+
   src = fetchurl {
-    url = "https://people.redhat.com/rjones/ioport/files/ioport-1.2.tar.gz";
+    url = "https://people.redhat.com/rjones/ioport/files/ioport-${version}.tar.gz";
     sha256 = "1h4d5g78y7kla0zl25jgyrk43wy3m3bygqg0blki357bc55irb3z";
   };
+
   buildInputs = [ perl ];
+
   meta = with lib; {
     description = "Direct access to I/O ports from the command line";
     homepage = "https://people.redhat.com/rjones/ioport/";
diff --git a/pkgs/os-specific/linux/iotop-c/default.nix b/pkgs/os-specific/linux/iotop-c/default.nix
index 47cfa57fe81..1d7dc9e4d11 100644
--- a/pkgs/os-specific/linux/iotop-c/default.nix
+++ b/pkgs/os-specific/linux/iotop-c/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iotop-c";
-  version = "1.17";
+  version = "1.25";
 
   src = fetchFromGitHub {
     owner = "Tomas-M";
     repo = "iotop";
     rev = "v${version}";
-    sha256 = "0hjy30155c3nijx3jgyn5kpj293632p0j6f3lf5acdfax1ynav86";
+    sha256 = "sha256-ZIvWdNxGSUmQtMKB/MVHEZ0fJ8b//zSXz+1r/P9ZDkE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/iotop/default.nix b/pkgs/os-specific/linux/iotop/default.nix
index a91175aa59f..0376ff1a55e 100644
--- a/pkgs/os-specific/linux/iotop/default.nix
+++ b/pkgs/os-specific/linux/iotop/default.nix
@@ -1,10 +1,11 @@
 { lib, fetchurl, python3Packages, fetchpatch }:
 
 python3Packages.buildPythonApplication rec {
-  name = "iotop-0.6";
+  pname = "iotop";
+  version = "0.6";
 
   src = fetchurl {
-    url = "http://guichaz.free.fr/iotop/files/${name}.tar.bz2";
+    url = "http://guichaz.free.fr/iotop/files/iotop-${version}.tar.bz2";
     sha256 = "0nzprs6zqax0cwq8h7hnszdl3d2m4c2d4vjfxfxbnjfs9sia5pis";
   };
 
diff --git a/pkgs/os-specific/linux/ipp-usb/default.nix b/pkgs/os-specific/linux/ipp-usb/default.nix
new file mode 100644
index 00000000000..6dc63a7295b
--- /dev/null
+++ b/pkgs/os-specific/linux/ipp-usb/default.nix
@@ -0,0 +1,42 @@
+{ buildGoModule, avahi, libusb1, pkg-config, lib, fetchFromGitHub, ronn }:
+buildGoModule rec {
+  pname = "ipp-usb";
+  version = "0.9.23";
+
+  src = fetchFromGitHub {
+    owner = "openprinting";
+    repo = "ipp-usb";
+    rev = version;
+    sha256 = "sha256-sbPQWKqkTaD3kLNs0noVIzAN9cwDEaULsqO7SMQH2Jo=";
+  };
+
+  postPatch = ''
+    # rebuild with patched paths
+    rm ipp-usb.8
+    substituteInPlace Makefile --replace "install: all" "install: man"
+    substituteInPlace systemd-udev/ipp-usb.service --replace "/sbin" "$out/bin"
+    for i in Makefile paths.go ipp-usb.8.md; do
+      substituteInPlace $i --replace "/usr" "$out"
+      substituteInPlace $i --replace "/var/ipp-usb" "/var/lib/ipp-usb"
+    done
+  '';
+
+  nativeBuildInputs = [ pkg-config ronn ];
+  buildInputs = [ libusb1 avahi ];
+
+  vendorHash = "sha256-KwW6KgopjF4tVo8eB4OtpXF5R8jfrJ9nibNmaN8U4l8=";
+
+  postInstall = ''
+    # to accomodate the makefile
+    cp $out/bin/ipp-usb .
+    make install DESTDIR=$out
+  '';
+
+  meta = {
+    description = "Daemon to use the IPP everywhere protocol with USB printers";
+    homepage = "https://github.com/OpenPrinting/ipp-usb";
+    maintainers = [ lib.maintainers.symphorien ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.bsd2;
+  };
+}
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index ea3c4d36958..a86af7e6db2 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -1,20 +1,24 @@
 { lib, stdenv, fetchurl
 , buildPackages, bison, flex, pkg-config
 , db, iptables, libelf, libmnl
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "5.13.0";
+  version = "6.5.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-cqLlN3TKyeZfe2F97rsgWfh+iWDW6XE+TXiM6pZvGzY=";
+    hash = "sha256-pwF5CF+huW08M7BAyAm3XitXVjrcUFpK0F4mCd83NGM=";
   };
 
-  preConfigure = ''
+  postPatch = ''
     # Don't try to create /var/lib/arpd:
     sed -e '/ARPDDIR/d' -i Makefile
+
+    substituteInPlace Makefile \
+      --replace "CC := gcc" "CC ?= $CC"
   '';
 
   outputs = [ "out" "dev" ];
@@ -24,6 +28,12 @@ stdenv.mkDerivation rec {
     "SBINDIR=$(out)/sbin"
     "DOCDIR=$(TMPDIR)/share/doc/${pname}" # Don't install docs
     "HDRDIR=$(dev)/include/iproute2"
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "SHARED_LIBS=n"
+    # all build .so plugins:
+    "TC_CONFIG_NO_XT=y"
+  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "HOSTCC=$(CC_FOR_BUILD)"
   ];
 
   buildFlags = [
@@ -40,6 +50,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     homepage = "https://wiki.linuxfoundation.org/networking/iproute2";
     description = "A collection of utilities for controlling TCP/IP networking and traffic control in Linux";
diff --git a/pkgs/os-specific/linux/iproute/mptcp.nix b/pkgs/os-specific/linux/iproute/mptcp.nix
deleted file mode 100644
index 12723213901..00000000000
--- a/pkgs/os-specific/linux/iproute/mptcp.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib, iproute2, fetchFromGitHub }:
-
-iproute2.overrideAttrs (oa: rec {
-  pname = "iproute_mptcp";
-  version = "0.95";
-
-  src = fetchFromGitHub {
-    owner = "multipath-tcp";
-    repo = "iproute-mptcp";
-    rev = "mptcp_v${version}";
-    sha256 = "07fihvwlaj0ng8s8sxqhd0a9h1narcnp4ibk88km9cpsd32xv4q3";
-  };
-
-  preConfigure = ''
-    # Don't try to create /var/lib/arpd:
-    sed -e '/ARPDDIR/d' -i Makefile
-    patchShebangs configure
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/multipath-tcp/iproute-mptcp";
-    description = "IP-Route extensions for MultiPath TCP";
-    license = licenses.gpl2;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ teto ];
-    priority = 2;
-  };
-})
diff --git a/pkgs/os-specific/linux/ipsec-tools/CVE-2015-4047.patch b/pkgs/os-specific/linux/ipsec-tools/CVE-2015-4047.patch
deleted file mode 100644
index 00c23c6cac1..00000000000
--- a/pkgs/os-specific/linux/ipsec-tools/CVE-2015-4047.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-Index: pkg-ipsec-tools/src/racoon/gssapi.c
-===================================================================
---- pkg-ipsec-tools.orig/src/racoon/gssapi.c
-+++ pkg-ipsec-tools/src/racoon/gssapi.c
-@@ -192,6 +192,11 @@ gssapi_init(struct ph1handle *iph1)
-	gss_name_t princ, canon_princ;
-	OM_uint32 maj_stat, min_stat;
-
-+	if (iph1->rmconf == NULL) {
-+		plog(LLV_ERROR, LOCATION, NULL, "no remote config\n");
-+		return -1;
-+	}
-+
-	gps = racoon_calloc(1, sizeof (struct gssapi_ph1_state));
-	if (gps == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "racoon_calloc failed\n");
diff --git a/pkgs/os-specific/linux/ipsec-tools/CVE-2016-10396.patch b/pkgs/os-specific/linux/ipsec-tools/CVE-2016-10396.patch
deleted file mode 100644
index b644d46f8c9..00000000000
--- a/pkgs/os-specific/linux/ipsec-tools/CVE-2016-10396.patch
+++ /dev/null
@@ -1,193 +0,0 @@
-From: Antoine_Beaupre <anarcat@orangeseeds.org>
-Acked-by: Jiri Bohac <jbohac@suse.cz>
-Subject: PR/51682: Avoid DoS with fragment out of order insertion; keep fragments sorted in the list.
-References: bsc#1047443, CVE-2016-10396
-
-
-
-Index: a/src/racoon/handler.h
-===================================================================
---- a/src/racoon/handler.h.orig	2018-01-26 18:05:21.114764376 +0100
-+++ a/src/racoon/handler.h	2018-01-26 18:05:33.986741103 +0100
-@@ -141,6 +141,7 @@ struct ph1handle {
- #endif
- #ifdef ENABLE_FRAG
- 	int frag;			/* IKE phase 1 fragmentation */
-+	int frag_last_index;
- 	struct isakmp_frag_item *frag_chain;	/* Received fragments */
- #endif
- 
-Index: a/src/racoon/isakmp.c
-===================================================================
---- a/src/racoon/isakmp.c.orig	2018-01-26 18:05:21.118764369 +0100
-+++ a/src/racoon/isakmp.c	2018-01-26 18:05:33.986741103 +0100
-@@ -1069,6 +1069,7 @@ isakmp_ph1begin_i(rmconf, remote, local)
- 		iph1->frag = 1;
- 	else
- 		iph1->frag = 0;
-+	iph1->frag_last_index = 0;
- 	iph1->frag_chain = NULL;
- #endif
- 	iph1->approval = NULL;
-@@ -1173,6 +1174,7 @@ isakmp_ph1begin_r(msg, remote, local, et
- #endif
- #ifdef ENABLE_FRAG
- 	iph1->frag = 0;
-+	iph1->frag_last_index = 0;
- 	iph1->frag_chain = NULL;
- #endif
- 	iph1->approval = NULL;
-Index: a/src/racoon/isakmp_frag.c
-===================================================================
---- a/src/racoon/isakmp_frag.c.orig	2018-01-26 18:05:21.118764369 +0100
-+++ a/src/racoon/isakmp_frag.c	2018-01-26 18:05:33.986741103 +0100
-@@ -173,6 +173,43 @@ vendorid_frag_cap(gen)
- 	return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]);
- }
- 
-+static int 
-+isakmp_frag_insert(struct ph1handle *iph1, struct isakmp_frag_item *item)
-+{
-+	struct isakmp_frag_item *pitem = NULL;
-+	struct isakmp_frag_item *citem = iph1->frag_chain;
-+
-+	/* no frag yet, just insert at beginning of list */
-+	if (iph1->frag_chain == NULL) {
-+		iph1->frag_chain = item;
-+		return 0;
-+	}
-+
-+	do {
-+		/* duplicate fragment number, abort (CVE-2016-10396) */
-+		if (citem->frag_num == item->frag_num)
-+			return -1;
-+
-+		/* need to insert before current item */
-+		if (citem->frag_num > item->frag_num) {
-+			if (pitem != NULL)
-+				pitem->frag_next = item;
-+			else
-+				/* insert at the beginning of the list  */
-+				iph1->frag_chain = item;
-+			item->frag_next = citem;
-+			return 0;
-+		}
-+
-+		pitem = citem;
-+		citem = citem->frag_next;
-+	} while (citem != NULL);
-+
-+	/* we reached the end of the list, insert */
-+	pitem->frag_next = item;
-+	return 0;
-+}
-+
- int 
- isakmp_frag_extract(iph1, msg)
- 	struct ph1handle *iph1;
-@@ -224,39 +261,43 @@ isakmp_frag_extract(iph1, msg)
- 	item->frag_next = NULL;
- 	item->frag_packet = buf;
- 
--	/* Look for the last frag while inserting the new item in the chain */
--	if (item->frag_last)
--		last_frag = item->frag_num;
-+	/* Check for the last frag before inserting the new item in the chain */
-+	if (item->frag_last) {
-+		/* if we have the last fragment, indices must match */
-+		if (iph1->frag_last_index != 0 &&
-+		    item->frag_last != iph1->frag_last_index) {
-+			plog(LLV_ERROR, LOCATION, NULL,
-+			     "Repeated last fragment index mismatch\n");
-+			racoon_free(item);
-+			vfree(buf);
-+			return -1;
-+		}
- 
--	if (iph1->frag_chain == NULL) {
--		iph1->frag_chain = item;
--	} else {
--		struct isakmp_frag_item *current;
-+		last_frag = iph1->frag_last_index = item->frag_num;
-+	}
- 
--		current = iph1->frag_chain;
--		while (current->frag_next) {
--			if (current->frag_last)
--				last_frag = item->frag_num;
--			current = current->frag_next;
--		}
--		current->frag_next = item;
-+	/* insert fragment into chain */
-+	if (isakmp_frag_insert(iph1, item) == -1) {
-+		plog(LLV_ERROR, LOCATION, NULL,
-+		    "Repeated fragment index mismatch\n");
-+		racoon_free(item);
-+		vfree(buf);
-+		return -1;
- 	}
- 
--	/* If we saw the last frag, check if the chain is complete */
-+	/* If we saw the last frag, check if the chain is complete
-+	 * we have a sorted list now, so just walk through */
- 	if (last_frag != 0) {
-+		item = iph1->frag_chain;
- 		for (i = 1; i <= last_frag; i++) {
--			item = iph1->frag_chain;
--			do {
--				if (item->frag_num == i)
--					break;
--				item = item->frag_next;
--			} while (item != NULL);
--
-+			if (item->frag_num != i)
-+				break;
-+			item = item->frag_next;
- 			if (item == NULL) /* Not found */
- 				break;
- 		}
- 
--		if (item != NULL) /* It is complete */
-+		if (i > last_frag) /* It is complete */
- 			return 1;
- 	}
- 		
-@@ -291,15 +332,9 @@ isakmp_frag_reassembly(iph1)
- 	}
- 	data = buf->v;
- 
-+	item = iph1->frag_chain;
- 	for (i = 1; i <= frag_count; i++) {
--		item = iph1->frag_chain;
--		do {
--			if (item->frag_num == i)
--				break;
--			item = item->frag_next;
--		} while (item != NULL);
--
--		if (item == NULL) {
-+		if (item->frag_num != i) {
- 			plog(LLV_ERROR, LOCATION, NULL, 
- 			    "Missing fragment #%d\n", i);
- 			vfree(buf);
-@@ -308,6 +343,7 @@ isakmp_frag_reassembly(iph1)
- 		}
- 		memcpy(data, item->frag_packet->v, item->frag_packet->l);
- 		data += item->frag_packet->l;
-+		item = item->frag_next;
- 	}
- 
- out:
-
-
-diff -u -p -r1.50 -r1.51
---- a/src/racoon/isakmp_inf.c	2013/04/12 09:53:10	1.50
-+++ a/src/racoon/isakmp_inf.c	2017/01/24 19:23:56	1.51
-@@ -720,6 +720,7 @@ isakmp_info_send_nx(isakmp, remote, loca
- #endif
- #ifdef ENABLE_FRAG
- 	iph1->frag = 0;
-+	iph1->frag_last_index = 0;
- 	iph1->frag_chain = NULL;
- #endif
- 
diff --git a/pkgs/os-specific/linux/ipsec-tools/default.nix b/pkgs/os-specific/linux/ipsec-tools/default.nix
deleted file mode 100644
index 33152cc51c1..00000000000
--- a/pkgs/os-specific/linux/ipsec-tools/default.nix
+++ /dev/null
@@ -1,48 +0,0 @@
-{ lib, stdenv, fetchurl, fetchpatch, linuxHeaders, readline, openssl, flex, libkrb5, pam }:
-
-# TODO: These tools are supposed to work under NetBSD and FreeBSD as
-# well, so I guess it's not appropriate to place this expression in
-# "os-specific/linux/ipsec-tools". Since I cannot verify that the
-# expression actually builds on those platforms, I'll leave it here for
-# the time being.
-
-stdenv.mkDerivation rec {
-  name = "ipsec-tools-0.8.2";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/ipsec-tools/${name}.tar.bz2";
-    sha256 = "0b9gfbz78k2nj0k7jdlm5kajig628ja9qm0z5yksiwz22s3v7dlf";
-  };
-
-  buildInputs = [ readline openssl flex libkrb5 pam ];
-
-  patches = [
-    ./dont-create-localstatedir-during-install.patch
-    ./CVE-2015-4047.patch
-    ./CVE-2016-10396.patch
-  ];
-
-  # fix build with newer gcc versions
-  preConfigure = ''substituteInPlace configure --replace "-Werror" "" '';
-
-  configureFlags = [
-    "--sysconfdir=/etc --localstatedir=/var"
-    "--with-kernel-headers=${linuxHeaders}/include"
-    "--disable-security-context"
-    "--enable-adminport"
-    "--enable-dpd"
-    "--enable-frag"
-    "--enable-gssapi"
-    "--enable-hybrid"
-    "--enable-natt"
-    "--enable-shared"
-    "--enable-stats"
-  ];
-
-  meta = with lib; {
-    homepage = "http://ipsec-tools.sourceforge.net/";
-    description = "Port of KAME's IPsec utilities to the Linux-2.6 IPsec implementation";
-    license = licenses.bsd3;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/ipsec-tools/dont-create-localstatedir-during-install.patch b/pkgs/os-specific/linux/ipsec-tools/dont-create-localstatedir-during-install.patch
deleted file mode 100644
index 16b80c36d6a..00000000000
--- a/pkgs/os-specific/linux/ipsec-tools/dont-create-localstatedir-during-install.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff -ubr ipsec-tools-0.8.0-orig/src/racoon/Makefile.in ipsec-tools-0.8.0/src/racoon/Makefile.in
---- ipsec-tools-0.8.0-orig/src/racoon/Makefile.in	2012-10-20 13:01:07.700903316 +0200
-+++ ipsec-tools-0.8.0/src/racoon/Makefile.in	2012-10-20 13:01:13.177832616 +0200
-@@ -1085,9 +1085,6 @@
- 	uninstall-sbinPROGRAMS
- 
- 
--install-exec-local:
--	${mkinstalldirs} $(DESTDIR)${adminsockdir}
--
- # special object rules
- crypto_openssl_test.o: crypto_openssl.c
- 	$(COMPILE) -DEAYDEBUG -o crypto_openssl_test.o -c $(srcdir)/crypto_openssl.c
diff --git a/pkgs/os-specific/linux/ipset/default.nix b/pkgs/os-specific/linux/ipset/default.nix
index 7b4322657e5..8326ef1c461 100644
--- a/pkgs/os-specific/linux/ipset/default.nix
+++ b/pkgs/os-specific/linux/ipset/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ipset";
-  version = "7.14";
+  version = "7.19";
 
   src = fetchurl {
     url = "https://ipset.netfilter.org/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-JwMcNtNVkHAxzOQeZVU+mbsBPXYvzVU5L2PX6Edg+QA=";
+    sha256 = "sha256-m8H7pI1leG4+C2Pca2aahmgj13hAxpkMDGsjB47CxNY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 912d9078c94..b82484514e5 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -1,26 +1,26 @@
-{ lib, stdenv, fetchurl, pkg-config, pruneLibtoolFiles, flex, bison
+{ lib, stdenv, fetchurl
+, autoreconfHook, pkg-config, pruneLibtoolFiles, flex, bison
 , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap
-, nftablesCompat ? false
+, nftablesCompat ? true
+, gitUpdater
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
-  version = "1.8.7";
+  version = "1.8.10";
   pname = "iptables";
 
   src = fetchurl {
-    url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
-    sha256 = "1w6qx3sxzkv80shk21f63rq41c84irpx68k62m2cv629n1mwj2f1";
+    url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
+    sha256 = "XMJVwYk1bjF9BwdVzpNx62Oht4PDRJj7jDAmTzzFnJw=";
   };
 
-  nativeBuildInputs = [ pkg-config pruneLibtoolFiles flex bison ];
+  outputs = [ "out" "dev" "man" ];
 
-  buildInputs = [ libmnl libnetfilter_conntrack libnfnetlink libnftnl libpcap ];
+  nativeBuildInputs = [
+    autoreconfHook pkg-config pruneLibtoolFiles flex bison
+  ];
 
-  preConfigure = ''
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lmnl -lnftnl"
-  '';
+  buildInputs = [ libmnl libnetfilter_conntrack libnfnetlink libnftnl libpcap ];
 
   configureFlags = [
     "--enable-bpf-compiler"
@@ -28,11 +28,11 @@ stdenv.mkDerivation rec {
     "--enable-libipq"
     "--enable-nfsynproxy"
     "--enable-shared"
-  ] ++ optional (!nftablesCompat) "--disable-nftables";
+  ] ++ lib.optional (!nftablesCompat) "--disable-nftables";
 
-  outputs = [ "out" "dev" ];
+  enableParallelBuilding = true;
 
-  postInstall = optional nftablesCompat ''
+  postInstall = lib.optionalString nftablesCompat ''
     rm $out/sbin/{iptables,iptables-restore,iptables-save,ip6tables,ip6tables-restore,ip6tables-save}
     ln -sv xtables-nft-multi $out/bin/iptables
     ln -sv xtables-nft-multi $out/bin/iptables-restore
@@ -42,13 +42,19 @@ stdenv.mkDerivation rec {
     ln -sv xtables-nft-multi $out/bin/ip6tables-save
   '';
 
-  meta = {
+  passthru = {
+    updateScript = gitUpdater {
+      url = "https://git.netfilter.org/iptables";
+      rev-prefix = "v";
+    };
+  };
+
+  meta = with lib; {
     description = "A program to configure the Linux IP packet filtering ruleset";
     homepage = "https://www.netfilter.org/projects/iptables/index.html";
     platforms = platforms.linux;
     maintainers = with maintainers; [ fpletz ];
     license = licenses.gpl2;
     downloadPage = "https://www.netfilter.org/projects/iptables/files/";
-    updateWalker = true;
   };
 }
diff --git a/pkgs/os-specific/linux/iptstate/default.nix b/pkgs/os-specific/linux/iptstate/default.nix
index 94693f1559e..4e3693aba6f 100644
--- a/pkgs/os-specific/linux/iptstate/default.nix
+++ b/pkgs/os-specific/linux/iptstate/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iptstate";
-  version = "2.2.6";
+  version = "2.2.7";
 
   src = fetchurl {
     url = "https://github.com/jaymzh/iptstate/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    sha256 = "bef8eb67a4533e53079f397b71e91dd34da23f8cbd65cb2d5b67cb907b00c068";
+    sha256 = "sha256-iW3wYCiFRWomMfeV1jT8ITEeUF+MkQNI5jEoYPIJeVU=";
   };
 
   buildInputs = [ libnetfilter_conntrack ncurses ];
diff --git a/pkgs/os-specific/linux/ipu6-drivers/default.nix b/pkgs/os-specific/linux/ipu6-drivers/default.nix
new file mode 100644
index 00000000000..bc85ffd9aa3
--- /dev/null
+++ b/pkgs/os-specific/linux/ipu6-drivers/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, ivsc-driver
+, kernel
+}:
+
+stdenv.mkDerivation {
+  pname = "ipu6-drivers";
+  version = "unstable-2023-08-28";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ipu6-drivers";
+    rev = "7c3d6ab1e9e234563a0af51286b0a8d60445f2a3";
+    hash = "sha256-D782v6hIqAl2EO1+zKeakURD3UGVP3c7p3ba/61yfW4=";
+  };
+
+  postPatch = ''
+    cp --no-preserve=mode --recursive --verbose \
+      ${ivsc-driver.src}/backport-include \
+      ${ivsc-driver.src}/drivers \
+      ${ivsc-driver.src}/include \
+      .
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," Makefile
+  '';
+
+  installTargets = [
+    "modules_install"
+  ];
+
+  meta = {
+    homepage = "https://github.com/intel/ipu6-drivers";
+    description = "IPU6 kernel driver";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ hexa ];
+    platforms = [ "x86_64-linux" ];
+    # requires 6.1.7 https://github.com/intel/ipu6-drivers/pull/84
+    broken = kernel.kernelOlder "6.1.7";
+  };
+}
diff --git a/pkgs/os-specific/linux/iputils/default.nix b/pkgs/os-specific/linux/iputils/default.nix
index c949069885d..8396fd5e3d3 100644
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -1,53 +1,48 @@
-{ lib, stdenv, fetchFromGitHub
-, meson, ninja, pkg-config, gettext, libxslt, docbook_xsl_ns
-, libcap, libidn2
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, gettext
+, libxslt
+, docbook_xsl_ns
+, libcap
+, libidn2
 , iproute2
 , apparmorRulesFromClosure
 }:
 
-let
-  version = "20210722";
-  sunAsIsLicense = {
-    fullName = "AS-IS, SUN MICROSYSTEMS license";
-    url = "https://github.com/iputils/iputils/blob/s${version}/rdisc.c";
-  };
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "iputils";
-  inherit version;
+  version = "20221126";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "139fyifsjm0i012rhcx3ra3pxx2wxh77dfd551d8lgiv2mqd742j";
+    hash = "sha256-XVoQhdjBmEK8TbCpaKLjebPw7ZT8iEvyLJDTCkzezeE=";
   };
 
-  postPatch = lib.optionalString (!doCheck) ''
-    # There isn't a Meson option for this yet:
-    sed -i '/##### TESTS #####/q' ping/meson.build
-  '';
-
-  outputs = ["out" "apparmor"];
+  outputs = [ "out" "apparmor" ];
 
   # We don't have the required permissions inside the build sandbox:
   # /build/source/build/ping/ping: socket: Operation not permitted
   doCheck = false;
 
   mesonFlags = [
-    "-DBUILD_RARPD=true"
-    "-DBUILD_TRACEROUTE6=true"
-    "-DBUILD_TFTPD=true"
     "-DNO_SETCAP_OR_SUID=true"
     "-Dsystemdunitdir=etc/systemd/system"
     "-DINSTALL_SYSTEMD_UNITS=true"
+    "-DSKIP_TESTS=${lib.boolToString (!doCheck)}"
   ]
-    # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
-    ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
+  # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
+  ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
 
   nativeBuildInputs = [ meson ninja pkg-config gettext libxslt.bin docbook_xsl_ns ];
   buildInputs = [ libcap ]
     ++ lib.optional (!stdenv.hostPlatform.isMusl) libidn2;
-  checkInputs = [ iproute2 ];
+  nativeCheckInputs = [ iproute2 ];
 
   postInstall = ''
     mkdir $apparmor
@@ -71,25 +66,19 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    homepage = "https://github.com/iputils/iputils";
+    changelog = "https://github.com/iputils/iputils/releases/tag/${version}";
     description = "A set of small useful utilities for Linux networking";
-    inherit (src.meta) homepage;
-    changelog = "https://github.com/iputils/iputils/releases/tag/s${version}";
-    license = with licenses; [ gpl2Plus bsd3 sunAsIsLicense ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos lheckemann ];
-
     longDescription = ''
       A set of small useful utilities for Linux networking including:
 
-      arping
-      clockdiff
-      ninfod
-      ping
-      rarpd
-      rdisc
-      tftpd
-      tracepath
-      traceroute6
+      - arping: send ARP REQUEST to a neighbour host
+      - clockdiff: measure clock difference between hosts
+      - ping: send ICMP ECHO_REQUEST to network hosts
+      - tracepath: traces path to a network host discovering MTU along this path
     '';
+    license = with licenses; [ gpl2Plus bsd3 ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos lheckemann ];
   };
 }
diff --git a/pkgs/os-specific/linux/ipvsadm/default.nix b/pkgs/os-specific/linux/ipvsadm/default.nix
index fbd4d8efdac..c9881674691 100644
--- a/pkgs/os-specific/linux/ipvsadm/default.nix
+++ b/pkgs/os-specific/linux/ipvsadm/default.nix
@@ -16,6 +16,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libnl popt ];
 
+  # Disable parallel build, errors:
+  #  *** No rule to make target 'libipvs/libipvs.a', needed by 'ipvsadm'.  Stop.
+  enableParallelBuilding = false;
+
   preBuild = ''
     makeFlagsArray+=(
       INCLUDE=$(pkg-config --cflags libnl-genl-3.0)
diff --git a/pkgs/os-specific/linux/irqbalance/default.nix b/pkgs/os-specific/linux/irqbalance/default.nix
index 4b7a4527e2c..df197715013 100644
--- a/pkgs/os-specific/linux/irqbalance/default.nix
+++ b/pkgs/os-specific/linux/irqbalance/default.nix
@@ -1,18 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, glib, ncurses, libcap_ng }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, glib, ncurses, libcap_ng }:
 
 stdenv.mkDerivation rec {
   pname = "irqbalance";
-  version = "1.8.0";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "irqbalance";
     repo = "irqbalance";
     rev = "v${version}";
-    sha256 = "sha256-K+Nv6HqBZb0pwfNV127QDq+suaUD7TTV413S6j8NdUU=";
+    sha256 = "sha256-dk5gdDCXNELTlbZ34gUOVwPHvXF3N07v/ZqeNVfGTGw=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-
   buildInputs = [ glib ncurses libcap_ng ];
 
   LDFLAGS = "-lncurses";
@@ -33,6 +32,6 @@ stdenv.mkDerivation rec {
     description = "A daemon to help balance the cpu load generated by interrupts across all of a systems cpus";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/os-specific/linux/isgx/default.nix b/pkgs/os-specific/linux/isgx/default.nix
index 3e551e55917..c49a0a7b913 100644
--- a/pkgs/os-specific/linux/isgx/default.nix
+++ b/pkgs/os-specific/linux/isgx/default.nix
@@ -1,29 +1,16 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, kernel, kernelAtLeast }:
+{ stdenv, lib, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
   name = "isgx-${version}-${kernel.version}";
-  version = "2.11";
+  version = "2.14";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "linux-sgx-driver";
-    rev = "sgx_driver_${version}";
-    hash = "sha256-zZ0FgCx63LCNmvQ909O27v/o4+93gefhgEE/oDr/bHw=";
+    rev = "sgx_diver_${version}"; # Typo is upstream's.
+    sha256 = "0kbbf2inaywp44lm8ig26mkb36jq3smsln0yp6kmrirdwc3c53mi";
   };
 
-  patches = [
-    # Fixes build with kernel >= 5.8
-    (fetchpatch {
-      url = "https://github.com/intel/linux-sgx-driver/commit/276c5c6a064d22358542f5e0aa96b1c0ace5d695.patch";
-      sha256 = "sha256-PmchqYENIbnJ51G/tkdap/g20LUrJEoQ4rDtqy6hj24=";
-    })
-    # Fixes detection with kernel >= 5.11
-    (fetchpatch {
-      url = "https://github.com/intel/linux-sgx-driver/commit/ed2c256929962db1a8805db53bed09bb8f2f4de3.patch";
-      sha256 = "sha256-MRbgS4U8FTCP1J1n+rhsvbXxKDytfl6B7YlT9Izq05U=";
-    })
-  ];
-
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
@@ -38,6 +25,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Intel SGX Linux Driver";
     longDescription = ''
@@ -50,7 +39,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/intel/linux-sgx-driver";
     license = with licenses; [ bsd3 /* OR */ gpl2Only ];
-    maintainers = with maintainers; [ oxalica ];
+    maintainers = [ ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/it87/default.nix b/pkgs/os-specific/linux/it87/default.nix
index 1e56d3a830c..aa51626986e 100644
--- a/pkgs/os-specific/linux/it87/default.nix
+++ b/pkgs/os-specific/linux/it87/default.nix
@@ -2,14 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "it87-${version}-${kernel.version}";
-  version = "2018-08-14";
+  version = "unstable-2022-02-26";
 
-  # The original was deleted from github, but this seems to be an active fork
+  # Original is no longer maintained.
+  # This is the same upstream as the AUR uses.
   src = fetchFromGitHub {
-    owner = "hannesha";
+    owner = "frankcrawford";
     repo = "it87";
-    rev = "5515f5b78838cb6be551943ffef5d1792012724c";
-    sha256 = "1ygi4mwds4q7byhg8gqnh3syamdj5rpjy3jj012k7vl54gdgrmgm";
+    rev = "c93d61adadecb009c92f3258cd3ff14a66efb193";
+    sha256 = "sha256-wVhs//iwZUUGRTk1DpV/SnA7NZ7cFyYbsUbtazlxb6Q=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -29,8 +30,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Patched module for IT87xx superio chip sensors support";
     homepage = "https://github.com/hannesha/it87";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ yorickvp ];
+    maintainers = teams.lumiguide.members;
   };
 }
diff --git a/pkgs/os-specific/linux/ithc/default.nix b/pkgs/os-specific/linux/ithc/default.nix
new file mode 100644
index 00000000000..69b202e7e20
--- /dev/null
+++ b/pkgs/os-specific/linux/ithc/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "ithc";
+  version = "unstable-2022-06-07";
+
+  src = fetchFromGitHub {
+    owner = "quo";
+    repo = "ithc-linux";
+    rev = "5af2a2213d2f3d944b19ec7ccdb96f16d56adddb";
+    hash = "sha256-p4TooWUOWPfNdePE18ESmRJezPDAl9nLb55LQtkJiSg=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "VERSION=${version}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  postPatch = ''
+    sed -i ./Makefile -e '/depmod/d'
+  '';
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "Linux driver for Intel Touch Host Controller";
+    homepage = "https://github.com/quo/ithc-linux";
+    license = licenses.publicDomain;
+    maintainers = with maintainers; [ aacebedo ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.9";
+  };
+}
diff --git a/pkgs/os-specific/linux/ivsc-driver/default.nix b/pkgs/os-specific/linux/ivsc-driver/default.nix
new file mode 100644
index 00000000000..0491b1d548b
--- /dev/null
+++ b/pkgs/os-specific/linux/ivsc-driver/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
+
+stdenv.mkDerivation {
+  pname = "ivsc-driver";
+  version = "unstable-2023-03-10";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ivsc-driver";
+    rev = "c8db12b907e2e455d4d5586e5812d1ae0eebd571";
+    hash = "sha256-OM9PljvaMKrk72BFeSCqaABFeAws+tOdd3oC2jyNreE=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," Makefile
+  '';
+
+  installTargets = [
+    "modules_install"
+  ];
+
+  meta = {
+    homepage = "https://github.com/intel/ivsc-driver";
+    description = "Intel Vision Sensing Controller kernel driver";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ hexa ];
+    platforms = [ "x86_64-linux" ];
+    broken = kernel.kernelOlder "5.15";
+  };
+}
diff --git a/pkgs/os-specific/linux/iw/default.nix b/pkgs/os-specific/linux/iw/default.nix
index 7d526db53e9..bf7cb025bc1 100644
--- a/pkgs/os-specific/linux/iw/default.nix
+++ b/pkgs/os-specific/linux/iw/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iw";
-  version = "5.9";
+  version = "5.19";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1wp1ky1v353qqy5fnrk67apgzsap53jkr7pmghk3czpbk880ffi9";
+    sha256 = "sha256-8We76UfdU7uevAwdzvXbatc6wdYITyxvk3bFw2DMTU4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/iwd/default.nix b/pkgs/os-specific/linux/iwd/default.nix
index e0a1a566d77..1b983bb90e1 100644
--- a/pkgs/os-specific/linux/iwd/default.nix
+++ b/pkgs/os-specific/linux/iwd/default.nix
@@ -12,15 +12,15 @@
 
 stdenv.mkDerivation rec {
   pname = "iwd";
-  version = "1.15";
+  version = "2.8";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/network/wireless/iwd.git";
     rev = version;
-    sha256 = "sha256-qGQDIzJfeBT9VLwr9Ci9vXcM0ZvFvjL2E9PcKoZ8E94=";
+    sha256 = "sha256-i+2R8smgLXooApj0Z5e03FybhYgw1X/kIsJkrDzW8y4=";
   };
 
-  outputs = [ "out" "man" ]
+  outputs = [ "out" "man" "doc" ]
     ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "test";
 
   nativeBuildInputs = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     readline
   ];
 
-  checkInputs = [ openssl ];
+  nativeCheckInputs = [ openssl ];
 
   # wrapPython wraps the scripts in $test. They pull in gobject-introspection,
   # which doesn't cross-compile.
@@ -59,15 +59,16 @@ stdenv.mkDerivation rec {
   postUnpack = ''
     mkdir -p iwd/ell
     ln -s ${ell.src}/ell/useful.h iwd/ell/useful.h
+    ln -s ${ell.src}/ell/asn1-private.h iwd/ell/asn1-private.h
     patchShebangs .
   '';
 
   doCheck = true;
 
   postInstall = ''
-    mkdir -p $out/share
-    cp -a doc $out/share/
-    cp -a README AUTHORS TODO $out/share/doc/
+    mkdir -p $doc/share/doc
+    cp -a doc $doc/share/doc/iwd
+    cp -a README AUTHORS TODO $doc/share/doc/iwd
   '' + lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
     mkdir -p $test/bin
     cp -a test/* $test/bin/
@@ -91,6 +92,6 @@ stdenv.mkDerivation rec {
     description = "Wireless daemon for Linux";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ dtzWill fpletz maxeaubrey ];
+    maintainers = with maintainers; [ dtzWill fpletz amaxine ];
   };
 }
diff --git a/pkgs/os-specific/linux/jfbview/default.nix b/pkgs/os-specific/linux/jfbview/default.nix
deleted file mode 100644
index da4135d8a80..00000000000
--- a/pkgs/os-specific/linux/jfbview/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ lib, stdenv, fetchFromGitHub
-, freetype, harfbuzz, jbig2dec, libjpeg, libX11, mupdf_1_17, ncurses, openjpeg
-, openssl
-
-, imageSupport ? true, imlib2 ? null }:
-
-let
-  package = if imageSupport
-    then "jfbview"
-    else "jfbpdf";
-  binaries = if imageSupport
-    then [ "jfbview" "jpdfcat" "jpdfgrep" ] # all require imlib2
-    else [ "jfbpdf" ]; # does not
-in
-
-stdenv.mkDerivation rec {
-  name = "${package}-${version}";
-  version = "0.5.7";
-
-  src = fetchFromGitHub {
-    repo = "JFBView";
-    owner = "jichu4n";
-    rev = version;
-    sha256 = "0ppns49hnmp04zdjw6wc28v0yvz31rkzvd5ylcj7arikx20llpxf";
-  };
-
-  postPatch = ''
-    substituteInPlace main.cpp \
-      --replace "<stropts.h>" "<sys/ioctl.h>"
-  '';
-
-  hardeningDisable = [ "format" ];
-
-  buildInputs = [
-    freetype harfbuzz jbig2dec libjpeg libX11 mupdf_1_17 ncurses openjpeg
-    openssl
-  ] ++ lib.optionals imageSupport [
-    imlib2
-  ];
-
-  configurePhase = ''
-    # Hack. Probing (`ldconfig -p`) fails with ‘cannot execute binary file’.
-    # Overriding `OPENJP2 =` later works, but makes build output misleading:
-    substituteInPlace Makefile --replace "ldconfig -p" "echo libopenjp2"
-
-    make config.mk
-  '';
-
-  buildFlags = binaries;
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    install ${toString binaries} $out/bin
-  '';
-
-  meta = with lib; {
-    description = "PDF and image viewer for the Linux framebuffer";
-    longDescription = ''
-      A very fast PDF and image viewer for the Linux framebuffer with some
-      advanced and unique features, including:
-      - Reads PDFs (MuPDF) and common image formats (Imlib2)
-      - Supports arbitrary zoom (10% - 1000%) and rotation
-      - Table of Contents (TOC) viewer for PDF documents
-      - Multi-threaded rendering on multi-core machines
-      - Asynchronous background rendering of the next page
-      - Customizable multi-threaded caching
-    '';
-    homepage = "https://seasonofcode.com/pages/jfbview.html";
-    license = licenses.asl20;
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/jool/cli.nix b/pkgs/os-specific/linux/jool/cli.nix
index b1bce496614..ee5ee1128a8 100644
--- a/pkgs/os-specific/linux/jool/cli.nix
+++ b/pkgs/os-specific/linux/jool/cli.nix
@@ -1,14 +1,26 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libnl, iptables }:
+{ lib, stdenv, fetchFromGitHub, nixosTests
+, autoreconfHook, pkg-config, libnl, iptables
+}:
 
 let
   sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; };
 in
 
 stdenv.mkDerivation {
-  name = "jool-cli-${sourceAttrs.version}";
+  pname = "jool-cli";
+  version = sourceAttrs.version;
 
   src = sourceAttrs.src;
 
+  patches = [
+    ./validate-config.patch
+  ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libnl iptables ];
 
@@ -18,6 +30,8 @@ stdenv.mkDerivation {
     sed -e 's%^XTABLES_SO_DIR = .*%XTABLES_SO_DIR = '"$out"'/lib/xtables%g' -i src/usr/iptables/Makefile
   '';
 
+  passthru.tests = { inherit (nixosTests) jool; };
+
   meta = with lib; {
     homepage = "https://www.jool.mx/";
     description = "Fairly compliant SIIT and Stateful NAT64 for Linux - CLI tools";
diff --git a/pkgs/os-specific/linux/jool/default.nix b/pkgs/os-specific/linux/jool/default.nix
index 58894de6c2e..91276cbc11b 100644
--- a/pkgs/os-specific/linux/jool/default.nix
+++ b/pkgs/os-specific/linux/jool/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, kernel }:
+{ lib, stdenv, fetchFromGitHub, kernel, nixosTests }:
 
 let
   sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; };
@@ -16,18 +16,20 @@ stdenv.mkDerivation {
     sed -e 's@/lib/modules/\$(.*)@${kernel.dev}/lib/modules/${kernel.modDirVersion}@' -i src/mod/*/Makefile
   '';
 
-  buildPhase = ''
-    make -C src/mod
-  '';
+  makeFlags = kernel.makeFlags ++ [
+    "-C src/mod"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
-  installPhase = ''
-    make -C src/mod modules_install INSTALL_MOD_PATH=$out
-  '';
+  installTargets = "modules_install";
+
+  passthru.tests = { inherit (nixosTests) jool; };
 
   meta = with lib; {
     homepage = "https://www.jool.mx/";
     description = "Fairly compliant SIIT and Stateful NAT64 for Linux - kernel modules";
     platforms = platforms.linux;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ fpletz ];
   };
 }
diff --git a/pkgs/os-specific/linux/jool/source.nix b/pkgs/os-specific/linux/jool/source.nix
index a90482a58d3..d98747d890e 100644
--- a/pkgs/os-specific/linux/jool/source.nix
+++ b/pkgs/os-specific/linux/jool/source.nix
@@ -1,11 +1,11 @@
 { fetchFromGitHub }:
 
 rec {
-  version = "4.1.5";
+  version = "4.1.10";
   src = fetchFromGitHub {
     owner = "NICMx";
     repo = "Jool";
-    rev = "v${version}";
-    sha256 = "05dwz4q6v6azgpyj9dzwihnw1lalhhym116q2ya7spvgxzxi04ax";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-98XbBdSmgcepPZxX6hoPim+18lHLbrjqlbipB92nyAc=";
   };
 }
diff --git a/pkgs/os-specific/linux/jool/validate-config.patch b/pkgs/os-specific/linux/jool/validate-config.patch
new file mode 100644
index 00000000000..8841b6fb14f
--- /dev/null
+++ b/pkgs/os-specific/linux/jool/validate-config.patch
@@ -0,0 +1,193 @@
+From df0a1cf61188b5b7bb98675d746cb63d9300f148 Mon Sep 17 00:00:00 2001
+From: rnhmjoj <rnhmjoj@inventati.org>
+Date: Sat, 1 Jul 2023 18:47:05 +0200
+Subject: [PATCH] Add mode to validate the atomic configuration
+
+---
+ src/usr/argp/main.c       |  6 ++++++
+ src/usr/argp/wargp/file.c | 26 +++++++++++++++++++++++++-
+ src/usr/argp/wargp/file.h |  1 +
+ src/usr/nl/file.c         | 32 ++++++++++++++++++++++----------
+ src/usr/nl/file.h         |  3 ++-
+ 5 files changed, 56 insertions(+), 12 deletions(-)
+
+diff --git a/src/usr/argp/main.c b/src/usr/argp/main.c
+index 744a6df0..d04917da 100644
+--- a/src/usr/argp/main.c
++++ b/src/usr/argp/main.c
+@@ -238,6 +238,12 @@ static struct cmd_option file_ops[] = {
+ 			.handler = handle_file_update,
+ 			.handle_autocomplete = autocomplete_file_update,
+ 		},
++		{
++			.label = "check",
++			.xt = XT_ANY,
++			.handler = handle_file_check,
++			.handle_autocomplete = autocomplete_file_update,
++		},
+ 		{ 0 },
+ };
+ 
+diff --git a/src/usr/argp/wargp/file.c b/src/usr/argp/wargp/file.c
+index 0951b544..27ee3e64 100644
+--- a/src/usr/argp/wargp/file.c
++++ b/src/usr/argp/wargp/file.c
+@@ -26,6 +26,30 @@ static struct wargp_option update_opts[] = {
+ 	{ 0 },
+ };
+ 
++int handle_file_check(char *iname, int argc, char **argv, void const *arg)
++{
++	struct update_args uargs = { 0 };
++	struct joolnl_socket sk = { 0 };
++	struct jool_result result;
++
++	result.error = wargp_parse(update_opts, argc, argv, &uargs);
++	if (result.error)
++		return result.error;
++
++	if (!uargs.file_name.value) {
++		struct requirement reqs[] = {
++				{ false, "a file name" },
++				{ 0 }
++		};
++		return requirement_print(reqs);
++	}
++
++	result = joolnl_file_parse(&sk, xt_get(), iname, uargs.file_name.value,
++			uargs.force.value, true);
++
++	return pr_result(&result);
++}
++
+ int handle_file_update(char *iname, int argc, char **argv, void const *arg)
+ {
+ 	struct update_args uargs = { 0 };
+@@ -49,7 +73,7 @@ int handle_file_update(char *iname, int argc, char **argv, void const *arg)
+ 		return pr_result(&result);
+ 
+ 	result = joolnl_file_parse(&sk, xt_get(), iname, uargs.file_name.value,
+-			uargs.force.value);
++			uargs.force.value, false);
+ 
+ 	joolnl_teardown(&sk);
+ 	return pr_result(&result);
+diff --git a/src/usr/argp/wargp/file.h b/src/usr/argp/wargp/file.h
+index ce5de508..8ea4a4d2 100644
+--- a/src/usr/argp/wargp/file.h
++++ b/src/usr/argp/wargp/file.h
+@@ -2,6 +2,7 @@
+ #define SRC_USR_ARGP_WARGP_FILE_H_
+ 
+ int handle_file_update(char *iname, int argc, char **argv, void const *arg);
++int handle_file_check(char *iname, int argc, char **argv, void const *arg);
+ void autocomplete_file_update(void const *args);
+ 
+ #endif /* SRC_USR_ARGP_WARGP_FILE_H_ */
+diff --git a/src/usr/nl/file.c b/src/usr/nl/file.c
+index f9413236..51a668bd 100644
+--- a/src/usr/nl/file.c
++++ b/src/usr/nl/file.c
+@@ -29,6 +29,7 @@ static struct joolnl_socket sk;
+ static char const *iname;
+ static xlator_flags flags;
+ static __u8 force;
++static bool check;
+ 
+ struct json_meta {
+ 	char const *name; /* This being NULL signals the end of the array. */
+@@ -163,9 +164,11 @@ static struct jool_result handle_array(cJSON *json, int attrtype, char *name,
+ 				goto too_small;
+ 
+ 			nla_nest_end(msg, root);
+-			result = joolnl_request(&sk, msg, NULL, NULL);
+-			if (result.error)
+-				return result;
++			if (!check) {
++				result = joolnl_request(&sk, msg, NULL, NULL);
++				if (result.error)
++					return result;
++			}
+ 
+ 			msg = NULL;
+ 			json = json->prev;
+@@ -179,6 +182,8 @@ static struct jool_result handle_array(cJSON *json, int attrtype, char *name,
+ 		return result_success();
+ 
+ 	nla_nest_end(msg, root);
++	if (check)
++		return result_success();
+ 	return joolnl_request(&sk, msg, NULL, NULL);
+ 
+ too_small:
+@@ -244,6 +249,8 @@ static struct jool_result handle_global(cJSON *json)
+ 
+ 	nla_nest_end(msg, root);
+ 	free(meta);
++	if (check)
++		return result_success();
+ 	return joolnl_request(&sk, msg, NULL, NULL);
+ 
+ revert_meta:
+@@ -654,9 +661,11 @@ static struct jool_result send_ctrl_msg(bool init)
+ 	else
+ 		NLA_PUT(msg, JNLAR_ATOMIC_END, 0, NULL);
+ 
+-	result = joolnl_request(&sk, msg, NULL, NULL);
+-	if (result.error)
+-		return result;
++	if (!check) {
++		result = joolnl_request(&sk, msg, NULL, NULL);
++		if (result.error)
++			return result;
++	}
+ 
+ 	return result_success();
+ 
+@@ -683,9 +692,11 @@ static struct jool_result do_parsing(char const *iname, char *buffer)
+ 	if (result.error)
+ 		goto fail;
+ 
+-	result = send_ctrl_msg(true);
+-	if (result.error)
+-		goto fail;
++	if (!check) {
++		result = send_ctrl_msg(true);
++		if (result.error)
++			goto fail;
++	}
+ 
+ 	switch (xlator_flags2xt(flags)) {
+ 	case XT_SIIT:
+@@ -718,12 +729,13 @@ fail:
+ }
+ 
+ struct jool_result joolnl_file_parse(struct joolnl_socket *_sk, xlator_type xt,
+-		char const *iname, char const *file_name, bool _force)
++		char const *iname, char const *file_name, bool _force, bool _check)
+ {
+ 	char *buffer;
+ 	struct jool_result result;
+ 
+ 	sk = *_sk;
++	check = _check;
+ 	flags = xt;
+ 	force = _force ? JOOLNLHDR_FLAGS_FORCE : 0;
+ 
+diff --git a/src/usr/nl/file.h b/src/usr/nl/file.h
+index 51802aaf..8b4a66dd 100644
+--- a/src/usr/nl/file.h
++++ b/src/usr/nl/file.h
+@@ -9,7 +9,8 @@ struct jool_result joolnl_file_parse(
+ 	xlator_type xt,
+ 	char const *iname,
+ 	char const *file_name,
+-	bool force
++	bool force,
++	bool check
+ );
+ 
+ struct jool_result joolnl_file_get_iname(
+-- 
+2.40.1
+
diff --git a/pkgs/os-specific/linux/joycond/default.nix b/pkgs/os-specific/linux/joycond/default.nix
index a203073b081..e60e661f0c4 100644
--- a/pkgs/os-specific/linux/joycond/default.nix
+++ b/pkgs/os-specific/linux/joycond/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libevdev, udev }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libevdev, udev, acl }:
 
 stdenv.mkDerivation rec {
   pname = "joycond";
-  version = "unstable-2021-03-27";
+  version = "unstable-2021-07-30";
 
   src = fetchFromGitHub {
     owner = "DanielOgorchock";
     repo = "joycond";
-    rev = "2d3f553060291f1bfee2e49fc2ca4a768b289df8";
-    sha256 = "0dpmwspll9ar3pxg9rgnh224934par8h8bixdz9i2pqqbc3dqib7";
+    rev = "f9a66914622514c13997c2bf7ec20fa98e9dfc1d";
+    sha256 = "sha256-quw7yBHDDZk1+6uHthsfMCej7g5uP0nIAqzvI6436B8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -25,6 +25,9 @@ stdenv.mkDerivation rec {
 
     substituteInPlace $out/etc/systemd/system/joycond.service --replace \
       "ExecStart=/usr/bin/joycond" "ExecStart=$out/bin/joycond"
+
+    substituteInPlace $out/etc/udev/rules.d/89-joycond.rules --replace \
+      "/bin/setfacl"  "${acl}/bin/setfacl"
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/jujuutils/default.nix b/pkgs/os-specific/linux/jujuutils/default.nix
index 554898cedeb..12e4c15e62c 100644
--- a/pkgs/os-specific/linux/jujuutils/default.nix
+++ b/pkgs/os-specific/linux/jujuutils/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, linuxHeaders }:
 
-stdenv.mkDerivation {
-  name = "jujuutils-0.2";
+stdenv.mkDerivation rec {
+  pname = "jujuutils";
+  version = "0.2";
 
   src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/jujuutils/jujuutils-0.2.tar.gz";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/jujuutils/jujuutils-${version}.tar.gz";
     sha256 = "1r74m7s7rs9d6y7cffi7mdap3jf96qwm1v6jcw53x5cikgmfxn4x";
   };
 
diff --git a/pkgs/os-specific/linux/kbd/default.nix b/pkgs/os-specific/linux/kbd/default.nix
index 23a523b15d7..9d97f73780d 100644
--- a/pkgs/os-specific/linux/kbd/default.nix
+++ b/pkgs/os-specific/linux/kbd/default.nix
@@ -12,17 +12,22 @@
 , bzip2
 , xz
 , zstd
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
   pname = "kbd";
-  version = "2.4.0";
+  version = "2.6.3";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/kbd/${pname}-${version}.tar.xz";
-    sha256 = "17wvrqz2kk0w87idinhyvd31ih1dp7ldfl2yfx7ailygb0279w2m";
+    sha256 = "sha256-BJlsCNfRxGCWb7JEo9OIM1LCZ0t61SIAPZ9Oy4q0jes=";
   };
 
+  # vlock is moved into its own output, since it depends on pam. This
+  # reduces closure size for most use cases.
+  outputs = [ "out" "vlock" "dev" ];
+
   configureFlags = [
     "--enable-optional-progs"
     "--enable-libkeymap"
@@ -53,6 +58,12 @@ stdenv.mkDerivation rec {
         --replace 'bzip2 ' '${bzip2.bin}/bin/bzip2 ' \
         --replace 'xz '    '${xz.bin}/bin/xz ' \
         --replace 'zstd '  '${zstd.bin}/bin/zstd '
+
+      sed -i '
+        1i prefix:=$(vlock)
+        1i bindir := $(vlock)/bin' \
+        src/vlock/Makefile.in \
+        src/vlock/Makefile.am
     '';
 
   postInstall = ''
@@ -63,11 +74,20 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [ check pam ];
+  NIX_LDFLAGS = lib.optional stdenv.hostPlatform.isStatic "-laudit";
   nativeBuildInputs = [ autoreconfHook pkg-config flex ];
 
   passthru.tests = {
     inherit (nixosTests) keymap kbd-setfont-decompress kbd-update-search-paths-patch;
   };
+  passthru = {
+    gzip = gzip;
+    updateScript = gitUpdater {
+       # No nicer place to find latest release.
+       url = "https://github.com/legionus/kbd.git";
+       rev-prefix = "v";
+    };
+  };
 
   meta = with lib; {
     homepage = "https://kbd-project.org/";
diff --git a/pkgs/os-specific/linux/kbd/search-paths.patch b/pkgs/os-specific/linux/kbd/search-paths.patch
index 3b337ca7cc2..61e8918017c 100644
--- a/pkgs/os-specific/linux/kbd/search-paths.patch
+++ b/pkgs/os-specific/linux/kbd/search-paths.patch
@@ -18,44 +18,39 @@ Without this patch, kbd will only look inside
  	DATADIR "/" KEYMAPDIR "/mac/include/",
 --- a/src/libkfont/context.c
 +++ b/src/libkfont/context.c
-@@ -13,6 +13,7 @@
+@@ -13,5 +13,6 @@
  /* search for the map file in these directories (with trailing /) */
  static const char *const mapdirpath[]  = {
- 	"",
 +	"/etc/kbd/" TRANSDIR "/",
  	DATADIR "/" TRANSDIR "/",
  	NULL
  };
-@@ -28,6 +29,7 @@ static const char *const mapsuffixes[] = {
+@@ -28,5 +29,6 @@ static const char *const mapsuffixes[] = {
  /* search for the font in these directories (with trailing /) */
  static const char *const fontdirpath[]  = {
- 	"",
 +	"/etc/kbd/" FONTDIR "/",
  	DATADIR "/" FONTDIR "/",
  	NULL
  };
-@@ -42,6 +44,7 @@ static char const *const fontsuffixes[] = {
+@@ -42,5 +44,6 @@ static char const *const fontsuffixes[] = {
  
  static const char *const unidirpath[]  = {
- 	"",
 +	"/etc/kbd/" UNIMAPDIR "/",
  	DATADIR "/" UNIMAPDIR "/",
  	NULL
  };
-@@ -55,6 +58,7 @@ static const char *const unisuffixes[] = {
+@@ -55,5 +58,6 @@ static const char *const unisuffixes[] = {
  /* hide partial fonts a bit - loading a single one is a bad idea */
  const char *const partfontdirpath[]  = {
- 	"",
 +	"/etc/kbd/" FONTDIR "/" PARTIALDIR "/",
  	DATADIR "/" FONTDIR "/" PARTIALDIR "/",
  	NULL
  };
 --- a/src/loadkeys.c
 +++ b/src/loadkeys.c
-@@ -27,6 +27,7 @@
+@@ -27,5 +27,6 @@
  
  static const char *const dirpath1[] = {
- 	"",
 +	"/etc/kbd/" KEYMAPDIR "/**",
  	DATADIR "/" KEYMAPDIR "/**",
  	KERNDIR "/",
diff --git a/pkgs/os-specific/linux/kernel-headers/default.nix b/pkgs/os-specific/linux/kernel-headers/default.nix
index 8b7b5a4fa42..e0a3c4319b8 100644
--- a/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -1,11 +1,34 @@
 { stdenvNoCC, lib, buildPackages, fetchurl, perl, elf-header
-, bison ? null, flex ? null, python ? null, rsync ? null
+, bison, flex, rsync
+, writeTextFile
 }:
 
-assert stdenvNoCC.hostPlatform.isAndroid ->
-  (flex != null && bison != null && python != null && rsync != null);
+let
+
+  # As part of building a hostPlatform=mips kernel, Linux creates and runs a
+  # tiny utility `arch/mips/boot/tools/relocs_main.c` for the buildPlatform.
+  # This utility references a glibc-specific header `byteswap.h`.  There is a
+  # compatibility header in gnulib for most BSDs, but not for Darwin, so we
+  # synthesize one here.
+  darwin-endian-h = writeTextFile {
+    name = "endian-h";
+    text = ''
+      #include <byteswap.h>
+    '';
+    destination = "/include/endian.h";
+  };
+  darwin-byteswap-h = writeTextFile {
+    name = "byteswap-h";
+    text = ''
+      #pragma once
+      #include <libkern/OSByteOrder.h>
+      #define bswap_16 OSSwapInt16
+      #define bswap_32 OSSwapInt32
+      #define bswap_64 OSSwapInt64
+    '';
+    destination = "/include/byteswap.h";
+  };
 
-rec {
   makeLinuxHeaders = { src, version, patches ? [] }: stdenvNoCC.mkDerivation {
     inherit src;
 
@@ -14,6 +37,9 @@ rec {
 
     ARCH = stdenvNoCC.hostPlatform.linuxArch;
 
+    strictDeps = true;
+    enableParallelBuilding = true;
+
     # It may look odd that we use `stdenvNoCC`, and yet explicit depend on a cc.
     # We do this so we have a build->build, not build->host, C compiler.
     depsBuildBuild = [ buildPackages.stdenv.cc ];
@@ -21,10 +47,14 @@ rec {
     nativeBuildInputs = [
       perl elf-header
     ] ++ lib.optionals stdenvNoCC.hostPlatform.isAndroid [
-      flex bison python rsync
+      bison flex rsync
+    ] ++ lib.optionals (stdenvNoCC.buildPlatform.isDarwin &&
+                        stdenvNoCC.hostPlatform.isMips) [
+      darwin-endian-h
+      darwin-byteswap-h
     ];
 
-    extraIncludeDirs = lib.optional stdenvNoCC.hostPlatform.isPowerPC ["ppc"];
+    extraIncludeDirs = lib.optionals (with stdenvNoCC.hostPlatform; isPower && is32bit && isBigEndian) ["ppc"];
 
     inherit patches;
 
@@ -78,18 +108,21 @@ rec {
       platforms = platforms.linux;
     };
   };
+in {
+  inherit makeLinuxHeaders;
 
-  linuxHeadersPatches = [
-    ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
-  ];
-
-  linuxHeaders = let version = "5.12"; in
+  linuxHeaders = let version = "6.5"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
-        url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "sha256-fQ328r8jhNaNC9jh/j4HHWQ2Tc3GAC57XIfJLUj6w2Y=";
+        url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
+        hash = "sha256-eldLvCCALqdrUsp/rwcmf3IEXoYbGJFcUnKpjCer+IQ=";
       };
-      patches = linuxHeadersPatches;
+      patches = [
+        ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
+
+        # Fix regression turning `struct sockaddr_ll` flexible size.
+        ./revert-af_packet-flex.patch
+      ];
     };
 }
diff --git a/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch b/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch
new file mode 100644
index 00000000000..ed6c8861d2f
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel-headers/revert-af_packet-flex.patch
@@ -0,0 +1,31 @@
+Revert commit https://github.com/torvalds/linux/commit/a0ade8404c3bc2bf2631cb0f20d372eed22d9d96
+
+The change caused API regression by turning fixed size struct to
+flexible size struct. It was an unintentional change, broke `udp2raw`:
+    https://github.com/NixOS/nixpkgs/pull/252587#issuecomment-1744427473
+--- a/include/uapi/linux/if_packet.h
++++ b/include/uapi/linux/if_packet.h
+@@ -18,11 +18,7 @@ struct sockaddr_ll {
+ 	unsigned short	sll_hatype;
+ 	unsigned char	sll_pkttype;
+ 	unsigned char	sll_halen;
+-	union {
+-		unsigned char	sll_addr[8];
+-		/* Actual length is in sll_halen. */
+-		__DECLARE_FLEX_ARRAY(unsigned char, sll_addr_flex);
+-	};
++	unsigned char	sll_addr[8];
+ };
+ 
+ /* Packet types */
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3607,7 +3607,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
+ 	if (dev) {
+ 		sll->sll_hatype = dev->type;
+ 		sll->sll_halen = dev->addr_len;
+-		memcpy(sll->sll_addr_flex, dev->dev_addr, dev->addr_len);
++		memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
+ 	} else {
+ 		sll->sll_hatype = 0;	/* Bad: we have no ARPHRD_UNSPEC */
+ 		sll->sll_halen = 0;
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2a23c8d3ea5..2954ee8f78b 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -29,20 +29,31 @@ let
     mkIf (stdenv.hostPlatform.isAarch32 ||
           stdenv.hostPlatform.isAarch64 ||
           stdenv.hostPlatform.isx86_64 ||
-          (stdenv.hostPlatform.isPowerPC && stdenv.hostPlatform.is64bit) ||
+          (stdenv.hostPlatform.isPower && stdenv.hostPlatform.is64bit) ||
           (stdenv.hostPlatform.isMips && stdenv.hostPlatform.is64bit));
 
   options = {
 
     debug = {
-      DEBUG_INFO                = if (features.debug or false) then yes else no;
+      # Necessary for BTF
+      DEBUG_INFO                = mkMerge [
+        (whenOlder "5.2" (if (features.debug or false) then yes else no))
+        (whenBetween "5.2" "5.18" yes)
+      ];
+      DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT = whenAtLeast "5.18" yes;
+      # Reduced debug info conflict with BTF and have been enabled in
+      # aarch64 defconfig since 5.13
+      DEBUG_INFO_REDUCED        = whenAtLeast "5.13" (option no);
+      DEBUG_INFO_BTF            = whenAtLeast "5.2" (option yes);
+      # Allow loading modules with mismatched BTFs
+      # FIXME: figure out how to actually make BTFs reproducible instead
+      # See https://github.com/NixOS/nixpkgs/pull/181456 for details.
+      MODULE_ALLOW_BTF_MISMATCH = whenAtLeast "5.18" (option yes);
+      BPF_LSM                   = whenAtLeast "5.7" (option yes);
       DEBUG_KERNEL              = yes;
       DEBUG_DEVRES              = no;
       DYNAMIC_DEBUG             = yes;
-      TIMER_STATS               = whenOlder "4.11" yes;
-      DEBUG_NX_TEST             = whenOlder "4.11" no;
       DEBUG_STACK_USAGE         = no;
-      DEBUG_STACKOVERFLOW       = option no;
       RCU_TORTURE_TEST          = no;
       SCHEDSTATS                = no;
       DETECT_HUNG_TASK          = yes;
@@ -54,16 +65,50 @@ let
     };
 
     power-management = {
-      PM_ADVANCED_DEBUG                = yes;
-      X86_INTEL_LPSS                   = yes;
-      X86_INTEL_PSTATE                 = yes;
-      INTEL_IDLE                       = yes;
       CPU_FREQ_DEFAULT_GOV_PERFORMANCE = yes;
-      CPU_FREQ_GOV_SCHEDUTIL           = whenAtLeast "4.9" yes;
+      CPU_FREQ_GOV_SCHEDUTIL           = yes;
+      PM_ADVANCED_DEBUG                = yes;
       PM_WAKELOCKS                     = yes;
-      # Power-capping framework and support for INTEL RAPL
       POWERCAP                         = yes;
+      # ACPI Firmware Performance Data Table Support
+      ACPI_FPDT                        = whenAtLeast "5.12" (option yes);
+      # ACPI Heterogeneous Memory Attribute Table Support
+      ACPI_HMAT                        = whenAtLeast "5.2" (option yes);
+      # ACPI Platform Error Interface
+      ACPI_APEI                        = (option yes);
+      # APEI Generic Hardware Error Source
+      ACPI_APEI_GHES                   = (option yes);
+
+      # Enable lazy RCUs for power savings:
+      # https://lore.kernel.org/rcu/20221019225138.GA2499943@paulmck-ThinkPad-P17-Gen-1/
+      # RCU_LAZY depends on RCU_NOCB_CPU depends on NO_HZ_FULL
+      # depends on HAVE_VIRT_CPU_ACCOUNTING_GEN depends on 64BIT,
+      # so we can't force-enable this
+      RCU_LAZY                         = whenAtLeast "6.2" (option yes);
+    } // optionalAttrs (stdenv.hostPlatform.isx86) {
+      INTEL_IDLE                       = yes;
       INTEL_RAPL                       = whenAtLeast "5.3" module;
+      X86_INTEL_LPSS                   = yes;
+      X86_INTEL_PSTATE                 = yes;
+      X86_AMD_PSTATE                   = whenAtLeast "5.17" yes;
+      # Intel DPTF (Dynamic Platform and Thermal Framework) Support
+      ACPI_DPTF                        = whenAtLeast "5.10" yes;
+
+      # Required to bring up some Bay Trail devices properly
+      I2C                              = yes;
+      I2C_DESIGNWARE_PLATFORM          = yes;
+      PMIC_OPREGION                    = whenAtLeast "5.10" yes;
+      INTEL_SOC_PMIC                   = whenAtLeast "5.10" yes;
+      BYTCRC_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      CHTCRC_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      XPOWER_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      BXT_WC_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      INTEL_SOC_PMIC_CHTWC             = whenAtLeast "5.10" yes;
+      CHT_WC_PMIC_OPREGION             = whenAtLeast "5.10" yes;
+      INTEL_SOC_PMIC_CHTDC_TI          = whenAtLeast "5.10" yes;
+      CHT_DC_TI_PMIC_OPREGION          = whenAtLeast "5.10" yes;
+      MFD_TPS68470                     = whenBetween "5.10" "5.13" yes;
+      TPS68470_PMIC_OPREGION           = whenAtLeast "5.10" yes;
     };
 
     external-firmware = {
@@ -82,6 +127,16 @@ let
       CC_OPTIMIZE_FOR_SIZE = no;
     };
 
+    memory = {
+      DAMON = whenAtLeast "5.15" yes;
+      DAMON_VADDR = whenAtLeast "5.15" yes;
+      DAMON_PADDR = whenAtLeast "5.16" yes;
+      DAMON_SYSFS = whenAtLeast "5.18" yes;
+      DAMON_DBGFS = whenAtLeast "5.15" yes;
+      DAMON_RECLAIM = whenAtLeast "5.16" yes;
+      DAMON_LRU_SORT = whenAtLeast "6.0" yes;
+    };
+
     memtest = {
       MEMTEST = yes;
     };
@@ -91,13 +146,20 @@ let
     scheduler = {
       IOSCHED_CFQ = whenOlder "5.0" yes; # Removed in 5.0-RC1
       BLK_CGROUP  = yes; # required by CFQ"
-      BLK_CGROUP_IOLATENCY = whenAtLeast "4.19" yes;
+      BLK_CGROUP_IOLATENCY = yes;
       BLK_CGROUP_IOCOST = whenAtLeast "5.4" yes;
       IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1
-      MQ_IOSCHED_DEADLINE = whenAtLeast "4.11" yes;
-      BFQ_GROUP_IOSCHED = whenAtLeast "4.12" yes;
-      MQ_IOSCHED_KYBER = whenAtLeast "4.12" yes;
-      IOSCHED_BFQ = whenAtLeast "4.12" module;
+      MQ_IOSCHED_DEADLINE = yes;
+      BFQ_GROUP_IOSCHED = yes;
+      MQ_IOSCHED_KYBER = yes;
+      IOSCHED_BFQ = module;
+    };
+
+
+    timer = {
+      # Enable Full Dynticks System.
+      # NO_HZ_FULL depends on HAVE_VIRT_CPU_ACCOUNTING_GEN depends on 64BIT
+      NO_HZ_FULL = mkIf stdenv.is64bit yes;
     };
 
     # Enable NUMA.
@@ -109,6 +171,7 @@ let
       NET                = yes;
       IP_ADVANCED_ROUTER = yes;
       IP_PNP             = no;
+      IP_ROUTE_MULTIPATH = yes;
       IP_VS_PROTO_TCP    = yes;
       IP_VS_PROTO_UDP    = yes;
       IP_VS_PROTO_ESP    = yes;
@@ -120,10 +183,11 @@ let
       BPF_JIT            = whenPlatformHasEBPFJit yes;
       BPF_JIT_ALWAYS_ON  = whenPlatformHasEBPFJit no; # whenPlatformHasEBPFJit yes; # see https://github.com/NixOS/nixpkgs/issues/79304
       HAVE_EBPF_JIT      = whenPlatformHasEBPFJit yes;
-      BPF_STREAM_PARSER  = whenAtLeast "4.19" yes;
-      XDP_SOCKETS        = whenAtLeast "4.19" yes;
+      BPF_STREAM_PARSER  = yes;
+      XDP_SOCKETS        = yes;
       XDP_SOCKETS_DIAG   = whenAtLeast "5.1" yes;
       WAN                = yes;
+      TCP_CONG_ADVANCED  = yes;
       TCP_CONG_CUBIC     = yes; # This is the default congestion control algorithm since 2.6.19
       # Required by systemd per-cgroup firewalling
       CGROUP_BPF                  = option yes;
@@ -141,12 +205,12 @@ let
       IPV6_MROUTE                 = yes;
       IPV6_MROUTE_MULTIPLE_TABLES = yes;
       IPV6_PIMSM_V2               = yes;
-      IPV6_FOU_TUNNEL             = whenAtLeast "4.7" module;
-      IPV6_SEG6_LWTUNNEL          = whenAtLeast "4.10" yes;
-      IPV6_SEG6_HMAC              = whenAtLeast "4.10" yes;
-      IPV6_SEG6_BPF               = whenAtLeast "4.18" yes;
-      NET_CLS_BPF                 = whenAtLeast "4.4" module;
-      NET_ACT_BPF                 = whenAtLeast "4.4" module;
+      IPV6_FOU_TUNNEL             = module;
+      IPV6_SEG6_LWTUNNEL          = yes;
+      IPV6_SEG6_HMAC              = yes;
+      IPV6_SEG6_BPF               = yes;
+      NET_CLS_BPF                 = module;
+      NET_ACT_BPF                 = module;
       NET_SCHED                   = yes;
       L2TP_V3                     = yes;
       L2TP_IP                     = module;
@@ -161,7 +225,7 @@ let
       PPP_FILTER    = yes;
 
       # needed for iwd WPS support (wpa_supplicant replacement)
-      KEY_DH_OPERATIONS = whenAtLeast "4.7" yes;
+      KEY_DH_OPERATIONS = yes;
 
       # needed for nftables
       # Networking Options
@@ -173,22 +237,17 @@ let
       NF_CONNTRACK_TIMEOUT        = yes;
       NF_CONNTRACK_TIMESTAMP      = yes;
       NETFILTER_NETLINK_GLUE_CT   = yes;
-      NF_TABLES_INET              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
-      NF_TABLES_NETDEV            = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_INET              = yes;
+      NF_TABLES_NETDEV            = yes;
       NFT_REJECT_NETDEV           = whenAtLeast "5.11" module;
 
       # IP: Netfilter Configuration
-      NF_TABLES_IPV4              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
-      NF_TABLES_ARP               = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_IPV4              = yes;
+      NF_TABLES_ARP               = yes;
       # IPv6: Netfilter Configuration
-      NF_TABLES_IPV6              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_IPV6              = yes;
       # Bridge Netfilter Configuration
-      NF_TABLES_BRIDGE            = mkMerge [ (whenBetween "4.19" "5.3" yes)
+      NF_TABLES_BRIDGE            = mkMerge [ (whenOlder "5.3" yes)
                                               (whenAtLeast "5.3" module) ];
 
       # needed for `dropwatch`
@@ -200,28 +259,49 @@ let
       INET_DIAG         = mkDefault module;
       INET_TCP_DIAG     = mkDefault module;
       INET_UDP_DIAG     = mkDefault module;
-      INET_RAW_DIAG     = whenAtLeast "4.14" (mkDefault module);
-      INET_DIAG_DESTROY = whenAtLeast "4.9" (mkDefault yes);
+      INET_RAW_DIAG     = mkDefault module;
+      INET_DIAG_DESTROY = mkDefault yes;
 
       # enable multipath-tcp
       MPTCP           = whenAtLeast "5.6" yes;
       MPTCP_IPV6      = whenAtLeast "5.6" yes;
       INET_MPTCP_DIAG = whenAtLeast "5.9" (mkDefault module);
+
+      # Kernel TLS
+      TLS         = module;
+      TLS_DEVICE  = yes;
+
+      # infiniband
+      INFINIBAND = module;
+      INFINIBAND_IPOIB = module;
+      INFINIBAND_IPOIB_CM = yes;
     };
 
     wireless = {
-      CFG80211_WEXT         = option yes; # Without it, ipw2200 drivers don't build
-      IPW2100_MONITOR       = option yes; # support promiscuous mode
-      IPW2200_MONITOR       = option yes; # support promiscuous mode
-      HOSTAP_FIRMWARE       = option yes; # Support downloading firmware images with Host AP driver
-      HOSTAP_FIRMWARE_NVRAM = option yes;
-      ATH9K_PCI             = option yes; # Detect Atheros AR9xxx cards on PCI(e) bus
-      ATH9K_AHB             = option yes; # Ditto, AHB bus
-      B43_PHY_HT            = option yes;
-      BCMA_HOST_PCI         = option yes;
-      RTW88                 = whenAtLeast "5.2" module;
-      RTW88_8822BE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
-      RTW88_8822CE          = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      CFG80211_WEXT               = option yes; # Without it, ipw2200 drivers don't build
+      IPW2100_MONITOR             = option yes; # support promiscuous mode
+      IPW2200_MONITOR             = option yes; # support promiscuous mode
+      HOSTAP_FIRMWARE             = option yes; # Support downloading firmware images with Host AP driver
+      HOSTAP_FIRMWARE_NVRAM       = option yes;
+      ATH9K_PCI                   = option yes; # Detect Atheros AR9xxx cards on PCI(e) bus
+      ATH9K_AHB                   = option yes; # Ditto, AHB bus
+      # The description of this option makes it sound dangerous or even illegal
+      # But OpenWRT enables it by default: https://github.com/openwrt/openwrt/blob/master/package/kernel/mac80211/Makefile#L55
+      # At the time of writing (25-06-2023): this is only used in a "correct" way by ath drivers for initiating DFS radiation
+      # for "certified devices"
+      EXPERT                      = option yes; # this is needed for offering the certification option
+      CFG80211_CERTIFICATION_ONUS = option yes;
+      # DFS: "Dynamic Frequency Selection" is a spectrum-sharing mechanism that allows
+      # you to use certain interesting frequency when your local regulatory domain mandates it.
+      # ATH drivers hides the feature behind this option and makes hostapd works with DFS frequencies.
+      # OpenWRT enables it too: https://github.com/openwrt/openwrt/blob/master/package/kernel/mac80211/ath.mk#L42
+      ATH9K_DFS_CERTIFIED         = option yes;
+      ATH10K_DFS_CERTIFIED        = option yes;
+      B43_PHY_HT                  = option yes;
+      BCMA_HOST_PCI               = option yes;
+      RTW88                       = whenAtLeast "5.2" module;
+      RTW88_8822BE                = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
+      RTW88_8822CE                = mkMerge [ (whenBetween "5.2" "5.8" yes) (whenAtLeast "5.8" module) ];
     };
 
     fb = {
@@ -238,40 +318,59 @@ let
       FB_3DFX_ACCEL       = yes;
       FB_VESA             = yes;
       FRAMEBUFFER_CONSOLE = yes;
-      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = whenAtLeast "4.19" yes;
+      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = yes;
       FRAMEBUFFER_CONSOLE_ROTATION = yes;
+      FRAMEBUFFER_CONSOLE_DETECT_PRIMARY = yes;
       FB_GEODE            = mkIf (stdenv.hostPlatform.system == "i686-linux") yes;
+      # On 5.14 this conflicts with FB_SIMPLE.
+      DRM_SIMPLEDRM = whenAtLeast "5.14" no;
+      DRM_FBDEV_EMULATION = yes;
+    };
+
+    fonts = {
+      FONTS = yes;
+      # Default fonts enabled if FONTS is not set
+      FONT_8x8 = yes;
+      FONT_8x16 = yes;
+      # High DPI font
+      FONT_TER16x32 = whenAtLeast "5.0" yes;
     };
 
     video = {
+      DRM_LEGACY = no;
+      NOUVEAU_LEGACY_CTX_SUPPORT = whenBetween "5.2" "6.3" no;
+
       # Allow specifying custom EDID on the kernel command line
       DRM_LOAD_EDID_FIRMWARE = yes;
       VGA_SWITCHEROO         = yes; # Hybrid graphics support
       DRM_GMA500             = whenAtLeast "5.12" module;
       DRM_GMA600             = whenOlder "5.13" yes;
       DRM_GMA3600            = whenOlder "5.12" yes;
-      DRM_VMWGFX_FBCON       = yes;
-      # necessary for amdgpu polaris support
-      DRM_AMD_POWERPLAY = whenBetween "4.5" "4.9" yes;
+      DRM_VMWGFX_FBCON       = whenOlder "6.2" yes;
       # (experimental) amdgpu support for verde and newer chipsets
-      DRM_AMDGPU_SI = whenAtLeast "4.9" yes;
+      DRM_AMDGPU_SI = yes;
       # (stable) amdgpu support for bonaire and newer chipsets
-      DRM_AMDGPU_CIK = whenAtLeast "4.9" yes;
+      DRM_AMDGPU_CIK = yes;
       # Allow device firmware updates
-      DRM_DP_AUX_CHARDEV = whenAtLeast "4.6" yes;
+      DRM_DP_AUX_CHARDEV = yes;
       # amdgpu display core (DC) support
-      DRM_AMD_DC_DCN1_0 = whenBetween "4.15" "5.6" yes;
-      DRM_AMD_DC_PRE_VEGA = whenBetween "4.15" "4.18" yes;
+      DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes;
       DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
       DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
       DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
-      DRM_AMD_DC_DCN = whenAtLeast "5.11" yes;
-      DRM_AMD_DC_HDCP = whenAtLeast "5.5" yes;
+      DRM_AMD_DC_DCN = whenBetween "5.11" "6.4" yes;
+      DRM_AMD_DC_FP = whenAtLeast "6.4" yes;
+      DRM_AMD_DC_HDCP = whenBetween "5.5" "6.4" yes;
       DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       # Intel GVT-g graphics virtualization supports 64-bit only
-      DRM_I915_GVT = whenAtLeast "4.16" yes;
-      DRM_I915_GVT_KVMGT = whenAtLeast "4.16" module;
+      DRM_I915_GVT = yes;
+      DRM_I915_GVT_KVMGT = module;
+      # Enable Hyper-V Synthetic DRM Driver
+      DRM_HYPERV = whenAtLeast "5.14" module;
+    } // optionalAttrs (stdenv.hostPlatform.system == "aarch64-linux") {
+      # enable HDMI-CEC on RPi boards
+      DRM_VC4_HDMI_CEC = yes;
     };
 
     sound = {
@@ -284,11 +383,12 @@ let
       SND_HDA_CODEC_CA0132_DSP = whenOlder "5.7" yes; # Enable DSP firmware loading on Creative Soundblaster Z/Zx/ZxR/Recon
       SND_OSSEMUL         = yes;
       SND_USB_CAIAQ_INPUT = yes;
-      # Enable PSS mixer (Beethoven ADSP-16 and other compatible)
-      PSS_MIXER           = whenOlder "4.12" yes;
     # Enable Sound Open Firmware support
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" &&
                         versionAtLeast version "5.5") {
+      SND_SOC_INTEL_SOUNDWIRE_SOF_MACH       = whenAtLeast "5.10" module;
+      SND_SOC_INTEL_USER_FRIENDLY_LONG_NAMES = whenAtLeast "5.10" yes; # dep of SOF_MACH
+      SND_SOC_SOF_INTEL_SOUNDWIRE_LINK = whenBetween "5.10" "5.11" yes; # dep of SOF_MACH
       SND_SOC_SOF_TOPLEVEL              = yes;
       SND_SOC_SOF_ACPI                  = module;
       SND_SOC_SOF_PCI                   = module;
@@ -321,25 +421,9 @@ let
 
     usb-serial = {
       USB_SERIAL_GENERIC          = yes; # USB Generic Serial Driver
-    } // optionalAttrs (versionOlder version "4.16") {
-      # Include firmware for various USB serial devices.
-      # Only applicable for kernels below 4.16, after that no firmware is shipped in the kernel tree.
-      USB_SERIAL_KEYSPAN_MPR      = yes;
-      USB_SERIAL_KEYSPAN_USA28    = yes;
-      USB_SERIAL_KEYSPAN_USA28X   = yes;
-      USB_SERIAL_KEYSPAN_USA28XA  = yes;
-      USB_SERIAL_KEYSPAN_USA28XB  = yes;
-      USB_SERIAL_KEYSPAN_USA19    = yes;
-      USB_SERIAL_KEYSPAN_USA18X   = yes;
-      USB_SERIAL_KEYSPAN_USA19W   = yes;
-      USB_SERIAL_KEYSPAN_USA19QW  = yes;
-      USB_SERIAL_KEYSPAN_USA19QI  = yes;
-      USB_SERIAL_KEYSPAN_USA49W   = yes;
-      USB_SERIAL_KEYSPAN_USA49WLC = yes;
     };
 
     usb = {
-      USB_DEBUG = { optional = true; tristate = whenOlder "4.18" "n";};
       USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators
       USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling
       USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies)
@@ -348,10 +432,12 @@ let
     # Filesystem options - in particular, enable extended attributes and
     # ACLs for all filesystems that support them.
     filesystem = {
-      FANOTIFY        = yes;
+      FANOTIFY                    = yes;
+      FANOTIFY_ACCESS_PERMISSIONS = yes;
+
       TMPFS           = yes;
       TMPFS_POSIX_ACL = yes;
-      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else whenAtLeast "4.9" (option module);
+      FS_ENCRYPTION   = if (versionAtLeast version "5.1") then yes else option module;
 
       EXT2_FS_XATTR     = yes;
       EXT2_FS_POSIX_ACL = yes;
@@ -362,7 +448,11 @@ let
 
       EXT4_FS_POSIX_ACL = yes;
       EXT4_FS_SECURITY  = yes;
-      EXT4_ENCRYPTION   = { optional = true; tristate = if (versionOlder version "4.8") then "m" else "y"; };
+      EXT4_ENCRYPTION   = whenOlder "5.1" yes;
+
+      NTFS_FS            = whenAtLeast "5.15" no;
+      NTFS3_LZX_XPRESS   = whenAtLeast "5.15" yes;
+      NTFS3_FS_POSIX_ACL = whenAtLeast "5.15" yes;
 
       REISERFS_FS_XATTR     = option yes;
       REISERFS_FS_POSIX_ACL = option yes;
@@ -374,6 +464,7 @@ let
       XFS_QUOTA     = option yes;
       XFS_POSIX_ACL = option yes;
       XFS_RT        = option yes; # XFS Realtime subvolume support
+      XFS_ONLINE_SCRUB = option yes;
 
       OCFS2_DEBUG_MASKLOG = option no;
 
@@ -383,13 +474,12 @@ let
 
       F2FS_FS             = module;
       F2FS_FS_SECURITY    = option yes;
-      F2FS_FS_ENCRYPTION  = option yes;
+      F2FS_FS_ENCRYPTION  = whenOlder "5.1" yes;
       F2FS_FS_COMPRESSION = whenAtLeast "5.6" yes;
       UDF_FS              = module;
 
-      NFSD_PNFS              = whenBetween "4.0" "4.6" yes;
-      NFSD_V2_ACL            = yes;
-      NFSD_V3                = yes;
+      NFSD_V2_ACL            = whenOlder "6.2" yes;
+      NFSD_V3                = whenOlder "5.18" yes;
       NFSD_V3_ACL            = yes;
       NFSD_V4                = yes;
       NFSD_V4_SECURITY_LABEL = yes;
@@ -404,24 +494,22 @@ let
       CIFS_XATTR        = yes;
       CIFS_POSIX        = option yes;
       CIFS_FSCACHE      = yes;
-      CIFS_STATS        = whenOlder "4.19" yes;
-      CIFS_WEAK_PW_HASH = yes;
+      CIFS_WEAK_PW_HASH = whenOlder "5.15" yes;
       CIFS_UPCALL       = yes;
       CIFS_ACL          = whenOlder "5.3" yes;
       CIFS_DFS_UPCALL   = yes;
-      CIFS_SMB2         = whenOlder "4.13" yes;
 
       CEPH_FSCACHE      = yes;
       CEPH_FS_POSIX_ACL = yes;
 
       SQUASHFS_FILE_DIRECT         = yes;
-      SQUASHFS_DECOMP_MULTI_PERCPU = yes;
+      SQUASHFS_DECOMP_MULTI_PERCPU = whenOlder "6.2" yes;
       SQUASHFS_XATTR               = yes;
       SQUASHFS_ZLIB                = yes;
       SQUASHFS_LZO                 = yes;
       SQUASHFS_XZ                  = yes;
       SQUASHFS_LZ4                 = yes;
-      SQUASHFS_ZSTD                = whenAtLeast "4.14" yes;
+      SQUASHFS_ZSTD                = yes;
 
       # Native Language Support modules, needed by some filesystems
       NLS              = yes;
@@ -430,19 +518,29 @@ let
       NLS_CODEPAGE_437 = module; # VFAT default for the codepage= mount option
       NLS_ISO8859_1    = module; # VFAT default for the iocharset= mount option
 
+      # Needed to use the installation iso image. Not included in all defconfigs (e.g. arm64)
+      ISO9660_FS = module;
+
       DEVTMPFS = yes;
 
       UNICODE = whenAtLeast "5.2" yes; # Casefolding support for filesystems
     };
 
     security = {
-      # Detect writes to read-only module pages
-      DEBUG_SET_MODULE_RONX            = { optional = true; tristate = whenOlder "4.11" "y"; };
+      FORTIFY_SOURCE                   = option yes;
+
+      # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
+      DEBUG_LIST                       = yes;
+      HARDENED_USERCOPY                = yes;
       RANDOMIZE_BASE                   = option yes;
-      STRICT_DEVMEM                    = option yes; # Filter access to /dev/mem
+      STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
+      IO_STRICT_DEVMEM                 = mkDefault yes;
       SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
       # Prevent processes from ptracing non-children processes
       SECURITY_YAMA                    = option yes;
+      # The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes.
+      # This does not have any effect if a program does not support it
+      SECURITY_LANDLOCK                = whenAtLeast "5.13" yes;
       DEVKMEM                          = whenOlder "5.13" no; # Disable /dev/kmem
 
       USER_NS                          = yes; # Support for user namespaces
@@ -450,23 +548,49 @@ let
       SECURITY_APPARMOR                = yes;
       DEFAULT_SECURITY_APPARMOR        = yes;
 
-      RANDOM_TRUST_CPU                 = whenAtLeast "4.19" yes; # allow RDRAND to seed the RNG
+      RANDOM_TRUST_CPU                 = whenOlder "6.2" yes; # allow RDRAND to seed the RNG
+      RANDOM_TRUST_BOOTLOADER          = whenOlder "6.2" (whenAtLeast "5.4" yes); # allow the bootloader to seed the RNG
 
       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
       # Depends on MODULE_SIG and only really helps when you sign your modules
       # and enforce signatures which we don't do by default.
-      SECURITY_LOCKDOWN_LSM = option no;
-    } // optionalAttrs (!stdenv.hostPlatform.isAarch32) {
-
-      # Detect buffer overflows on the stack
-      CC_STACKPROTECTOR_REGULAR = {optional = true; tristate = whenOlder "4.18" "y";};
+      SECURITY_LOCKDOWN_LSM = whenAtLeast "5.4" no;
+
+      # provides a register of persistent per-UID keyrings, useful for encrypting storage pools in stratis
+      PERSISTENT_KEYRINGS              = yes;
+      # enable temporary caching of the last request_key() result
+      KEYS_REQUEST_CACHE               = whenAtLeast "5.3" yes;
+      # randomized slab caches
+      RANDOM_KMALLOC_CACHES            = whenAtLeast "6.6" yes;
+
+      # NIST SP800-90A DRBG modes - enabled by most distributions
+      #   and required by some out-of-tree modules (ShuffleCake)
+      #   This does not include the NSA-backdoored Dual-EC mode from the same NIST publication.
+      CRYPTO_DRBG_HASH                 = yes;
+      CRYPTO_DRBG_CTR                  = yes;
+
+    } // optionalAttrs stdenv.hostPlatform.isx86_64 {
+      # Enable Intel SGX
+      X86_SGX     = whenAtLeast "5.11" yes;
+      # Allow KVM guests to load SGX enclaves
+      X86_SGX_KVM = whenAtLeast "5.13" yes;
+
+      # AMD Cryptographic Coprocessor (CCP)
+      CRYPTO_DEV_CCP  = yes;
+      # AMD SME
+      AMD_MEM_ENCRYPT = yes;
+      # AMD SEV and AMD SEV-SE
+      KVM_AMD_SEV     = yes;
+      # AMD SEV-SNP
+      SEV_GUEST       = whenAtLeast "5.19" module;
+      # Shadow stacks
+      X86_USER_SHADOW_STACK = whenAtLeast "6.6" yes;
     };
 
     microcode = {
       MICROCODE       = yes;
-      MICROCODE_INTEL = yes;
-      MICROCODE_AMD   = yes;
-    } // optionalAttrs (versionAtLeast version "4.10") {
+      MICROCODE_INTEL = whenOlder "6.6" yes;
+      MICROCODE_AMD   = whenOlder "6.6" yes;
       # Write Back Throttling
       # https://lwn.net/Articles/682582/
       # https://bugzilla.kernel.org/show_bug.cgi?id=12309#c655
@@ -481,15 +605,14 @@ let
       CGROUP_DEVICE  = yes;
       CGROUP_HUGETLB = yes;
       CGROUP_PERF    = yes;
-      CGROUP_RDMA    = whenAtLeast "4.11" yes;
+      CGROUP_RDMA    = yes;
 
       MEMCG                    = yes;
-      MEMCG_SWAP               = yes;
+      MEMCG_SWAP               = whenOlder "6.1" yes;
 
-      DEVPTS_MULTIPLE_INSTANCES = whenOlder "4.7" yes;
       BLK_DEV_THROTTLING        = yes;
       CFQ_GROUP_IOSCHED         = whenOlder "5.0" yes; # Removed in 5.0-RC1
-      CGROUP_PIDS               = whenAtLeast "4.3" yes;
+      CGROUP_PIDS               = yes;
     };
 
     staging = {
@@ -512,25 +635,27 @@ let
       FTRACE_SYSCALLS       = yes;
       SCHED_TRACER          = yes;
       STACK_TRACER          = yes;
-      UPROBE_EVENT          = { optional = true; tristate = whenOlder "4.11" "y";};
-      UPROBE_EVENTS         = { optional = true; tristate = whenAtLeast "4.11" "y";};
-      BPF_SYSCALL           = whenAtLeast "4.4" yes;
-      BPF_EVENTS            = whenAtLeast "4.4" yes;
+      UPROBE_EVENTS         = option yes;
+      BPF_SYSCALL           = yes;
+      BPF_UNPRIV_DEFAULT_OFF = whenBetween "5.10" "5.16" yes;
+      BPF_EVENTS            = yes;
       FUNCTION_PROFILER     = yes;
       RING_BUFFER_BENCHMARK = no;
     };
 
+    perf = {
+      # enable AMD Zen branch sampling if available
+      PERF_EVENTS_AMD_BRS       = whenAtLeast "5.19" (option yes);
+    };
+
     virtualisation = {
       PARAVIRT = option yes;
 
       HYPERVISOR_GUEST = yes;
       PARAVIRT_SPINLOCKS  = option yes;
 
-      KVM_APIC_ARCHITECTURE             = whenOlder "4.8" yes;
       KVM_ASYNC_PF                      = yes;
-      KVM_COMPAT = { optional = true; tristate = whenBetween "4.0" "4.12" "y"; };
-      KVM_DEVICE_ASSIGNMENT  = { optional = true; tristate = whenBetween "3.10" "4.12" "y"; };
-      KVM_GENERIC_DIRTYLOG_READ_PROTECT = whenAtLeast "4.0"  yes;
+      KVM_GENERIC_DIRTYLOG_READ_PROTECT = yes;
       KVM_GUEST                         = yes;
       KVM_MMIO                          = yes;
       KVM_VFIO                          = yes;
@@ -563,22 +688,20 @@ let
       XEN_PVH                     = option yes;
       XEN_PVHVM                   = option yes;
       XEN_SAVE_RESTORE            = option yes;
-      XEN_SCRUB_PAGES             = option yes;
-      XEN_SELFBALLOONING          = option yes;
-      XEN_STUB                    = option yes;
-      XEN_TMEM                    = option yes;
+      XEN_SELFBALLOONING          = whenOlder "5.3" yes;
+
+      # Enable device detection on virtio-mmio hypervisors
+      VIRTIO_MMIO_CMDLINE_DEVICES = yes;
     };
 
     media = {
       MEDIA_DIGITAL_TV_SUPPORT = yes;
       MEDIA_CAMERA_SUPPORT     = yes;
-      MEDIA_RC_SUPPORT         = whenOlder "4.14" yes;
       MEDIA_CONTROLLER         = yes;
       MEDIA_PCI_SUPPORT        = yes;
       MEDIA_USB_SUPPORT        = yes;
       MEDIA_ANALOG_TV_SUPPORT  = yes;
-      VIDEO_STK1160_COMMON     = module;
-      VIDEO_STK1160_AC97       = whenOlder "4.11" yes;
+      VIDEO_STK1160_COMMON     = whenOlder "6.5" module;
     };
 
     "9p" = {
@@ -594,10 +717,11 @@ let
     };
 
     zram = {
-      ZRAM     = module;
-      ZSWAP    = option yes;
-      ZBUD     = option yes;
-      ZSMALLOC = module;
+      ZRAM           = module;
+      ZRAM_WRITEBACK = option yes;
+      ZSWAP          = option yes;
+      ZPOOL          = yes;
+      ZBUD           = option yes;
     };
 
     brcmfmac = {
@@ -616,67 +740,27 @@ let
     tests = {
       # This menu disables all/most of them on >= 4.16
       RUNTIME_TESTING_MENU = option no;
-    } // optionalAttrs (versionOlder version "4.16") {
-      # For older kernels, painstakingly disable each symbol.
-      ARM_KPROBES_TEST    = option no;
-      ASYNC_RAID6_TEST    = option no;
-      ATOMIC64_SELFTEST   = option no;
-      BACKTRACE_SELF_TEST = option no;
-      INTERVAL_TREE_TEST  = option no;
-      PERCPU_TEST         = option no;
-      RBTREE_TEST         = option no;
-      TEST_BITMAP         = option no;
-      TEST_BPF            = option no;
-      TEST_FIRMWARE       = option no;
-      TEST_HASH           = option no;
-      TEST_HEXDUMP        = option no;
-      TEST_KMOD           = option no;
-      TEST_KSTRTOX        = option no;
-      TEST_LIST_SORT      = option no;
-      TEST_LKM            = option no;
-      TEST_PARMAN         = option no;
-      TEST_PRINTF         = option no;
-      TEST_RHASHTABLE     = option no;
-      TEST_SORT           = option no;
-      TEST_STATIC_KEYS    = option no;
-      TEST_STRING_HELPERS = option no;
-      TEST_UDELAY         = option no;
-      TEST_USER_COPY      = option no;
-      TEST_UUID           = option no;
     } // {
       CRC32_SELFTEST           = option no;
       CRYPTO_TEST              = option no;
       EFI_TEST                 = option no;
       GLOB_SELFTEST            = option no;
-      DRM_DEBUG_MM_SELFTEST    = { optional = true; tristate = whenOlder "4.18" "n";};
-      LNET_SELFTEST            = { optional = true; tristate = whenOlder "4.18" "n";};
       LOCK_TORTURE_TEST        = option no;
       MTD_TESTS                = option no;
       NOTIFIER_ERROR_INJECTION = option no;
-      RCU_PERF_TEST            = option no;
+      RCU_PERF_TEST            = whenOlder "5.9" no;
+      RCU_SCALE_TEST           = whenAtLeast "5.10" no;
       RCU_TORTURE_TEST         = option no;
       TEST_ASYNC_DRIVER_PROBE  = option no;
       WW_MUTEX_SELFTEST        = option no;
       XZ_DEC_TEST              = option no;
     };
 
-    criu = if (versionAtLeast version "4.19") then {
+    criu = {
       # Unconditionally enabled, because it is required for CRIU and
       # it provides the kcmp() system call that Mesa depends on.
       CHECKPOINT_RESTORE  = yes;
-    } else optionalAttrs (features.criu or false) ({
-      # For older kernels, CHECKPOINT_RESTORE is hidden behind EXPERT.
-      EXPERT              = yes;
-      CHECKPOINT_RESTORE  = yes;
-    } // optionalAttrs (features.criu_revert_expert or true) {
-      RFKILL_INPUT          = option yes;
-      HID_PICOLCD_FB        = option yes;
-      HID_PICOLCD_BACKLIGHT = option yes;
-      HID_PICOLCD_LCD       = option yes;
-      HID_PICOLCD_LEDS      = option yes;
-      HID_PICOLCD_CIR       = option yes;
-      DEBUG_MEMORY_INIT     = option yes;
-    });
+    };
 
     misc = let
       # Use zstd for kernel compression if 64-bit and newer than 5.9, otherwise xz.
@@ -692,7 +776,12 @@ let
 
       HID_ACRUX_FF       = yes;
       DRAGONRISE_FF      = yes;
+      GREENASIA_FF       = yes;
       HOLTEK_FF          = yes;
+      JOYSTICK_PSXPAD_SPI_FF = yes;
+      LOGIG940_FF        = yes;
+      NINTENDO_FF        = whenAtLeast "5.16" yes;
+      PLAYSTATION_FF     = whenAtLeast "5.12" yes;
       SONY_FF            = yes;
       SMARTJOYPLUS_FF    = yes;
       THRUSTMASTER_FF    = yes;
@@ -715,7 +804,6 @@ let
       PM_TRACE_RTC         = no; # Disable some expensive (?) features.
       ACCESSIBILITY        = yes; # Accessibility support
       AUXDISPLAY           = yes; # Auxiliary Display support
-      DONGLE               = whenOlder "4.17" yes; # Serial dongle support
       HIPPI                = yes;
       MTD_COMPLEX_MAPPINGS = yes; # needed for many devices
 
@@ -732,35 +820,47 @@ let
       AIC79XX_DEBUG_ENABLE = no;
       AIC7XXX_DEBUG_ENABLE = no;
       AIC94XX_DEBUG = no;
-      B43_PCMCIA = { optional=true; tristate = whenOlder "4.4" "y";};
 
       BLK_DEV_INTEGRITY       = yes;
 
-      BLK_SED_OPAL = whenAtLeast "4.14" yes;
+      BLK_SED_OPAL = yes;
 
       BSD_PROCESS_ACCT_V3 = yes;
 
+      SERIAL_DEV_BUS = yes; # enables support for serial devices
+      SERIAL_DEV_CTRL_TTYPORT = yes; # enables support for TTY serial devices
+
+      BT_HCIBTUSB_MTK = whenAtLeast "5.3" yes; # MediaTek protocol support
+      BT_HCIUART_QCA = yes; # Qualcomm Atheros protocol support
+      BT_HCIUART_SERDEV = yes; # required by BT_HCIUART_QCA
+      BT_HCIUART = module; # required for BT devices with serial port interface (QCA6390)
       BT_HCIUART_BCSP = option yes;
       BT_HCIUART_H4   = option yes; # UART (H4) protocol support
       BT_HCIUART_LL   = option yes;
       BT_RFCOMM_TTY   = option yes; # RFCOMM TTY support
+      BT_QCA = module; # enables QCA6390 bluetooth
 
-      CLEANCACHE = option yes;
+      # Removed on 5.17 as it was unused
+      # upstream: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0a4ee518185e902758191d968600399f3bc2be31
+      CLEANCACHE = whenOlder "5.17" (option yes);
       CRASH_DUMP = option no;
 
+      FSCACHE_STATS = yes;
+
       DVB_DYNAMIC_MINORS = option yes; # we use udev
 
       EFI_STUB            = yes; # EFI bootloader in the bzImage itself
+      EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER =
+          whenOlder "6.2" (whenAtLeast "5.8" yes); # initrd kernel parameter for EFI
       CGROUPS             = yes; # used by systemd
       FHANDLE             = yes; # used by systemd
       SECCOMP             = yes; # used by systemd >= 231
       SECCOMP_FILTER      = yes; # ditto
       POSIX_MQUEUE        = yes;
-      FRONTSWAP           = yes;
+      FRONTSWAP           = whenOlder "6.6" yes;
       FUSION              = yes; # Fusion MPT device support
       IDE                 = whenOlder "5.14" no; # deprecated IDE support, removed in 5.14
       IDLE_PAGE_TRACKING  = yes;
-      IRDA_ULTRA          = whenOlder "4.17" yes; # Ultra (connectionless) protocol
 
       JOYSTICK_IFORCE_232 = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force Serial joysticks and wheels
       JOYSTICK_IFORCE_USB = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force USB joysticks and wheels
@@ -780,25 +880,30 @@ let
       MEDIA_ATTACH          = yes;
       MEGARAID_NEWGEN       = yes;
 
-      MLX4_EN_VXLAN = whenOlder "4.8" yes;
       MLX5_CORE_EN       = option yes;
 
-      NVME_MULTIPATH = whenAtLeast "4.15" yes;
+      NVME_MULTIPATH = yes;
 
       PSI = whenAtLeast "4.20" yes;
 
-      MODVERSIONS        = whenOlder "4.9" yes;
       MOUSE_ELAN_I2C_SMBUS = yes;
       MOUSE_PS2_ELANTECH = yes; # Elantech PS/2 protocol extension
+      MOUSE_PS2_VMMOUSE  = yes;
       MTRR_SANITIZER     = yes;
       NET_FC             = yes; # Fibre Channel driver support
+      # Needed for touchpads to work on some AMD laptops
+      PINCTRL_AMD        = whenAtLeast "5.19" yes;
       # GPIO on Intel Bay Trail, for some Chromebook internal eMMC disks
       PINCTRL_BAYTRAIL   = yes;
+      # GPIO for Braswell and Cherryview devices
+      # Needs to be built-in to for integrated keyboards to function properly
+      PINCTRL_CHERRYVIEW = yes;
       # 8 is default. Modern gpt tables on eMMC may go far beyond 8.
       MMC_BLOCK_MINORS   = freeform "32";
 
       REGULATOR  = yes; # Voltage and Current Regulator Support
       RC_DEVICES = option yes; # Enable IR devices
+      RC_DECODERS = option yes; # Required for IR devices to work
 
       RT2800USB_RT53XX = yes;
       RT2800USB_RT55XX = yes;
@@ -809,6 +914,9 @@ let
       SCSI_LOGGING = yes; # SCSI logging facility
       SERIAL_8250  = yes; # 8250/16550 and compatible serial support
 
+      SLAB_FREELIST_HARDENED = yes;
+      SLAB_FREELIST_RANDOM   = yes;
+
       SLIP_COMPRESSED = yes; # CSLIP compressed headers
       SLIP_SMART      = yes;
 
@@ -831,6 +939,8 @@ let
       # Disable the firmware helper fallback, udev doesn't implement it any more
       FW_LOADER_USER_HELPER_FALLBACK = option no;
 
+      FW_LOADER_COMPRESS = option yes;
+
       HOTPLUG_PCI_ACPI = yes; # PCI hotplug using ACPI
       HOTPLUG_PCI_PCIE = yes; # PCI-Expresscard hotplug support
 
@@ -845,9 +955,34 @@ let
 
       X86_AMD_PLATFORM_DEVICE = yes;
       X86_PLATFORM_DRIVERS_DELL = whenAtLeast "5.12" yes;
+      X86_PLATFORM_DRIVERS_HP = whenAtLeast "6.1" yes;
+
+      LIRC = yes;
+
+      SCHED_CORE = whenAtLeast "5.14" yes;
+
+      LRU_GEN = whenAtLeast "6.1"  yes;
+      LRU_GEN_ENABLED =  whenAtLeast "6.1" yes;
+
+      FSL_MC_UAPI_SUPPORT = mkIf (stdenv.hostPlatform.system == "aarch64-linux") (whenAtLeast "5.12" yes);
+
+      ASHMEM =                 { optional = true; tristate = whenBetween "5.0" "5.18" "y";};
+      ANDROID =                { optional = true; tristate = whenBetween "5.0" "5.19" "y";};
+      ANDROID_BINDER_IPC =     { optional = true; tristate = whenAtLeast "5.0" "y";};
+      ANDROID_BINDERFS =       { optional = true; tristate = whenAtLeast "5.0" "y";};
+      ANDROID_BINDER_DEVICES = { optional = true; freeform = whenAtLeast "5.0" "binder,hwbinder,vndbinder";};
+
+      TASKSTATS = yes;
+      TASK_DELAY_ACCT = yes;
+      TASK_XACCT = yes;
+      TASK_IO_ACCOUNTING = yes;
 
-      LIRC = mkMerge [ (whenOlder "4.16" module) (whenAtLeast "4.17" yes) ];
+      # Fresh toolchains frequently break -Werror build for minor issues.
+      WERROR = whenAtLeast "5.15" no;
 
+      # > CONFIG_KUNIT should not be enabled in a production environment. Enabling KUnit disables Kernel Address-Space Layout Randomization (KASLR), and tests may affect the state of the kernel in ways not suitable for production.
+      # https://www.kernel.org/doc/html/latest/dev-tools/kunit/start.html
+      KUNIT = whenAtLeast "5.5" no;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Enable CPU/memory hotplug support
       # Allows you to dynamically add & remove CPUs/memory to a VM client running NixOS without requiring a reboot
@@ -864,7 +999,7 @@ let
       NR_CPUS = freeform "384";
     } // optionalAttrs (stdenv.hostPlatform.system == "armv7l-linux" || stdenv.hostPlatform.system == "aarch64-linux") {
       # Enables support for the Allwinner Display Engine 2.0
-      SUN8I_DE2_CCU = whenAtLeast "4.13" yes;
+      SUN8I_DE2_CCU = yes;
 
       # See comments on https://github.com/NixOS/nixpkgs/commit/9b67ea9106102d882f53d62890468071900b9647
       CRYPTO_AEGIS128_SIMD = whenAtLeast "5.4" no;
@@ -880,6 +1015,46 @@ let
       # Keeping it a built-in ensures it will be used if possible.
       FB_SIMPLE = yes;
 
+      # https://docs.kernel.org/arch/arm/mem_alignment.html
+      # tldr:
+      #  when buggy userspace code emits illegal misaligned LDM, STM,
+      #  LDRD and STRDs, the instructions trap, are caught, and then
+      #  are emulated by the kernel.
+      #
+      #  This is the default on armv7l, anyway, but it is explicitly
+      #  enabled here for the sake of providing context for the
+      #  aarch64 compat option which follows.
+      ALIGNMENT_TRAP = mkIf (stdenv.hostPlatform.system == "armv7l-linux") yes;
+
+      # https://patchwork.kernel.org/project/linux-arm-kernel/patch/20220701135322.3025321-1-ardb@kernel.org/
+      # tldr:
+      #  when encountering alignment faults under aarch64, this option
+      #  makes the kernel attempt to handle the fault by doing the
+      #  same style of misaligned emulation that is performed under
+      #  armv7l (see above option).
+      #
+      #  This minimizes the potential for aarch32 userspace to behave
+      #  differently when run under aarch64 kernels compared to when
+      #  it is run under an aarch32 kernel.
+      COMPAT_ALIGNMENT_FIXUPS = mkIf (stdenv.hostPlatform.system == "aarch64-linux") (whenAtLeast "6.1" yes);
+    } // optionalAttrs (versionAtLeast version "5.4" && (stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "aarch64-linux")) {
+      # Required for various hardware features on Chrome OS devices
+      CHROME_PLATFORMS = yes;
+      CHROMEOS_TBMC = module;
+
+      CROS_EC = module;
+
+      CROS_EC_I2C = module;
+      CROS_EC_SPI = module;
+      CROS_EC_LPC = module;
+      CROS_EC_ISHTP = module;
+
+      CROS_KBD_LED_BACKLIGHT = module;
+
+      TCG_TIS_SPI_CR50 = whenAtLeast "5.5" yes;
+    } // optionalAttrs (versionAtLeast version "5.4" && stdenv.hostPlatform.system == "x86_64-linux") {
+      CHROMEOS_LAPTOP = module;
+      CHROMEOS_PSTORE = module;
     };
   };
 in
diff --git a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.11.patch b/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.11.patch
deleted file mode 100644
index 38cc0532ba9..00000000000
--- a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.11.patch
+++ /dev/null
@@ -1,784 +0,0 @@
-commit 827b86ad1dd21feed4c0b99faf6059f245f7dadb
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Misc preps for cgroup unified hierarchy interface
-    
-    Make the following changes in preparation for the cpu controller
-    interface implementation for the unified hierarchy.  This patch
-    doesn't cause any functional differences.
-    
-    * s/cpu_stats_show()/cpu_cfs_stats_show()/
-    
-    * s/cpu_files/cpu_legacy_files/
-    
-    * Separate out cpuacct_stats_read() from cpuacct_stats_show().  While
-      at it, make the @val array u64 for consistency.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 3b31fc05a0f1..a1b95e83fa87 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -7174,7 +7174,7 @@ static int __cfs_schedulable(struct task_group *tg, u64 period, u64 quota)
- 	return ret;
- }
- 
--static int cpu_stats_show(struct seq_file *sf, void *v)
-+static int cpu_cfs_stats_show(struct seq_file *sf, void *v)
- {
- 	struct task_group *tg = css_tg(seq_css(sf));
- 	struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-@@ -7214,7 +7214,7 @@ static u64 cpu_rt_period_read_uint(struct cgroup_subsys_state *css,
- }
- #endif /* CONFIG_RT_GROUP_SCHED */
- 
--static struct cftype cpu_files[] = {
-+static struct cftype cpu_legacy_files[] = {
- #ifdef CONFIG_FAIR_GROUP_SCHED
- 	{
- 		.name = "shares",
-@@ -7235,7 +7235,7 @@ static struct cftype cpu_files[] = {
- 	},
- 	{
- 		.name = "stat",
--		.seq_show = cpu_stats_show,
-+		.seq_show = cpu_cfs_stats_show,
- 	},
- #endif
- #ifdef CONFIG_RT_GROUP_SCHED
-@@ -7261,7 +7261,7 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.fork		= cpu_cgroup_fork,
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
--	.legacy_cftypes	= cpu_files,
-+	.legacy_cftypes	= cpu_legacy_files,
- 	.early_init	= true,
- };
- 
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index f95ab29a45d0..6151c23f722f 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -276,26 +276,33 @@ static int cpuacct_all_seq_show(struct seq_file *m, void *V)
- 	return 0;
- }
- 
--static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+static void cpuacct_stats_read(struct cpuacct *ca,
-+			       u64 (*val)[CPUACCT_STAT_NSTATS])
- {
--	struct cpuacct *ca = css_ca(seq_css(sf));
--	s64 val[CPUACCT_STAT_NSTATS];
- 	int cpu;
--	int stat;
- 
--	memset(val, 0, sizeof(val));
-+	memset(val, 0, sizeof(*val));
-+
- 	for_each_possible_cpu(cpu) {
- 		u64 *cpustat = per_cpu_ptr(ca->cpustat, cpu)->cpustat;
- 
--		val[CPUACCT_STAT_USER]   += cpustat[CPUTIME_USER];
--		val[CPUACCT_STAT_USER]   += cpustat[CPUTIME_NICE];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SYSTEM];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_IRQ];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SOFTIRQ];
-+		(*val)[CPUACCT_STAT_USER]   += cpustat[CPUTIME_USER];
-+		(*val)[CPUACCT_STAT_USER]   += cpustat[CPUTIME_NICE];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SYSTEM];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_IRQ];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SOFTIRQ];
- 	}
-+}
-+
-+static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+{
-+	u64 val[CPUACCT_STAT_NSTATS];
-+	int stat;
-+
-+	cpuacct_stats_read(css_ca(seq_css(sf)), &val);
- 
- 	for (stat = 0; stat < CPUACCT_STAT_NSTATS; stat++) {
--		seq_printf(sf, "%s %lld\n",
-+		seq_printf(sf, "%s %llu\n",
- 			   cpuacct_stat_desc[stat],
- 			   (long long)nsec_to_clock_t(val[stat]));
- 	}
-
-commit fdb64d002b3a223ce4bb11aa4448a42050470052
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Implement interface for cgroup unified hierarchy
-    
-    While the cpu controller doesn't have any functional problems, there
-    are a couple interface issues which can be addressed in the v2
-    interface.
-    
-    * cpuacct being a separate controller.  This separation is artificial
-      and rather pointless as demonstrated by most use cases co-mounting
-      the two controllers.  It also forces certain information to be
-      accounted twice.
-    
-    * Use of different time units.  Writable control knobs use
-      microseconds, some stat fields use nanoseconds while other cpuacct
-      stat fields use centiseconds.
-    
-    * Control knobs which can't be used in the root cgroup still show up
-      in the root.
-    
-    * Control knob names and semantics aren't consistent with other
-      controllers.
-    
-    This patchset implements cpu controller's interface on the unified
-    hierarchy which adheres to the controller file conventions described
-    in Documentation/cgroups/unified-hierarchy.txt.  Overall, the
-    following changes are made.
-    
-    * cpuacct is implictly enabled and disabled by cpu and its information
-      is reported through "cpu.stat" which now uses microseconds for all
-      time durations.  All time duration fields now have "_usec" appended
-      to them for clarity.  While this doesn't solve the double accounting
-      immediately, once majority of users switch to v2, cpu can directly
-      account and report the relevant stats and cpuacct can be disabled on
-      the unified hierarchy.
-    
-      Note that cpuacct.usage_percpu is currently not included in
-      "cpu.stat".  If this information is actually called for, it can be
-      added later.
-    
-    * "cpu.shares" is replaced with "cpu.weight" and operates on the
-      standard scale defined by CGROUP_WEIGHT_MIN/DFL/MAX (1, 100, 10000).
-      The weight is scaled to scheduler weight so that 100 maps to 1024
-      and the ratio relationship is preserved - if weight is W and its
-      scaled value is S, W / 100 == S / 1024.  While the mapped range is a
-      bit smaller than the orignal scheduler weight range, the dead zones
-      on both sides are relatively small and covers wider range than the
-      nice value mappings.  This file doesn't make sense in the root
-      cgroup and isn't create on root.
-    
-    * "cpu.cfs_quota_us" and "cpu.cfs_period_us" are replaced by "cpu.max"
-      which contains both quota and period.
-    
-    * "cpu.rt_runtime_us" and "cpu.rt_period_us" are replaced by
-      "cpu.rt.max" which contains both runtime and period.
-    
-    v2: cpu_stats_show() was incorrectly using CONFIG_FAIR_GROUP_SCHED for
-        CFS bandwidth stats and also using raw division for u64.  Use
-        CONFIG_CFS_BANDWITH and do_div() instead.
-    
-        The semantics of "cpu.rt.max" is not fully decided yet.  Dropped
-        for now.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index a1b95e83fa87..f01d56e58a1b 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -7253,6 +7253,139 @@ static struct cftype cpu_legacy_files[] = {
- 	{ }	/* Terminate */
- };
- 
-+static int cpu_stats_show(struct seq_file *sf, void *v)
-+{
-+	cpuacct_cpu_stats_show(sf);
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		struct task_group *tg = css_tg(seq_css(sf));
-+		struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-+		u64 throttled_usec;
-+
-+		throttled_usec = cfs_b->throttled_time;
-+		do_div(throttled_usec, NSEC_PER_USEC);
-+
-+		seq_printf(sf, "nr_periods %d\n"
-+			   "nr_throttled %d\n"
-+			   "throttled_usec %llu\n",
-+			   cfs_b->nr_periods, cfs_b->nr_throttled,
-+			   throttled_usec);
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+static u64 cpu_weight_read_u64(struct cgroup_subsys_state *css,
-+			       struct cftype *cft)
-+{
-+	struct task_group *tg = css_tg(css);
-+	u64 weight = scale_load_down(tg->shares);
-+
-+	return DIV_ROUND_CLOSEST_ULL(weight * CGROUP_WEIGHT_DFL, 1024);
-+}
-+
-+static int cpu_weight_write_u64(struct cgroup_subsys_state *css,
-+				struct cftype *cftype, u64 weight)
-+{
-+	/*
-+	 * cgroup weight knobs should use the common MIN, DFL and MAX
-+	 * values which are 1, 100 and 10000 respectively.  While it loses
-+	 * a bit of range on both ends, it maps pretty well onto the shares
-+	 * value used by scheduler and the round-trip conversions preserve
-+	 * the original value over the entire range.
-+	 */
-+	if (weight < CGROUP_WEIGHT_MIN || weight > CGROUP_WEIGHT_MAX)
-+		return -ERANGE;
-+
-+	weight = DIV_ROUND_CLOSEST_ULL(weight * 1024, CGROUP_WEIGHT_DFL);
-+
-+	return sched_group_set_shares(css_tg(css), scale_load(weight));
-+}
-+#endif
-+
-+static void __maybe_unused cpu_period_quota_print(struct seq_file *sf,
-+						  long period, long quota)
-+{
-+	if (quota < 0)
-+		seq_puts(sf, "max");
-+	else
-+		seq_printf(sf, "%ld", quota);
-+
-+	seq_printf(sf, " %ld\n", period);
-+}
-+
-+/* caller should put the current value in *@periodp before calling */
-+static int __maybe_unused cpu_period_quota_parse(char *buf,
-+						 u64 *periodp, u64 *quotap)
-+{
-+	char tok[21];	/* U64_MAX */
-+
-+	if (!sscanf(buf, "%s %llu", tok, periodp))
-+		return -EINVAL;
-+
-+	*periodp *= NSEC_PER_USEC;
-+
-+	if (sscanf(tok, "%llu", quotap))
-+		*quotap *= NSEC_PER_USEC;
-+	else if (!strcmp(tok, "max"))
-+		*quotap = RUNTIME_INF;
-+	else
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+static int cpu_max_show(struct seq_file *sf, void *v)
-+{
-+	struct task_group *tg = css_tg(seq_css(sf));
-+
-+	cpu_period_quota_print(sf, tg_get_cfs_period(tg), tg_get_cfs_quota(tg));
-+	return 0;
-+}
-+
-+static ssize_t cpu_max_write(struct kernfs_open_file *of,
-+			     char *buf, size_t nbytes, loff_t off)
-+{
-+	struct task_group *tg = css_tg(of_css(of));
-+	u64 period = tg_get_cfs_period(tg);
-+	u64 quota;
-+	int ret;
-+
-+	ret = cpu_period_quota_parse(buf, &period, &quota);
-+	if (!ret)
-+		ret = tg_set_cfs_bandwidth(tg, period, quota);
-+	return ret ?: nbytes;
-+}
-+#endif
-+
-+static struct cftype cpu_files[] = {
-+	{
-+		.name = "stat",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_stats_show,
-+	},
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+	{
-+		.name = "weight",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.read_u64 = cpu_weight_read_u64,
-+		.write_u64 = cpu_weight_write_u64,
-+	},
-+#endif
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		.name = "max",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_max_show,
-+		.write = cpu_max_write,
-+	},
-+#endif
-+	{ }	/* terminate */
-+};
-+
- struct cgroup_subsys cpu_cgrp_subsys = {
- 	.css_alloc	= cpu_cgroup_css_alloc,
- 	.css_online	= cpu_cgroup_css_online,
-@@ -7262,7 +7395,15 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
- 	.legacy_cftypes	= cpu_legacy_files,
-+	.dfl_cftypes	= cpu_files,
- 	.early_init	= true,
-+#ifdef CONFIG_CGROUP_CPUACCT
-+	/*
-+	 * cpuacct is enabled together with cpu on the unified hierarchy
-+	 * and its stats are reported through "cpu.stat".
-+	 */
-+	.depends_on	= 1 << cpuacct_cgrp_id,
-+#endif
- };
- 
- #endif	/* CONFIG_CGROUP_SCHED */
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index 6151c23f722f..fc1cf13c3af1 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -347,6 +347,31 @@ static struct cftype files[] = {
- 	{ }	/* terminate */
- };
- 
-+/* used to print cpuacct stats in cpu.stat on the unified hierarchy */
-+void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+	struct cgroup_subsys_state *css;
-+	u64 usage, val[CPUACCT_STAT_NSTATS];
-+
-+	css = cgroup_get_e_css(seq_css(sf)->cgroup, &cpuacct_cgrp_subsys);
-+
-+	usage = cpuusage_read(css, seq_cft(sf));
-+	cpuacct_stats_read(css_ca(css), &val);
-+
-+	val[CPUACCT_STAT_USER] *= TICK_NSEC;
-+	val[CPUACCT_STAT_SYSTEM] *= TICK_NSEC;
-+	do_div(usage, NSEC_PER_USEC);
-+	do_div(val[CPUACCT_STAT_USER], NSEC_PER_USEC);
-+	do_div(val[CPUACCT_STAT_SYSTEM], NSEC_PER_USEC);
-+
-+	seq_printf(sf, "usage_usec %llu\n"
-+		   "user_usec %llu\n"
-+		   "system_usec %llu\n",
-+		   usage, val[CPUACCT_STAT_USER], val[CPUACCT_STAT_SYSTEM]);
-+
-+	css_put(css);
-+}
-+
- /*
-  * charge this task's execution time to its accounting group.
-  *
-diff --git a/kernel/sched/cpuacct.h b/kernel/sched/cpuacct.h
-index ba72807c73d4..ddf7af466d35 100644
---- a/kernel/sched/cpuacct.h
-+++ b/kernel/sched/cpuacct.h
-@@ -2,6 +2,7 @@
- 
- extern void cpuacct_charge(struct task_struct *tsk, u64 cputime);
- extern void cpuacct_account_field(struct task_struct *tsk, int index, u64 val);
-+extern void cpuacct_cpu_stats_show(struct seq_file *sf);
- 
- #else
- 
-@@ -14,4 +15,8 @@ cpuacct_account_field(struct task_struct *tsk, int index, u64 val)
- {
- }
- 
-+static inline void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+}
-+
- #endif
-
-commit 8dde150866b8c433216105c50b7e889d5242d583
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Aug 5 12:41:01 2016 -0400
-
-    cgroup: add documentation regarding CPU controller cgroup v2 support
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-
-diff --git a/Documentation/cgroup-v2-cpu.txt b/Documentation/cgroup-v2-cpu.txt
-new file mode 100644
-index 000000000000..1ed7032d4472
---- /dev/null
-+++ b/Documentation/cgroup-v2-cpu.txt
-@@ -0,0 +1,368 @@
-+
-+
-+CPU Controller on Control Group v2
-+
-+August, 2016		Tejun Heo <tj@kernel.org>
-+
-+
-+While most controllers have support for cgroup v2 now, the CPU
-+controller support is not upstream yet due to objections from the
-+scheduler maintainers on the basic designs of cgroup v2.  This
-+document explains the current situation as well as an interim
-+solution, and details the disagreements and arguments.  The latest
-+version of this document can be found at the following URL.
-+
-+ https://git.kernel.org/cgit/linux/kernel/git/tj/cgroup.git/tree/Documentation/cgroup-v2-cpu.txt?h=cgroup-v2-cpu
-+
-+This document was posted to the linux-kernel and cgroup mailing lists.
-+Unfortunately, no consensus was reached as of Oct, 2016.  The thread
-+can be found at the following URL.
-+
-+ http://lkml.kernel.org/r/20160805170752.GK2542@mtj.duckdns.org
-+
-+
-+CONTENTS
-+
-+1. Current Situation and Interim Solution
-+2. Disagreements and Arguments
-+  2-1. Contentious Restrictions
-+    2-1-1. Process Granularity
-+    2-1-2. No Internal Process Constraint
-+  2-2. Impact on CPU Controller
-+    2-2-1. Impact of Process Granularity
-+    2-2-2. Impact of No Internal Process Constraint
-+  2-3. Arguments for cgroup v2
-+3. Way Forward
-+4. References
-+
-+
-+1. Current Situation and Interim Solution
-+
-+All objections from the scheduler maintainers apply to cgroup v2 core
-+design, and there are no known objections to the specifics of the CPU
-+controller cgroup v2 interface.  The only blocked part is changes to
-+expose the CPU controller interface on cgroup v2, which comprises the
-+following two patches:
-+
-+ [1] sched: Misc preps for cgroup unified hierarchy interface
-+ [2] sched: Implement interface for cgroup unified hierarchy
-+
-+The necessary changes are superficial and implement the interface
-+files on cgroup v2.  The combined diffstat is as follows.
-+
-+ kernel/sched/core.c    |  149 +++++++++++++++++++++++++++++++++++++++++++++++--
-+ kernel/sched/cpuacct.c |   57 ++++++++++++------
-+ kernel/sched/cpuacct.h |    5 +
-+ 3 files changed, 189 insertions(+), 22 deletions(-)
-+
-+The patches are easy to apply and forward-port.  The following git
-+branch will always carry the two patches on top of the latest release
-+of the upstream kernel.
-+
-+ git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/cgroup-v2-cpu
-+
-+There also are versioned branches going back to v4.4.
-+
-+ git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/cgroup-v2-cpu-$KERNEL_VER
-+
-+While it's difficult to tell whether the CPU controller support will
-+be merged, there are crucial resource control features in cgroup v2
-+that are only possible due to the design choices that are being
-+objected to, and every effort will be made to ease enabling the CPU
-+controller cgroup v2 support out-of-tree for parties which choose to.
-+
-+
-+2. Disagreements and Arguments
-+
-+There have been several lengthy discussion threads [3][4] on LKML
-+around the structural constraints of cgroup v2.  The two that affect
-+the CPU controller are process granularity and no internal process
-+constraint.  Both arise primarily from the need for common resource
-+domain definition across different resources.
-+
-+The common resource domain is a powerful concept in cgroup v2 that
-+allows controllers to make basic assumptions about the structural
-+organization of processes and controllers inside the cgroup hierarchy,
-+and thus solve problems spanning multiple types of resources.  The
-+prime example for this is page cache writeback: dirty page cache is
-+regulated through throttling buffered writers based on memory
-+availability, and initiating batched write outs to the disk based on
-+IO capacity.  Tracking and controlling writeback inside a cgroup thus
-+requires the direct cooperation of the memory and the IO controller.
-+
-+This easily extends to other areas, such as CPU cycles consumed while
-+performing memory reclaim or IO encryption.
-+
-+
-+2-1. Contentious Restrictions
-+
-+For controllers of different resources to work together, they must
-+agree on a common organization.  This uniform model across controllers
-+imposes two contentious restrictions on the CPU controller: process
-+granularity and the no-internal-process constraint.
-+
-+
-+  2-1-1. Process Granularity
-+
-+  For memory, because an address space is shared between all threads
-+  of a process, the terminal consumer is a process, not a thread.
-+  Separating the threads of a single process into different memory
-+  control domains doesn't make semantical sense.  cgroup v2 ensures
-+  that all controller can agree on the same organization by requiring
-+  that threads of the same process belong to the same cgroup.
-+
-+  There are other reasons to enforce process granularity.  One
-+  important one is isolating system-level management operations from
-+  in-process application operations.  The cgroup interface, being a
-+  virtual filesystem, is very unfit for multiple independent
-+  operations taking place at the same time as most operations have to
-+  be multi-step and there is no way to synchronize multiple accessors.
-+  See also [5] Documentation/cgroup-v2.txt, "R-2. Thread Granularity"
-+
-+
-+  2-1-2. No Internal Process Constraint
-+
-+  cgroup v2 does not allow processes to belong to any cgroup which has
-+  child cgroups when resource controllers are enabled on it (the
-+  notable exception being the root cgroup itself).  This is because,
-+  for some resources, a resource domain (cgroup) is not directly
-+  comparable to the terminal consumer (process/task) of said resource,
-+  and so putting the two into a sibling relationship isn't meaningful.
-+
-+  - Differing Control Parameters and Capabilities
-+
-+    A cgroup controller has different resource control parameters and
-+    capabilities from a terminal consumer, be that a task or process.
-+    There are a couple cases where a cgroup control knob can be mapped
-+    to a per-task or per-process API but they are exceptions and the
-+    mappings aren't obvious even in those cases.
-+
-+    For example, task priorities (also known as nice values) set
-+    through setpriority(2) are mapped to the CPU controller
-+    "cpu.shares" values.  However, how exactly the two ranges map and
-+    even the fact that they map to each other at all are not obvious.
-+
-+    The situation gets further muddled when considering other resource
-+    types and control knobs.  IO priorities set through ioprio_set(2)
-+    cannot be mapped to IO controller weights and most cgroup resource
-+    control knobs including the bandwidth control knobs of the CPU
-+    controller don't have counterparts in the terminal consumers.
-+
-+  - Anonymous Resource Consumption
-+
-+    For CPU, every time slice consumed from inside a cgroup, which
-+    comprises most but not all of consumed CPU time for the cgroup,
-+    can be clearly attributed to a specific task or process.  Because
-+    these two types of entities are directly comparable as consumers
-+    of CPU time, it's theoretically possible to mix tasks and cgroups
-+    on the same tree levels and let them directly compete for the time
-+    quota available to their common ancestor.
-+
-+    However, the same can't be said for resource types like memory or
-+    IO: the memory consumed by the page cache, for example, can be
-+    tracked on a per-cgroup level, but due to mismatches in lifetimes
-+    of involved objects (page cache can persist long after processes
-+    are gone), shared usages and the implementation overhead of
-+    tracking persistent state, it can no longer be attributed to
-+    individual processes after instantiation.  Consequently, any IO
-+    incurred by page cache writeback can be attributed to a cgroup,
-+    but not to the individual consumers inside the cgroup.
-+
-+  For memory and IO, this makes a resource domain (cgroup) an object
-+  of a fundamentally different type than a terminal consumer
-+  (process).  A process can't be a first class object in the resource
-+  distribution graph as its total resource consumption can't be
-+  described without the containing resource domain.
-+
-+  Disallowing processes in internal cgroups avoids competition between
-+  cgroups and processes which cannot be meaningfully defined for these
-+  resources.  All resource control takes place among cgroups and a
-+  terminal consumer interacts with the containing cgroup the same way
-+  it would with the system without cgroup.
-+
-+  Root cgroup is exempt from this constraint, which is in line with
-+  how root cgroup is handled in general - it's excluded from cgroup
-+  resource accounting and control.
-+
-+
-+Enforcing process granularity and no internal process constraint
-+allows all controllers to be on the same footing in terms of resource
-+distribution hierarchy.
-+
-+
-+2-2. Impact on CPU Controller
-+
-+As indicated earlier, the CPU controller's resource distribution graph
-+is the simplest.  Every schedulable resource consumption can be
-+attributed to a specific task.  In addition, for weight based control,
-+the per-task priority set through setpriority(2) can be translated to
-+and from a per-cgroup weight.  As such, the CPU controller can treat a
-+task and a cgroup symmetrically, allowing support for any tree layout
-+of cgroups and tasks.  Both process granularity and the no internal
-+process constraint restrict how the CPU controller can be used.
-+
-+
-+  2-2-1. Impact of Process Granularity
-+
-+  Process granularity prevents tasks belonging to the same process to
-+  be assigned to different cgroups.  It was pointed out [6] that this
-+  excludes the valid use case of hierarchical CPU distribution within
-+  processes.
-+
-+  To address this issue, the rgroup (resource group) [7][8][9]
-+  interface, an extension of the existing setpriority(2) API, was
-+  proposed, which is in line with other programmable priority
-+  mechanisms and eliminates the risk of in-application configuration
-+  and system configuration stepping on each other's toes.
-+  Unfortunately, the proposal quickly turned into discussions around
-+  cgroup v2 design decisions [4] and no consensus could be reached.
-+
-+
-+  2-2-2. Impact of No Internal Process Constraint
-+
-+  The no internal process constraint disallows tasks from competing
-+  directly against cgroups.  Here is an excerpt from Peter Zijlstra
-+  pointing out the issue [10] - R, L and A are cgroups; t1, t2, t3 and
-+  t4 are tasks:
-+
-+
-+          R
-+        / | \
-+       t1 t2 A
-+           /   \
-+          t3   t4
-+
-+
-+    Is fundamentally different from:
-+
-+
-+               R
-+             /   \
-+           L       A
-+         /   \   /   \
-+        t1  t2  t3   t4
-+
-+
-+    Because if in the first hierarchy you add a task (t5) to R, all of
-+    its A will run at 1/4th of total bandwidth where before it had
-+    1/3rd, whereas with the second example, if you add our t5 to L, A
-+    doesn't get any less bandwidth.
-+
-+
-+  It is true that the trees are semantically different from each other
-+  and the symmetric handling of tasks and cgroups is aesthetically
-+  pleasing.  However, it isn't clear what the practical usefulness of
-+  a layout with direct competition between tasks and cgroups would be,
-+  considering that number and behavior of tasks are controlled by each
-+  application, and cgroups primarily deal with system level resource
-+  distribution; changes in the number of active threads would directly
-+  impact resource distribution.  Real world use cases of such layouts
-+  could not be established during the discussions.
-+
-+
-+2-3. Arguments for cgroup v2
-+
-+There are strong demands for comprehensive hierarchical resource
-+control across all major resources, and establishing a common resource
-+hierarchy is an essential step.  As with most engineering decisions,
-+common resource hierarchy definition comes with its trade-offs.  With
-+cgroup v2, the trade-offs are in the form of structural constraints
-+which, among others, restrict the CPU controller's space of possible
-+configurations.
-+
-+However, even with the restrictions, cgroup v2, in combination with
-+rgroup, covers most of identified real world use cases while enabling
-+new important use cases of resource control across multiple resource
-+types that were fundamentally broken previously.
-+
-+Furthermore, for resource control, treating resource domains as
-+objects of a different type from terminal consumers has important
-+advantages - it can account for resource consumptions which are not
-+tied to any specific terminal consumer, be that a task or process, and
-+allows decoupling resource distribution controls from in-application
-+APIs.  Even the CPU controller may benefit from it as the kernel can
-+consume significant amount of CPU cycles in interrupt context or tasks
-+shared across multiple resource domains (e.g. softirq).
-+
-+Finally, it's important to note that enabling cgroup v2 support for
-+the CPU controller doesn't block use cases which require the features
-+which are not available on cgroup v2.  Unlikely, but should anybody
-+actually rely on the CPU controller's symmetric handling of tasks and
-+cgroups, backward compatibility is and will be maintained by being
-+able to disconnect the controller from the cgroup v2 hierarchy and use
-+it standalone.  This also holds for cpuset which is often used in
-+highly customized configurations which might be a poor fit for common
-+resource domains.
-+
-+The required changes are minimal, the benefits for the target use
-+cases are critical and obvious, and use cases which have to use v1 can
-+continue to do so.
-+
-+
-+3. Way Forward
-+
-+cgroup v2 primarily aims to solve the problem of comprehensive
-+hierarchical resource control across all major computing resources,
-+which is one of the core problems of modern server infrastructure
-+engineering.  The trade-offs that cgroup v2 took are results of
-+pursuing that goal and gaining a better understanding of the nature of
-+resource control in the process.
-+
-+I believe that real world usages will prove cgroup v2's model right,
-+considering the crucial pieces of comprehensive resource control that
-+cannot be implemented without common resource domains.  This is not to
-+say that cgroup v2 is fixed in stone and can't be updated; if there is
-+an approach which better serves both comprehensive resource control
-+and the CPU controller's flexibility, we will surely move towards
-+that.  It goes without saying that discussions around such approach
-+should consider practical aspects of resource control as a whole
-+rather than absolutely focusing on a particular controller.
-+
-+Until such consensus can be reached, the CPU controller cgroup v2
-+support will be maintained out of the mainline kernel in an easily
-+accessible form.  If there is anything cgroup developers can do to
-+ease the pain, please feel free to contact us on the cgroup mailing
-+list at cgroups@vger.kernel.org.
-+
-+
-+4. References
-+
-+[1]  http://lkml.kernel.org/r/20160105164834.GE5995@mtj.duckdns.org
-+     [PATCH 1/2] sched: Misc preps for cgroup unified hierarchy interface
-+     Tejun Heo <tj@kernel.org>
-+
-+[2]  http://lkml.kernel.org/r/20160105164852.GF5995@mtj.duckdns.org
-+     [PATCH 2/2] sched: Implement interface for cgroup unified hierarchy
-+     Tejun Heo <tj@kernel.org>
-+
-+[3]  http://lkml.kernel.org/r/1438641689-14655-4-git-send-email-tj@kernel.org
-+     [PATCH 3/3] sched: Implement interface for cgroup unified hierarchy
-+     Tejun Heo <tj@kernel.org>
-+
-+[4]  http://lkml.kernel.org/r/20160407064549.GH3430@twins.programming.kicks-ass.net
-+     Re: [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource group and PRIO_RGRP
-+     Peter Zijlstra <peterz@infradead.org>
-+
-+[5]  https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/cgroup-v2.txt
-+     Control Group v2
-+     Tejun Heo <tj@kernel.org>
-+
-+[6]  http://lkml.kernel.org/r/CAPM31RJNy3jgG=DYe6GO=wyL4BPPxwUm1f2S6YXacQmo7viFZA@mail.gmail.com
-+     Re: [PATCH 3/3] sched: Implement interface for cgroup unified hierarchy
-+     Paul Turner <pjt@google.com>
-+
-+[7]  http://lkml.kernel.org/r/20160105154503.GC5995@mtj.duckdns.org
-+     [RFD] cgroup: thread granularity support for cpu controller
-+     Tejun Heo <tj@kernel.org>
-+
-+[8]  http://lkml.kernel.org/r/1457710888-31182-1-git-send-email-tj@kernel.org
-+     [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource group and PRIO_RGRP
-+     Tejun Heo <tj@kernel.org>
-+
-+[9]  http://lkml.kernel.org/r/20160311160522.GA24046@htj.duckdns.org
-+     Example program for PRIO_RGRP
-+     Tejun Heo <tj@kernel.org>
-+
-+[10] http://lkml.kernel.org/r/20160407082810.GN3430@twins.programming.kicks-ass.net
-+     Re: [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource
-+     Peter Zijlstra <peterz@infradead.org>
diff --git a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.4.patch b/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.4.patch
deleted file mode 100644
index 8f2418c9efc..00000000000
--- a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.4.patch
+++ /dev/null
@@ -1,407 +0,0 @@
-commit e7cae741f6d645ac68fe8823ca6ef45dbbf6891b
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Misc preps for cgroup unified hierarchy interface
-    
-    Make the following changes in preparation for the cpu controller
-    interface implementation for the unified hierarchy.  This patch
-    doesn't cause any functional differences.
-    
-    * s/cpu_stats_show()/cpu_cfs_stats_show()/
-    
-    * s/cpu_files/cpu_legacy_files/
-    
-    * Separate out cpuacct_stats_read() from cpuacct_stats_show().  While
-      at it, remove pointless cpuacct_stat_desc[] array.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 732e993..77f3ddd 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -8512,7 +8512,7 @@ static int __cfs_schedulable(struct task_group *tg, u64 period, u64 quota)
- 	return ret;
- }
- 
--static int cpu_stats_show(struct seq_file *sf, void *v)
-+static int cpu_cfs_stats_show(struct seq_file *sf, void *v)
- {
- 	struct task_group *tg = css_tg(seq_css(sf));
- 	struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-@@ -8552,7 +8552,7 @@ static u64 cpu_rt_period_read_uint(struct cgroup_subsys_state *css,
- }
- #endif /* CONFIG_RT_GROUP_SCHED */
- 
--static struct cftype cpu_files[] = {
-+static struct cftype cpu_legacy_files[] = {
- #ifdef CONFIG_FAIR_GROUP_SCHED
- 	{
- 		.name = "shares",
-@@ -8573,7 +8573,7 @@ static struct cftype cpu_files[] = {
- 	},
- 	{
- 		.name = "stat",
--		.seq_show = cpu_stats_show,
-+		.seq_show = cpu_cfs_stats_show,
- 	},
- #endif
- #ifdef CONFIG_RT_GROUP_SCHED
-@@ -8599,7 +8599,7 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.fork		= cpu_cgroup_fork,
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
--	.legacy_cftypes	= cpu_files,
-+	.legacy_cftypes	= cpu_legacy_files,
- 	.early_init	= 1,
- };
- 
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index dd7cbb5..42b2dd5 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -177,36 +177,33 @@ static int cpuacct_percpu_seq_show(struct seq_file *m, void *V)
- 	return 0;
- }
- 
--static const char * const cpuacct_stat_desc[] = {
--	[CPUACCT_STAT_USER] = "user",
--	[CPUACCT_STAT_SYSTEM] = "system",
--};
--
--static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+static void cpuacct_stats_read(struct cpuacct *ca, u64 *userp, u64 *sysp)
- {
--	struct cpuacct *ca = css_ca(seq_css(sf));
- 	int cpu;
--	s64 val = 0;
- 
-+	*userp = 0;
- 	for_each_online_cpu(cpu) {
- 		struct kernel_cpustat *kcpustat = per_cpu_ptr(ca->cpustat, cpu);
--		val += kcpustat->cpustat[CPUTIME_USER];
--		val += kcpustat->cpustat[CPUTIME_NICE];
-+		*userp += kcpustat->cpustat[CPUTIME_USER];
-+		*userp += kcpustat->cpustat[CPUTIME_NICE];
- 	}
--	val = cputime64_to_clock_t(val);
--	seq_printf(sf, "%s %lld\n", cpuacct_stat_desc[CPUACCT_STAT_USER], val);
- 
--	val = 0;
-+	*sysp = 0;
- 	for_each_online_cpu(cpu) {
- 		struct kernel_cpustat *kcpustat = per_cpu_ptr(ca->cpustat, cpu);
--		val += kcpustat->cpustat[CPUTIME_SYSTEM];
--		val += kcpustat->cpustat[CPUTIME_IRQ];
--		val += kcpustat->cpustat[CPUTIME_SOFTIRQ];
-+		*sysp += kcpustat->cpustat[CPUTIME_SYSTEM];
-+		*sysp += kcpustat->cpustat[CPUTIME_IRQ];
-+		*sysp += kcpustat->cpustat[CPUTIME_SOFTIRQ];
- 	}
-+}
- 
--	val = cputime64_to_clock_t(val);
--	seq_printf(sf, "%s %lld\n", cpuacct_stat_desc[CPUACCT_STAT_SYSTEM], val);
-+static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+{
-+	cputime64_t user, sys;
- 
-+	cpuacct_stats_read(css_ca(seq_css(sf)), &user, &sys);
-+	seq_printf(sf, "user %lld\n", cputime64_to_clock_t(user));
-+	seq_printf(sf, "system %lld\n", cputime64_to_clock_t(sys));
- 	return 0;
- }
- 
-
-commit 1bb33e8a69f089f2d3f58a0e681d4ff352e11c97
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Implement interface for cgroup unified hierarchy
-    
-    While the cpu controller doesn't have any functional problems, there
-    are a couple interface issues which can be addressed in the v2
-    interface.
-    
-    * cpuacct being a separate controller.  This separation is artificial
-      and rather pointless as demonstrated by most use cases co-mounting
-      the two controllers.  It also forces certain information to be
-      accounted twice.
-    
-    * Use of different time units.  Writable control knobs use
-      microseconds, some stat fields use nanoseconds while other cpuacct
-      stat fields use centiseconds.
-    
-    * Control knobs which can't be used in the root cgroup still show up
-      in the root.
-    
-    * Control knob names and semantics aren't consistent with other
-      controllers.
-    
-    This patchset implements cpu controller's interface on the unified
-    hierarchy which adheres to the controller file conventions described
-    in Documentation/cgroups/unified-hierarchy.txt.  Overall, the
-    following changes are made.
-    
-    * cpuacct is implictly enabled and disabled by cpu and its information
-      is reported through "cpu.stat" which now uses microseconds for all
-      time durations.  All time duration fields now have "_usec" appended
-      to them for clarity.  While this doesn't solve the double accounting
-      immediately, once majority of users switch to v2, cpu can directly
-      account and report the relevant stats and cpuacct can be disabled on
-      the unified hierarchy.
-    
-      Note that cpuacct.usage_percpu is currently not included in
-      "cpu.stat".  If this information is actually called for, it can be
-      added later.
-    
-    * "cpu.shares" is replaced with "cpu.weight" and operates on the
-      standard scale defined by CGROUP_WEIGHT_MIN/DFL/MAX (1, 100, 10000).
-      The weight is scaled to scheduler weight so that 100 maps to 1024
-      and the ratio relationship is preserved - if weight is W and its
-      scaled value is S, W / 100 == S / 1024.  While the mapped range is a
-      bit smaller than the orignal scheduler weight range, the dead zones
-      on both sides are relatively small and covers wider range than the
-      nice value mappings.  This file doesn't make sense in the root
-      cgroup and isn't create on root.
-    
-    * "cpu.cfs_quota_us" and "cpu.cfs_period_us" are replaced by "cpu.max"
-      which contains both quota and period.
-    
-    * "cpu.rt_runtime_us" and "cpu.rt_period_us" are replaced by
-      "cpu.rt.max" which contains both runtime and period.
-    
-    v2: cpu_stats_show() was incorrectly using CONFIG_FAIR_GROUP_SCHED for
-        CFS bandwidth stats and also using raw division for u64.  Use
-        CONFIG_CFS_BANDWITH and do_div() instead.
-    
-        The semantics of "cpu.rt.max" is not fully decided yet.  Dropped
-        for now.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 77f3ddd..7aafe63 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -8591,6 +8591,139 @@ static struct cftype cpu_legacy_files[] = {
- 	{ }	/* terminate */
- };
- 
-+static int cpu_stats_show(struct seq_file *sf, void *v)
-+{
-+	cpuacct_cpu_stats_show(sf);
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		struct task_group *tg = css_tg(seq_css(sf));
-+		struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-+		u64 throttled_usec;
-+
-+		throttled_usec = cfs_b->throttled_time;
-+		do_div(throttled_usec, NSEC_PER_USEC);
-+
-+		seq_printf(sf, "nr_periods %d\n"
-+			   "nr_throttled %d\n"
-+			   "throttled_usec %llu\n",
-+			   cfs_b->nr_periods, cfs_b->nr_throttled,
-+			   throttled_usec);
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+static u64 cpu_weight_read_u64(struct cgroup_subsys_state *css,
-+			       struct cftype *cft)
-+{
-+	struct task_group *tg = css_tg(css);
-+	u64 weight = scale_load_down(tg->shares);
-+
-+	return DIV_ROUND_CLOSEST_ULL(weight * CGROUP_WEIGHT_DFL, 1024);
-+}
-+
-+static int cpu_weight_write_u64(struct cgroup_subsys_state *css,
-+				struct cftype *cftype, u64 weight)
-+{
-+	/*
-+	 * cgroup weight knobs should use the common MIN, DFL and MAX
-+	 * values which are 1, 100 and 10000 respectively.  While it loses
-+	 * a bit of range on both ends, it maps pretty well onto the shares
-+	 * value used by scheduler and the round-trip conversions preserve
-+	 * the original value over the entire range.
-+	 */
-+	if (weight < CGROUP_WEIGHT_MIN || weight > CGROUP_WEIGHT_MAX)
-+		return -ERANGE;
-+
-+	weight = DIV_ROUND_CLOSEST_ULL(weight * 1024, CGROUP_WEIGHT_DFL);
-+
-+	return sched_group_set_shares(css_tg(css), scale_load(weight));
-+}
-+#endif
-+
-+static void __maybe_unused cpu_period_quota_print(struct seq_file *sf,
-+						  long period, long quota)
-+{
-+	if (quota < 0)
-+		seq_puts(sf, "max");
-+	else
-+		seq_printf(sf, "%ld", quota);
-+
-+	seq_printf(sf, " %ld\n", period);
-+}
-+
-+/* caller should put the current value in *@periodp before calling */
-+static int __maybe_unused cpu_period_quota_parse(char *buf,
-+						 u64 *periodp, u64 *quotap)
-+{
-+	char tok[21];	/* U64_MAX */
-+
-+	if (!sscanf(buf, "%s %llu", tok, periodp))
-+		return -EINVAL;
-+
-+	*periodp *= NSEC_PER_USEC;
-+
-+	if (sscanf(tok, "%llu", quotap))
-+		*quotap *= NSEC_PER_USEC;
-+	else if (!strcmp(tok, "max"))
-+		*quotap = RUNTIME_INF;
-+	else
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+static int cpu_max_show(struct seq_file *sf, void *v)
-+{
-+	struct task_group *tg = css_tg(seq_css(sf));
-+
-+	cpu_period_quota_print(sf, tg_get_cfs_period(tg), tg_get_cfs_quota(tg));
-+	return 0;
-+}
-+
-+static ssize_t cpu_max_write(struct kernfs_open_file *of,
-+			     char *buf, size_t nbytes, loff_t off)
-+{
-+	struct task_group *tg = css_tg(of_css(of));
-+	u64 period = tg_get_cfs_period(tg);
-+	u64 quota;
-+	int ret;
-+
-+	ret = cpu_period_quota_parse(buf, &period, &quota);
-+	if (!ret)
-+		ret = tg_set_cfs_bandwidth(tg, period, quota);
-+	return ret ?: nbytes;
-+}
-+#endif
-+
-+static struct cftype cpu_files[] = {
-+	{
-+		.name = "stat",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_stats_show,
-+	},
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+	{
-+		.name = "weight",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.read_u64 = cpu_weight_read_u64,
-+		.write_u64 = cpu_weight_write_u64,
-+	},
-+#endif
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		.name = "max",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_max_show,
-+		.write = cpu_max_write,
-+	},
-+#endif
-+	{ }	/* terminate */
-+};
-+
- struct cgroup_subsys cpu_cgrp_subsys = {
- 	.css_alloc	= cpu_cgroup_css_alloc,
- 	.css_free	= cpu_cgroup_css_free,
-@@ -8600,7 +8733,15 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
- 	.legacy_cftypes	= cpu_legacy_files,
-+	.dfl_cftypes	= cpu_files,
- 	.early_init	= 1,
-+#ifdef CONFIG_CGROUP_CPUACCT
-+	/*
-+	 * cpuacct is enabled together with cpu on the unified hierarchy
-+	 * and its stats are reported through "cpu.stat".
-+	 */
-+	.depends_on	= 1 << cpuacct_cgrp_id,
-+#endif
- };
- 
- #endif	/* CONFIG_CGROUP_SCHED */
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index 42b2dd5..b4d32a6 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -224,6 +224,30 @@ static struct cftype files[] = {
- 	{ }	/* terminate */
- };
- 
-+/* used to print cpuacct stats in cpu.stat on the unified hierarchy */
-+void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+	struct cgroup_subsys_state *css;
-+	u64 usage, user, sys;
-+
-+	css = cgroup_get_e_css(seq_css(sf)->cgroup, &cpuacct_cgrp_subsys);
-+
-+	usage = cpuusage_read(css, seq_cft(sf));
-+	cpuacct_stats_read(css_ca(css), &user, &sys);
-+
-+	user *= TICK_NSEC;
-+	sys *= TICK_NSEC;
-+	do_div(usage, NSEC_PER_USEC);
-+	do_div(user, NSEC_PER_USEC);
-+	do_div(sys, NSEC_PER_USEC);
-+
-+	seq_printf(sf, "usage_usec %llu\n"
-+		   "user_usec %llu\n"
-+		   "system_usec %llu\n", usage, user, sys);
-+
-+	css_put(css);
-+}
-+
- /*
-  * charge this task's execution time to its accounting group.
-  *
-diff --git a/kernel/sched/cpuacct.h b/kernel/sched/cpuacct.h
-index ed60562..44eace9 100644
---- a/kernel/sched/cpuacct.h
-+++ b/kernel/sched/cpuacct.h
-@@ -2,6 +2,7 @@
- 
- extern void cpuacct_charge(struct task_struct *tsk, u64 cputime);
- extern void cpuacct_account_field(struct task_struct *p, int index, u64 val);
-+extern void cpuacct_cpu_stats_show(struct seq_file *sf);
- 
- #else
- 
-@@ -14,4 +15,8 @@ cpuacct_account_field(struct task_struct *p, int index, u64 val)
- {
- }
- 
-+static inline void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+}
-+
- #endif
diff --git a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.9.patch b/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.9.patch
deleted file mode 100644
index 6f0904cbce9..00000000000
--- a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.9.patch
+++ /dev/null
@@ -1,784 +0,0 @@
-commit 280858b0bb3384b9ec06b455e196b453888bd6b8
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Misc preps for cgroup unified hierarchy interface
-    
-    Make the following changes in preparation for the cpu controller
-    interface implementation for the unified hierarchy.  This patch
-    doesn't cause any functional differences.
-    
-    * s/cpu_stats_show()/cpu_cfs_stats_show()/
-    
-    * s/cpu_files/cpu_legacy_files/
-    
-    * Separate out cpuacct_stats_read() from cpuacct_stats_show().  While
-      at it, make the @val array u64 for consistency.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 154fd689fe02..57472485b79c 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -8705,7 +8705,7 @@ static int __cfs_schedulable(struct task_group *tg, u64 period, u64 quota)
- 	return ret;
- }
- 
--static int cpu_stats_show(struct seq_file *sf, void *v)
-+static int cpu_cfs_stats_show(struct seq_file *sf, void *v)
- {
- 	struct task_group *tg = css_tg(seq_css(sf));
- 	struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-@@ -8745,7 +8745,7 @@ static u64 cpu_rt_period_read_uint(struct cgroup_subsys_state *css,
- }
- #endif /* CONFIG_RT_GROUP_SCHED */
- 
--static struct cftype cpu_files[] = {
-+static struct cftype cpu_legacy_files[] = {
- #ifdef CONFIG_FAIR_GROUP_SCHED
- 	{
- 		.name = "shares",
-@@ -8766,7 +8766,7 @@ static struct cftype cpu_files[] = {
- 	},
- 	{
- 		.name = "stat",
--		.seq_show = cpu_stats_show,
-+		.seq_show = cpu_cfs_stats_show,
- 	},
- #endif
- #ifdef CONFIG_RT_GROUP_SCHED
-@@ -8791,7 +8791,7 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.fork		= cpu_cgroup_fork,
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
--	.legacy_cftypes	= cpu_files,
-+	.legacy_cftypes	= cpu_legacy_files,
- 	.early_init	= true,
- };
- 
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index bc0b309c3f19..d1e5dd0b3a64 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -276,26 +276,33 @@ static int cpuacct_all_seq_show(struct seq_file *m, void *V)
- 	return 0;
- }
- 
--static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+static void cpuacct_stats_read(struct cpuacct *ca,
-+			       u64 (*val)[CPUACCT_STAT_NSTATS])
- {
--	struct cpuacct *ca = css_ca(seq_css(sf));
--	s64 val[CPUACCT_STAT_NSTATS];
- 	int cpu;
--	int stat;
- 
--	memset(val, 0, sizeof(val));
-+	memset(val, 0, sizeof(*val));
-+
- 	for_each_possible_cpu(cpu) {
- 		u64 *cpustat = per_cpu_ptr(ca->cpustat, cpu)->cpustat;
- 
--		val[CPUACCT_STAT_USER]   += cpustat[CPUTIME_USER];
--		val[CPUACCT_STAT_USER]   += cpustat[CPUTIME_NICE];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SYSTEM];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_IRQ];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SOFTIRQ];
-+		(*val)[CPUACCT_STAT_USER]   += cpustat[CPUTIME_USER];
-+		(*val)[CPUACCT_STAT_USER]   += cpustat[CPUTIME_NICE];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SYSTEM];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_IRQ];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SOFTIRQ];
- 	}
-+}
-+
-+static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+{
-+	u64 val[CPUACCT_STAT_NSTATS];
-+	int stat;
-+
-+	cpuacct_stats_read(css_ca(seq_css(sf)), &val);
- 
- 	for (stat = 0; stat < CPUACCT_STAT_NSTATS; stat++) {
--		seq_printf(sf, "%s %lld\n",
-+		seq_printf(sf, "%s %llu\n",
- 			   cpuacct_stat_desc[stat],
- 			   cputime64_to_clock_t(val[stat]));
- 	}
-
-commit 015cbdcb90034fd566d00de9d3d405613da3cd26
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Implement interface for cgroup unified hierarchy
-    
-    While the cpu controller doesn't have any functional problems, there
-    are a couple interface issues which can be addressed in the v2
-    interface.
-    
-    * cpuacct being a separate controller.  This separation is artificial
-      and rather pointless as demonstrated by most use cases co-mounting
-      the two controllers.  It also forces certain information to be
-      accounted twice.
-    
-    * Use of different time units.  Writable control knobs use
-      microseconds, some stat fields use nanoseconds while other cpuacct
-      stat fields use centiseconds.
-    
-    * Control knobs which can't be used in the root cgroup still show up
-      in the root.
-    
-    * Control knob names and semantics aren't consistent with other
-      controllers.
-    
-    This patchset implements cpu controller's interface on the unified
-    hierarchy which adheres to the controller file conventions described
-    in Documentation/cgroups/unified-hierarchy.txt.  Overall, the
-    following changes are made.
-    
-    * cpuacct is implictly enabled and disabled by cpu and its information
-      is reported through "cpu.stat" which now uses microseconds for all
-      time durations.  All time duration fields now have "_usec" appended
-      to them for clarity.  While this doesn't solve the double accounting
-      immediately, once majority of users switch to v2, cpu can directly
-      account and report the relevant stats and cpuacct can be disabled on
-      the unified hierarchy.
-    
-      Note that cpuacct.usage_percpu is currently not included in
-      "cpu.stat".  If this information is actually called for, it can be
-      added later.
-    
-    * "cpu.shares" is replaced with "cpu.weight" and operates on the
-      standard scale defined by CGROUP_WEIGHT_MIN/DFL/MAX (1, 100, 10000).
-      The weight is scaled to scheduler weight so that 100 maps to 1024
-      and the ratio relationship is preserved - if weight is W and its
-      scaled value is S, W / 100 == S / 1024.  While the mapped range is a
-      bit smaller than the orignal scheduler weight range, the dead zones
-      on both sides are relatively small and covers wider range than the
-      nice value mappings.  This file doesn't make sense in the root
-      cgroup and isn't create on root.
-    
-    * "cpu.cfs_quota_us" and "cpu.cfs_period_us" are replaced by "cpu.max"
-      which contains both quota and period.
-    
-    * "cpu.rt_runtime_us" and "cpu.rt_period_us" are replaced by
-      "cpu.rt.max" which contains both runtime and period.
-    
-    v2: cpu_stats_show() was incorrectly using CONFIG_FAIR_GROUP_SCHED for
-        CFS bandwidth stats and also using raw division for u64.  Use
-        CONFIG_CFS_BANDWITH and do_div() instead.
-    
-        The semantics of "cpu.rt.max" is not fully decided yet.  Dropped
-        for now.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 57472485b79c..c0ae869f51c4 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -8784,6 +8784,139 @@ static struct cftype cpu_legacy_files[] = {
- 	{ }	/* terminate */
- };
- 
-+static int cpu_stats_show(struct seq_file *sf, void *v)
-+{
-+	cpuacct_cpu_stats_show(sf);
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		struct task_group *tg = css_tg(seq_css(sf));
-+		struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-+		u64 throttled_usec;
-+
-+		throttled_usec = cfs_b->throttled_time;
-+		do_div(throttled_usec, NSEC_PER_USEC);
-+
-+		seq_printf(sf, "nr_periods %d\n"
-+			   "nr_throttled %d\n"
-+			   "throttled_usec %llu\n",
-+			   cfs_b->nr_periods, cfs_b->nr_throttled,
-+			   throttled_usec);
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+static u64 cpu_weight_read_u64(struct cgroup_subsys_state *css,
-+			       struct cftype *cft)
-+{
-+	struct task_group *tg = css_tg(css);
-+	u64 weight = scale_load_down(tg->shares);
-+
-+	return DIV_ROUND_CLOSEST_ULL(weight * CGROUP_WEIGHT_DFL, 1024);
-+}
-+
-+static int cpu_weight_write_u64(struct cgroup_subsys_state *css,
-+				struct cftype *cftype, u64 weight)
-+{
-+	/*
-+	 * cgroup weight knobs should use the common MIN, DFL and MAX
-+	 * values which are 1, 100 and 10000 respectively.  While it loses
-+	 * a bit of range on both ends, it maps pretty well onto the shares
-+	 * value used by scheduler and the round-trip conversions preserve
-+	 * the original value over the entire range.
-+	 */
-+	if (weight < CGROUP_WEIGHT_MIN || weight > CGROUP_WEIGHT_MAX)
-+		return -ERANGE;
-+
-+	weight = DIV_ROUND_CLOSEST_ULL(weight * 1024, CGROUP_WEIGHT_DFL);
-+
-+	return sched_group_set_shares(css_tg(css), scale_load(weight));
-+}
-+#endif
-+
-+static void __maybe_unused cpu_period_quota_print(struct seq_file *sf,
-+						  long period, long quota)
-+{
-+	if (quota < 0)
-+		seq_puts(sf, "max");
-+	else
-+		seq_printf(sf, "%ld", quota);
-+
-+	seq_printf(sf, " %ld\n", period);
-+}
-+
-+/* caller should put the current value in *@periodp before calling */
-+static int __maybe_unused cpu_period_quota_parse(char *buf,
-+						 u64 *periodp, u64 *quotap)
-+{
-+	char tok[21];	/* U64_MAX */
-+
-+	if (!sscanf(buf, "%s %llu", tok, periodp))
-+		return -EINVAL;
-+
-+	*periodp *= NSEC_PER_USEC;
-+
-+	if (sscanf(tok, "%llu", quotap))
-+		*quotap *= NSEC_PER_USEC;
-+	else if (!strcmp(tok, "max"))
-+		*quotap = RUNTIME_INF;
-+	else
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+static int cpu_max_show(struct seq_file *sf, void *v)
-+{
-+	struct task_group *tg = css_tg(seq_css(sf));
-+
-+	cpu_period_quota_print(sf, tg_get_cfs_period(tg), tg_get_cfs_quota(tg));
-+	return 0;
-+}
-+
-+static ssize_t cpu_max_write(struct kernfs_open_file *of,
-+			     char *buf, size_t nbytes, loff_t off)
-+{
-+	struct task_group *tg = css_tg(of_css(of));
-+	u64 period = tg_get_cfs_period(tg);
-+	u64 quota;
-+	int ret;
-+
-+	ret = cpu_period_quota_parse(buf, &period, &quota);
-+	if (!ret)
-+		ret = tg_set_cfs_bandwidth(tg, period, quota);
-+	return ret ?: nbytes;
-+}
-+#endif
-+
-+static struct cftype cpu_files[] = {
-+	{
-+		.name = "stat",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_stats_show,
-+	},
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+	{
-+		.name = "weight",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.read_u64 = cpu_weight_read_u64,
-+		.write_u64 = cpu_weight_write_u64,
-+	},
-+#endif
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		.name = "max",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_max_show,
-+		.write = cpu_max_write,
-+	},
-+#endif
-+	{ }	/* terminate */
-+};
-+
- struct cgroup_subsys cpu_cgrp_subsys = {
- 	.css_alloc	= cpu_cgroup_css_alloc,
- 	.css_released	= cpu_cgroup_css_released,
-@@ -8792,7 +8925,15 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
- 	.legacy_cftypes	= cpu_legacy_files,
-+	.dfl_cftypes	= cpu_files,
- 	.early_init	= true,
-+#ifdef CONFIG_CGROUP_CPUACCT
-+	/*
-+	 * cpuacct is enabled together with cpu on the unified hierarchy
-+	 * and its stats are reported through "cpu.stat".
-+	 */
-+	.depends_on	= 1 << cpuacct_cgrp_id,
-+#endif
- };
- 
- #endif	/* CONFIG_CGROUP_SCHED */
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index d1e5dd0b3a64..57f390514c39 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -347,6 +347,31 @@ static struct cftype files[] = {
- 	{ }	/* terminate */
- };
- 
-+/* used to print cpuacct stats in cpu.stat on the unified hierarchy */
-+void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+	struct cgroup_subsys_state *css;
-+	u64 usage, val[CPUACCT_STAT_NSTATS];
-+
-+	css = cgroup_get_e_css(seq_css(sf)->cgroup, &cpuacct_cgrp_subsys);
-+
-+	usage = cpuusage_read(css, seq_cft(sf));
-+	cpuacct_stats_read(css_ca(css), &val);
-+
-+	val[CPUACCT_STAT_USER] *= TICK_NSEC;
-+	val[CPUACCT_STAT_SYSTEM] *= TICK_NSEC;
-+	do_div(usage, NSEC_PER_USEC);
-+	do_div(val[CPUACCT_STAT_USER], NSEC_PER_USEC);
-+	do_div(val[CPUACCT_STAT_SYSTEM], NSEC_PER_USEC);
-+
-+	seq_printf(sf, "usage_usec %llu\n"
-+		   "user_usec %llu\n"
-+		   "system_usec %llu\n",
-+		   usage, val[CPUACCT_STAT_USER], val[CPUACCT_STAT_SYSTEM]);
-+
-+	css_put(css);
-+}
-+
- /*
-  * charge this task's execution time to its accounting group.
-  *
-diff --git a/kernel/sched/cpuacct.h b/kernel/sched/cpuacct.h
-index ba72807c73d4..ddf7af466d35 100644
---- a/kernel/sched/cpuacct.h
-+++ b/kernel/sched/cpuacct.h
-@@ -2,6 +2,7 @@
- 
- extern void cpuacct_charge(struct task_struct *tsk, u64 cputime);
- extern void cpuacct_account_field(struct task_struct *tsk, int index, u64 val);
-+extern void cpuacct_cpu_stats_show(struct seq_file *sf);
- 
- #else
- 
-@@ -14,4 +15,8 @@ cpuacct_account_field(struct task_struct *tsk, int index, u64 val)
- {
- }
- 
-+static inline void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+}
-+
- #endif
-
-commit 5019fe3d7ec456b58d451ef06fe1f81d7d9f28a9
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Aug 5 12:41:01 2016 -0400
-
-    cgroup: add documentation regarding CPU controller cgroup v2 support
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-
-diff --git a/Documentation/cgroup-v2-cpu.txt b/Documentation/cgroup-v2-cpu.txt
-new file mode 100644
-index 000000000000..1ed7032d4472
---- /dev/null
-+++ b/Documentation/cgroup-v2-cpu.txt
-@@ -0,0 +1,368 @@
-+
-+
-+CPU Controller on Control Group v2
-+
-+August, 2016		Tejun Heo <tj@kernel.org>
-+
-+
-+While most controllers have support for cgroup v2 now, the CPU
-+controller support is not upstream yet due to objections from the
-+scheduler maintainers on the basic designs of cgroup v2.  This
-+document explains the current situation as well as an interim
-+solution, and details the disagreements and arguments.  The latest
-+version of this document can be found at the following URL.
-+
-+ https://git.kernel.org/cgit/linux/kernel/git/tj/cgroup.git/tree/Documentation/cgroup-v2-cpu.txt?h=cgroup-v2-cpu
-+
-+This document was posted to the linux-kernel and cgroup mailing lists.
-+Unfortunately, no consensus was reached as of Oct, 2016.  The thread
-+can be found at the following URL.
-+
-+ http://lkml.kernel.org/r/20160805170752.GK2542@mtj.duckdns.org
-+
-+
-+CONTENTS
-+
-+1. Current Situation and Interim Solution
-+2. Disagreements and Arguments
-+  2-1. Contentious Restrictions
-+    2-1-1. Process Granularity
-+    2-1-2. No Internal Process Constraint
-+  2-2. Impact on CPU Controller
-+    2-2-1. Impact of Process Granularity
-+    2-2-2. Impact of No Internal Process Constraint
-+  2-3. Arguments for cgroup v2
-+3. Way Forward
-+4. References
-+
-+
-+1. Current Situation and Interim Solution
-+
-+All objections from the scheduler maintainers apply to cgroup v2 core
-+design, and there are no known objections to the specifics of the CPU
-+controller cgroup v2 interface.  The only blocked part is changes to
-+expose the CPU controller interface on cgroup v2, which comprises the
-+following two patches:
-+
-+ [1] sched: Misc preps for cgroup unified hierarchy interface
-+ [2] sched: Implement interface for cgroup unified hierarchy
-+
-+The necessary changes are superficial and implement the interface
-+files on cgroup v2.  The combined diffstat is as follows.
-+
-+ kernel/sched/core.c    |  149 +++++++++++++++++++++++++++++++++++++++++++++++--
-+ kernel/sched/cpuacct.c |   57 ++++++++++++------
-+ kernel/sched/cpuacct.h |    5 +
-+ 3 files changed, 189 insertions(+), 22 deletions(-)
-+
-+The patches are easy to apply and forward-port.  The following git
-+branch will always carry the two patches on top of the latest release
-+of the upstream kernel.
-+
-+ git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/cgroup-v2-cpu
-+
-+There also are versioned branches going back to v4.4.
-+
-+ git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/cgroup-v2-cpu-$KERNEL_VER
-+
-+While it's difficult to tell whether the CPU controller support will
-+be merged, there are crucial resource control features in cgroup v2
-+that are only possible due to the design choices that are being
-+objected to, and every effort will be made to ease enabling the CPU
-+controller cgroup v2 support out-of-tree for parties which choose to.
-+
-+
-+2. Disagreements and Arguments
-+
-+There have been several lengthy discussion threads [3][4] on LKML
-+around the structural constraints of cgroup v2.  The two that affect
-+the CPU controller are process granularity and no internal process
-+constraint.  Both arise primarily from the need for common resource
-+domain definition across different resources.
-+
-+The common resource domain is a powerful concept in cgroup v2 that
-+allows controllers to make basic assumptions about the structural
-+organization of processes and controllers inside the cgroup hierarchy,
-+and thus solve problems spanning multiple types of resources.  The
-+prime example for this is page cache writeback: dirty page cache is
-+regulated through throttling buffered writers based on memory
-+availability, and initiating batched write outs to the disk based on
-+IO capacity.  Tracking and controlling writeback inside a cgroup thus
-+requires the direct cooperation of the memory and the IO controller.
-+
-+This easily extends to other areas, such as CPU cycles consumed while
-+performing memory reclaim or IO encryption.
-+
-+
-+2-1. Contentious Restrictions
-+
-+For controllers of different resources to work together, they must
-+agree on a common organization.  This uniform model across controllers
-+imposes two contentious restrictions on the CPU controller: process
-+granularity and the no-internal-process constraint.
-+
-+
-+  2-1-1. Process Granularity
-+
-+  For memory, because an address space is shared between all threads
-+  of a process, the terminal consumer is a process, not a thread.
-+  Separating the threads of a single process into different memory
-+  control domains doesn't make semantical sense.  cgroup v2 ensures
-+  that all controller can agree on the same organization by requiring
-+  that threads of the same process belong to the same cgroup.
-+
-+  There are other reasons to enforce process granularity.  One
-+  important one is isolating system-level management operations from
-+  in-process application operations.  The cgroup interface, being a
-+  virtual filesystem, is very unfit for multiple independent
-+  operations taking place at the same time as most operations have to
-+  be multi-step and there is no way to synchronize multiple accessors.
-+  See also [5] Documentation/cgroup-v2.txt, "R-2. Thread Granularity"
-+
-+
-+  2-1-2. No Internal Process Constraint
-+
-+  cgroup v2 does not allow processes to belong to any cgroup which has
-+  child cgroups when resource controllers are enabled on it (the
-+  notable exception being the root cgroup itself).  This is because,
-+  for some resources, a resource domain (cgroup) is not directly
-+  comparable to the terminal consumer (process/task) of said resource,
-+  and so putting the two into a sibling relationship isn't meaningful.
-+
-+  - Differing Control Parameters and Capabilities
-+
-+    A cgroup controller has different resource control parameters and
-+    capabilities from a terminal consumer, be that a task or process.
-+    There are a couple cases where a cgroup control knob can be mapped
-+    to a per-task or per-process API but they are exceptions and the
-+    mappings aren't obvious even in those cases.
-+
-+    For example, task priorities (also known as nice values) set
-+    through setpriority(2) are mapped to the CPU controller
-+    "cpu.shares" values.  However, how exactly the two ranges map and
-+    even the fact that they map to each other at all are not obvious.
-+
-+    The situation gets further muddled when considering other resource
-+    types and control knobs.  IO priorities set through ioprio_set(2)
-+    cannot be mapped to IO controller weights and most cgroup resource
-+    control knobs including the bandwidth control knobs of the CPU
-+    controller don't have counterparts in the terminal consumers.
-+
-+  - Anonymous Resource Consumption
-+
-+    For CPU, every time slice consumed from inside a cgroup, which
-+    comprises most but not all of consumed CPU time for the cgroup,
-+    can be clearly attributed to a specific task or process.  Because
-+    these two types of entities are directly comparable as consumers
-+    of CPU time, it's theoretically possible to mix tasks and cgroups
-+    on the same tree levels and let them directly compete for the time
-+    quota available to their common ancestor.
-+
-+    However, the same can't be said for resource types like memory or
-+    IO: the memory consumed by the page cache, for example, can be
-+    tracked on a per-cgroup level, but due to mismatches in lifetimes
-+    of involved objects (page cache can persist long after processes
-+    are gone), shared usages and the implementation overhead of
-+    tracking persistent state, it can no longer be attributed to
-+    individual processes after instantiation.  Consequently, any IO
-+    incurred by page cache writeback can be attributed to a cgroup,
-+    but not to the individual consumers inside the cgroup.
-+
-+  For memory and IO, this makes a resource domain (cgroup) an object
-+  of a fundamentally different type than a terminal consumer
-+  (process).  A process can't be a first class object in the resource
-+  distribution graph as its total resource consumption can't be
-+  described without the containing resource domain.
-+
-+  Disallowing processes in internal cgroups avoids competition between
-+  cgroups and processes which cannot be meaningfully defined for these
-+  resources.  All resource control takes place among cgroups and a
-+  terminal consumer interacts with the containing cgroup the same way
-+  it would with the system without cgroup.
-+
-+  Root cgroup is exempt from this constraint, which is in line with
-+  how root cgroup is handled in general - it's excluded from cgroup
-+  resource accounting and control.
-+
-+
-+Enforcing process granularity and no internal process constraint
-+allows all controllers to be on the same footing in terms of resource
-+distribution hierarchy.
-+
-+
-+2-2. Impact on CPU Controller
-+
-+As indicated earlier, the CPU controller's resource distribution graph
-+is the simplest.  Every schedulable resource consumption can be
-+attributed to a specific task.  In addition, for weight based control,
-+the per-task priority set through setpriority(2) can be translated to
-+and from a per-cgroup weight.  As such, the CPU controller can treat a
-+task and a cgroup symmetrically, allowing support for any tree layout
-+of cgroups and tasks.  Both process granularity and the no internal
-+process constraint restrict how the CPU controller can be used.
-+
-+
-+  2-2-1. Impact of Process Granularity
-+
-+  Process granularity prevents tasks belonging to the same process to
-+  be assigned to different cgroups.  It was pointed out [6] that this
-+  excludes the valid use case of hierarchical CPU distribution within
-+  processes.
-+
-+  To address this issue, the rgroup (resource group) [7][8][9]
-+  interface, an extension of the existing setpriority(2) API, was
-+  proposed, which is in line with other programmable priority
-+  mechanisms and eliminates the risk of in-application configuration
-+  and system configuration stepping on each other's toes.
-+  Unfortunately, the proposal quickly turned into discussions around
-+  cgroup v2 design decisions [4] and no consensus could be reached.
-+
-+
-+  2-2-2. Impact of No Internal Process Constraint
-+
-+  The no internal process constraint disallows tasks from competing
-+  directly against cgroups.  Here is an excerpt from Peter Zijlstra
-+  pointing out the issue [10] - R, L and A are cgroups; t1, t2, t3 and
-+  t4 are tasks:
-+
-+
-+          R
-+        / | \
-+       t1 t2 A
-+           /   \
-+          t3   t4
-+
-+
-+    Is fundamentally different from:
-+
-+
-+               R
-+             /   \
-+           L       A
-+         /   \   /   \
-+        t1  t2  t3   t4
-+
-+
-+    Because if in the first hierarchy you add a task (t5) to R, all of
-+    its A will run at 1/4th of total bandwidth where before it had
-+    1/3rd, whereas with the second example, if you add our t5 to L, A
-+    doesn't get any less bandwidth.
-+
-+
-+  It is true that the trees are semantically different from each other
-+  and the symmetric handling of tasks and cgroups is aesthetically
-+  pleasing.  However, it isn't clear what the practical usefulness of
-+  a layout with direct competition between tasks and cgroups would be,
-+  considering that number and behavior of tasks are controlled by each
-+  application, and cgroups primarily deal with system level resource
-+  distribution; changes in the number of active threads would directly
-+  impact resource distribution.  Real world use cases of such layouts
-+  could not be established during the discussions.
-+
-+
-+2-3. Arguments for cgroup v2
-+
-+There are strong demands for comprehensive hierarchical resource
-+control across all major resources, and establishing a common resource
-+hierarchy is an essential step.  As with most engineering decisions,
-+common resource hierarchy definition comes with its trade-offs.  With
-+cgroup v2, the trade-offs are in the form of structural constraints
-+which, among others, restrict the CPU controller's space of possible
-+configurations.
-+
-+However, even with the restrictions, cgroup v2, in combination with
-+rgroup, covers most of identified real world use cases while enabling
-+new important use cases of resource control across multiple resource
-+types that were fundamentally broken previously.
-+
-+Furthermore, for resource control, treating resource domains as
-+objects of a different type from terminal consumers has important
-+advantages - it can account for resource consumptions which are not
-+tied to any specific terminal consumer, be that a task or process, and
-+allows decoupling resource distribution controls from in-application
-+APIs.  Even the CPU controller may benefit from it as the kernel can
-+consume significant amount of CPU cycles in interrupt context or tasks
-+shared across multiple resource domains (e.g. softirq).
-+
-+Finally, it's important to note that enabling cgroup v2 support for
-+the CPU controller doesn't block use cases which require the features
-+which are not available on cgroup v2.  Unlikely, but should anybody
-+actually rely on the CPU controller's symmetric handling of tasks and
-+cgroups, backward compatibility is and will be maintained by being
-+able to disconnect the controller from the cgroup v2 hierarchy and use
-+it standalone.  This also holds for cpuset which is often used in
-+highly customized configurations which might be a poor fit for common
-+resource domains.
-+
-+The required changes are minimal, the benefits for the target use
-+cases are critical and obvious, and use cases which have to use v1 can
-+continue to do so.
-+
-+
-+3. Way Forward
-+
-+cgroup v2 primarily aims to solve the problem of comprehensive
-+hierarchical resource control across all major computing resources,
-+which is one of the core problems of modern server infrastructure
-+engineering.  The trade-offs that cgroup v2 took are results of
-+pursuing that goal and gaining a better understanding of the nature of
-+resource control in the process.
-+
-+I believe that real world usages will prove cgroup v2's model right,
-+considering the crucial pieces of comprehensive resource control that
-+cannot be implemented without common resource domains.  This is not to
-+say that cgroup v2 is fixed in stone and can't be updated; if there is
-+an approach which better serves both comprehensive resource control
-+and the CPU controller's flexibility, we will surely move towards
-+that.  It goes without saying that discussions around such approach
-+should consider practical aspects of resource control as a whole
-+rather than absolutely focusing on a particular controller.
-+
-+Until such consensus can be reached, the CPU controller cgroup v2
-+support will be maintained out of the mainline kernel in an easily
-+accessible form.  If there is anything cgroup developers can do to
-+ease the pain, please feel free to contact us on the cgroup mailing
-+list at cgroups@vger.kernel.org.
-+
-+
-+4. References
-+
-+[1]  http://lkml.kernel.org/r/20160105164834.GE5995@mtj.duckdns.org
-+     [PATCH 1/2] sched: Misc preps for cgroup unified hierarchy interface
-+     Tejun Heo <tj@kernel.org>
-+
-+[2]  http://lkml.kernel.org/r/20160105164852.GF5995@mtj.duckdns.org
-+     [PATCH 2/2] sched: Implement interface for cgroup unified hierarchy
-+     Tejun Heo <tj@kernel.org>
-+
-+[3]  http://lkml.kernel.org/r/1438641689-14655-4-git-send-email-tj@kernel.org
-+     [PATCH 3/3] sched: Implement interface for cgroup unified hierarchy
-+     Tejun Heo <tj@kernel.org>
-+
-+[4]  http://lkml.kernel.org/r/20160407064549.GH3430@twins.programming.kicks-ass.net
-+     Re: [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource group and PRIO_RGRP
-+     Peter Zijlstra <peterz@infradead.org>
-+
-+[5]  https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/cgroup-v2.txt
-+     Control Group v2
-+     Tejun Heo <tj@kernel.org>
-+
-+[6]  http://lkml.kernel.org/r/CAPM31RJNy3jgG=DYe6GO=wyL4BPPxwUm1f2S6YXacQmo7viFZA@mail.gmail.com
-+     Re: [PATCH 3/3] sched: Implement interface for cgroup unified hierarchy
-+     Paul Turner <pjt@google.com>
-+
-+[7]  http://lkml.kernel.org/r/20160105154503.GC5995@mtj.duckdns.org
-+     [RFD] cgroup: thread granularity support for cpu controller
-+     Tejun Heo <tj@kernel.org>
-+
-+[8]  http://lkml.kernel.org/r/1457710888-31182-1-git-send-email-tj@kernel.org
-+     [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource group and PRIO_RGRP
-+     Tejun Heo <tj@kernel.org>
-+
-+[9]  http://lkml.kernel.org/r/20160311160522.GA24046@htj.duckdns.org
-+     Example program for PRIO_RGRP
-+     Tejun Heo <tj@kernel.org>
-+
-+[10] http://lkml.kernel.org/r/20160407082810.GN3430@twins.programming.kicks-ass.net
-+     Re: [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource
-+     Peter Zijlstra <peterz@infradead.org>
diff --git a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md b/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md
deleted file mode 100644
index 6d48fde6bee..00000000000
--- a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md
+++ /dev/null
@@ -1,21 +0,0 @@
-Patches for CPU Controller on Control Group v2
-===============================================
-
-See Tejun Heo's [explanation][1] for why these patches are currently
-out-of-tree.
-
-Generating the patches
------------------------
-
-In a linux checkout, with remote tc-cgroup pointing to
-git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git, your
-nixpkgs checkout in the same directory as your linux checkout (or
-modify the command accordingly), and setting `ver` to the appropriate
-version:
-
-```shell
-$ ver=4.7
-$ git log --reverse --patch v$ver..remotes/tc-cgroup/cgroup-v2-cpu-v$ver > ../nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/$ver.patch
-```
-
-[1]: https://git.kernel.org/cgit/linux/kernel/git/tj/cgroup.git/tree/Documentation/cgroup-v2-cpu.txt?h=cgroup-v2-cpu
diff --git a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/default.nix b/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/default.nix
deleted file mode 100644
index 5bef5633aa0..00000000000
--- a/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/default.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-let
-  ents = builtins.readDir ./.;
-in builtins.listToAttrs (builtins.filter (x: x != null) (map (name: let
-  match = builtins.match "(.*)\\.patch" name;
-in if match == null then null else {
-  name = builtins.head match;
-  value = {
-    name = "cpu-cgroup-v2-${name}";
-    patch = ./. + "/${name}";
-  };
-}) (builtins.attrNames ents)))
diff --git a/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch b/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch
deleted file mode 100644
index 0639f8b4e8f..00000000000
--- a/pkgs/os-specific/linux/kernel/gen-kheaders-metadata.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From 2cc99c9cdc8fde5e92e34f9655829449cebd3e00 Mon Sep 17 00:00:00 2001
-From: Dmitry Goldin <dgoldin+lkml@protonmail.ch>
-Date: Fri, 4 Oct 2019 10:40:07 +0000
-Subject: kheaders: make headers archive reproducible
-
-In commit 43d8ce9d65a5 ("Provide in-kernel headers to make
-extending kernel easier") a new mechanism was introduced, for kernels
->=5.2, which embeds the kernel headers in the kernel image or a module
-and exposes them in procfs for use by userland tools.
-
-The archive containing the header files has nondeterminism caused by
-header files metadata. This patch normalizes the metadata and utilizes
-KBUILD_BUILD_TIMESTAMP if provided and otherwise falls back to the
-default behaviour.
-
-In commit f7b101d33046 ("kheaders: Move from proc to sysfs") it was
-modified to use sysfs and the script for generation of the archive was
-renamed to what is being patched.
-
-Signed-off-by: Dmitry Goldin <dgoldin+lkml@protonmail.ch>
-Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
-Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
-
----
-
-nixos note: This patch is from
-https://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild.git/commit/?h=fixes&id=2cc99c9cdc8fde5e92e34f9655829449cebd3e00
-I commented out the documentation part here, so that it easily applies
-to linux 5.2 and 5.3, which does not ship with the reproducible build
-documentation yet, which only was introduced recently.
-
----
- Documentation/kbuild/reproducible-builds.rst | 13 +++++++++----
- kernel/gen_kheaders.sh                       |  5 ++++-
- 2 files changed, 13 insertions(+), 5 deletions(-)
-
-#diff --git a/Documentation/kbuild/reproducible-builds.rst b/Documentation/kbuild/reproducible-builds.rst
-#index ab92e98c89c8..503393854e2e 100644
-# --- a/Documentation/kbuild/reproducible-builds.rst
-#+++ b/Documentation/kbuild/reproducible-builds.rst
-#@@ -16,16 +16,21 @@ the kernel may be unreproducible, and how to avoid them.
-# Timestamps
-# ----------
-#
-#-The kernel embeds a timestamp in two places:
-#+The kernel embeds timestamps in three places:
-#
-# * The version string exposed by ``uname()`` and included in
-#   ``/proc/version``
-#
-# * File timestamps in the embedded initramfs
-#
-#-By default the timestamp is the current time.  This must be overridden
-#-using the `KBUILD_BUILD_TIMESTAMP`_ variable.  If you are building
-#-from a git commit, you could use its commit date.
-#+* If enabled via ``CONFIG_IKHEADERS``, file timestamps of kernel
-#+  headers embedded in the kernel or respective module,
-#+  exposed via ``/sys/kernel/kheaders.tar.xz``
-#+
-#+By default the timestamp is the current time and in the case of
-#+``kheaders`` the various files' modification times. This must
-#+be overridden using the `KBUILD_BUILD_TIMESTAMP`_ variable.
-#+If you are building from a git commit, you could use its commit date.
-#
-# The kernel does *not* use the ``__DATE__`` and ``__TIME__`` macros,
-# and enables warnings if they are used.  If you incorporate external
-diff --git a/kernel/gen_kheaders.sh b/kernel/gen_kheaders.sh
-index 9ff449888d9c..aff79e461fc9 100755
---- a/kernel/gen_kheaders.sh
-+++ b/kernel/gen_kheaders.sh
-@@ -71,7 +71,10 @@ done | cpio --quiet -pd $cpio_dir >/dev/null 2>&1
- find $cpio_dir -type f -print0 |
- 	xargs -0 -P8 -n1 perl -pi -e 'BEGIN {undef $/;}; s/\/\*((?!SPDX).)*?\*\///smg;'
-
--tar -Jcf $tarfile -C $cpio_dir/ . > /dev/null
-+# Create archive and try to normalize metadata for reproducibility
-+tar "${KBUILD_BUILD_TIMESTAMP:+--mtime=$KBUILD_BUILD_TIMESTAMP}" \
-+    --owner=0 --group=0 --sort=name --numeric-owner \
-+    -Jcf $tarfile -C $cpio_dir/ . > /dev/null
-
- echo "$src_files_md5" >  kernel/kheaders.md5
- echo "$obj_files_md5" >> kernel/kheaders.md5
---
-cgit 1.2-0.3.lf.el7
-
diff --git a/pkgs/os-specific/linux/kernel/generate-config.pl b/pkgs/os-specific/linux/kernel/generate-config.pl
index df807188f14..7e12ca5d96a 100644
--- a/pkgs/os-specific/linux/kernel/generate-config.pl
+++ b/pkgs/os-specific/linux/kernel/generate-config.pl
@@ -81,7 +81,7 @@ sub runConfig {
                 my $question = $1; my $name = $2; my $alts = $3;
                 my $answer = "";
                 # Build everything as a module if possible.
-                $answer = "m" if $autoModules && $alts =~ /\/m/ && !($preferBuiltin && $alts =~ /Y/);
+                $answer = "m" if $autoModules && $alts =~ qr{\A(\w/)+m/(\w/)*\?\z} && !($preferBuiltin && $alts =~ /Y/);
                 $answer = $answers{$name} if defined $answers{$name};
                 print STDERR "QUESTION: $question, NAME: $name, ALTS: $alts, ANSWER: $answer\n" if $debug;
                 print OUT "$answer\n";
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 7f4f0f2d6bb..df67005dd81 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -6,6 +6,7 @@
 , gmp ? null
 , libmpc ? null
 , mpfr ? null
+, pahole
 , lib
 , stdenv
 
@@ -24,11 +25,16 @@
   # Additional make flags passed to kbuild
 , extraMakeFlags ? []
 
+, # enables the options in ./common-config.nix; if `false` then only
+  # `structuredExtraConfig` is used
+ enableCommonConfig ? true
+
 , # kernel intermediate config overrides, as a set
  structuredExtraConfig ? {}
 
 , # The version number used for the module directory
-  modDirVersion ? version
+  # If unspecified, this is determined automatically from the version.
+  modDirVersion ? null
 
 , # An attribute set whose attributes express the availability of
   # certain features in this kernel.  E.g. `{iwlwifi = true;}'
@@ -45,8 +51,7 @@
   # symbolic name and `patch' is the actual patch.  The patch may
   # optionally be compressed with gzip or bzip2.
   kernelPatches ? []
-, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name != "pc" ||
-                       stdenv.hostPlatform != stdenv.buildPlatform
+, ignoreConfigErrors ? stdenv.hostPlatform.linux-kernel.name != "pc"
 , extraMeta ? {}
 
 , isZen      ? false
@@ -58,8 +63,9 @@
 , preferBuiltin ? stdenv.hostPlatform.linux-kernel.preferBuiltin or false
 , kernelArch ? stdenv.hostPlatform.linuxArch
 , kernelTests ? []
+, nixosTests
 , ...
-}:
+}@args:
 
 # Note: this package is used for bootstrapping fetchurl, and thus
 # cannot use fetchpatch! All mutable patches (generated by GitHub or
@@ -69,6 +75,18 @@
 assert stdenv.isLinux;
 
 let
+  # Dirty hack to make sure that `version` & `src` have
+  # `<nixpkgs/pkgs/os-specific/linux/kernel/linux-x.y.nix>` as position
+  # when using `builtins.unsafeGetAttrPos`.
+  #
+  # This is to make sure that ofborg actually detects changes in the kernel derivation
+  # and pings all maintainers.
+  #
+  # For further context, see https://github.com/NixOS/nixpkgs/pull/143113#issuecomment-953319957
+  basicArgs = builtins.removeAttrs
+    args
+    (lib.filter (x: ! (builtins.elem x [ "version" "src" ])) (lib.attrNames args));
+
   # Combine the `features' attribute sets of all the kernel patches.
   kernelFeatures = lib.foldr (x: y: (x.features or {}) // y) ({
     iwlwifi = true;
@@ -111,18 +129,17 @@ let
 
     depsBuildBuild = [ buildPackages.stdenv.cc ];
     nativeBuildInputs = [ perl gmp libmpc mpfr ]
-      ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ];
+      ++ lib.optionals (lib.versionAtLeast version "4.16") [ bison flex ]
+      ++ lib.optional (lib.versionAtLeast version "5.2") pahole;
 
     platformName = stdenv.hostPlatform.linux-kernel.name;
     # e.g. "defconfig"
     kernelBaseConfig = if defconfig != null then defconfig else stdenv.hostPlatform.linux-kernel.baseConfig;
-    # e.g. "bzImage"
-    kernelTarget = stdenv.hostPlatform.linux-kernel.target;
 
     makeFlags = lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags) stdenv.hostPlatform.linux-kernel.makeFlags
       ++ extraMakeFlags;
 
-    prePatch = kernel.prePatch + ''
+    postPatch = kernel.postPatch + ''
       # Patch kconfig to print "###" after every question so that
       # generate-config.pl from the generic builder can answer them.
       sed -e '/fflush(stdout);/i\printf("###");' -i scripts/kconfig/conf.c
@@ -168,7 +185,9 @@ let
       moduleStructuredConfig = (lib.evalModules {
         modules = [
           module
+        ] ++ lib.optionals enableCommonConfig [
           { settings = commonStructuredConfig; _file = "pkgs/os-specific/linux/kernel/common-config.nix"; }
+        ] ++ [
           { settings = structuredExtraConfig; _file = "structuredExtraConfig"; }
         ]
         ++  structuredConfigFromPatches
@@ -179,20 +198,37 @@ let
     };
   }; # end of configfile derivation
 
-  kernel = (callPackage ./manual-config.nix { inherit buildPackages;  }) {
-    inherit version modDirVersion src kernelPatches randstructSeed lib stdenv extraMakeFlags extraMeta configfile;
+  kernel = (callPackage ./manual-config.nix { inherit lib stdenv buildPackages; }) (basicArgs // {
+    inherit kernelPatches randstructSeed extraMakeFlags extraMeta configfile;
+    pos = builtins.unsafeGetAttrPos "version" args;
 
     config = { CONFIG_MODULES = "y"; CONFIG_FW_LOADER = "m"; };
-  };
+  } // lib.optionalAttrs (modDirVersion != null) { inherit modDirVersion; });
 
-  passthru = {
+  passthru = basicArgs // {
     features = kernelFeatures;
-    inherit commonStructuredConfig structuredExtraConfig extraMakeFlags isZen isHardened isLibre modDirVersion;
+    inherit commonStructuredConfig structuredExtraConfig extraMakeFlags isZen isHardened isLibre;
     isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
-    kernelOlder = lib.versionOlder version;
-    kernelAtLeast = lib.versionAtLeast version;
+
+    # Adds dependencies needed to edit the config:
+    # nix-shell '<nixpkgs>' -A linux.configEnv --command 'make nconfig'
+    configEnv = kernel.overrideAttrs (old: {
+      nativeBuildInputs = old.nativeBuildInputs or [] ++ (with buildPackages; [
+        pkg-config ncurses
+      ]);
+    });
+
     passthru = kernel.passthru // (removeAttrs passthru [ "passthru" ]);
-    tests = kernelTests;
+    tests = let
+      overridableKernel = finalKernel // {
+        override = args:
+          lib.warn (
+            "override is stubbed for NixOS kernel tests, not applying changes these arguments: "
+            + toString (lib.attrNames (if lib.isAttrs args then args else args {}))
+          ) overridableKernel;
+      };
+    in [ (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel) ] ++ kernelTests;
   };
 
-in lib.extendDerivation true passthru kernel
+  finalKernel = lib.extendDerivation true passthru kernel;
+in finalKernel
diff --git a/pkgs/os-specific/linux/kernel/genksyms-fix-segfault.patch b/pkgs/os-specific/linux/kernel/genksyms-fix-segfault.patch
deleted file mode 100644
index 47ae77a5a54..00000000000
--- a/pkgs/os-specific/linux/kernel/genksyms-fix-segfault.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-diff --git a/scripts/genksyms/genksyms.c b/scripts/genksyms/genksyms.c
-index 88632df..ba6cfa9 100644
---- a/scripts/genksyms/genksyms.c
-+++ b/scripts/genksyms/genksyms.c
-@@ -233,11 +233,11 @@ static struct symbol *__add_symbol(const char *name, enum symbol_type type,
- 		free_list(last_enum_expr, NULL);
- 		last_enum_expr = NULL;
- 		enum_counter = 0;
--		if (!name)
--			/* Anonymous enum definition, nothing more to do */
--			return NULL;
- 	}
- 
-+	if (!name)
-+		return NULL;
-+
- 	h = crc32(name) % HASH_BUCKETS;
- 	for (sym = symtab[h]; sym; sym = sym->hash_next) {
- 		if (map_to_ns(sym->type) == map_to_ns(type) &&
diff --git a/pkgs/os-specific/linux/kernel/gpio-utils.nix b/pkgs/os-specific/linux/kernel/gpio-utils.nix
index e28d838efb3..40e282bbf54 100644
--- a/pkgs/os-specific/linux/kernel/gpio-utils.nix
+++ b/pkgs/os-specific/linux/kernel/gpio-utils.nix
@@ -2,10 +2,9 @@
 
 with lib;
 
-assert versionAtLeast linux.version "4.6";
-
 stdenv.mkDerivation {
-  name = "gpio-utils-${linux.version}";
+  pname = "gpio-utils";
+  version = linux.version;
 
   inherit (linux) src makeFlags;
 
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index 20f9f5aaa14..92192eb79f8 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -8,7 +8,7 @@
 #
 # See also <nixos/modules/profiles/hardened.nix>
 
-{ lib, version }:
+{ stdenv, lib, version }:
 
 with lib;
 with lib.kernel;
@@ -20,10 +20,6 @@ assert (versionAtLeast version "4.9");
   # Report BUG() conditions and kill the offending process.
   BUG = yes;
 
-  # Safer page access permissions (wrt. code injection).  Default on >=4.11.
-  DEBUG_RODATA          = whenOlder "4.11" yes;
-  DEBUG_SET_MODULE_RONX = whenOlder "4.11" yes;
-
   # Mark LSM hooks read-only after init.  SECURITY_WRITABLE_HOOKS n
   # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
   # implicitly marks LSM hooks read-only after init.
@@ -32,10 +28,10 @@ assert (versionAtLeast version "4.9");
   #
   # We set SECURITY_WRITABLE_HOOKS n primarily for documentation purposes; the
   # config builder fails to detect that it has indeed been unset.
-  SECURITY_SELINUX_DISABLE = whenAtLeast "4.12" no;
-  SECURITY_WRITABLE_HOOKS  = whenAtLeast "4.12" (option no);
+  SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE
+  SECURITY_WRITABLE_HOOKS  = option no;
 
-  STRICT_KERNEL_RWX = whenAtLeast "4.11" yes;
+  STRICT_KERNEL_RWX = yes;
 
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = yes;
@@ -45,7 +41,7 @@ assert (versionAtLeast version "4.9");
   DEBUG_SG              = yes;
   SCHED_STACK_END_CHECK = yes;
 
-  REFCOUNT_FULL = whenBetween "4.13" "5.5" yes;
+  REFCOUNT_FULL = whenOlder "5.4.208" yes;
 
   # Randomize page allocator when page_alloc.shuffle=1
   SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
@@ -68,11 +64,15 @@ assert (versionAtLeast version "4.9");
   # Gather additional entropy at boot time for systems that may not have appropriate entropy sources.
   GCC_PLUGIN_LATENT_ENTROPY = yes;
 
-  GCC_PLUGIN_STRUCTLEAK = whenAtLeast "4.11" yes; # A port of the PaX structleak plugin
-  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = whenAtLeast "4.14" yes; # Also cover structs passed by address
+  GCC_PLUGIN_STRUCTLEAK = option yes; # A port of the PaX structleak plugin
+  GCC_PLUGIN_STRUCTLEAK_BYREF_ALL = option yes; # Also cover structs passed by address
   GCC_PLUGIN_STACKLEAK = whenAtLeast "4.20" yes; # A port of the PaX stackleak plugin
-  GCC_PLUGIN_RANDSTRUCT = whenAtLeast "4.13" yes; # A port of the PaX randstruct plugin
-  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenAtLeast "4.13" yes;
+  GCC_PLUGIN_RANDSTRUCT = whenOlder "5.19" yes; # A port of the PaX randstruct plugin
+  GCC_PLUGIN_RANDSTRUCT_PERFORMANCE = whenOlder "5.19" yes;
+
+  # Same as GCC_PLUGIN_RANDSTRUCT*, but has been renamed to `RANDSTRUCT*` in 5.19.
+  RANDSTRUCT = whenAtLeast "5.19" yes;
+  RANDSTRUCT_PERFORMANCE = whenAtLeast "5.19" yes;
 
   # Disable various dangerous settings
   ACPI_CUSTOM_METHOD = no; # Allows writing directly to physical memory
@@ -88,9 +88,13 @@ assert (versionAtLeast version "4.9");
   INET_MPTCP_DIAG   = option no;
 
   # Use -fstack-protector-strong (gcc 4.9+) for best stack canary coverage.
-  CC_STACKPROTECTOR_REGULAR = whenOlder "4.18" no;
+  CC_STACKPROTECTOR_REGULAR = lib.mkForce (whenOlder "4.18" no);
   CC_STACKPROTECTOR_STRONG  = whenOlder "4.18" yes;
 
   # Detect out-of-bound reads/writes and use-after-free
   KFENCE = whenAtLeast "5.12" yes;
+
+  # CONFIG_DEVMEM=n causes these to not exist anymore.
+  STRICT_DEVMEM    = option no;
+  IO_STRICT_DEVMEM = option no;
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 412e5041500..d8f8bb2fa73 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,32 +1,82 @@
 {
     "4.14": {
-        "extra": "-hardened1",
-        "name": "linux-hardened-4.14.240-hardened1.patch",
-        "sha256": "0j5zp0f8s4w3f60yam2spg3bx56bdjvv0mh632zlhchz8rdk5zs4",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.240-hardened1/linux-hardened-4.14.240-hardened1.patch"
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-4.14.328-hardened1.patch",
+            "sha256": "1qq2l4nwhxgl4drx6isc1ly892kffjq4hqb4zadqs6sxvsdm7x57",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.328-hardened1/linux-hardened-4.14.328-hardened1.patch"
+        },
+        "sha256": "1igcpvnhwwrczfdsafmszvi0456k7f6j4cgpfw6v6afw09p95d8x",
+        "version": "4.14.328"
     },
     "4.19": {
-        "extra": "-hardened1",
-        "name": "linux-hardened-4.19.198-hardened1.patch",
-        "sha256": "18c5j00xiwc0xn5klcrwazk6wvjiy3cixbfbrw4xj7zal9r5p6q9",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.198-hardened1/linux-hardened-4.19.198-hardened1.patch"
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-4.19.297-hardened1.patch",
+            "sha256": "1qj09bynl7ml880xpc2956jn0b1gmm77yf3jc45v3jq3610jhna4",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.297-hardened1/linux-hardened-4.19.297-hardened1.patch"
+        },
+        "sha256": "0c9xxqgv2i36hrr06dwz7f3idc04xpv0a5pxg08xdh03cnyf12cx",
+        "version": "4.19.297"
     },
     "5.10": {
-        "extra": "-hardened1",
-        "name": "linux-hardened-5.10.52-hardened1.patch",
-        "sha256": "062a32rb1g5xk1npiz9fa114k7g4x9pmygycn3alc0phngjmvr98",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.52-hardened1/linux-hardened-5.10.52-hardened1.patch"
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-5.10.199-hardened1.patch",
+            "sha256": "10vwd5wygfnxpbz15bq56pjygba3vqqal0d7xry2bch4p444pp5f",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.199-hardened1/linux-hardened-5.10.199-hardened1.patch"
+        },
+        "sha256": "1h944syk7n6c4j1djlx19n77alzwbxcdza77c9ykicgfynhpgsm0",
+        "version": "5.10.199"
     },
-    "5.12": {
-        "extra": "-hardened1",
-        "name": "linux-hardened-5.12.19-hardened1.patch",
-        "sha256": "1nr3922gd6il69k5cpp9g3knpy6yjb6jsmpi9k4v02bkvypg86dc",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.12.19-hardened1/linux-hardened-5.12.19-hardened1.patch"
+    "5.15": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-5.15.137-hardened1.patch",
+            "sha256": "19gs1w380qgvazwjwhxypizpfx71faa7hsji0x5cgyw6vxhi6l1b",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.137-hardened1/linux-hardened-5.15.137-hardened1.patch"
+        },
+        "sha256": "1xxjbxldrhmnh2q6rykpxyfbj8xqgl82q30n8sfavrzr14bb4jcp",
+        "version": "5.15.137"
     },
     "5.4": {
-        "extra": "-hardened1",
-        "name": "linux-hardened-5.4.134-hardened1.patch",
-        "sha256": "0iay6dxwd1vqj02ljf0ghncrqpr6b0gby90xiza8kkk8wnh3r9hh",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.134-hardened1/linux-hardened-5.4.134-hardened1.patch"
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-5.4.259-hardened1.patch",
+            "sha256": "1w8ipflgisd127gmx6wyz8p5qfi8cfd2a5j2xgibspkf45nzfwi8",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.259-hardened1/linux-hardened-5.4.259-hardened1.patch"
+        },
+        "sha256": "195v4fidavzm637glj6580006mrcaygnbj4za874imb62bxf9rpz",
+        "version": "5.4.259"
+    },
+    "6.1": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-6.1.61-hardened1.patch",
+            "sha256": "0d9zhh32dx1q828q50kmznmsa6yinppbklhgg8ix7b7k23857ha6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.61-hardened1/linux-hardened-6.1.61-hardened1.patch"
+        },
+        "sha256": "1kk4d7ph6pvgdrdmaklg15wf58nw9n7yqgkag7jdvqinzh99sb5d",
+        "version": "6.1.61"
+    },
+    "6.4": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-6.4.16-hardened1.patch",
+            "sha256": "10lydnnhhq9ynng1gfaqh1mncsb0dmr27zzcbygs1xigy2bl70n9",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.16-hardened1/linux-hardened-6.4.16-hardened1.patch"
+        },
+        "sha256": "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln",
+        "version": "6.4.16"
+    },
+    "6.5": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-6.5.10-hardened1.patch",
+            "sha256": "0p2lj7ryiizr1sxvm2kgds3l8sg9fns35y2fcyqq61lg7ymzj1fi",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.10-hardened1/linux-hardened-6.5.10-hardened1.patch"
+        },
+        "sha256": "12sswml8jvabv6bqx35lg3jj6gq8jjk365rghjngdy5d0j34jpx1",
+        "version": "6.5.10"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py
index e96ac9ca855..ce54c298075 100755
--- a/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python -p "python38.withPackages (ps: [ps.PyGithub])" git gnupg
+#! nix-shell -i python -p "python3.withPackages (ps: [ps.pygithub])" git gnupg
 
 # This is automatically called by ../update.sh.
 
@@ -31,7 +31,12 @@ VersionComponent = Union[int, str]
 Version = List[VersionComponent]
 
 
-Patch = TypedDict("Patch", {"name": str, "url": str, "sha256": str, "extra": str})
+PatchData = TypedDict("PatchData", {"name": str, "url": str, "sha256": str, "extra": str})
+Patch = TypedDict("Patch", {
+    "patch": PatchData,
+    "version": str,
+    "sha256": str,
+})
 
 
 @dataclass
@@ -133,7 +138,15 @@ def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]:
     if not sig_ok:
         return None
 
-    return Patch(name=patch_filename, url=patch_url, sha256=sha256, extra=extra)
+    kernel_ver = re.sub(r"(.*)(-hardened[\d]+)$", r'\1', release_info.release.tag_name)
+    major = kernel_ver.split('.')[0]
+    sha256_kernel, _ = nix_prefetch_url(f"mirror://kernel/linux/kernel/v{major}.x/linux-{kernel_ver}.tar.xz")
+
+    return Patch(
+        patch=PatchData(name=patch_filename, url=patch_url, sha256=sha256, extra=extra),
+        version=kernel_ver,
+        sha256=sha256_kernel
+    )
 
 
 def parse_version(version_str: str) -> Version:
@@ -180,21 +193,14 @@ with open(HARDENED_PATCHES_PATH) as patches_file:
 
 # Get the set of currently packaged kernel versions.
 kernel_versions = {}
-for filename in os.listdir(NIXPKGS_KERNEL_PATH):
-    filename_match = re.fullmatch(r"linux-(\d+)\.(\d+)\.nix", filename)
-    if filename_match:
-        nix_version_expr = f"""
-            with import {NIXPKGS_PATH} {{}};
-            (callPackage {NIXPKGS_KERNEL_PATH / filename} {{}}).version
-        """
-        kernel_version_json = run(
-            "nix-instantiate", "--eval", "--json", "--expr", nix_version_expr,
-        ).stdout
-        kernel_version = parse_version(json.loads(kernel_version_json))
-        if kernel_version < MIN_KERNEL_VERSION:
-            continue
-        kernel_key = major_kernel_version_key(kernel_version)
-        kernel_versions[kernel_key] = kernel_version
+with open(NIXPKGS_KERNEL_PATH / "kernels-org.json") as kernel_versions_json:
+    kernel_versions = json.load(kernel_versions_json)
+    for kernel_branch_str in kernel_versions:
+        if kernel_branch_str == "testing": continue
+        kernel_branch = [int(i) for i in kernel_branch_str.split(".")]
+        if kernel_branch < MIN_KERNEL_VERSION: continue
+        kernel_version = [int(i) for i in kernel_versions[kernel_branch_str]["version"].split(".")]
+        kernel_versions[kernel_branch_str] = kernel_version
 
 # Remove patches for unpackaged kernel versions.
 for kernel_key in sorted(patches.keys() - kernel_versions.keys()):
@@ -206,13 +212,26 @@ failures = False
 
 # Match each kernel version with the best patch version.
 releases = {}
+i = 0
 for release in repo.get_releases():
+    # Dirty workaround to make sure that we don't run into issues because
+    # GitHub's API only allows fetching the last 1000 releases.
+    # It's not reliable to exit earlier because not every kernel minor may
+    # have hardened patches, hence the naive search below.
+    i += 1
+    if i > 500:
+        break
+
     version = parse_version(release.tag_name)
     # needs to look like e.g. 5.6.3-hardened1
     if len(version) < 4:
         continue
 
+    if not (isinstance(version[-2], int)):
+        continue
+
     kernel_version = version[:-1]
+
     kernel_key = major_kernel_version_key(kernel_version)
     try:
         packaged_kernel_version = kernel_versions[kernel_key]
@@ -226,7 +245,7 @@ for release in repo.get_releases():
     else:
         # Fall back to the latest patch for this major kernel version,
         # skipping patches for kernels newer than the packaged one.
-        if kernel_version > packaged_kernel_version:
+        if '.'.join(str(x) for x in kernel_version) > '.'.join(str(x) for x in packaged_kernel_version):
             continue
         elif (
             kernel_key not in releases or releases[kernel_key].version < version
@@ -245,7 +264,7 @@ for kernel_key in sorted(releases.keys()):
     old_version_str: Optional[str] = None
     update: bool
     try:
-        old_filename = patches[kernel_key]["name"]
+        old_filename = patches[kernel_key]["patch"]["name"]
         old_version_str = old_filename.replace("linux-hardened-", "").replace(
             ".patch", ""
         )
diff --git a/pkgs/os-specific/linux/kernel/htmldocs.nix b/pkgs/os-specific/linux/kernel/htmldocs.nix
new file mode 100644
index 00000000000..ba641347c83
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/htmldocs.nix
@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, graphviz
+, imagemagick
+, linux_latest
+, makeFontsConf
+, perl
+, python3
+, sphinx
+, which
+}:
+
+stdenv.mkDerivation {
+  pname = "linux-kernel-latest-htmldocs";
+
+  inherit (linux_latest) version src;
+
+  postPatch = ''
+    patchShebangs \
+      Documentation/sphinx/parse-headers.pl \
+      scripts/{get_abi.pl,get_feat.pl,kernel-doc,sphinx-pre-install}
+  '';
+
+  FONTCONFIG_FILE = makeFontsConf {
+    fontDirectories = [ ];
+  };
+
+  nativeBuildInputs = [
+    graphviz
+    imagemagick
+    perl
+    python3.pkgs.sphinx
+    python3.pkgs.sphinx-rtd-theme
+    which
+  ];
+
+  preBuild = ''
+    export XDG_CACHE_HOME="$(mktemp -d)"
+  '';
+
+  makeFlags = [ "htmldocs" ];
+
+  installPhase = ''
+    mkdir -p $out/share/doc
+    mv Documentation/output $out/share/doc/linux-doc
+    cp -r Documentation/* $out/share/doc/linux-doc/
+  '';
+
+  meta = with lib; {
+    description = "Linux kernel html documentation";
+    homepage = "https://www.kernel.org/doc/htmldocs/";
+    platforms = platforms.linux;
+    inherit (linux_latest.meta) license;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
new file mode 100644
index 00000000000..94ab60aa67b
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -0,0 +1,38 @@
+{
+    "testing": {
+        "version": "6.7-rc1",
+        "hash": "sha256:1a071vvmm08sp48d0arqzcmqnz5xdb1vflfhxcqwmpzaabjrgadk"
+    },
+    "6.5": {
+        "version": "6.5.11",
+        "hash": "sha256:06dmb4hbwrms0lp4axphwgj8wbnzsym70sx55lxr501b53wlmqif"
+    },
+    "6.1": {
+        "version": "6.1.62",
+        "hash": "sha256:1v453q4sf0j8708ivs1zmdf645hgimqvxfc8xz7czgnnmipn3zdr"
+    },
+    "5.15": {
+        "version": "5.15.138",
+        "hash": "sha256:1ajaxy97gx0c9cdxiyxa49ykfsykir22i9abfrcizh71ci0yb15g"
+    },
+    "5.10": {
+        "version": "5.10.200",
+        "hash": "sha256:012i41bj8rcqn0vhfxrwq3gg82nb6pp2cwq8n146wj47pwgrcbcx"
+    },
+    "5.4": {
+        "version": "5.4.260",
+        "hash": "sha256:1zpbaipd2j3idj8h9iznlj0ywcq5nkhwj707a1f9ixf82h3q4c4q"
+    },
+    "4.19": {
+        "version": "4.19.298",
+        "hash": "sha256:0mhgq6hdcls1af7nj999x1mds5b37s7vwin8nsb4q0lnx2y1da4x"
+    },
+    "4.14": {
+        "version": "4.14.329",
+        "hash": "sha256:1dvb4xf0b7snabznl7bg7gga7ffdmywy8vr8q65pzl9yf6fnhdny"
+    },
+    "6.6": {
+        "version": "6.6.1",
+        "hash": "sha256:0d42b1hbvv9w3y3q4wydr6il0g5a823n54a06p4p5vcpgkadf7ns"
+    }
+}
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
deleted file mode 100644
index ccecc433a4a..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "4.14.240";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1k65qwzlnqnh9ym0n2fxpa8nk2qwvykwhwgaixk3b7ndzmr8b6c8";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_14 ];
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
deleted file mode 100644
index 4ed06ee2205..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "4.19.198";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "13k0r6a4n8nbni64a18wqzy0pg4vn1zw2li78xrm78rqcrnah85y";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_19 ];
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
deleted file mode 100644
index 6c2595386e0..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
-
-buildLinux (args // rec {
-  version = "4.4.276";
-  extraMeta.branch = "4.4";
-  extraMeta.broken = stdenv.isAarch64;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1hf9h5kr1ws2lvinzq6cv7aps8af1kx4q8j4bsk2vv4i2zvmfr7y";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_4 ];
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
deleted file mode 100644
index 0dc5cfeae6e..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ /dev/null
@@ -1,14 +0,0 @@
-{ buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
-
-buildLinux (args // rec {
-  version = "4.9.276";
-  extraMeta.branch = "4.9";
-  extraMeta.broken = stdenv.isAarch64;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "16jp05jhmqcp8lawqga69gxn1acdkxsskn3a6wf0635863fky3hv";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_4_9 ];
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.10.nix b/pkgs/os-specific/linux/kernel/linux-5.10.nix
deleted file mode 100644
index f59cca3e12f..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.10.52";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0ydf09wsg0pkjm9dk8y730ksg15p5rlbhq445zx8k191zah5g7kn";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_10 ];
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.12.nix b/pkgs/os-specific/linux/kernel/linux-5.12.nix
deleted file mode 100644
index e1e7aec2ce2..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.12.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.12.19";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0wscz736n13m833cd12lskn47r0b8ki4fhgpjnwga0jsab9iqf79";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_12 ];
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.13.nix b/pkgs/os-specific/linux/kernel/linux-5.13.nix
deleted file mode 100644
index bece15821a8..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.13.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.13.6";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0xjjl8dmilp425b1cp977v26qxlg1147gh54kni949pzxwh1fb56";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_13 ];
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
deleted file mode 100644
index c4e08b685b5..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.4.134";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0haqw1w6f8p330ydbsl7iml1x0qqrv63az6921p2a70n88b8dyy9";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_5_4 ];
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-cros.nix b/pkgs/os-specific/linux/kernel/linux-cros.nix
deleted file mode 100644
index edaa33ac0fb..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-cros.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ stdenv, lib, buildPackages, fetchFromGitiles, upstreamInfo, perl, buildLinux
-, modDirVersionArg ? null
-, ... } @ args:
-
-let
-  versionData = upstreamInfo.components."src/third_party/kernel/v5.4";
-in
-
-with lib;
-with lib.kernel;
-
-buildLinux (args // rec {
-  inherit (versionData) version;
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion =
-    if modDirVersionArg == null
-    then concatStringsSep "." (take 3 (splitVersion "${version}.0"))
-    else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchFromGitiles { inherit (versionData) name url rev sha256; };
-
-  updateScript = ../chromium-os/update.py;
-
-  structuredExtraConfig = {
-    # Enabling this (the default) caused a build failure.  If you can
-    # archieve a successful build with this enabled, go ahead and
-    # enable it.
-    VIDEO_INTEL_IPU6 = no;
-
-    # RTW88_8822*E were being selected as Y when N/m/? are the only valid options
-    RTW88_8822BE = lib.mkForce module;
-    RTW88_8822CE = lib.mkForce module;
-  } // (args.structuredExtraConfig or {});
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix b/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix
deleted file mode 100644
index a64520ab893..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix
+++ /dev/null
@@ -1,33 +0,0 @@
-{ buildPackages, fetchFromGitHub, perl, buildLinux, libelf, util-linux, ... } @ args:
-
-buildLinux (args // rec {
-  version = "4.14.165-172";
-
-  # modDirVersion needs to be x.y.z.
-  modDirVersion = "4.14.165";
-
-  # branchVersion needs to be x.y.
-  extraMeta.branch = "4.14";
-
-  src = fetchFromGitHub {
-    owner = "hardkernel";
-    repo = "linux";
-    rev = version;
-    sha256 = "10ayqjjs2hxj1q7sb0mxa3gv75q28lznjha19rpxvig2fpi8015s";
-  };
-
-  defconfig = "odroidxu4_defconfig";
-
-  # This extraConfig is (only) required because the gator module fails to build as-is.
-  extraConfig = ''
-
-    GATOR n
-
-    # This attempted fix applies correctly but does not fix the build.
-    #GATOR_MALI_MIDGARD_PATH ${src}/drivers/gpu/arm/midgard
-
-  '' + (args.extraConfig or "");
-
-  extraMeta.platforms = [ "armv7l-linux" ];
-
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index f02c1ad1250..9cf5f46cfb8 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18191";
-    sha256 = "0ggaccg7z540kh5if48v6sjy39xllzvznqx5srvrlycrs2r89iyr";
+    rev = "19441";
+    sha256 = "1z0x8cw9nr7qf5qh3xjf6rg20q0i79bg71lik847sabyb6vcrk0z";
   }
 , ...
 }:
@@ -14,9 +14,14 @@ let
   minor = lib.versions.minor linux.modDirVersion;
   patch = lib.versions.patch linux.modDirVersion;
 
+  # See http://linux-libre.fsfla.org/pub/linux-libre/releases
+  versionPrefix = if linux.kernelOlder "5.14" then
+    "gnu1"
+  else
+    "gnu";
 in linux.override {
   argsOverride = {
-    modDirVersion = "${linux.modDirVersion}-gnu";
+    modDirVersion = "${linux.modDirVersion}-${versionPrefix}";
     isLibre = true;
 
     src = stdenv.mkDerivation {
@@ -35,10 +40,8 @@ in linux.override {
       '';
     };
 
-    extraMeta.broken = true;
-
     passthru.updateScript = ./update-libre.sh;
 
-    maintainers = [ lib.maintainers.qyliss ];
+    maintainers = with lib.maintainers; [ qyliss ivar ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-lqx.nix b/pkgs/os-specific/linux/kernel/linux-lqx.nix
deleted file mode 100644
index 23a6b0b2d36..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-lqx.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, fetchFromGitHub, buildLinux, linux_zen, ... } @ args:
-
-let
-  version = "5.12.19";
-  suffix = "lqx2";
-in
-
-buildLinux (args // {
-  modDirVersion = "${version}-${suffix}";
-  inherit version;
-  isZen = true;
-
-  src = fetchFromGitHub {
-    owner = "zen-kernel";
-    repo = "zen-kernel";
-    rev = "v${version}-${suffix}";
-    sha256 = "sha256-r2DvKLlm1a1VuJwC81tRuRwCd6H21T3MsBAC3b9TUbs=";
-  };
-
-  extraMeta = {
-    branch = "5.12/master";
-    maintainers = with lib.maintainers; [ atemu ];
-    description = linux_zen.meta.description + " (Same as linux_zen but less aggressive release schedule)";
-  };
-
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-mptcp-95.nix b/pkgs/os-specific/linux/kernel/linux-mptcp-95.nix
deleted file mode 100644
index a6a8d4936d4..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-mptcp-95.nix
+++ /dev/null
@@ -1,27 +0,0 @@
-{ lib, buildPackages, fetchFromGitHub, perl, buildLinux, structuredExtraConfig ? {}, ... } @ args:
-let
-  mptcpVersion = "0.95.1";
-  modDirVersion = "4.19.126";
-in
-buildLinux ({
-  version = "${modDirVersion}-mptcp_v${mptcpVersion}";
-  inherit modDirVersion;
-
-  extraMeta = {
-    branch = "4.19";
-    maintainers = with lib.maintainers; [ teto layus ];
-  };
-
-  src = fetchFromGitHub {
-    owner = "multipath-tcp";
-    repo = "mptcp";
-    rev = "v${mptcpVersion}";
-    sha256 = "sha256-J9UXhkI49cq83EtojLHieRtp8fT3LXTJNIqb+mUwZdM=";
-  };
-
-  structuredExtraConfig = lib.mkMerge [
-    (import ./mptcp-config.nix { inherit lib; })
-    structuredExtraConfig
-  ];
-
-} // args)
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 8ccf46b402b..1bea6197529 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -2,8 +2,8 @@
 
 let
   # NOTE: raspberrypifw & raspberryPiWirelessFirmware should be updated with this
-  modDirVersion = "5.10.17";
-  tag = "1.20210303";
+  modDirVersion = "6.1.21";
+  tag = "1.20230405";
 in
 lib.overrideDerivation (buildLinux (args // {
   version = "${modDirVersion}-${tag}";
@@ -12,8 +12,8 @@ lib.overrideDerivation (buildLinux (args // {
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "linux";
-    rev = "raspberrypi-kernel_${tag}-1";
-    sha256 = "0ffsllayl18ka4mgp4rdy9h0da5gy1n6g0kfvinvzdzabb5wzvrx";
+    rev = tag;
+    hash = "sha256-ILwecHZ1BN6GhZAUB6/UwiN/rZ8gHndKON6DUhidtxI=";
   };
 
   defconfig = {
@@ -27,19 +27,11 @@ lib.overrideDerivation (buildLinux (args // {
     efiBootStub = false;
   } // (args.features or {});
 
-  extraConfig = ''
-    # ../drivers/gpu/drm/ast/ast_mode.c:851:18: error: initialization of 'void (*)(struct drm_crtc *, struct drm_atomic_state *)' from incompatible pointer type 'void (*)(struct drm_crtc *, struct drm_crtc_state *)' [-Werror=incompatible-pointer-types]
-    #   851 |  .atomic_flush = ast_crtc_helper_atomic_flush,
-    #       |                  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
-    # ../drivers/gpu/drm/ast/ast_mode.c:851:18: note: (near initialization for 'ast_crtc_helper_funcs.atomic_flush')
-    DRM_AST n
-  '';
-
   extraMeta = if (rpiVersion < 3) then {
-    platforms = with lib.platforms; [ arm ];
+    platforms = with lib.platforms; arm;
     hydraPlatforms = [];
   } else {
-    platforms = with lib.platforms; [ arm aarch64 ];
+    platforms = with lib.platforms; arm ++ aarch64;
     hydraPlatforms = [ "aarch64-linux" ];
   };
 } // (args.argsOverride or {}))) (oldAttrs: {
@@ -70,6 +62,7 @@ lib.overrideDerivation (buildLinux (args // {
   '' + lib.optionalString (lib.elem stdenv.hostPlatform.system ["armv7l-linux"]) ''
     copyDTB bcm2709-rpi-2-b.dtb bcm2836-rpi-2-b.dtb
   '' + lib.optionalString (lib.elem stdenv.hostPlatform.system ["armv7l-linux" "aarch64-linux"]) ''
+    copyDTB bcm2710-rpi-zero-2.dtb bcm2837-rpi-zero-2.dtb
     copyDTB bcm2710-rpi-3-b.dtb bcm2837-rpi-3-b.dtb
     copyDTB bcm2710-rpi-3-b-plus.dtb bcm2837-rpi-3-a-plus.dtb
     copyDTB bcm2710-rpi-3-b-plus.dtb bcm2837-rpi-3-b-plus.dtb
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 83b2fc05093..65ca352b53b 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,26 +6,25 @@
 , ... } @ args:
 
 let
-  version = "5.10.52-rt47"; # updated by ./update-rt.sh
+  version = "5.10.199-rt97"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
   inherit version;
 
   # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
-  modDirVersion = if (builtins.match "[^.]*[.][^.]*-.*" version) == null then version
-    else lib.replaceStrings ["-"] [".0-"] version;
+  modDirVersion = lib.versions.pad 3 version;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0ydf09wsg0pkjm9dk8y730ksg15p5rlbhq445zx8k191zah5g7kn";
+    sha256 = "1h944syk7n6c4j1djlx19n77alzwbxcdza77c9ykicgfynhpgsm0";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1n71nbshma0gxyrifyymrd0wii1q0plj020amc0wdzzm27xs5k2k";
+      sha256 = "13k7md0a63q4r5vqqvbszmg3kzp5np0hdaj1siyl4yvs9j78d03s";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.11.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 5d1b14f1d0f..bc45a86905c 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.11.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.11.4-rt11"; # updated by ./update-rt.sh
+  version = "5.15.137-rt71"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1i8dfw83ndaylwji7lazfckk113plvnz7kh1yppbfg35r6przrc8";
+    sha256 = "1xxjbxldrhmnh2q6rykpxyfbj8xqgl82q30n8sfavrzr14bb4jcp";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1az6cn9jj3bnjgwzzrjy1adnrnn06p2vzsnc1iib4xhs0sfr27hc";
+      sha256 = "11zk02ni3b0l1wwrfvyc1q92bd9as61hwgbwlj42xv5gbpd39jlw";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 4c49dc9c42a..22e07bfd0f5 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.129-rt61"; # updated by ./update-rt.sh
+  version = "5.4.257-rt87"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1ps64gx85lmbriq445hd2hcv4g4b1d1cwf4r3nd90x6i2cj4c9j4";
+    sha256 = "1w1x91slzg9ggakqhyxnmvz77v2cwfk8bz0knrpgz9qya9q5jxrf";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0b3hp6a7afkjqd7an4hj423nq6flwzd42kjcyk4pifv5fx6c7pgq";
+      sha256 = "0rgkk5ibagsyz9in12clzn7szsw1i3m96s8wy5yxwa26aaa2wki7";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
new file mode 100644
index 00000000000..85c8a8b8a10
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -0,0 +1,45 @@
+{ lib, buildLinux, fetchurl
+, kernelPatches ? [ ]
+, structuredExtraConfig ? {}
+, extraMeta ? {}
+, argsOverride ? {}
+, ... } @ args:
+
+let
+  version = "6.1.59-rt16"; # updated by ./update-rt.sh
+  branch = lib.versions.majorMinor version;
+  kversion = builtins.elemAt (lib.splitString "-" version) 0;
+in buildLinux (args // {
+  inherit version;
+
+  # modDirVersion needs a patch number, change X.Y-rtZ to X.Y.0-rtZ.
+  modDirVersion = if (builtins.match "[^.]*[.][^.]*-.*" version) == null then version
+    else lib.replaceStrings ["-"] [".0-"] version;
+
+  src = fetchurl {
+    url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
+    sha256 = "1860r1aan258yi2jq68bp1kdbcyy7ygc7d8g54wnc0vmqqj7fzv2";
+  };
+
+  kernelPatches = let rt-patch = {
+    name = "rt";
+    patch = fetchurl {
+      url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
+      sha256 = "1cmgw6a8zlj89172mp85lxaksz1pvc155mj2fq59l1ry35gwb5q7";
+    };
+  }; in [ rt-patch ] ++ kernelPatches;
+
+  structuredExtraConfig = with lib.kernel; {
+    PREEMPT_RT = yes;
+    # Fix error: unused option: PREEMPT_RT.
+    EXPERT = yes; # PREEMPT_RT depends on it (in kernel/Kconfig.preempt)
+    # Fix error: option not set correctly: PREEMPT_VOLUNTARY (wanted 'y', got 'n').
+    PREEMPT_VOLUNTARY = lib.mkForce no; # PREEMPT_RT deselects it.
+    # Fix error: unused option: RT_GROUP_SCHED.
+    RT_GROUP_SCHED = lib.mkForce (option no); # Removed by sched-disable-rt-group-sched-on-rt.patch.
+  } // structuredExtraConfig;
+
+  extraMeta = extraMeta // {
+    inherit branch;
+  };
+} // argsOverride)
diff --git a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index a12633eb6d7..c58c4e67e4d 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,33 +1,46 @@
 { lib
+, stdenv
 , fetchpatch
 , kernel
-, date ? "2021-07-08"
-, commit ? "3693b2ca83ff9eda49660b31299d2bebe3a1075f"
-, diffHash ? "1sfq3vwc2kxa761s292f2cqrm0vvqvkdx6drpyn5yaxwnapwidcw"
+, commitDate ? "2023-06-28"
+# bcachefs-tools stores the expected-revision in:
+#   https://evilpiepirate.org/git/bcachefs-tools.git/tree/.bcachefs_revision
+# but this does not means that it'll be the latest-compatible revision
+, currentCommit ? "4d2faeb4fb58c389dc9f76b8d5ae991ef4497e04"
+, diffHash ? "sha256-DtMc8P4lTRzvS6PVvD7WtWEPsfnxIXSpqMsKKWs+edI="
 , kernelPatches # must always be defined in bcachefs' all-packages.nix entry because it's also a top-level attribute supplied by callPackage
 , argsOverride ? {}
 , ...
 } @ args:
-
-kernel.override ( args // {
+# NOTE: bcachefs-tools should be updated simultaneously to preserve compatibility
+(kernel.override ( args // {
 
   argsOverride = {
-    version = "${kernel.version}-bcachefs-unstable-${date}";
+    version = "${kernel.version}-bcachefs-unstable-${commitDate}";
+    modDirVersion = kernel.modDirVersion;
+
     extraMeta = {
+      homepage = "https://bcachefs.org/";
       branch = "master";
-      maintainers = with lib.maintainers; [ davidak chiiruno ];
-      platforms = [ "x86_64-linux" ];
+      maintainers = with lib.maintainers; [ davidak Madouura pedrohlc raitobezarius YellowOnion ];
     };
   } // argsOverride;
 
+  structuredExtraConfig = with lib.kernel; {
+    BCACHEFS_FS = module;
+    BCACHEFS_QUOTA = option yes;
+    BCACHEFS_POSIX_ACL = option yes;
+    # useful for bug reports
+    FTRACE = option yes;
+  };
+
   kernelPatches = [ {
-      name = "bcachefs-${commit}";
+      name = "bcachefs-${currentCommit}";
+
       patch = fetchpatch {
-        name = "bcachefs-${commit}.diff";
-        url = "https://evilpiepirate.org/git/bcachefs.git/rawdiff/?id=${commit}&id2=v${lib.versions.majorMinor kernel.version}";
+        name = "bcachefs-${currentCommit}.diff";
+        url = "https://evilpiepirate.org/git/bcachefs.git/rawdiff/?id=${currentCommit}&id2=v${lib.versions.majorMinor kernel.version}";
         sha256 = diffHash;
       };
-      extraConfig = "BCACHEFS_FS m";
     } ] ++ kernelPatches;
-
-})
+}))
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
deleted file mode 100644
index 4e2ef7b4652..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.13-rc6";
-  extraMeta.branch = "5.12";
-
-  # modDirVersion needs to be x.y.z, will always add .0
-  modDirVersion = if (modDirVersionArg == null) then builtins.replaceStrings ["-"] [".0-"] version else modDirVersionArg;
-
-  src = fetchurl {
-    url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    sha256 = "sha256-PunFd6tOsmrsPItp2QX4TEVxHnvvi1BMSwWio/DTlMU=";
-  };
-
-  kernelTests = args.kernelTests or [ nixosTests.kernel-generic.linux_testing ];
-
-  # Should the testing kernels ever be built on Hydra?
-  extraMeta.hydraPlatforms = [];
-
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-xanmod.nix b/pkgs/os-specific/linux/kernel/linux-xanmod.nix
deleted file mode 100644
index 62e88d01853..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-xanmod.nix
+++ /dev/null
@@ -1,55 +0,0 @@
-{ lib, stdenv, buildLinux, fetchFromGitHub, ... } @ args:
-
-let
-  version = "5.13.7";
-  release = "1";
-  suffix = "xanmod${release}-cacule";
-in
-buildLinux (args // rec {
-  inherit version;
-  modDirVersion = "${version}-${suffix}";
-
-  src = fetchFromGitHub {
-    owner = "xanmod";
-    repo = "linux";
-    rev = modDirVersion;
-    sha256 = "sha256-6SppDriZWzLu6Qye1e6ciiE+Ro63vDyabxfgWS/PTSo=";
-  };
-
-  structuredExtraConfig = with lib.kernel; {
-    # Preemptive Full Tickless Kernel at 500Hz
-    PREEMPT_VOLUNTARY = lib.mkForce no;
-    PREEMPT = lib.mkForce yes;
-    NO_HZ_FULL = yes;
-    HZ_500 = yes;
-
-    # Google's Multigenerational LRU Framework
-    LRU_GEN = yes;
-    LRU_GEN_ENABLED = yes;
-
-    # Google's BBRv2 TCP congestion Control
-    TCP_CONG_BBR2 = yes;
-    DEFAULT_BBR2 = yes;
-
-    # FQ-PIE Packet Scheduling
-    NET_SCH_DEFAULT = yes;
-    DEFAULT_FQ_PIE = yes;
-
-    # Graysky's additional CPU optimizations
-    CC_OPTIMIZE_FOR_PERFORMANCE_O3 = yes;
-
-    # Android Ashmem and Binder IPC Driver as module for Anbox
-    ASHMEM = module;
-    ANDROID = yes;
-    ANDROID_BINDER_IPC = module;
-    ANDROID_BINDERFS = module;
-    ANDROID_BINDER_DEVICES = freeform "binder,hwbinder,vndbinder";
-  };
-
-  extraMeta = {
-    branch = "5.13-cacule";
-    maintainers = with lib.maintainers; [ fortuneteller2k ];
-    description = "Built with custom settings and new features built to provide a stable, responsive and smooth desktop experience";
-    broken = stdenv.isAarch64;
-  };
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-zen.nix b/pkgs/os-specific/linux/kernel/linux-zen.nix
deleted file mode 100644
index 2b91a259232..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ lib, fetchFromGitHub, buildLinux, ... } @ args:
-
-let
-  version = "5.13.7";
-  suffix = "zen1";
-in
-
-buildLinux (args // {
-  modDirVersion = "${version}-${suffix}";
-  inherit version;
-  isZen = true;
-
-  src = fetchFromGitHub {
-    owner = "zen-kernel";
-    repo = "zen-kernel";
-    rev = "v${version}-${suffix}";
-    sha256 = "sha256-ZvB5Ejt9MXP4QK5cj9CGQgFJIfDV03IW5xcknCxDui0=";
-  };
-
-  structuredExtraConfig = with lib.kernel; {
-    ZEN_INTERACTIVE = yes;
-  };
-
-  extraMeta = {
-    branch = "5.13";
-    maintainers = with lib.maintainers; [ atemu andresilva ];
-    description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads.";
-  };
-
-} // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/mac-nvme-t2.patch b/pkgs/os-specific/linux/kernel/mac-nvme-t2.patch
deleted file mode 100644
index 2f1fa6a0dae..00000000000
--- a/pkgs/os-specific/linux/kernel/mac-nvme-t2.patch
+++ /dev/null
@@ -1,283 +0,0 @@
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index dd10cf78f2d3..8f006638452b 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -28,8 +28,8 @@
- #include "trace.h"
- #include "nvme.h"
- 
--#define SQ_SIZE(depth)		(depth * sizeof(struct nvme_command))
--#define CQ_SIZE(depth)		(depth * sizeof(struct nvme_completion))
-+#define SQ_SIZE(q)	((q)->q_depth * sizeof(struct nvme_command))
-+#define CQ_SIZE(q)	((q)->q_depth * sizeof(struct nvme_completion))
- 
- #define SGES_PER_PAGE	(PAGE_SIZE / sizeof(struct nvme_sgl_desc))
- 
-@@ -1344,16 +1344,16 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved)
- 
- static void nvme_free_queue(struct nvme_queue *nvmeq)
- {
--	dma_free_coherent(nvmeq->dev->dev, CQ_SIZE(nvmeq->q_depth),
-+	dma_free_coherent(nvmeq->dev->dev, CQ_SIZE(nvmeq),
- 				(void *)nvmeq->cqes, nvmeq->cq_dma_addr);
- 	if (!nvmeq->sq_cmds)
- 		return;
- 
- 	if (test_and_clear_bit(NVMEQ_SQ_CMB, &nvmeq->flags)) {
- 		pci_free_p2pmem(to_pci_dev(nvmeq->dev->dev),
--				nvmeq->sq_cmds, SQ_SIZE(nvmeq->q_depth));
-+				nvmeq->sq_cmds, SQ_SIZE(nvmeq));
- 	} else {
--		dma_free_coherent(nvmeq->dev->dev, SQ_SIZE(nvmeq->q_depth),
-+		dma_free_coherent(nvmeq->dev->dev, SQ_SIZE(nvmeq),
- 				nvmeq->sq_cmds, nvmeq->sq_dma_addr);
- 	}
- }
-@@ -1433,12 +1433,12 @@ static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues,
- }
- 
- static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
--				int qid, int depth)
-+				int qid)
- {
- 	struct pci_dev *pdev = to_pci_dev(dev->dev);
- 
- 	if (qid && dev->cmb_use_sqes && (dev->cmbsz & NVME_CMBSZ_SQS)) {
--		nvmeq->sq_cmds = pci_alloc_p2pmem(pdev, SQ_SIZE(depth));
-+		nvmeq->sq_cmds = pci_alloc_p2pmem(pdev, SQ_SIZE(nvmeq));
- 		if (nvmeq->sq_cmds) {
- 			nvmeq->sq_dma_addr = pci_p2pmem_virt_to_bus(pdev,
- 							nvmeq->sq_cmds);
-@@ -1447,11 +1447,11 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq,
- 				return 0;
- 			}
- 
--			pci_free_p2pmem(pdev, nvmeq->sq_cmds, SQ_SIZE(depth));
-+			pci_free_p2pmem(pdev, nvmeq->sq_cmds, SQ_SIZE(nvmeq));
- 		}
- 	}
- 
--	nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
-+	nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(nvmeq),
- 				&nvmeq->sq_dma_addr, GFP_KERNEL);
- 	if (!nvmeq->sq_cmds)
- 		return -ENOMEM;
-@@ -1465,12 +1465,13 @@ static int nvme_alloc_queue(struct nvme_dev *dev, int qid, int depth)
- 	if (dev->ctrl.queue_count > qid)
- 		return 0;
- 
--	nvmeq->cqes = dma_alloc_coherent(dev->dev, CQ_SIZE(depth),
-+	nvmeq->q_depth = depth;
-+	nvmeq->cqes = dma_alloc_coherent(dev->dev, CQ_SIZE(nvmeq),
- 					 &nvmeq->cq_dma_addr, GFP_KERNEL);
- 	if (!nvmeq->cqes)
- 		goto free_nvmeq;
- 
--	if (nvme_alloc_sq_cmds(dev, nvmeq, qid, depth))
-+	if (nvme_alloc_sq_cmds(dev, nvmeq, qid))
- 		goto free_cqdma;
- 
- 	nvmeq->dev = dev;
-@@ -1479,15 +1480,14 @@ static int nvme_alloc_queue(struct nvme_dev *dev, int qid, int depth)
- 	nvmeq->cq_head = 0;
- 	nvmeq->cq_phase = 1;
- 	nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride];
--	nvmeq->q_depth = depth;
- 	nvmeq->qid = qid;
- 	dev->ctrl.queue_count++;
- 
- 	return 0;
- 
-  free_cqdma:
--	dma_free_coherent(dev->dev, CQ_SIZE(depth), (void *)nvmeq->cqes,
--							nvmeq->cq_dma_addr);
-+	dma_free_coherent(dev->dev, CQ_SIZE(nvmeq), (void *)nvmeq->cqes,
-+			  nvmeq->cq_dma_addr);
-  free_nvmeq:
- 	return -ENOMEM;
- }
-@@ -1515,7 +1515,7 @@ static void nvme_init_queue(struct nvme_queue *nvmeq, u16 qid)
- 	nvmeq->cq_head = 0;
- 	nvmeq->cq_phase = 1;
- 	nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride];
--	memset((void *)nvmeq->cqes, 0, CQ_SIZE(nvmeq->q_depth));
-+	memset((void *)nvmeq->cqes, 0, CQ_SIZE(nvmeq));
- 	nvme_dbbuf_init(dev, nvmeq, qid);
- 	dev->online_queues++;
- 	wmb(); /* ensure the first interrupt sees the initialization */
-diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
-index cc09b81fc7f4..716ebe87a2b8 100644
---- a/drivers/nvme/host/core.c
-+++ b/drivers/nvme/host/core.c
-@@ -1986,6 +1986,7 @@ int nvme_enable_ctrl(struct nvme_ctrl *ctrl, u64 cap)
- 	ctrl->ctrl_config = NVME_CC_CSS_NVM;
- 	ctrl->ctrl_config |= (page_shift - 12) << NVME_CC_MPS_SHIFT;
- 	ctrl->ctrl_config |= NVME_CC_AMS_RR | NVME_CC_SHN_NONE;
-+	/* Use default IOSQES. We'll update it later if needed */
- 	ctrl->ctrl_config |= NVME_CC_IOSQES | NVME_CC_IOCQES;
- 	ctrl->ctrl_config |= NVME_CC_ENABLE;
- 
-@@ -2698,6 +2699,30 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
- 		ctrl->hmmin = le32_to_cpu(id->hmmin);
- 		ctrl->hmminds = le32_to_cpu(id->hmminds);
- 		ctrl->hmmaxd = le16_to_cpu(id->hmmaxd);
-+
-+		/* Grab required IO queue size */
-+		ctrl->iosqes = id->sqes & 0xf;
-+		if (ctrl->iosqes < NVME_NVM_IOSQES) {
-+			dev_err(ctrl->device,
-+				"unsupported required IO queue size %d\n", ctrl->iosqes);
-+			ret = -EINVAL;
-+			goto out_free;
-+		}
-+		/*
-+		 * If our IO queue size isn't the default, update the setting
-+		 * in CC:IOSQES.
-+		 */
-+		if (ctrl->iosqes != NVME_NVM_IOSQES) {
-+			ctrl->ctrl_config &= ~(0xfu << NVME_CC_IOSQES_SHIFT);
-+			ctrl->ctrl_config |= ctrl->iosqes << NVME_CC_IOSQES_SHIFT;
-+			ret = ctrl->ops->reg_write32(ctrl, NVME_REG_CC,
-+						     ctrl->ctrl_config);
-+			if (ret) {
-+				dev_err(ctrl->device,
-+					"error updating CC register\n");
-+				goto out_free;
-+			}
-+		}
- 	}
- 
- 	ret = nvme_mpath_init(ctrl, id);
-diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
-index 716a876119c8..34ef35fcd8a5 100644
---- a/drivers/nvme/host/nvme.h
-+++ b/drivers/nvme/host/nvme.h
-@@ -244,6 +244,7 @@ struct nvme_ctrl {
- 	u32 hmmin;
- 	u32 hmminds;
- 	u16 hmmaxd;
-+	u8 iosqes;
- 
- 	/* Fabrics only */
- 	u16 sqsize;
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index 8f006638452b..54b35ea4af88 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -28,7 +28,7 @@
- #include "trace.h"
- #include "nvme.h"
- 
--#define SQ_SIZE(q)	((q)->q_depth * sizeof(struct nvme_command))
-+#define SQ_SIZE(q)	((q)->q_depth << (q)->sqes)
- #define CQ_SIZE(q)	((q)->q_depth * sizeof(struct nvme_completion))
- 
- #define SGES_PER_PAGE	(PAGE_SIZE / sizeof(struct nvme_sgl_desc))
-@@ -162,7 +162,7 @@ static inline struct nvme_dev *to_nvme_dev(struct nvme_ctrl *ctrl)
- struct nvme_queue {
- 	struct nvme_dev *dev;
- 	spinlock_t sq_lock;
--	struct nvme_command *sq_cmds;
-+	void *sq_cmds;
- 	 /* only used for poll queues: */
- 	spinlock_t cq_poll_lock ____cacheline_aligned_in_smp;
- 	volatile struct nvme_completion *cqes;
-@@ -178,6 +178,7 @@ struct nvme_queue {
- 	u16 last_cq_head;
- 	u16 qid;
- 	u8 cq_phase;
-+	u8 sqes;
- 	unsigned long flags;
- #define NVMEQ_ENABLED		0
- #define NVMEQ_SQ_CMB		1
-@@ -488,7 +489,8 @@ static void nvme_submit_cmd(struct nvme_queue *nvmeq, struct nvme_command *cmd,
- 			    bool write_sq)
- {
- 	spin_lock(&nvmeq->sq_lock);
--	memcpy(&nvmeq->sq_cmds[nvmeq->sq_tail], cmd, sizeof(*cmd));
-+	memcpy(nvmeq->sq_cmds + (nvmeq->sq_tail << nvmeq->sqes),
-+	       cmd, sizeof(*cmd));
- 	if (++nvmeq->sq_tail == nvmeq->q_depth)
- 		nvmeq->sq_tail = 0;
- 	nvme_write_sq_db(nvmeq, write_sq);
-@@ -1465,6 +1467,7 @@ static int nvme_alloc_queue(struct nvme_dev *dev, int qid, int depth)
- 	if (dev->ctrl.queue_count > qid)
- 		return 0;
- 
-+	nvmeq->sqes = qid ? dev->ctrl.iosqes : NVME_NVM_ADMSQES;
- 	nvmeq->q_depth = depth;
- 	nvmeq->cqes = dma_alloc_coherent(dev->dev, CQ_SIZE(nvmeq),
- 					 &nvmeq->cq_dma_addr, GFP_KERNEL);
-diff --git a/include/linux/nvme.h b/include/linux/nvme.h
-index 01aa6a6c241d..7af18965fb57 100644
---- a/include/linux/nvme.h
-+++ b/include/linux/nvme.h
-@@ -141,6 +141,7 @@ enum {
-  * (In bytes and specified as a power of two (2^n)).
-  */
- #define NVME_NVM_IOSQES		6
-+#define NVME_NVM_ADMSQES	6
- #define NVME_NVM_IOCQES		4
- 
- enum {
-diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
-index 716ebe87a2b8..480ea24d8cf4 100644
---- a/drivers/nvme/host/core.c
-+++ b/drivers/nvme/host/core.c
-@@ -2701,7 +2701,10 @@ int nvme_init_identify(struct nvme_ctrl *ctrl)
- 		ctrl->hmmaxd = le16_to_cpu(id->hmmaxd);
- 
- 		/* Grab required IO queue size */
--		ctrl->iosqes = id->sqes & 0xf;
-+		if (ctrl->quirks & NVME_QUIRK_128_BYTES_SQES)
-+			ctrl->iosqes = 7;
-+		else
-+			ctrl->iosqes = id->sqes & 0xf;
- 		if (ctrl->iosqes < NVME_NVM_IOSQES) {
- 			dev_err(ctrl->device,
- 				"unsupported required IO queue size %d\n", ctrl->iosqes);
-diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
-index 34ef35fcd8a5..b2a78d08b984 100644
---- a/drivers/nvme/host/nvme.h
-+++ b/drivers/nvme/host/nvme.h
-@@ -92,6 +92,16 @@ enum nvme_quirks {
- 	 * Broken Write Zeroes.
- 	 */
- 	NVME_QUIRK_DISABLE_WRITE_ZEROES		= (1 << 9),
-+
-+	/*
-+	 * Use only one interrupt vector for all queues
-+	 */
-+	NVME_QUIRK_SINGLE_VECTOR		= (1 << 10),
-+
-+	/*
-+	 * Use non-standard 128 bytes SQEs.
-+	 */
-+	NVME_QUIRK_128_BYTES_SQES		= (1 << 11),
- };
- 
- /*
-diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
-index 54b35ea4af88..ab2358137419 100644
---- a/drivers/nvme/host/pci.c
-+++ b/drivers/nvme/host/pci.c
-@@ -2080,6 +2080,9 @@ static int nvme_setup_irqs(struct nvme_dev *dev, unsigned int nr_io_queues)
- 	dev->io_queues[HCTX_TYPE_DEFAULT] = 1;
- 	dev->io_queues[HCTX_TYPE_READ] = 0;
- 
-+	if (dev->ctrl.quirks & NVME_QUIRK_SINGLE_VECTOR)
-+		irq_queues = 1;
-+
- 	return pci_alloc_irq_vectors_affinity(pdev, 1, irq_queues,
- 			      PCI_IRQ_ALL_TYPES | PCI_IRQ_AFFINITY, &affd);
- }
-@@ -3037,6 +3040,9 @@ static const struct pci_device_id nvme_id_table[] = {
- 	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) },
-+	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005),
-+		.driver_data = NVME_QUIRK_SINGLE_VECTOR |
-+				NVME_QUIRK_128_BYTES_SQES },
- 	{ 0, }
- };
- MODULE_DEVICE_TABLE(pci, nvme_id_table);
diff --git a/pkgs/os-specific/linux/kernel/mainline.nix b/pkgs/os-specific/linux/kernel/mainline.nix
new file mode 100644
index 00000000000..4e1d5b8a9e8
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/mainline.nix
@@ -0,0 +1,27 @@
+{ branch, lib, fetchurl, fetchzip, buildLinux, ... } @ args:
+
+let
+  allKernels = builtins.fromJSON (builtins.readFile ./kernels-org.json);
+  thisKernel = allKernels.${branch};
+  inherit (thisKernel) version;
+
+  src =
+    # testing kernels are a special case because they don't have tarballs on the CDN
+    if branch == "testing"
+      then fetchzip {
+        url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
+        inherit (thisKernel) hash;
+      }
+      else fetchurl {
+        url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
+        inherit (thisKernel) hash;
+      };
+
+  args' = (builtins.removeAttrs args ["branch"]) // {
+    inherit src version;
+
+    modDirVersion = lib.versions.pad 3 version;
+    extraMeta.branch = branch;
+  } // (args.argsOverride or {});
+in
+buildLinux args'
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 77add0aef53..2ba31fbc978 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,9 +1,12 @@
-{ lib, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, libelf, cpio, elfutils, zstd, gawk, python3Minimal
-, writeTextFile
+{ lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
+, libelf, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
+, fetchpatch
 }:
 
 let
+  lib_ = lib;
+  stdenv_ = stdenv;
+
   readConfig = configfile: import (runCommand "config.nix" {} ''
     echo "{" > "$out"
     while IFS='=' read key val; do
@@ -13,16 +16,16 @@ let
     done < "${configfile}"
     echo "}" >> $out
   '').outPath;
-in {
-  lib,
-  # Allow overriding stdenv on each buildLinux call
-  stdenv,
+in lib.makeOverridable ({
   # The kernel version
   version,
+  # Position of the Linux build expression
+  pos ? null,
   # Additional kernel make flags
   extraMakeFlags ? [],
-  # The version of the kernel module directory
-  modDirVersion ? version,
+  # The name of the kernel module directory
+  # Needs to be X.Y.Z[-extra], so pad with zeros if needed.
+  modDirVersion ? lib.versions.pad 3 version,
   # The kernel source (tarball, git checkout, etc.)
   src,
   # a list of { name=..., patch=..., extraConfig=...} patches
@@ -35,7 +38,7 @@ in {
   # Custom seed used for CONFIG_GCC_PLUGIN_RANDSTRUCT if enabled. This is
   # automatically extended with extra per-version and per-config values.
   randstructSeed ? "",
-  # Use defaultMeta // extraMeta
+  # Extra meta attributes
   extraMeta ? {},
 
   # for module compatibility
@@ -46,7 +49,7 @@ in {
   # Whether to utilize the controversial import-from-derivation feature to parse the config
   allowImportFromDerivation ? false,
   # ignored
-  features ? null,
+  features ? null, lib ? lib_, stdenv ? stdenv_,
 }:
 
 let
@@ -54,19 +57,13 @@ let
     hasAttr getAttr optional optionals optionalString optionalAttrs maintainers platforms;
 
   # Dependencies that are required to build kernel modules
-  moduleBuildDependencies = optional (lib.versionAtLeast version "4.14") libelf;
-
-  installkernel = writeTextFile { name = "installkernel"; executable=true; text = ''
-    #!${stdenv.shell} -e
-    mkdir -p $4
-    cp -av $2 $4
-    cp -av $3 $4
-  ''; };
-
-  commonMakeFlags = [
-    "O=$(buildRoot)"
-  ] ++ lib.optionals (stdenv.hostPlatform.linux-kernel ? makeFlags)
-    stdenv.hostPlatform.linux-kernel.makeFlags;
+  moduleBuildDependencies = [
+    pahole
+    perl
+    libelf
+    # module makefiles often run uname commands to find out the kernel version
+    (buildPackages.deterministic-uname.override { inherit modDirVersion; })
+  ] ++ optional (lib.versionAtLeast version "5.13") zstd;
 
   drvAttrs = config_: kernelConf: kernelPatches: configfile:
     let
@@ -88,17 +85,17 @@ let
 
       isModular = config.isYes "MODULES";
 
-      installsFirmware = (config.isEnabled "FW_LOADER") &&
-        (isModular || (config.isDisabled "FIRMWARE_IN_KERNEL")) &&
-        (lib.versionOlder version "4.14");
+      buildDTBs = kernelConf.DTB or false;
+
     in (optionalAttrs isModular { outputs = [ "out" "dev" ]; }) // {
-      passthru = {
+      passthru = rec {
         inherit version modDirVersion config kernelPatches configfile
           moduleBuildDependencies stdenv;
         inherit isZen isHardened isLibre;
         isXen = lib.warn "The isXen attribute is deprecated. All Nixpkgs kernels that support it now have Xen enabled." true;
-        kernelOlder = lib.versionOlder version;
-        kernelAtLeast = lib.versionAtLeast version;
+        baseVersion = lib.head (lib.splitString "-rc" version);
+        kernelOlder = lib.versionOlder baseVersion;
+        kernelAtLeast = lib.versionAtLeast baseVersion;
       };
 
       inherit src;
@@ -106,16 +103,22 @@ let
       patches =
         map (p: p.patch) kernelPatches
         # Required for deterministic builds along with some postPatch magic.
-        ++ optional (lib.versionAtLeast version "4.13") ./randstruct-provide-seed.patch
-        # Fixes determinism by normalizing metadata for the archive of kheaders
-        ++ optional (lib.versionAtLeast version "5.2" && lib.versionOlder version "5.4") ./gen-kheaders-metadata.patch;
-
-      prePatch = ''
-        for mf in $(find -name Makefile -o -name Makefile.include -o -name install.sh); do
-            echo "stripping FHS paths in \`$mf'..."
-            sed -i "$mf" -e 's|/usr/bin/||g ; s|/bin/||g ; s|/sbin/||g'
-        done
-        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
+        ++ optional (lib.versionOlder version "5.19") ./randstruct-provide-seed.patch
+        ++ optional (lib.versionAtLeast version "5.19") ./randstruct-provide-seed-5.19.patch
+        # Linux 5.12 marked certain PowerPC-only symbols as GPL, which breaks
+        # OpenZFS; this was fixed in Linux 5.19 so we backport the fix
+        # https://github.com/openzfs/zfs/pull/13367
+        ++ optional (lib.versionAtLeast version "5.12" &&
+                     lib.versionOlder version "5.19" &&
+                     stdenv.hostPlatform.isPower)
+          (fetchpatch {
+            url = "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/patch/?id=d9e5c3e9e75162f845880535957b7fd0b4637d23";
+            hash = "sha256-bBOyJcP6jUvozFJU0SPTOf3cmnTQ6ZZ4PlHjiniHXLU=";
+          });
+
+      postPatch = ''
+        # Ensure that depmod gets resolved through PATH
+        sed -i Makefile -e 's|= /sbin/depmod|= depmod|'
 
         # Don't include a (random) NT_GNU_BUILD_ID, to make the build more deterministic.
         # This way kernels can be bit-by-bit reproducible depending on settings
@@ -123,20 +126,29 @@ let
         # See also https://kernelnewbies.org/BuildId
         sed -i Makefile -e 's|--build-id=[^ ]*|--build-id=none|'
 
-        patchShebangs scripts
-      '';
+        # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
+        [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
 
-      postPatch = ''
         # Set randstruct seed to a deterministic but diversified value. Note:
         # we could have instead patched gen-random-seed.sh to take input from
         # the buildFlags, but that would require also patching the kernel's
         # toplevel Makefile to add a variable export. This would be likely to
         # cause future patch conflicts.
-        if [ -f scripts/gcc-plugins/gen-random-seed.sh ]; then
-          substituteInPlace scripts/gcc-plugins/gen-random-seed.sh \
-            --replace NIXOS_RANDSTRUCT_SEED \
-            $(echo ${randstructSeed}${src} ${configfile} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
-        fi
+        for file in scripts/gen-randstruct-seed.sh scripts/gcc-plugins/gen-random-seed.sh; do
+          if [ -f "$file" ]; then
+            substituteInPlace "$file" \
+              --replace NIXOS_RANDSTRUCT_SEED \
+              $(echo ${randstructSeed}${src} ${placeholder "configfile"} | sha256sum | cut -d ' ' -f 1 | tr -d '\n')
+            break
+          fi
+        done
+
+        patchShebangs scripts
+
+        # also patch arch-specific install scripts
+        for i in $(find arch -name install.sh); do
+            patchShebangs "$i"
+        done
       '';
 
       configurePhase = ''
@@ -165,7 +177,6 @@ let
           exit 1
         fi
 
-        # Note: we can get rid of this once http://permalink.gmane.org/gmane.linux.kbuild.devel/13800 is merged.
         buildFlagsArray+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
 
         cd $buildRoot
@@ -175,18 +186,69 @@ let
         "KBUILD_BUILD_VERSION=1-NixOS"
         kernelConf.target
         "vmlinux"  # for "perf" and things like that
-      ]
-      ++ optional isModular "modules"
+      ] ++ optional isModular "modules"
+        ++ optionals buildDTBs ["dtbs" "DTC_FLAGS=-@"]
       ++ extraMakeFlags;
 
       installFlags = [
-        "INSTALLKERNEL=${installkernel}"
         "INSTALL_PATH=$(out)"
       ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
-      ++ optional installsFirmware "INSTALL_FW_PATH=$(out)/lib/firmware";
-
-      preInstall = ''
+      ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
+
+      preInstall = let
+        # All we really need to do here is copy the final image and System.map to $out,
+        # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
+        # for the rest. Easy, right?
+        #
+        # Unfortunately for us, the obvious way of getting the built image path,
+        # make -s image_name, does not work correctly, because some architectures
+        # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
+        # so we end up attempting to install the thing we didn't actually build.
+        #
+        # Thankfully, there's a way out that doesn't involve just hardcoding everything.
+        #
+        # The kernel has an install target, which runs a pretty simple shell script
+        # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
+        # which kernel version you're looking at) that tries to do something sensible.
+        #
+        # (it would be great to hijack this script immediately, as it has all the
+        #   information we need passed to it and we don't need it to try and be smart,
+        #   but unfortunately, the exact location of the scripts differs between kernel
+        #   versions, and they're seemingly not considered to be public API at all)
+        #
+        # One of the ways it tries to discover what "something sensible" actually is
+        # is by delegating to what's supposed to be a user-provided install script
+        # located at ~/bin/installkernel.
+        #
+        # (the other options are:
+        #   - a distribution-specific script at /sbin/installkernel,
+        #        which we can't really create in the sandbox easily
+        #   - an architecture-specific script at arch/$arch/boot/install.sh,
+        #        which attempts to guess _something_ and usually guesses very wrong)
+        #
+        # More specifically, the install script exec's into ~/bin/installkernel, if one
+        # exists, with the following arguments:
+        #
+        # $1: $KERNELRELEASE - full kernel version string
+        # $2: $KBUILD_IMAGE - the final image path
+        # $3: System.map - path to System.map file, seemingly hardcoded everywhere
+        # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
+        #
+        # $2 is exactly what we want, so hijack the script and use the knowledge given to it
+        # by the makefile overlords for our own nefarious ends.
+        #
+        # Note that the makefiles specifically look in ~/bin/installkernel, and
+        # writeShellScriptBin writes the script to <store path>/bin/installkernel,
+        # so HOME needs to be set to just the store path.
+        #
+        # FIXME: figure out a less roundabout way of doing this.
+        installkernel = buildPackages.writeShellScriptBin "installkernel" ''
+          cp -av $2 $4
+          cp -av $3 $4
+        '';
+      in ''
         installFlagsArray+=("-j$NIX_BUILD_CORES")
+        export HOME=${installkernel}
       '';
 
       # Some image types need special install targets (e.g. uImage is installed with make uinstall)
@@ -197,11 +259,7 @@ let
           else "install"))
       ];
 
-      postInstall = (optionalString installsFirmware ''
-        mkdir -p $out/lib/firmware
-      '') + (if (kernelConf.DTB or false) then ''
-        make $makeFlags "''${makeFlagsArray[@]}" dtbs dtbs_install INSTALL_DTBS_PATH=$out/dtbs
-      '' else "") + (if isModular then ''
+      postInstall = optionalString isModular ''
         mkdir -p $dev
         cp vmlinux $dev/
         if [ -z "''${dontStrip-}" ]; then
@@ -210,7 +268,7 @@ let
         make modules_install $makeFlags "''${makeFlagsArray[@]}" \
           $installFlags "''${installFlagsArray[@]}"
         unlink $out/lib/modules/${modDirVersion}/build
-        unlink $out/lib/modules/${modDirVersion}/source
+        rm -f $out/lib/modules/${modDirVersion}/source
 
         mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
 
@@ -261,8 +319,7 @@ let
         find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
 
         # Keep root and arch-specific Makefiles
-        chmod u-w Makefile
-        chmod u-w arch/$arch/Makefile*
+        chmod u-w Makefile arch/"$arch"/Makefile*
 
         # Keep whole scripts dir
         chmod u-w -R scripts
@@ -272,13 +329,7 @@ let
 
         # Delete empty directories
         find -empty -type d -delete
-
-        # Remove reference to kmod
-        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
-      '' else optionalString installsFirmware ''
-        make firmware_install $makeFlags "''${makeFlagsArray[@]}" \
-          $installFlags "''${installFlagsArray[@]}"
-      '');
+      '';
 
       requiredSystemFeatures = [ "big-parallel" ];
 
@@ -291,17 +342,19 @@ let
             + ")");
         license = lib.licenses.gpl2Only;
         homepage = "https://www.kernel.org/";
-        repositories.git = "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git";
-        maintainers = [
+        maintainers = lib.teams.linux-kernel.members ++ [
           maintainers.thoughtpolice
         ];
         platforms = platforms.linux;
+        badPlatforms =
+          lib.optionals (lib.versionOlder version "4.15") [ "riscv32-linux" "riscv64-linux" ] ++
+          lib.optional (lib.versionOlder version "5.19") "loongarch64-linux";
         timeout = 14400; # 4 hours
       } // extraMeta;
     };
 in
 
-assert (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") -> libelf != null;
+assert lib.versionOlder version "5.8" -> libelf != null;
 assert lib.versionAtLeast version "5.8" -> elfutils != null;
 
 stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPatches configfile) // {
@@ -311,25 +364,26 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
   enableParallelBuilding = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr gawk zstd python3Minimal ]
-      ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
-      ++ optional  (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") libelf
-      # Removed util-linuxMinimal since it should not be a dependency.
+  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ubootTools ]
+      ++ optional  (lib.versionOlder version "5.8") libelf
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ optional  (lib.versionAtLeast version "5.2")  cpio
+      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
       ++ optional  (lib.versionAtLeast version "5.8")  elfutils
       ;
 
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
   # Absolute paths for compilers avoid any PATH-clobbering issues.
-  makeFlags = commonMakeFlags ++ [
+  makeFlags = [
+    "O=$(buildRoot)"
     "CC=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
     "HOSTCC=${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc"
+    "HOSTLD=${buildPackages.stdenv.cc.bintools}/bin/${buildPackages.stdenv.cc.targetPrefix}ld"
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
-  ] ++ extraMakeFlags;
+  ] ++ (stdenv.hostPlatform.linux-kernel.makeFlags or [])
+    ++ extraMakeFlags;
 
   karch = stdenv.hostPlatform.linuxArch;
-})
+} // (optionalAttrs (pos != null) { inherit pos; })))
diff --git a/pkgs/os-specific/linux/kernel/p9-fixes.patch b/pkgs/os-specific/linux/kernel/p9-fixes.patch
deleted file mode 100644
index f6061b60667..00000000000
--- a/pkgs/os-specific/linux/kernel/p9-fixes.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -483,6 +483,9 @@ static int v9fs_test_inode(struct inode *inode, void *data)
- 
- 	if (v9inode->qid.type != st->qid.type)
- 		return 0;
-+
-+	if (v9inode->qid.path != st->qid.path)
-+		return 0;
- 	return 1;
- }
- 
-diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
---- a/fs/9p/vfs_inode_dotl.c
-+++ b/fs/9p/vfs_inode_dotl.c
-@@ -87,6 +87,9 @@ static int v9fs_test_inode_dotl(struct inode *inode, void *data)
- 
- 	if (v9inode->qid.type != st->qid.type)
- 		return 0;
-+
-+	if (v9inode->qid.path != st->qid.path)
-+		return 0;
- 	return 1;
- }
- 
-diff --git a/net/9p/client.c b/net/9p/client.c
-index 3ce672af1596..f1c8ad373f90 100644
---- a/net/9p/client.c
-+++ b/net/9p/client.c
-@@ -749,8 +749,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...)
- 	}
- again:
- 	/* Wait for the response */
--	err = wait_event_interruptible(*req->wq,
--				       req->status >= REQ_STATUS_RCVD);
-+	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
- 
- 	/*
- 	 * Make sure our req is coherent with regard to updates in other
-diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
-index f24b25c25106..f3a4efcf1456 100644
---- a/net/9p/trans_virtio.c
-+++ b/net/9p/trans_virtio.c
-@@ -286,8 +286,8 @@ p9_virtio_request(struct p9_client *client, struct p9_req_t *req)
- 		if (err == -ENOSPC) {
- 			chan->ring_bufs_avail = 0;
- 			spin_unlock_irqrestore(&chan->lock, flags);
--			err = wait_event_interruptible(*chan->vc_wq,
--							chan->ring_bufs_avail);
-+			err = wait_event_killable(*chan->vc_wq,
-+						  chan->ring_bufs_avail);
- 			if (err  == -ERESTARTSYS)
- 				return err;
- 
-@@ -327,7 +327,7 @@ static int p9_get_mapped_pages(struct virtio_chan *chan,
- 		 * Other zc request to finish here
- 		 */
- 		if (atomic_read(&vp_pinned) >= chan->p9_max_pages) {
--			err = wait_event_interruptible(vp_wq,
-+			err = wait_event_killable(vp_wq,
- 			      (atomic_read(&vp_pinned) < chan->p9_max_pages));
- 			if (err == -ERESTARTSYS)
- 				return err;
-@@ -471,8 +471,8 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
- 		if (err == -ENOSPC) {
- 			chan->ring_bufs_avail = 0;
- 			spin_unlock_irqrestore(&chan->lock, flags);
--			err = wait_event_interruptible(*chan->vc_wq,
--						       chan->ring_bufs_avail);
-+			err = wait_event_killable(*chan->vc_wq,
-+						  chan->ring_bufs_avail);
- 			if (err  == -ERESTARTSYS)
- 				goto err_out;
- 
-@@ -489,8 +489,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
- 	virtqueue_kick(chan->vq);
- 	spin_unlock_irqrestore(&chan->lock, flags);
- 	p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n");
--	err = wait_event_interruptible(*req->wq,
--				       req->status >= REQ_STATUS_RCVD);
-+	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);
- 	/*
- 	 * Non kernel buffers are pinned, unpin them
- 	 */
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index f41cedca0f6..5d4ebc214dc 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -19,6 +19,16 @@
       patch = ./bridge-stp-helper.patch;
     };
 
+  # Reverts the buggy commit causing https://bugzilla.kernel.org/show_bug.cgi?id=217802
+  dell_xps_regression = {
+    name = "dell_xps_regression";
+    patch = fetchpatch {
+      name = "Revert-101bd907b424-misc-rtsx-judge-ASPM-Mode-to-set.patch";
+      url = "https://raw.githubusercontent.com/openSUSE/kernel-source/1b02b1528a26f4e9b577e215c114d8c5e773ee10/patches.suse/Revert-101bd907b424-misc-rtsx-judge-ASPM-Mode-to-set.patch";
+      sha256 = "sha256-RHJdQ4p0msTOVPR+/dYiKuwwEoG9IpIBqT4dc5cJjf8=";
+    };
+  };
+
   request_key_helper =
     { name = "request-key-helper";
       patch = ./request-key-helper.patch;
@@ -29,62 +39,21 @@
       patch = ./request-key-helper-updated.patch;
     };
 
-  p9_fixes =
-    { name = "p9-fixes";
-      patch = ./p9-fixes.patch;
-    };
-
   modinst_arg_list_too_long =
     { name = "modinst-arglist-too-long";
       patch = ./modinst-arg-list-too-long.patch;
     };
 
-  genksyms_fix_segfault =
-    { name = "genksyms-fix-segfault";
-      patch = ./genksyms-fix-segfault.patch;
-    };
-
-  cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches;
-
   hardened = let
-    mkPatch = kernelVersion: src: {
+    mkPatch = kernelVersion: { version, sha256, patch }: let src = patch; in {
       name = lib.removeSuffix ".patch" src.name;
       patch = fetchurl (lib.filterAttrs (k: v: k != "extra") src);
       extra = src.extra;
+      inherit version sha256;
     };
-    patches = builtins.fromJSON (builtins.readFile ./hardened/patches.json);
+    patches = lib.importJSON ./hardened/patches.json;
   in lib.mapAttrs mkPatch patches;
 
-  # https://bugzilla.kernel.org/show_bug.cgi?id=197591#c6
-  iwlwifi_mvm_support_version_7_scan_req_umac_fw_command = rec {
-    name = "iwlwifi_mvm_support_version_7_scan_req_umac_fw_command";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = "https://bugzilla.kernel.org/attachment.cgi?id=260597";
-      sha256 = "09096npxpgvlwdz3pb3m9brvxh7vy0xc9z9p8hh85xyczyzcsjhr";
-    };
-  };
-
-  # https://github.com/NixOS/nixpkgs/issues/42755
-  xen-netfront_fix_mismatched_rtnl_unlock = rec {
-    name = "xen-netfront_fix_mismatched_rtnl_unlock";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = "https://github.com/torvalds/linux/commit/cb257783c2927b73614b20f915a91ff78aa6f3e8.patch";
-      sha256 = "0xhblx2j8wi3kpnfpgjjwlcwdry97ji2aaq54r3zirk5g5p72zs8";
-    };
-  };
-
-  # https://github.com/NixOS/nixpkgs/issues/42755
-  xen-netfront_update_features_after_registering_netdev = rec {
-    name = "xen-netfront_update_features_after_registering_netdev";
-    patch = fetchpatch {
-      name = name + ".patch";
-      url = "https://github.com/torvalds/linux/commit/45c8184c1bed1ca8a7f02918552063a00b909bf5.patch";
-      sha256 = "1l8xq02rd7vakxg52xm9g4zng0ald866rpgm8kjlh88mwwyjkrwv";
-    };
-  };
-
   # Adapted for Linux 5.4 from:
   # https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=04896832c94aae4842100cafb8d3a73e1bed3a45
   rtl8761b_support =
@@ -96,10 +65,4 @@
     name = "export-rt-sched-migrate";
     patch = ./export-rt-sched-migrate.patch;
   };
-
-  # patches from https://lkml.org/lkml/2019/7/15/1748
-  mac_nvme_t2 = rec {
-    name = "mac_nvme_t2";
-    patch = ./mac-nvme-t2.patch;
-  };
 }
diff --git a/pkgs/os-specific/linux/kernel/perf.nix b/pkgs/os-specific/linux/kernel/perf.nix
deleted file mode 100644
index b58bca352e6..00000000000
--- a/pkgs/os-specific/linux/kernel/perf.nix
+++ /dev/null
@@ -1,83 +0,0 @@
-{ lib, stdenv, kernel, elfutils, python2, python3, perl, newt, slang, asciidoc, xmlto, makeWrapper
-, docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkg-config, libunwind, binutils
-, libiberty, audit, libbfd, libopcodes, openssl, systemtap, numactl
-, zlib
-, withGtk ? false, gtk2
-, withZstd ? true, zstd
-, withLibcap ? true, libcap
-}:
-
-with lib;
-
-assert versionAtLeast kernel.version "3.12";
-
-stdenv.mkDerivation {
-  name = "perf-linux-${kernel.version}";
-
-  inherit (kernel) src;
-
-  preConfigure = ''
-    cd tools/perf
-
-    substituteInPlace Makefile \
-      --replace /usr/include/elfutils $elfutils/include/elfutils
-
-    for x in util/build-id.c util/dso.c; do
-      substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
-    done
-
-    if [ -f bash_completion ]; then
-      sed -i 's,^have perf,_have perf,' bash_completion
-    fi
-  '';
-
-  makeFlags = ["prefix=$(out)" "WERROR=0"] ++ kernel.makeFlags;
-
-  hardeningDisable = [ "format" ];
-
-  # perf refers both to newt and slang
-  nativeBuildInputs = [
-    asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-    flex bison libiberty audit makeWrapper pkg-config python3
-  ];
-  buildInputs = [
-    elfutils newt slang libunwind libbfd zlib openssl systemtap.stapBuild numactl
-    libopcodes python3 perl
-  ] ++ lib.optional withGtk gtk2
-    ++ (if (versionAtLeast kernel.version "4.19") then [ python3 ] else [ python2 ])
-    ++ lib.optional withZstd zstd
-    ++ lib.optional withLibcap libcap;
-
-  # Note: we don't add elfutils to buildInputs, since it provides a
-  # bad `ld' and other stuff.
-  NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=cpp"
-    "-Wno-error=bool-compare"
-    "-Wno-error=deprecated-declarations"
-    "-DOBJDUMP_PATH=\"${binutils}/bin/objdump\""
-    "-Wno-error=stringop-truncation"
-  ];
-
-  postPatch = ''
-    patchShebangs scripts
-  '';
-
-  doCheck = false; # requires "sparse"
-  doInstallCheck = false; # same
-
-  separateDebugInfo = true;
-  installFlags = [ "install" "install-man" "ASCIIDOC8=1" "prefix=$(out)" ];
-
-  preFixup = ''
-    wrapProgram $out/bin/perf \
-      --prefix PATH : "${binutils}/bin"
-  '';
-
-  meta = {
-    homepage = "https://perf.wiki.kernel.org/";
-    description = "Linux tools to profile with performance counters";
-    maintainers = with lib.maintainers; [viric];
-    platforms = with lib.platforms; linux;
-    broken = kernel.kernelOlder "5";
-  };
-}
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/os-specific/linux/kernel/perf/default.nix
new file mode 100644
index 00000000000..ad8f2608d93
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -0,0 +1,166 @@
+{ lib
+, stdenv
+, fetchpatch
+, fetchurl
+, kernel
+, elfutils
+, python3
+, perl
+, newt
+, slang
+, asciidoc
+, xmlto
+, makeWrapper
+, docbook_xsl
+, docbook_xml_dtd_45
+, libxslt
+, flex
+, bison
+, pkg-config
+, libunwind
+, binutils-unwrapped
+, libiberty
+, audit
+, libbfd
+, libbfd_2_38
+, libopcodes
+, libopcodes_2_38
+, libpfm
+, libtraceevent
+, openssl
+, systemtap
+, numactl
+, zlib
+, babeltrace
+, withGtk ? false
+, gtk2
+, withZstd ? true
+, zstd
+, withLibcap ? true
+, libcap
+}:
+let
+  d3-flame-graph-templates = stdenv.mkDerivation rec {
+    pname = "d3-flame-graph-templates";
+    version = "4.1.3";
+
+    src = fetchurl {
+      url = "https://registry.npmjs.org/d3-flame-graph/-/d3-flame-graph-${version}.tgz";
+      sha256 = "sha256-W5/Vh5jarXUV224aIiTB2TnBFYT3naEIcG2945QjY8Q=";
+    };
+
+    installPhase = ''
+      install -D -m 0755 -t $out/share/d3-flame-graph/ ./dist/templates/*
+    '';
+  };
+in
+
+stdenv.mkDerivation {
+  pname = "perf-linux";
+  version = kernel.version;
+
+  inherit (kernel) src;
+
+  postPatch = ''
+    # Linux scripts
+    patchShebangs scripts
+    patchShebangs tools/perf/check-headers.sh
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "6.3") ''
+    # perf-specific scripts
+    patchShebangs tools/perf/pmu-events
+  '' + ''
+    cd tools/perf
+
+    for x in util/build-id.c util/dso.c; do
+      substituteInPlace $x --replace /usr/lib/debug /run/current-system/sw/lib/debug
+    done
+
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "5.8") ''
+    substituteInPlace scripts/python/flamegraph.py \
+      --replace "/usr/share/d3-flame-graph/d3-flamegraph-base.html" \
+      "${d3-flame-graph-templates}/share/d3-flame-graph/d3-flamegraph-base.html"
+
+  '' + lib.optionalString (lib.versionAtLeast kernel.version "6.0") ''
+    patchShebangs pmu-events/jevents.py
+  '';
+
+  makeFlags = [ "prefix=$(out)" "WERROR=0" "ASCIIDOC8=1" ] ++ kernel.makeFlags
+    ++ lib.optional (!withGtk) "NO_GTK2=1"
+    ++ lib.optional (!withZstd) "NO_LIBZSTD=1"
+    ++ lib.optional (!withLibcap) "NO_LIBCAP=1";
+
+  hardeningDisable = [ "format" ];
+
+  # perf refers both to newt and slang
+  nativeBuildInputs = [
+    asciidoc
+    xmlto
+    docbook_xsl
+    docbook_xml_dtd_45
+    libxslt
+    flex
+    bison
+    libiberty
+    audit
+    makeWrapper
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    elfutils
+    newt
+    slang
+    libtraceevent
+    libunwind
+    zlib
+    openssl
+    numactl
+    python3
+    perl
+    babeltrace
+  ] ++ (if (lib.versionAtLeast kernel.version "5.19")
+  then [ libbfd libopcodes ]
+  else [ libbfd_2_38 libopcodes_2_38 ])
+  ++ lib.optional (lib.meta.availableOn stdenv.hostPlatform systemtap) systemtap.stapBuild
+  ++ lib.optional withGtk gtk2
+  ++ lib.optional withZstd zstd
+  ++ lib.optional withLibcap libcap
+  ++ lib.optional (lib.versionAtLeast kernel.version "5.8") libpfm
+  ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools;
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=cpp"
+    "-Wno-error=bool-compare"
+    "-Wno-error=deprecated-declarations"
+    "-Wno-error=stringop-truncation"
+  ];
+
+  doCheck = false; # requires "sparse"
+
+  installTargets = [ "install" "install-man" ];
+
+  # TODO: Add completions based on perf-completion.sh
+  postInstall = ''
+    # Same as perf. Remove.
+    rm -f $out/bin/trace
+  '';
+
+  separateDebugInfo = true;
+
+  preFixup = ''
+    # Pull in 'objdump' into PATH to make annotations work.
+    # The embedded Python interpreter will search PATH to calculate the Python path configuration(Should be fixed by upstream).
+    # Add python.interpreter to PATH for now.
+    wrapProgram $out/bin/perf \
+      --prefix PATH : ${lib.makeBinPath [ binutils-unwrapped python3 ]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://perf.wiki.kernel.org/";
+    description = "Linux tools to profile with performance counters";
+    maintainers = with maintainers; [ viric ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5";
+  };
+}
diff --git a/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch b/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch
new file mode 100644
index 00000000000..5ca897a76bf
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/randstruct-provide-seed-5.19.patch
@@ -0,0 +1,13 @@
+diff --git a/scripts/gen-randstruct-seed.sh b/scripts/gen-randstruct-seed.sh
+index 61017b36c464..7bb494dd2e18 100755
+--- a/scripts/gen-randstruct-seed.sh
++++ b/scripts/gen-randstruct-seed.sh
+@@ -1,7 +1,7 @@
+ #!/bin/sh
+ # SPDX-License-Identifier: GPL-2.0
+ 
+-SEED=$(od -A n -t x8 -N 32 /dev/urandom | tr -d ' \n')
++SEED="NIXOS_RANDSTRUCT_SEED"
+ echo "$SEED" > "$1"
+ HASH=$(echo -n "$SEED" | sha256sum | cut -d" " -f1)
+ echo "#define RANDSTRUCT_HASHED_SEED \"$HASH\"" > "$2"
diff --git a/pkgs/os-specific/linux/kernel/update-mainline.py b/pkgs/os-specific/linux/kernel/update-mainline.py
new file mode 100755
index 00000000000..30b9ebec984
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/update-mainline.py
@@ -0,0 +1,130 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.beautifulsoup4 ps.lxml ])"
+import json
+import os
+import pathlib
+import subprocess
+import sys
+import urllib.request
+from dataclasses import dataclass
+from enum import Enum
+
+from bs4 import BeautifulSoup, NavigableString, Tag
+
+HERE = pathlib.Path(__file__).parent
+ROOT = HERE.parent.parent.parent.parent
+VERSIONS_FILE = HERE / "kernels-org.json"
+
+
+class KernelNature(Enum):
+    MAINLINE = 1
+    STABLE = 2
+    LONGTERM = 3
+
+
+@dataclass
+class KernelRelease:
+    nature: KernelNature
+    version: str
+    branch: str
+    date: str
+    link: str
+    eol: bool = False
+
+
+def parse_release(release: Tag) -> KernelRelease | None:
+    columns: list[Tag] = list(release.find_all("td"))
+    try:
+        nature = KernelNature[columns[0].get_text().rstrip(":").upper()]
+    except KeyError:
+        return None
+
+    version = columns[1].get_text().rstrip(" [EOL]")
+    date = columns[2].get_text()
+    link = columns[3].find("a")
+    if link is not None and isinstance(link, Tag):
+        link = link.attrs.get("href")
+    assert link is not None, f"link for kernel {version} is non-existent"
+    eol = bool(release.find(class_="eolkernel"))
+
+    return KernelRelease(
+        nature=nature,
+        branch=get_branch(version),
+        version=version,
+        date=date,
+        link=link,
+        eol=eol,
+    )
+
+
+def get_branch(version: str):
+    # This is a testing kernel.
+    if "rc" in version:
+        return "testing"
+    else:
+        major, minor, *_ = version.split(".")
+        return f"{major}.{minor}"
+
+
+def get_hash(kernel: KernelRelease):
+    if kernel.branch == "testing":
+        args = ["--unpack"]
+    else:
+        args = []
+
+    hash = (
+        subprocess.check_output(["nix-prefetch-url", kernel.link] + args)
+        .decode()
+        .strip()
+    )
+    return f"sha256:{hash}"
+
+
+def commit(message):
+    return subprocess.check_call(["git", "commit", "-m", message, VERSIONS_FILE])
+
+
+def main():
+    kernel_org = urllib.request.urlopen("https://kernel.org/")
+    soup = BeautifulSoup(kernel_org.read().decode(), "lxml")
+    release_table = soup.find(id="releases")
+    if not release_table or isinstance(release_table, NavigableString):
+        print(release_table, file=sys.stderr)
+        print("Failed to find the release table on https://kernel.org", file=sys.stderr)
+        sys.exit(1)
+
+    releases = release_table.find_all("tr")
+    parsed_releases = filter(None, [parse_release(release) for release in releases])
+    all_kernels = json.load(VERSIONS_FILE.open())
+
+    for kernel in parsed_releases:
+        branch = get_branch(kernel.version)
+        nixpkgs_branch = branch.replace(".", "_")
+
+        old_version = all_kernels.get(branch, {}).get("version")
+        if old_version == kernel.version:
+            print(f"linux_{nixpkgs_branch}: {kernel.version} is latest, skipping...")
+            continue
+
+        if old_version is None:
+            message = f"linux_{nixpkgs_branch}: init at {kernel.version}"
+        else:
+            message = f"linux_{nixpkgs_branch}: {old_version} -> {kernel.version}"
+
+        print(message, file=sys.stderr)
+
+        all_kernels[branch] = {
+            "version": kernel.version,
+            "hash": get_hash(kernel),
+        }
+
+        with VERSIONS_FILE.open("w") as fd:
+            json.dump(all_kernels, fd, indent=4)
+            fd.write("\n")  # makes editorconfig happy
+
+        if os.environ.get("COMMIT") == "1":
+            commit(message)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/pkgs/os-specific/linux/kernel/update-rt.sh b/pkgs/os-specific/linux/kernel/update-rt.sh
index ccb01793342..a9e0577fae9 100755
--- a/pkgs/os-specific/linux/kernel/update-rt.sh
+++ b/pkgs/os-specific/linux/kernel/update-rt.sh
@@ -38,6 +38,7 @@ latest-rt-version() {
     curl -sL "$mirror/projects/rt/$branch/sha256sums.asc" |
         sed -ne '/.patch.xz/ { s/.*patch-\(.*\).patch.xz/\1/p}' |
         grep -v '\-rc' |
+        sort --version-sort |
         tail -n 1
 }
 
diff --git a/pkgs/os-specific/linux/kernel/update-zen.py b/pkgs/os-specific/linux/kernel/update-zen.py
new file mode 100755
index 00000000000..3c51f806d8f
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/update-zen.py
@@ -0,0 +1,122 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p python3 nix nix-prefetch-git
+
+import fileinput
+import json
+import os
+import sys
+import re
+import subprocess
+
+from datetime import datetime
+from urllib.request import urlopen, Request
+
+
+def panic(exc):
+    raise Exception(exc)
+
+
+DIR = os.path.dirname(os.path.abspath(__file__))
+HEADERS = {'Accept': 'application/vnd.github.v3+json'}
+
+
+def github_api_request(endpoint):
+    base_url = 'https://api.github.com/'
+    request = Request(base_url + endpoint, headers=HEADERS)
+    with urlopen(request) as http_response:
+        return json.loads(http_response.read().decode('utf-8'))
+
+
+def get_commit_date(repo, sha):
+    url = f'https://api.github.com/repos/{repo}/commits/{sha}'
+    request = Request(url, headers=HEADERS)
+    with urlopen(request) as http_response:
+        commit = json.loads(http_response.read().decode())
+        date = commit['commit']['committer']['date'].rstrip('Z')
+        date = datetime.fromisoformat(date).date().isoformat()
+        return 'unstable-' + date
+
+
+def nix_prefetch_git(url, rev):
+    """Prefetches the requested Git revision (incl. submodules) of the given repository URL."""
+    print(f'nix-prefetch-git {url} {rev}')
+    out = subprocess.check_output([
+        'nix-prefetch-git', '--quiet',
+        '--url', url,
+        '--rev', rev,
+        '--fetch-submodules'])
+    return json.loads(out)['sha256']
+
+
+def nix_prefetch_url(url, unpack=False):
+    """Prefetches the content of the given URL."""
+    print(f'nix-prefetch-url {url}')
+    options = ['--type', 'sha256']
+    if unpack:
+        options += ['--unpack']
+    out = subprocess.check_output(['nix-prefetch-url'] + options + [url])
+    return out.decode('utf-8').rstrip()
+
+
+def update_file(relpath, variant, version, suffix, sha256):
+    file_path = os.path.join(DIR, relpath)
+    with fileinput.FileInput(file_path, inplace=True) as f:
+        for line in f:
+            result = line
+            result = re.sub(
+                fr'^    version = ".+"; #{variant}',
+                f'    version = "{version}"; #{variant}',
+                result)
+            result = re.sub(
+                fr'^    suffix = ".+"; #{variant}',
+                f'    suffix = "{suffix}"; #{variant}',
+                result)
+            result = re.sub(
+                fr'^    sha256 = ".+"; #{variant}',
+                f'    sha256 = "{sha256}"; #{variant}',
+                result)
+            print(result, end='')
+
+
+def read_file(relpath, variant):
+    file_path = os.path.join(DIR, relpath)
+    re_version = re.compile(fr'^\s*version = "(.+)"; #{variant}')
+    re_suffix = re.compile(fr'^\s*suffix = "(.+)"; #{variant}')
+    version = None
+    suffix = None
+    with fileinput.FileInput(file_path, mode='r') as f:
+        for line in f:
+            version_match = re_version.match(line)
+            if version_match:
+                version = version_match.group(1)
+                continue
+
+            suffix_match = re_suffix.match(line)
+            if suffix_match:
+                suffix = suffix_match.group(1)
+                continue
+
+            if version and suffix:
+                break
+    return version, suffix
+
+
+if __name__ == "__main__":
+    if len(sys.argv) == 1:
+        panic("Update variant expected")
+    variant = sys.argv[1]
+    if variant not in ("zen", "lqx"):
+        panic(f"Unexepected variant instead of 'zen' or 'lqx': {sys.argv[1]}")
+    pattern = re.compile(fr"v(\d+\.\d+\.?\d*)-({variant}\d+)")
+    zen_tags = github_api_request('repos/zen-kernel/zen-kernel/releases')
+    for tag in zen_tags:
+        zen_match = pattern.match(tag['tag_name'])
+        if zen_match:
+            zen_tag = zen_match.group(0)
+            zen_version = zen_match.group(1)
+            zen_suffix = zen_match.group(2)
+            break
+    old_version, old_suffix = read_file('zen-kernels.nix', variant)
+    if old_version != zen_version or old_suffix != zen_suffix:
+        zen_hash = nix_prefetch_git('https://github.com/zen-kernel/zen-kernel.git', zen_tag)
+        update_file('zen-kernels.nix', variant, zen_version, zen_suffix, zen_hash)
diff --git a/pkgs/os-specific/linux/kernel/update.sh b/pkgs/os-specific/linux/kernel/update.sh
index 560edced36e..37e1cc1a5cd 100755
--- a/pkgs/os-specific/linux/kernel/update.sh
+++ b/pkgs/os-specific/linux/kernel/update.sh
@@ -1,68 +1,14 @@
 #!/usr/bin/env bash
-set -e
+cd "$(dirname "$(readlink -f "$0")")" || exit
 
-# Get the latest versions from kernel.org
-LINUXSED='s/.*linux-\([0-9]\+\(.[0-9]\+\)*\).*/\1/p'
-KDATA="$(curl -s https://www.kernel.org | sed -n -e '/Download complete/p')"
-VERSIONS=($(sed -n -e $LINUXSED <<< "$KDATA" | sort -Vr))
+echo "Update linux (mainline)"
+COMMIT=1 ./update-mainline.py || echo "update-mainline failed with exit code $?"
 
-# Remove mainline version if there is a stable update
-# Note due to sorting these two will always exist at the bottom
-if grep -q "^${VERSIONS[1]}" <<< "${VERSIONS[0]}"; then
-  VERSIONS=(${VERSIONS[@]:0:1} ${VERSIONS[@]:2})
-fi
+echo "Update linux-rt"
+COMMIT=1 ./update-rt.sh || echo "update-rt failed with exit code $?"
 
-# Inspect each file and see if it has the latest version
-NIXPKGS="$(git rev-parse --show-toplevel)"
-ls $NIXPKGS/pkgs/os-specific/linux/kernel | while read FILE; do
-  KERNEL="$(sed -n -e $LINUXSED <<< "$FILE")"
-  [ -z "$KERNEL" ] && continue
+echo "Update linux-libre"
+COMMIT=1 ./update-libre.sh || echo "update-libre failed with exit code $?"
 
-  # Find the matching new kernel version
-  MATCHING=""
-  for V in "${VERSIONS[@]}"; do
-    if grep -q "^$KERNEL" <<< "$V"; then
-      MATCHING="$V"
-      break
-    fi
-  done
-  if [ -z "$MATCHING" ]; then
-    echo "Out-of-support $KERNEL"
-    continue
-  fi
-
-  # Inspect the nix expression to check for changes
-  DATA="$(<$NIXPKGS/pkgs/os-specific/linux/kernel/$FILE)"
-  URL="$(sed -n -e 's/.*url = "\(.*\)";.*/\1/p' <<< "$DATA" | sed -e "s/\${version}/$MATCHING/g")"
-  OLDVER=$(sed -n -e 's/.*version = "\(.*\)".*/\1/p' <<< "$DATA")
-  if [ "$OLDVER" = "$V" ]; then
-    echo "No updates for $KERNEL"
-    continue
-  fi
-
-  # Download the new file for the hash
-  if ! HASH="$(nix-prefetch-url $URL 2>/dev/null)"; then
-    echo "Failed to get hash of $URL"
-    continue
-  fi
-  sed -i -e "s/sha256 = \".*\"/sha256 = \"$HASH\"/g" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
-
-  # Rewrite the expression
-  sed -i -e '/version = /d' $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
-  sed -i -e "\#buildLinux (args // rec {#a \  version = \"$V\";" $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
-
-  # Commit the changes
-  git add -u $NIXPKGS/pkgs/os-specific/linux/kernel/$FILE
-  git commit -m "linux: $OLDVER -> $V" >/dev/null 2>&1
-
-  echo "Updated $OLDVER -> $V"
-done
-
-# Update linux-rt
-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/update-rt.sh
-
-# Update linux-libre
-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/update-libre.sh
-
-# Update linux-hardened
-COMMIT=1 $NIXPKGS/pkgs/os-specific/linux/kernel/hardened/update.py
+echo "Update linux-hardened"
+COMMIT=1 ./hardened/update.py || echo "update-hardened failed with exit code $?"
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
new file mode 100644
index 00000000000..4f967734d5e
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -0,0 +1,56 @@
+{ lib, stdenv, fetchFromGitHub, buildLinux, ... } @ args:
+
+let
+  # These names are how they are designated in https://xanmod.org.
+
+  # NOTE: When updating these, please also take a look at the changes done to
+  # kernel config in the xanmod version commit
+  ltsVariant = {
+    version = "6.1.62";
+    hash = "sha256-fo5OQ/MZ+QVdCmLzX0OgFUBedfqrkqp+Ev081RVdtWw=";
+    variant = "lts";
+  };
+
+  mainVariant = {
+    version = "6.5.11";
+    hash = "sha256-1bb5LG6JvqX5eNSe2Xyu86HxaqkUVkKUf1H3T7bFkGE=";
+    variant = "main";
+  };
+
+  xanmodKernelFor = { version, suffix ? "xanmod1", hash, variant }: buildLinux (args // rec {
+    inherit version;
+    modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
+
+    src = fetchFromGitHub {
+      owner = "xanmod";
+      repo = "linux";
+      rev = modDirVersion;
+      inherit hash;
+    };
+
+    structuredExtraConfig = with lib.kernel; {
+      # Google's BBRv3 TCP congestion Control
+      TCP_CONG_BBR = yes;
+      DEFAULT_BBR = yes;
+
+      # WineSync driver for fast kernel-backed Wine
+      WINESYNC = module;
+
+      # Preemptive Full Tickless Kernel at 250Hz
+      HZ = freeform "250";
+      HZ_250 = yes;
+      HZ_1000 = no;
+    };
+
+    extraMeta = {
+      branch = lib.versions.majorMinor version;
+      maintainers = with lib.maintainers; [ moni lovesegfault atemu shawn8901 zzzsy ];
+      description = "Built with custom settings and new features built to provide a stable, responsive and smooth desktop experience";
+      broken = stdenv.isAarch64;
+    };
+  } // (args.argsOverride or { }));
+in
+{
+  lts = xanmodKernelFor ltsVariant;
+  main = xanmodKernelFor mainVariant;
+}
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
new file mode 100644
index 00000000000..456a6c7c27d
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -0,0 +1,116 @@
+{ lib, stdenv, fetchFromGitHub, buildLinux, ... } @ args:
+
+let
+  # comments with variant added for update script
+  # ./update-zen.py zen
+  zenVariant = {
+    version = "6.6.1"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "13m820wggf6pkp351w06mdn2lfcwbn08ydwksyxilqb88vmr0lpq"; #zen
+    isLqx = false;
+  };
+  # ./update-zen.py lqx
+  lqxVariant = {
+    version = "6.5.11"; #lqx
+    suffix = "lqx2"; #lqx
+    sha256 = "0rak2ald95bwb5qlp8pf2g93a0gkv8rypiv5s8dpds3cilwmxrg9"; #lqx
+    isLqx = true;
+  };
+  zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
+    inherit version;
+    modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
+    isZen = true;
+
+    src = fetchFromGitHub {
+      owner = "zen-kernel";
+      repo = "zen-kernel";
+      rev = "v${version}-${suffix}";
+      inherit sha256;
+    };
+
+    # This is based on the following sources:
+    # - zen: https://gitlab.archlinux.org/archlinux/packaging/packages/linux-zen/-/blob/main/config
+    # - lqx: https://github.com/damentz/liquorix-package/blob/6.4/master/linux-liquorix/debian/config/kernelarch-x86/config-arch-64
+    # - Liquorix features: https://liquorix.net/
+    # The list below is not exhaustive, so the kernels probably doesn't match
+    # the upstream, but should bring most of the improvements that will be
+    # expected by users
+    structuredExtraConfig = with lib.kernel; {
+      # Zen Interactive tuning
+      ZEN_INTERACTIVE = yes;
+
+      # FQ-Codel Packet Scheduling
+      NET_SCH_DEFAULT = yes;
+      DEFAULT_FQ_CODEL = yes;
+      DEFAULT_NET_SCH = freeform "fq_codel";
+
+      # Preempt (low-latency)
+      PREEMPT = lib.mkOverride 60 yes;
+      PREEMPT_VOLUNTARY = lib.mkOverride 60 no;
+
+      # Preemptible tree-based hierarchical RCU
+      TREE_RCU = yes;
+      PREEMPT_RCU = yes;
+      RCU_EXPERT = yes;
+      TREE_SRCU = yes;
+      TASKS_RCU_GENERIC = yes;
+      TASKS_RCU = yes;
+      TASKS_RUDE_RCU = yes;
+      TASKS_TRACE_RCU = yes;
+      RCU_STALL_COMMON = yes;
+      RCU_NEED_SEGCBLIST = yes;
+      RCU_FANOUT = freeform "64";
+      RCU_FANOUT_LEAF = freeform "16";
+      RCU_BOOST = yes;
+      RCU_BOOST_DELAY = freeform "500";
+      RCU_NOCB_CPU = yes;
+      RCU_LAZY = yes;
+
+      # Futex WAIT_MULTIPLE implementation for Wine / Proton Fsync.
+      FUTEX = yes;
+      FUTEX_PI = yes;
+
+      # Preemptive Full Tickless Kernel at 1000Hz
+      HZ = freeform "1000";
+      HZ_1000 = yes;
+    } // lib.optionalAttrs (isLqx) {
+      # Google's BBRv3 TCP congestion Control
+      TCP_CONG_BBR = yes;
+      DEFAULT_BBR = yes;
+      DEFAULT_TCP_CONG = freeform "bbr";
+
+      # PDS Process Scheduler
+      SCHED_ALT = yes;
+      SCHED_PDS = yes;
+
+      # Swap storage is compressed with LZ4 using zswap
+      ZSWAP_COMPRESSOR_DEFAULT_LZ4 = yes;
+      ZSWAP_COMPRESSOR_DEFAULT = freeform "lz4";
+
+      # Fix error: unused option: XXX.
+      CFS_BANDWIDTH = lib.mkForce (option no);
+      PSI = lib.mkForce (option no);
+      RT_GROUP_SCHED = lib.mkForce (option no);
+      SCHED_AUTOGROUP = lib.mkForce (option no);
+      SCHED_CORE = lib.mkForce (option no);
+
+      # ERROR: modpost: "sched_numa_hop_mask" [drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko] undefined!
+      MLX5_CORE = no;
+    };
+
+    passthru.updateScript = [ ./update-zen.py (if isLqx then "lqx" else "zen") ];
+
+    extraMeta = {
+      branch = lib.versions.majorMinor version + "/master";
+      maintainers = with lib.maintainers; [ thiagokokada jerrysm64 ];
+      description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads." +
+        lib.optionalString isLqx " (Same as linux_zen, but less aggressive release schedule and additional extra config)";
+      broken = stdenv.isAarch64;
+    };
+
+  } // (args.argsOverride or { }));
+in
+{
+  zen = zenKernelsFor zenVariant;
+  lqx = zenKernelsFor lqxVariant;
+}
diff --git a/pkgs/os-specific/linux/kexectools/default.nix b/pkgs/os-specific/linux/kexec-tools/default.nix
index 21d803e2b72..2df5c0454dd 100644
--- a/pkgs/os-specific/linux/kexectools/default.nix
+++ b/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -1,17 +1,25 @@
-{ lib, stdenv, buildPackages, fetchurl, zlib, fetchpatch }:
+{ lib, stdenv, buildPackages, fetchurl, fetchpatch, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "kexec-tools";
-  version = "2.0.20";
+  version = "2.0.26";
 
   src = fetchurl {
     urls = [
       "mirror://kernel/linux/utils/kernel/kexec/${pname}-${version}.tar.xz"
       "http://horms.net/projects/kexec/kexec-tools/${pname}-${version}.tar.xz"
     ];
-    sha256 = "1j7qlhxk1rbv9jbj8wd6hb7zl8p2mp29ymrmccgmsi0m0dzhgn6s";
+    sha256 = "sha256-f+NqBkEBzVxRXkGyvjk9zjyoitzlnW7maOCvfAxFcM0=";
   };
 
+  patches = [
+    # Use ELFv2 ABI on ppc64be
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/6c1192cbf166698932030c2e3de71db1885a572d/srcpkgs/kexec-tools/patches/ppc64-elfv2.patch";
+      sha256 = "19wzfwb0azm932v0vhywv4221818qmlmvdfwpvvpfyw4hjsc2s1l";
+    })
+  ];
+
   hardeningDisable = [ "format" "pic" "relro" "pie" ];
 
   # Prevent kexec-tools from using uname to detect target, which is wrong in
@@ -21,16 +29,6 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   buildInputs = [ zlib ];
 
-  patches = [
-    # fix build on i686
-    # See: https://src.fedoraproject.org/rpms/kexec-tools/c/cb1e5463b5298b064e9b6c86ad6fe3505fec9298
-    (fetchpatch {
-      name = "kexec-tools-2.0.20-fix-broken-multiboot2-buliding-for-i386.patch";
-      url = "https://src.fedoraproject.org/rpms/kexec-tools/raw/cb1e5463b5298b064e9b6c86ad6fe3505fec9298/f/kexec-tools-2.0.20-fix-broken-multiboot2-buliding-for-i386.patch";
-      sha256 = "1kzmcsbhwfdgxlc5s88ir0n494phww1j16yk0z42x09qlkxxkg0l";
-    })
-  ];
-
   meta = with lib; {
     homepage = "http://horms.net/projects/kexec/kexec-tools";
     description = "Tools related to the kexec Linux feature";
diff --git a/pkgs/os-specific/linux/keyutils/0001-Remove-unused-function-after_eq.patch b/pkgs/os-specific/linux/keyutils/0001-Remove-unused-function-after_eq.patch
new file mode 100644
index 00000000000..61ad2a474f9
--- /dev/null
+++ b/pkgs/os-specific/linux/keyutils/0001-Remove-unused-function-after_eq.patch
@@ -0,0 +1,28 @@
+From 59d91e57d103fb4686d2f45ee3c688878244367a Mon Sep 17 00:00:00 2001
+From: Christian Kampka <christian@kampka.net>
+Date: Tue, 24 Nov 2020 22:12:40 +0100
+Subject: [PATCH] Remove unused function 'after_eq'
+
+---
+ keyctl_watch.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/keyctl_watch.c b/keyctl_watch.c
+index a70a19a..c4ca7f7 100644
+--- a/keyctl_watch.c
++++ b/keyctl_watch.c
+@@ -47,11 +47,6 @@ static struct watch_notification_filter filter = {
+ 	},
+ };
+ 
+-static inline bool after_eq(unsigned int a, unsigned int b)
+-{
+-        return (signed int)(a - b) >= 0;
+-}
+-
+ static void consumer_term(int sig)
+ {
+ 	consumer_stop = 1;
+-- 
+2.28.0
+
diff --git a/pkgs/os-specific/linux/keyutils/default.nix b/pkgs/os-specific/linux/keyutils/default.nix
index 71f708e210d..86b2535e1dd 100644
--- a/pkgs/os-specific/linux/keyutils/default.nix
+++ b/pkgs/os-specific/linux/keyutils/default.nix
@@ -15,19 +15,31 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    ./conf-symlink.patch
+    # This patch solves a duplicate symbol error when building with a clang stdenv
+    # Before removing this patch, please ensure the package still builds by running eg.
+    # nix-build -E 'with import ./. {}; pkgs.keyutils.override { stdenv = pkgs.clangStdenv; }'
+    ./0001-Remove-unused-function-after_eq.patch
+
+    # Fix build for s390-linux, where size_t is different from ptrdiff_t.
     (fetchurl {
-      # improve reproducibility
-      url = "https://salsa.debian.org/debian/keyutils/raw/4cecffcb8e2a2aa4ef41777ed40e4e4bcfb2e5bf/debian/patches/Make-build-reproducible.patch";
-      sha256 = "0wnvbjfrbk7rghd032z684l7vk7mhy3bd41zvhkrhgp3cd5id0bm";
+      url = "https://lore.kernel.org/keyrings/20230301134250.301819-1-hi@alyssa.is/raw";
+      sha256 = "1cbgwxq28fw5ldh38ngcs7xiqvpnmrw0hw9zzhbhb1hdxkavrc1s";
     })
-    ./conf-symlink.patch
   ];
 
   makeFlags = lib.optionals stdenv.hostPlatform.isStatic "NO_SOLIB=1";
 
-  BUILDDATE = "1970-01-01";
   outputs = [ "out" "lib" "dev" ];
 
+  postPatch = ''
+    # https://github.com/archlinux/svntogit-packages/blob/packages/keyutils/trunk/reproducible.patch
+    substituteInPlace Makefile \
+      --replace \
+        'VCPPFLAGS	:= -DPKGBUILD="\"$(shell date -u +%F)\""' \
+        'VCPPFLAGS	:= -DPKGBUILD="\"$(date -ud "@$SOURCE_DATE_EPOCH" +%F)\""'
+  '';
+
   enableParallelBuilding = true;
 
   installFlags = [
diff --git a/pkgs/os-specific/linux/klibc/default.nix b/pkgs/os-specific/linux/klibc/default.nix
index 522a74dea01..3a044cf9d84 100644
--- a/pkgs/os-specific/linux/klibc/default.nix
+++ b/pkgs/os-specific/linux/klibc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, buildPackages, linuxHeaders, perl }:
+{ lib, stdenv, fetchurl, buildPackages, linuxHeaders, perl, nixosTests }:
 
 let
   commonMakeFlags = [
@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "klibc";
-  version = "2.0.9";
+  version = "2.0.13";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/klibc/2.0/klibc-${version}.tar.xz";
-    sha256 = "sha256-bcynCJEzINJjCfBbDCv2gHG/EbPa3MTmx9kjg3/CPuE=";
+    hash = "sha256-1nOilPdC1ZNoIi/1w4Ri2BCYxVBjeZ3m+4p7o9SvBDY=";
   };
 
   patches = [ ./no-reinstall-kernel-headers.patch ];
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" "stackprotector" ];
 
   makeFlags = commonMakeFlags ++ [
-    "KLIBCARCH=${stdenv.hostPlatform.linuxArch}"
+    "KLIBCARCH=${if stdenv.hostPlatform.isRiscV64 then "riscv64" else stdenv.hostPlatform.linuxArch}"
     "KLIBCKERNELSRC=${linuxHeaders}"
   ] # TODO(@Ericson2314): We now can get the ABI from
     # `stdenv.hostPlatform.parsed.abi`, is this still a good idea?
@@ -43,6 +43,11 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  passthru.tests = {
+    # uses klibc's ipconfig
+    inherit (nixosTests) initrd-network-ssh;
+  };
+
   meta = {
     description = "Minimalistic libc subset for initramfs usage";
     homepage = "https://kernel.org/pub/linux/libs/klibc/";
diff --git a/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch b/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch
index 709dd30f8c7..bf46a17f3d7 100644
--- a/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch
+++ b/pkgs/os-specific/linux/klibc/no-reinstall-kernel-headers.patch
@@ -1,11 +1,12 @@
-diff -Naur klibc-2.0.3-orig/scripts/Kbuild.install klibc-2.0.3/scripts/Kbuild.install
---- klibc-2.0.3-orig/scripts/Kbuild.install	2013-12-03 13:53:46.000000000 -0500
-+++ klibc-2.0.3/scripts/Kbuild.install	2014-01-04 18:17:09.342609021 -0500
-@@ -95,7 +95,6 @@
+diff --git a/scripts/Kbuild.install b/scripts/Kbuild.install
+index 0788637f..6708e19f 100644
+--- a/scripts/Kbuild.install
++++ b/scripts/Kbuild.install
+@@ -102,7 +102,6 @@ header:
  	$(Q)mkdir -p $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include
  	$(Q)mkdir -p $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)lib
  	$(Q)mkdir -p $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)bin
 -	$(Q)cp -rfL $(KLIBCKERNELSRC)/include/. $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include/.
- 	$(Q)cp -rf usr/include/. $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include/.
- 	$(Q)chmod -R a+rX $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include
- 	$(Q)$(install-data) $(srctree)/klcc/klcc.1 $(INSTALLROOT)$(mandir)/man1/$(KCROSS)klcc.1
+ ifneq ($(srctree),$(objtree))
+ 	$(Q)cp -rf $(srctree)/usr/include/. $(INSTALLROOT)$(INSTALLDIR)/$(KCROSS)include/.
+ endif
diff --git a/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix b/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
index 1c7ea22b758..3964538a409 100644
--- a/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
+++ b/pkgs/os-specific/linux/kmod-blacklist-ubuntu/default.nix
@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchurl, gnugrep, findutils }:
+{ lib, stdenv, fetchurl }:
 
 let
-  version = "22-1.1ubuntu1"; # Zesty
+  version = "28-1ubuntu4"; # impish 2021-06-24
 
 in stdenv.mkDerivation {
   pname = "kmod-blacklist";
@@ -9,7 +9,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://launchpad.net/ubuntu/+archive/primary/+files/kmod_${version}.debian.tar.xz";
-    sha256 = "1k749g707ccb82l4xmrkp53khl71f57cpj9fzd1qyzrz147fjyhi";
+    sha256 = "sha256-K8tWpaLmCm3Jcxw3OZ+D7Koiug7epooRn1YMfqjGAiw=";
   };
 
   installPhase = ''
@@ -26,12 +26,12 @@ in stdenv.mkDerivation {
       --replace /sbin/lsmod /run/booted-system/sw/bin/lsmod \
       --replace /sbin/rmmod /run/booted-system/sw/bin/rmmod \
       --replace /sbin/modprobe /run/booted-system/sw/bin/modprobe \
-      --replace " grep " " ${gnugrep}/bin/grep " \
-      --replace " xargs " " ${findutils}/bin/xargs "
+      --replace " grep " " /run/booted-system/sw/bin/grep " \
+      --replace " xargs " " /run/booted-system/sw/bin/xargs "
   '';
 
   meta = with lib; {
-    homepage = "https://packages.ubuntu.com/source/zesty/kmod";
+    homepage = "https://launchpad.net/ubuntu/+source/kmod";
     description = "Linux kernel module blacklists from Ubuntu";
     platforms = platforms.linux;
     license = with licenses; [ gpl2Plus lgpl21Plus ];
diff --git a/pkgs/os-specific/linux/kmod-debian-aliases/default.nix b/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
index 23d323f84b8..15f7251f996 100644
--- a/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
+++ b/pkgs/os-specific/linux/kmod-debian-aliases/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, lib }:
 
 stdenv.mkDerivation rec {
-  name = "kmod-debian-aliases-${version}.conf";
+  pname = "kmod-debian-aliases.conf";
   version = "22-1.1";
 
   src = fetchurl {
diff --git a/pkgs/os-specific/linux/kmod/darwin.patch b/pkgs/os-specific/linux/kmod/darwin.patch
deleted file mode 100644
index e112e691525..00000000000
--- a/pkgs/os-specific/linux/kmod/darwin.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-diff --git a/Makefile.am b/Makefile.am
-index 194e111..0a095b5 100644
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -80,8 +80,7 @@ EXTRA_DIST += libkmod/README \
- 	libkmod/COPYING testsuite/COPYING tools/COPYING COPYING
- 
- libkmod_libkmod_la_LDFLAGS = $(AM_LDFLAGS) \
--	-version-info $(LIBKMOD_CURRENT):$(LIBKMOD_REVISION):$(LIBKMOD_AGE) \
--	-Wl,--version-script=$(top_srcdir)/libkmod/libkmod.sym
-+	-version-info $(LIBKMOD_CURRENT):$(LIBKMOD_REVISION):$(LIBKMOD_AGE)
- libkmod_libkmod_la_DEPENDENCIES = \
- 	shared/libshared.la \
- 	${top_srcdir}/libkmod/libkmod.sym
-@@ -91,8 +90,7 @@ libkmod_libkmod_la_LIBADD = \
- 
- noinst_LTLIBRARIES += libkmod/libkmod-internal.la
- libkmod_libkmod_internal_la_SOURCES = $(libkmod_libkmod_la_SOURCES)
--libkmod_libkmod_internal_la_LDFLAGS = $(AM_LDFLAGS) \
--	-Wl,--version-script=$(top_srcdir)/libkmod/libkmod.sym
-+libkmod_libkmod_internal_la_LDFLAGS = $(AM_LDFLAGS)
- libkmod_libkmod_internal_la_DEPENDENCIES  = $(libkmod_libkmod_la_DEPENDENCIES)
- libkmod_libkmod_internal_la_LIBADD = $(libkmod_libkmod_la_LIBADD)
- 
-diff --git a/libkmod/libkmod-module.c b/libkmod/libkmod-module.c
-index 889f264..6f0a285 100644
---- a/libkmod/libkmod-module.c
-+++ b/libkmod/libkmod-module.c
-@@ -787,7 +787,11 @@ KMOD_EXPORT int kmod_module_remove_module(struct kmod_module *mod,
- 	flags &= KMOD_REMOVE_FORCE;
- 	flags |= KMOD_REMOVE_NOWAIT;
- 
-+#if defined(__linux__)
- 	err = delete_module(mod->name, flags);
-+#else
-+	err = -1;
-+#endif
- 	if (err != 0) {
- 		err = -errno;
- 		ERR(mod->ctx, "could not remove '%s': %m\n", mod->name);
-@@ -879,7 +883,11 @@ KMOD_EXPORT int kmod_module_insert_module(struct kmod_module *mod,
- 	}
- 	size = kmod_file_get_size(mod->file);
- 
-+#if defined(__linux__)
- 	err = init_module(mem, size, args);
-+#else
-+	err = -1;
-+#endif
- init_finished:
- 	if (err < 0) {
- 		err = -errno;
-diff --git a/libkmod/libkmod-signature.c b/libkmod/libkmod-signature.c
-index 429ffbd..17a3b9c 100644
---- a/libkmod/libkmod-signature.c
-+++ b/libkmod/libkmod-signature.c
-@@ -17,7 +17,10 @@
-  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
-  */
- 
-+#if defined(__linux__)
- #include <endian.h>
-+#endif
-+
- #include <inttypes.h>
- #include <stdio.h>
- #include <stdlib.h>
-diff --git a/shared/macro.h b/shared/macro.h
-index 4fc5405..b5a2702 100644
---- a/shared/macro.h
-+++ b/shared/macro.h
-@@ -71,3 +71,7 @@
- #endif
- 
- #define UNIQ __COUNTER__
-+
-+ #if !defined(__linux__)
-+#define program_invocation_short_name getprogname()
-+#endif
-diff --git a/shared/missing.h b/shared/missing.h
-index 4c0d136..ad8ec0f 100644
---- a/shared/missing.h
-+++ b/shared/missing.h
-@@ -45,6 +45,9 @@ static inline int finit_module(int fd, const char *uargs, int flags)
- #endif
- 
- #if !HAVE_DECL_BE32TOH
-+
-+#if defined(__linux__)
-+
- #include <endian.h>
- #include <byteswap.h>
- #if __BYTE_ORDER == __LITTLE_ENDIAN
-@@ -52,4 +55,16 @@ static inline int finit_module(int fd, const char *uargs, int flags)
- #else
- #define be32toh(x) (x)
- #endif
-+
-+#elif defined(__APPLE__)
-+
-+#include <libkern/OSByteOrder.h>
-+#define be32toh(x) OSSwapBigToHostInt32(x)
-+
-+#else
-+
-+#error No be32toh known for platform
-+
-+#endif
-+
- #endif
-diff --git a/shared/util.c b/shared/util.c
-index fd2028d..ecb0141 100644
---- a/shared/util.c
-+++ b/shared/util.c
-@@ -367,7 +367,7 @@ char *path_make_absolute_cwd(const char *p)
- 	if (path_is_absolute(p))
- 		return strdup(p);
- 
--	cwd = get_current_dir_name();
-+	cwd = getcwd(NULL, 0);
- 	if (!cwd)
- 		return NULL;
- 
---- a/shared/util.h	2018-01-31 18:10:59.000000000 +0100
-+++ b/shared/util.h	2020-12-28 19:48:21.000000000 +0100
-@@ -7,6 +7,9 @@
- #include <stdio.h>
- #include <sys/types.h>
- #include <sys/stat.h>
-+#ifdef __APPLE__
-+#include <libgen.h>
-+#endif
- 
- #include <shared/macro.h>
- 
diff --git a/pkgs/os-specific/linux/kmod/default.nix b/pkgs/os-specific/linux/kmod/default.nix
index ef8296cf16f..3f971e7a6ed 100644
--- a/pkgs/os-specific/linux/kmod/default.nix
+++ b/pkgs/os-specific/linux/kmod/default.nix
@@ -1,32 +1,54 @@
-{ stdenv, lib, fetchurl, autoreconfHook, pkg-config
-, libxslt, xz, elf-header
+{ stdenv, lib, fetchzip, autoconf, automake, docbook_xml_dtd_42
+, docbook_xml_dtd_43, docbook_xsl, gtk-doc, libtool, pkg-config
+, libxslt, xz, zstd, elf-header
+, withDevdoc ? stdenv.hostPlatform == stdenv.buildPlatform
 , withStatic ? stdenv.hostPlatform.isStatic
+, gitUpdater
 }:
 
 let
-  systems = [ "/run/current-system/kernel-modules" "/run/booted-system/kernel-modules" "" ];
+  systems = [ "/run/booted-system/kernel-modules" "/run/current-system/kernel-modules" "" ];
   modulesDirs = lib.concatMapStringsSep ":" (x: "${x}/lib/modules") systems;
 
 in stdenv.mkDerivation rec {
   pname = "kmod";
-  version = "27";
+  version = "31";
 
-  src = fetchurl {
-    url = "mirror://kernel/linux/utils/kernel/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "035wzfzjx4nwidk747p8n085mgkvy531ppn16krrajx2dkqzply1";
+  # autogen.sh is missing from the release tarball,
+  # and we need to run it to regenerate gtk_doc.make,
+  # because the version in the release tarball is broken.
+  # Possibly this will be fixed in kmod 30?
+  # https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/commit/.gitignore?id=61a93a043aa52ad62a11ba940d4ba93cb3254e78
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/snapshot/kmod-${version}.tar.gz";
+    hash = "sha256-FNR015/AoYBbi7Eb1M2TXH3yxUuddKICCu+ot10CdeQ=";
   };
 
-  nativeBuildInputs = [ autoreconfHook pkg-config libxslt ];
-  buildInputs = [ xz ] ++ lib.optional stdenv.isDarwin elf-header;
+  outputs = [ "out" "dev" "lib" ] ++ lib.optional withDevdoc "devdoc";
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    autoconf automake docbook_xsl libtool libxslt pkg-config
+
+    docbook_xml_dtd_42 # for the man pages
+  ] ++ lib.optionals withDevdoc [ docbook_xml_dtd_43 gtk-doc ];
+  buildInputs = [ xz zstd ]
+    # gtk-doc is looked for with pkg-config
+    ++ lib.optionals withDevdoc [ gtk-doc ];
+
+  preConfigure = ''
+    ./autogen.sh
+  '';
 
   configureFlags = [
     "--sysconfdir=/etc"
     "--with-xz"
+    "--with-zstd"
     "--with-modulesdirs=${modulesDirs}"
+    (lib.enableFeature withDevdoc "gtk-doc")
   ] ++ lib.optional withStatic "--enable-static";
 
-  patches = [ ./module-dir.patch ./no-name-field.patch ]
-    ++ lib.optional stdenv.isDarwin ./darwin.patch
+  patches = [ ./module-dir.patch ]
     ++ lib.optional withStatic ./enable-static.patch;
 
   postInstall = ''
@@ -38,6 +60,12 @@ in stdenv.mkDerivation rec {
     ln -s bin $out/sbin
   '';
 
+  passthru.updateScript = gitUpdater {
+    # No nicer place to find latest release.
+    url = "https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git";
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     description = "Tools for loading and managing Linux kernel modules";
     longDescription = ''
@@ -49,7 +77,8 @@ in stdenv.mkDerivation rec {
     homepage = "https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/";
     downloadPage = "https://www.kernel.org/pub/linux/utils/kernel/kmod/";
     changelog = "https://git.kernel.org/pub/scm/utils/kernel/kmod/kmod.git/plain/NEWS?h=v${version}";
-    license = licenses.lgpl21;
-    platforms = platforms.unix;
+    license = with licenses; [ lgpl21Plus gpl2Plus ]; # GPLv2+ for tools
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ artturin ];
   };
 }
diff --git a/pkgs/os-specific/linux/kmod/no-name-field.patch b/pkgs/os-specific/linux/kmod/no-name-field.patch
deleted file mode 100644
index 282f59e55e5..00000000000
--- a/pkgs/os-specific/linux/kmod/no-name-field.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-
----
- tools/modinfo.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/tools/modinfo.c b/tools/modinfo.c
-index 0231bb0..7b2259e 100644
---- a/tools/modinfo.c
-+++ b/tools/modinfo.c
-@@ -178,7 +178,10 @@ static int modinfo_do(struct kmod_module *mod)
- 	is_builtin = (filename == NULL);
- 
- 	if (is_builtin) {
--		printf("%-16s%s%c", "name:", kmod_module_get_name(mod), separator);
-+		if (field == NULL || field != NULL && streq(field, "name")){
-+			printf("%-16s%s%c", "name:",
-+			       kmod_module_get_name(mod), separator);
-+		}
- 		filename = "(builtin)";
- 	}
- 
--- 
-2.28.0
-
diff --git a/pkgs/os-specific/linux/kmscon/default.nix b/pkgs/os-specific/linux/kmscon/default.nix
index f48895fc017..4762b63eda9 100644
--- a/pkgs/os-specific/linux/kmscon/default.nix
+++ b/pkgs/os-specific/linux/kmscon/default.nix
@@ -1,31 +1,37 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, autoreconfHook
+, fetchpatch
+, meson
 , libtsm
 , systemd
 , libxkbcommon
 , libdrm
-, libGLU, libGL
+, libGLU
+, libGL
 , pango
 , pixman
 , pkg-config
 , docbook_xsl
 , libxslt
+, mesa
+, ninja
 }:
 
 stdenv.mkDerivation rec {
   pname = "kmscon";
-  version = "unstable-2018-09-07";
+  version = "9.0.0";
 
   src = fetchFromGitHub {
     owner = "Aetf";
     repo = "kmscon";
-    rev = "01dd0a231e2125a40ceba5f59fd945ff29bf2cdc";
-    sha256 = "0q62kjsvy2iwy8adfiygx2bfwlh83rphgxbis95ycspqidg9py87";
+    rev = "v${version}";
+    sha256 = "sha256-8owyyzCrZVbWXcCR+RA+m0MOrdzW+efI+rIMWEVEZ1o=";
   };
 
   buildInputs = [
-    libGLU libGL
+    libGLU
+    libGL
     libdrm
     libtsm
     libxkbcommon
@@ -33,14 +39,28 @@ stdenv.mkDerivation rec {
     pango
     pixman
     systemd
+    mesa
   ];
 
   nativeBuildInputs = [
-    autoreconfHook
+    meson
+    ninja
     docbook_xsl
     pkg-config
   ];
 
+  patches = [
+    (fetchpatch {
+      name = "0001-tests-fix-warnings.patch";
+      url = "https://github.com/Aetf/kmscon/commit/b65f4269b03de580923ab390bde795e7956b633f.patch";
+      sha256 = "sha256-ngflPwmNMM/2JzhV+hHiH3efQyoSULfqEywzWox9iAQ=";
+    })
+  ];
+
+  # _FORTIFY_SOURCE requires compiling with optimization (-O)
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-O"
+    + " -Wno-error=maybe-uninitialized"; # https://github.com/Aetf/kmscon/issues/49
+
   configureFlags = [
     "--enable-multi-seat"
     "--disable-debug"
@@ -52,7 +72,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "KMS/DRM based System Console";
-    homepage = "http://www.freedesktop.org/wiki/Software/kmscon/";
+    homepage = "https://www.freedesktop.org/wiki/Software/kmscon/";
     license = licenses.mit;
     maintainers = with maintainers; [ omasanori ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/kmscube/default.nix b/pkgs/os-specific/linux/kmscube/default.nix
index 6db3a9583ec..b9da3790170 100644
--- a/pkgs/os-specific/linux/kmscube/default.nix
+++ b/pkgs/os-specific/linux/kmscube/default.nix
@@ -1,7 +1,8 @@
-{ lib, stdenv, fetchgit, autoreconfHook, libdrm, libX11, libGL, mesa, pkg-config }:
+{ lib, stdenv, fetchgit, fetchpatch, autoreconfHook, libdrm, libX11, libGL, mesa, pkg-config }:
 
 stdenv.mkDerivation {
-  name = "kmscube-2018-06-17";
+  pname = "kmscube";
+  version = "unstable-2018-06-17";
 
   src = fetchgit {
     url = "git://anongit.freedesktop.org/mesa/kmscube";
@@ -9,6 +10,15 @@ stdenv.mkDerivation {
     sha256 = "1q5b5yvyfj3127385mp1bfmcbnpnbdswdk8gspp7g4541xk4k933";
   };
 
+  patches = [
+    # Pull upstream patch for -fno-common toolchains.
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://gitlab.freedesktop.org/mesa/kmscube/-/commit/908ef39864442c0807954af5d3f88a3da1a6f8a5.patch";
+      sha256 = "1gxn3b50mvjlc25234839v5z29r8fd9di4176a3yx4gbsz8cc5vi";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ libdrm libX11 libGL mesa ];
 
diff --git a/pkgs/os-specific/linux/ksmbd-tools/0001-skip-installing-example-configuration.patch b/pkgs/os-specific/linux/ksmbd-tools/0001-skip-installing-example-configuration.patch
new file mode 100644
index 00000000000..2b4b35774d1
--- /dev/null
+++ b/pkgs/os-specific/linux/ksmbd-tools/0001-skip-installing-example-configuration.patch
@@ -0,0 +1,38 @@
+From 592de67191a3969fcccef6293740c7142793d461 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Wed, 1 Nov 2023 21:54:05 +0100
+Subject: [PATCH] skip installing example configuration
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This requires root if prefix dir is pointed to /etc,
+which we cannot do in nix builds.
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ meson.build | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 5f5935f..8373013 100644
+--- a/meson.build
++++ b/meson.build
+@@ -114,10 +114,10 @@ else
+   runstatedir = rundir
+ endif
+ 
+-install_data(
+-  sources: 'ksmbd.conf.example',
+-  install_dir: get_option('sysconfdir') / 'ksmbd',
+-)
++#install_data(
++#  sources: 'ksmbd.conf.example',
++#  install_dir: get_option('sysconfdir') / 'ksmbd',
++#)
+ 
+ systemdsystemunitdir = get_option('systemdsystemunitdir')
+ if systemdsystemunitdir == ''
+-- 
+2.42.0
+
diff --git a/pkgs/os-specific/linux/ksmbd-tools/default.nix b/pkgs/os-specific/linux/ksmbd-tools/default.nix
new file mode 100644
index 00000000000..4098f6c2225
--- /dev/null
+++ b/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, glib
+, libkrb5
+, libnl
+, libtool
+, pkg-config
+, withKerberos ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ksmbd-tools";
+  version = "3.5.0";
+
+  src = fetchFromGitHub {
+    owner = "cifsd-team";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-8mjfKCazigHnuN7Egf11ZuD+nQx7ZTesn0a4LsVvV/M=";
+  };
+
+  buildInputs = [ glib libnl ] ++ lib.optional withKerberos libkrb5;
+
+  nativeBuildInputs = [ meson ninja libtool pkg-config ];
+  patches = [ ./0001-skip-installing-example-configuration.patch ];
+  mesonFlags = [
+    "-Drundir=/run"
+    "--sysconfdir /etc"
+  ];
+
+  meta = with lib; {
+    description = "Userspace utilities for the ksmbd kernel SMB server";
+    homepage = "https://www.kernel.org/doc/html/latest/filesystems/cifs/ksmbd.html";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/os-specific/linux/kvdo/default.nix b/pkgs/os-specific/linux/kvdo/default.nix
new file mode 100644
index 00000000000..e2390b68a5c
--- /dev/null
+++ b/pkgs/os-specific/linux/kvdo/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, lib, fetchFromGitHub, vdo, kernel }:
+
+stdenv.mkDerivation rec {
+  inherit (vdo);
+  pname = "kvdo";
+  version = "8.2.1.6"; # bump this version with vdo
+
+  src = fetchFromGitHub {
+    owner = "dm-vdo";
+    repo = "kvdo";
+    rev = version;
+    hash = "sha256-S5r2Rgx5pWk4IsdIwmfZkuGL/oEQ3prquyVqxjR3cO0=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  dontConfigure = true;
+  enableParallelBuilding = true;
+
+  KSRC = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  INSTALL_MOD_PATH = placeholder "out";
+
+  preBuild = ''
+    makeFlags="$makeFlags -C ${KSRC} M=$(pwd)"
+  '';
+  installTargets = [ "modules_install" ];
+
+  meta = with lib; {
+    inherit (vdo.meta) license maintainers;
+    homepage = "https://github.com/dm-vdo/kvdo";
+    description = "A pair of kernel modules which provide pools of deduplicated and/or compressed block storage";
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.15";
+  };
+}
diff --git a/pkgs/os-specific/linux/kvmfr/default.nix b/pkgs/os-specific/linux/kvmfr/default.nix
index a7949c85c2e..a77d1290ca8 100644
--- a/pkgs/os-specific/linux/kvmfr/default.nix
+++ b/pkgs/os-specific/linux/kvmfr/default.nix
@@ -1,11 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, kernel, kmod, looking-glass-client }:
+{ lib, stdenv, kernel, looking-glass-client }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "kvmfr";
   version = looking-glass-client.version;
 
   src = looking-glass-client.src;
-  sourceRoot = "source/module";
+  sourceRoot = "${looking-glass-client.src.name}/module";
+  patches = lib.optional (kernel.kernelAtLeast "6.4") [
+    ./linux-6-4-compat.patch
+  ];
   hardeningDisable = [ "pic" "format" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
@@ -28,5 +31,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ j-brn ];
     platforms = [ "x86_64-linux" ];
+    broken = kernel.kernelOlder "5.3";
   };
 }
diff --git a/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch b/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch
new file mode 100644
index 00000000000..e57d1d27c36
--- /dev/null
+++ b/pkgs/os-specific/linux/kvmfr/linux-6-4-compat.patch
@@ -0,0 +1,16 @@
+diff --git a/kvmfr.c b/kvmfr.c
+index 121aae5b..2f4c9e1a 100644
+--- a/kvmfr.c
++++ b/kvmfr.c
+@@ -539,7 +539,11 @@ static int __init kvmfr_module_init(void)
+   if (kvmfr->major < 0)
+     goto out_free;
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 4, 0)
+   kvmfr->pClass = class_create(THIS_MODULE, KVMFR_DEV_NAME);
++#else
++  kvmfr->pClass = class_create(KVMFR_DEV_NAME);
++#endif
+   if (IS_ERR(kvmfr->pClass))
+     goto out_unreg;
+ 
diff --git a/pkgs/os-specific/linux/latencytop/default.nix b/pkgs/os-specific/linux/latencytop/default.nix
index 30ec6cdc7b5..a48abf85831 100644
--- a/pkgs/os-specific/linux/latencytop/default.nix
+++ b/pkgs/os-specific/linux/latencytop/default.nix
@@ -1,13 +1,20 @@
-{ lib, stdenv, fetchurl, ncurses, glib, pkg-config, gtk2 }:
+{ lib, stdenv, fetchurl, ncurses, glib, pkg-config, gtk2, util-linux }:
 
 stdenv.mkDerivation rec {
-  name = "latencytop-0.5";
+  pname = "latencytop";
+  version = "0.5";
+
+  postPatch = ''
+    sed -i s,/usr,$out, Makefile
+
+    # Fix #171609
+    substituteInPlace fsync.c --replace /bin/mount ${util-linux}/bin/mount
+  '';
 
-  patchPhase = "sed -i s,/usr,$out, Makefile";
   preInstall = "mkdir -p $out/sbin";
 
   src = fetchurl {
-    urls = [ "http://latencytop.org/download/${name}.tar.gz"
+    urls = [ "http://latencytop.org/download/latencytop-${version}.tar.gz"
      "http://dbg.download.sourcemage.org/mirror/latencytop-0.5.tar.gz" ];
     sha256 = "1vq3j9zdab6njly2wp900b3d5244mnxfm88j2bkiinbvxbxp4zwy";
   };
diff --git a/pkgs/os-specific/linux/ldm/default.nix b/pkgs/os-specific/linux/ldm/default.nix
index 072b53b02ec..f8a519de847 100644
--- a/pkgs/os-specific/linux/ldm/default.nix
+++ b/pkgs/os-specific/linux/ldm/default.nix
@@ -4,7 +4,6 @@ assert mountPath != "";
 
 let
   version = "0.5";
-  git = "https://github.com/LemonBoy/ldm.git";
 in
 stdenv.mkDerivation rec {
   pname = "ldm";
@@ -13,7 +12,7 @@ stdenv.mkDerivation rec {
   # There is a stable release, but we'll use the lvm branch, which
   # contains important fixes for LVM setups.
   src = fetchgit {
-    url = meta.repositories.git;
+    url = "https://github.com/LemonBoy/ldm";
     rev = "refs/tags/v${version}";
     sha256 = "0lxfypnbamfx6p9ar5k9wra20gvwn665l4pp2j4vsx4yi5q7rw2n";
   };
@@ -36,8 +35,6 @@ stdenv.mkDerivation rec {
   meta = {
     description = "A lightweight device mounter, with libudev as only dependency";
     license = lib.licenses.mit;
-
     platforms = lib.platforms.linux;
-    repositories.git = git;
   };
 }
diff --git a/pkgs/os-specific/linux/ledger-udev-rules/default.nix b/pkgs/os-specific/linux/ledger-udev-rules/default.nix
index 7b23719c791..3a6bf9e5d51 100644
--- a/pkgs/os-specific/linux/ledger-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/ledger-udev-rules/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "ledger-udev-rules";
-  version = "unstable-2019-05-30";
+  version = "unstable-2021-09-10";
 
   src = fetchFromGitHub {
     owner = "LedgerHQ";
     repo = "udev-rules";
-    rev = "765b7fdf57b20fd9326cedf48ee52e905024ab4f";
-    sha256 = "10a42al020zpkx918y6b1l9az45vk3921b2l1mx87w3m0ad9qvif";
+    rev = "2776324af6df36c2af4d2e8e92a1c98c281117c9";
+    sha256 = "sha256-yTYI81PXMc32lMfI5uhD14nP20zAI7ZF33V1LRDWg2Y=";
   };
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/lenovo-legion/app.nix b/pkgs/os-specific/linux/lenovo-legion/app.nix
new file mode 100644
index 00000000000..a409ad2fbf4
--- /dev/null
+++ b/pkgs/os-specific/linux/lenovo-legion/app.nix
@@ -0,0 +1,55 @@
+{ lib, fetchFromGitHub, xorg, libsForQt5, wrapQtAppsHook, python3 }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "lenovo-legion-app";
+  version = "0.0.9";
+
+  src = fetchFromGitHub {
+    owner = "johnfanv2";
+    repo = "LenovoLegionLinux";
+    rev = "v${version}-prerelese";
+    hash = "sha256-P4vqzNX2nF4LnoQDOV8WEiXAICQCyjj9xPpFNvMu93k=";
+  };
+
+  sourceRoot = "${src.name}/python/legion_linux";
+
+  nativeBuildInputs = [ wrapQtAppsHook ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pyqt5
+    argcomplete
+    pyyaml
+    darkdetect
+    xorg.libxcb
+    libsForQt5.qtbase
+  ];
+
+  postPatch = ''
+    substituteInPlace ./setup.cfg \
+      --replace "_VERSION" "${version}"
+    substituteInPlace ../../extra/service/fancurve-set \
+      --replace "FOLDER=/etc/legion_linux/" "FOLDER=$out/share/legion_linux"
+    substituteInPlace ./legion_linux/legion.py \
+      --replace "/etc/legion_linux" "$out/share/legion_linux"
+  '';
+
+  postInstall = ''
+    cp ./legion_linux/legion_logo.png $out/${python3.sitePackages}/legion_logo.png
+  '';
+
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+  '';
+
+  meta = {
+    description = "An utility to control Lenovo Legion laptop";
+    homepage = "https://github.com/johnfanv2/LenovoLegionLinux";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.ulrikstrid ];
+    mainProgram = "legion_gui";
+  };
+}
+
diff --git a/pkgs/os-specific/linux/lenovo-legion/default.nix b/pkgs/os-specific/linux/lenovo-legion/default.nix
new file mode 100644
index 00000000000..527f1852f1e
--- /dev/null
+++ b/pkgs/os-specific/linux/lenovo-legion/default.nix
@@ -0,0 +1,34 @@
+{ lib, fetchurl, stdenv, kernel, bash, lenovo-legion }:
+
+stdenv.mkDerivation {
+  pname = "lenovo-legion-module";
+  inherit (lenovo-legion) version src;
+
+  sourceRoot = "${lenovo-legion.src.name}/kernel_module";
+
+  hardeningDisable = [ "pic" ];
+
+  preConfigure = ''
+    sed -i -e '/depmod/d' ./Makefile
+  '';
+
+  makeFlags = kernel.makeFlags ++ [
+    "SHELL=bash"
+    "KERNELVERSION=${kernel.modDirVersion}"
+    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALLDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86"
+    "MODDESTDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86"
+    "DKMSDIR=${placeholder "out"}/lib/modules/${kernel.modDirVersion}/misc"
+  ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  meta = {
+    description = "Linux kernel module for controlling fan and power in Lenovo Legion laptops";
+    homepage = "https://github.com/johnfanv2/LenovoLegionLinux";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.ulrikstrid ];
+    broken = kernel.kernelOlder "5.15";
+  };
+}
diff --git a/pkgs/os-specific/linux/libaio/default.nix b/pkgs/os-specific/linux/libaio/default.nix
index 046bba5dda0..324e2695dd5 100644
--- a/pkgs/os-specific/linux/libaio/default.nix
+++ b/pkgs/os-specific/linux/libaio/default.nix
@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, fetchpatch }:
 
 stdenv.mkDerivation rec {
-  version = "0.3.112";
+  version = "0.3.113";
   pname = "libaio";
 
   src = fetchurl {
     url = "https://pagure.io/libaio/archive/${pname}-${version}/${pname}-${pname}-${version}.tar.gz";
-    sha256 = "0wi2myh191sja13qj3claxhpfkngvy10x30f78hm9cxzkfr97kxp";
+    sha256 = "sha256-cWxwWXAyRzROsGa1TsvDyiE08BAzBxkubCt9q1+VKKs=";
   };
 
   postPatch = ''
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Library for asynchronous I/O in Linux";
-    homepage = "http://lse.sourceforge.net/io/aio.html";
+    homepage = "https://lse.sourceforge.net/io/aio.html";
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;
     maintainers = with lib.maintainers; [ ];
diff --git a/pkgs/os-specific/linux/libatasmart/default.nix b/pkgs/os-specific/linux/libatasmart/default.nix
index c422f5e01bb..d5be78e913b 100644
--- a/pkgs/os-specific/linux/libatasmart/default.nix
+++ b/pkgs/os-specific/linux/libatasmart/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, udev, buildPackages }:
 
 stdenv.mkDerivation rec {
-  name = "libatasmart-0.19";
+  pname = "libatasmart";
+  version = "0.19";
 
   src = fetchurl {
-    url = "http://0pointer.de/public/${name}.tar.xz";
+    url = "http://0pointer.de/public/libatasmart-${version}.tar.xz";
     sha256 = "138gvgdwk6h4ljrjsr09pxk1nrki4b155hqdzyr8mlk3bwsfmw31";
   };
 
diff --git a/pkgs/os-specific/linux/libbpf/0.x.nix b/pkgs/os-specific/linux/libbpf/0.x.nix
new file mode 100644
index 00000000000..480e78d0803
--- /dev/null
+++ b/pkgs/os-specific/linux/libbpf/0.x.nix
@@ -0,0 +1,54 @@
+{ fetchFromGitHub
+, elfutils
+, pkg-config
+, stdenv
+, zlib
+, lib
+, nixosTests
+}:
+
+# update bot does not seem to limit updates here to 0.8.x despite
+# the all-packages derivation being libbpf_0 as the libbpf base alias
+# is still present: just disable it for 0.x:
+# nixpkgs-update: no auto update
+
+stdenv.mkDerivation rec {
+  pname = "libbpf";
+  version = "0.8.1";
+
+  src = fetchFromGitHub {
+    owner = "libbpf";
+    repo = "libbpf";
+    rev = "v${version}";
+    sha256 = "sha256-daVS+TErmDU8ksThOvcepg1A61iD8N8GIkC40cmc9/8=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ elfutils zlib ];
+
+  enableParallelBuilding = true;
+  makeFlags = [ "PREFIX=$(out)" "-C src" ];
+
+  passthru.tests = {
+    bpf = nixosTests.bpf;
+  };
+
+  postInstall = ''
+    # install linux's libbpf-compatible linux/btf.h
+    install -Dm444 include/uapi/linux/*.h -t $out/include/linux
+  '';
+
+  # FIXME: Multi-output requires some fixes to the way the pkg-config file is
+  # constructed (it gets put in $out instead of $dev for some reason, with
+  # improper paths embedded). Don't enable it for now.
+
+  # outputs = [ "out" "dev" ];
+
+  meta = with lib; {
+    description = "Upstream mirror of libbpf";
+    homepage = "https://github.com/libbpf/libbpf";
+    license = with licenses; [ lgpl21 /* or */ bsd2 ];
+    maintainers = with maintainers; [ thoughtpolice vcunat saschagrunert martinetd ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 2e497584fab..51f6ea471a6 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -1,42 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config
-, libelf, zlib
-, fetchpatch
+{ fetchFromGitHub
+, elfutils
+, pkg-config
+, stdenv
+, zlib
+, lib
+, nixosTests
 }:
 
-with builtins;
-
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "0.1.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
-    owner  = "libbpf";
-    repo   = "libbpf";
-    rev    = "v${version}";
-    sha256 = "0ilnnm4q22f8fagwp8kb37licy4ks861i2iqh2djsypqhnxvx3fv";
+    owner = "libbpf";
+    repo = "libbpf";
+    rev = "v${version}";
+    sha256 = "sha256-SDDdz2HKEfzHloLkb0sv5ldTo+1yJDVc9O7nj4Cjznk=";
   };
 
-  patches = [
-    (fetchpatch { # included upstream for > 0.1.0
-      name = "link-zlib.patch";
-      url = "https://github.com/libbpf/libbpf/commit/8b14cb43ff837.diff";
-      sha256 = "17mvjrs7s727drz013a8qlyj0345ldi2kph6pazcmxv6kl1qrz2z";
-    })
-  ];
-  patchFlags = "-p2";
-  # https://github.com/libbpf/libbpf/pull/201#issuecomment-689174740
-  postPatch = ''
-    substituteInPlace ../scripts/check-reallocarray.sh \
-      --replace 'mktemp /tmp/' 'mktemp ' \
-      --replace '/bin/rm' 'rm'
-  '';
-
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libelf zlib ];
+  buildInputs = [ elfutils zlib ];
 
-  sourceRoot = "source/src";
   enableParallelBuilding = true;
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=$(out)" "-C src" ];
+
+  passthru.tests = {
+    bpf = nixosTests.bpf;
+  };
+
+  postInstall = ''
+    # install linux's libbpf-compatible linux/btf.h
+    install -Dm444 include/uapi/linux/*.h -t $out/include/linux
+  '';
 
   # FIXME: Multi-output requires some fixes to the way the pkg-config file is
   # constructed (it gets put in $out instead of $dev for some reason, with
@@ -46,9 +41,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Upstream mirror of libbpf";
-    homepage    = "https://github.com/libbpf/libbpf";
-    license     = with licenses; [ lgpl21 /* or */ bsd2 ];
-    maintainers = with maintainers; [ thoughtpolice vcunat ];
-    platforms   = platforms.linux;
+    homepage = "https://github.com/libbpf/libbpf";
+    license = with licenses; [ lgpl21 /* or */ bsd2 ];
+    maintainers = with maintainers; [ thoughtpolice vcunat saschagrunert martinetd ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/libcap-ng/default.nix b/pkgs/os-specific/linux/libcap-ng/default.nix
index 615f376d79d..0f60a8655ce 100644
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@@ -1,36 +1,21 @@
-{ lib, stdenv, fetchurl, swig ? null, python2 ? null, python3 ? null }:
-
-assert python2 != null || python3 != null -> swig != null;
+{ lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
   pname = "libcap-ng";
-  # When updating make sure to test that the version with
-  # all of the python bindings still works
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchurl {
-    url = "${meta.homepage}/${pname}-${version}.tar.gz";
-    sha256 = "1sasp1n154aqy9fz0knlb966svm7xg1zjhg1vr4q839bgjvq7h2j";
+    url = "https://people.redhat.com/sgrubb/libcap-ng/libcap-ng-${version}.tar.gz";
+    sha256 = "sha256-vtb2hI4iuy+Dtfdksq7w7TkwVOgDqOOocRyyo55rSS0=";
   };
 
-  nativeBuildInputs = [ swig ];
-  buildInputs = [ python2 python3 ];
-
-  postPatch = ''
-    function get_header() {
-      echo -e "#include <$1>" | gcc -M -xc - | tr ' ' '\n' | grep "$1" | head -n 1
-    }
-
-    # Fix some hardcoding of header paths
-    sed -i "s,/usr/include/linux/capability.h,$(get_header linux/capability.h),g" bindings/python{,3}/Makefile.in
-  '';
+  outputs = [ "out" "dev" "man" ];
 
   configureFlags = [
-    (if python2 != null then "--with-python" else "--without-python")
-    (if python3 != null then "--with-python3" else "--without-python3")
+    "--without-python"
   ];
 
-  meta = let inherit (lib) platforms licenses; in {
+  meta = with lib; {
     description = "Library for working with POSIX capabilities";
     homepage = "https://people.redhat.com/sgrubb/libcap-ng/";
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index 2f12d2fea38..9b23625102a 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -1,24 +1,35 @@
-{ stdenv, lib, buildPackages, fetchurl, attr, perl, runtimeShell
+{ stdenv, lib, buildPackages, fetchurl, attr, runtimeShell
 , usePam ? !isStatic, pam ? null
 , isStatic ? stdenv.hostPlatform.isStatic
+
+# passthru.tests
+, bind
+, chrony
+, htop
+, libgcrypt
+, libvirt
+, ntp
+, qemu
+, squid
+, tor
+, uwsgi
 }:
 
 assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.49";
+  version = "2.69";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-6YvE2TZFCC7Hh3MLD9GnErOIgkZcUFd33hfDOIMe4YE=";
+    sha256 = "sha256-8xH489rYRpnQVm0db37JQ6kpiyj3FMrjyTHf1XSS1+s=";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" ]
     ++ lib.optional usePam "pam";
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl ];
 
   buildInputs = lib.optional usePam pam;
 
@@ -29,9 +40,12 @@ stdenv.mkDerivation rec {
     "PAM_CAP=${if usePam then "yes" else "no"}"
     "BUILD_CC=$(CC_FOR_BUILD)"
     "CC:=$(CC)"
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ] ++ lib.optional isStatic "SHARED=no";
 
-  prePatch = ''
+  postPatch = ''
+    patchShebangs ./progs/mkcapshdoc.sh
+
     # use full path to bash
     substituteInPlace progs/capsh.c --replace "/bin/bash" "${runtimeShell}"
 
@@ -55,6 +69,20 @@ stdenv.mkDerivation rec {
     mv "$lib"/lib/security "$pam/lib"
   '';
 
+  passthru.tests = {
+    inherit
+      bind
+      chrony
+      htop
+      libgcrypt
+      libvirt
+      ntp
+      qemu
+      squid
+      tor
+      uwsgi;
+  };
+
   meta = {
     description = "Library for working with POSIX capabilities";
     homepage = "https://sites.google.com/site/fullycapable";
diff --git a/pkgs/os-specific/linux/libcgroup/default.nix b/pkgs/os-specific/linux/libcgroup/default.nix
index 6d6a8e7c21e..8f24362b94b 100644
--- a/pkgs/os-specific/linux/libcgroup/default.nix
+++ b/pkgs/os-specific/linux/libcgroup/default.nix
@@ -2,17 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "libcgroup";
-  version = "0.42.2";
+  version = "3.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1h8s70lm6g7r0wj7j3xgj2g3j9fifvsy2pna6w0j3i5hh42qfms4";
+    fetchSubmodules = true;
+    hash = "sha256-x2yBqpr3LedtWmpZ4K1ipZxIualNJuDtC4FVGzzcQn8=";
   };
 
-  buildInputs = [ pam bison flex ];
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [ autoreconfHook bison flex ];
+  buildInputs = [ pam ];
 
   postPatch = ''
     substituteInPlace src/tools/Makefile.am \
@@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Library and tools to manage Linux cgroups";
-    homepage    = "http://libcg.sourceforge.net/";
+    homepage    = "https://github.com/libcgroup/libcgroup";
     license     = lib.licenses.lgpl2;
     platforms   = lib.platforms.linux;
     maintainers = [ lib.maintainers.thoughtpolice ];
diff --git a/pkgs/os-specific/linux/libevdevc/default.nix b/pkgs/os-specific/linux/libevdevc/default.nix
index 2417ef6da9d..5e6b7cd4781 100644
--- a/pkgs/os-specific/linux/libevdevc/default.nix
+++ b/pkgs/os-specific/linux/libevdevc/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, coreutils, pkg-config, glib, jsoncpp }:
 
 stdenv.mkDerivation rec {
-  name = "libevdevc";
+  pname = "libevdevc";
   version = "2.0.1";
   src = fetchFromGitHub {
     owner = "hugegreenbug";
@@ -19,6 +19,9 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "DESTDIR=$(out)" "LIBDIR=/lib" ];
 
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
   meta = with lib; {
     description = "ChromiumOS libevdev. Renamed to avoid conflicts with the standard libevdev found in Linux distros";
     license = licenses.bsd3;
diff --git a/pkgs/os-specific/linux/libfabric/default.nix b/pkgs/os-specific/linux/libfabric/default.nix
deleted file mode 100644
index 2abe07b0964..00000000000
--- a/pkgs/os-specific/linux/libfabric/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook, libpsm2 }:
-
-stdenv.mkDerivation rec {
-  pname = "libfabric";
-  version = "1.13.0";
-
-  enableParallelBuilding = true;
-
-  src = fetchFromGitHub {
-    owner = "ofiwg";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-felGKpdihOi4TCp95T1ti7fErQVphP0vYGRKEwlQt4Q=";
-  };
-
-  nativeBuildInputs = [ pkg-config autoreconfHook ] ;
-
-  buildInputs = [ libpsm2 ] ;
-
-  configureFlags = [ "--enable-psm2=${libpsm2}" ] ;
-
-  meta = with lib; {
-    homepage = "http://libfabric.org/";
-    description = "Open Fabric Interfaces";
-    license = with licenses; [ gpl2 bsd2 ];
-    platforms = [ "x86_64-linux" ];
-    maintainers = [ maintainers.bzizou ];
-  };
-}
diff --git a/pkgs/os-specific/linux/libgestures/default.nix b/pkgs/os-specific/linux/libgestures/default.nix
index bface8118be..1454c0c78a5 100644
--- a/pkgs/os-specific/linux/libgestures/default.nix
+++ b/pkgs/os-specific/linux/libgestures/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, glib, jsoncpp }:
 
 stdenv.mkDerivation rec {
-  name = "libgestures-${version}";
+  pname = "libgestures";
   version = "2.0.1";
   src = fetchFromGitHub {
     owner = "hugegreenbug";
diff --git a/pkgs/os-specific/linux/libnl-tiny/default.nix b/pkgs/os-specific/linux/libnl-tiny/default.nix
new file mode 100644
index 00000000000..2f5d1d0999a
--- /dev/null
+++ b/pkgs/os-specific/linux/libnl-tiny/default.nix
@@ -0,0 +1,28 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config }:
+
+stdenv.mkDerivation {
+  pname = "libnl-tiny";
+  version = "unstable-2023-07-27";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/libnl-tiny.git";
+    rev = "bc92a280186f9becc53c0f17e4e43cfbdeec7e7b";
+    hash = "sha256-/d6so8hfBOyp8NbUhPZ0aRj6gXO/RLgwCQnAT7N/rF8=";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  preConfigure = ''
+    sed -e 's|''${prefix}/@CMAKE_INSTALL_LIBDIR@|@CMAKE_INSTALL_FULL_LIBDIR@|g' \
+        -e 's|''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@|@CMAKE_INSTALL_FULL_INCLUDEDIR@|g' \
+        -i libnl-tiny.pc.in
+  '';
+
+  meta = with lib; {
+    description = "Tiny OpenWrt fork of libnl";
+    homepage = "https://git.openwrt.org/?p=project/libnl-tiny.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/os-specific/linux/libnl/default.nix b/pkgs/os-specific/linux/libnl/default.nix
index d6604f9e15b..5248c263b3b 100644
--- a/pkgs/os-specific/linux/libnl/default.nix
+++ b/pkgs/os-specific/linux/libnl/default.nix
@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libnl";
-  version = "3.5.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     repo = "libnl";
     owner = "thom311";
     rev = "libnl${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "1ak30jcx52gl5yz1691qq0b76ldbcp2z6vsvdr2mrrwqiplqbcs2";
+    sha256 = "sha256-Ty9NdWKWB29MTRfG5OJlSE0mSTN3Wy+sR4KtuExXcB4=";
   };
 
   outputs = [ "bin" "dev" "out" "man" ] ++ lib.optional pythonSupport "py";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   postBuild = lib.optionalString (pythonSupport) ''
       cd python
-      ${python.interpreter} setup.py install --prefix=../pythonlib
+      ${python.pythonOnBuildForHost.interpreter} setup.py install --prefix=../pythonlib
       cd -
   '';
 
diff --git a/pkgs/os-specific/linux/libnss-mysql/default.nix b/pkgs/os-specific/linux/libnss-mysql/default.nix
new file mode 100644
index 00000000000..77e629b0307
--- /dev/null
+++ b/pkgs/os-specific/linux/libnss-mysql/default.nix
@@ -0,0 +1,30 @@
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, which, libmysqlclient }:
+
+stdenv.mkDerivation rec {
+  pname = "libnss-mysql";
+  version = "1.7.1";
+
+  src = fetchFromGitHub {
+    owner = "saknopper";
+    repo = "libnss-mysql";
+    rev = "v${version}";
+    sha256 = "1fhsswa3h2nkhjkyjxxqnj07rlx6bmfvd8j521snimx2jba8h0d6";
+  };
+
+  nativeBuildInputs = [ autoreconfHook which ];
+  buildInputs = [ libmysqlclient ];
+
+  configureFlags = [ "--sysconfdir=/etc" ];
+  installFlags = [ "sysconfdir=$(out)/etc" ];
+  postInstall = ''
+    rm -r $out/etc
+  '';
+
+  meta = with lib; {
+    description = "MySQL module for the Solaris Nameservice Switch (NSS)";
+    homepage = "https://github.com/saknopper/libnss-mysql";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ netali ];
+  };
+}
diff --git a/pkgs/os-specific/linux/libnvme/default.nix b/pkgs/os-specific/linux/libnvme/default.nix
new file mode 100644
index 00000000000..129bb49e81e
--- /dev/null
+++ b/pkgs/os-specific/linux/libnvme/default.nix
@@ -0,0 +1,81 @@
+{ fetchFromGitHub
+, json_c
+, keyutils
+, lib
+, meson
+, ninja
+, openssl
+, perl
+, pkg-config
+, python3
+, stdenv
+, swig
+, systemd
+, fetchpatch
+# ImportError: cannot import name 'mlog' from 'mesonbuild'
+, withDocs ? stdenv.hostPlatform.canExecute stdenv.buildPlatform
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libnvme";
+  version = "1.6";
+
+  outputs = [ "out" ] ++ lib.optionals withDocs [ "man" ];
+
+  src = fetchFromGitHub {
+    owner = "linux-nvme";
+    repo = "libnvme";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-7bvjsmt16/6RycSDKIECtJ4ES7NTaspU6IMpUw0sViA=";
+  };
+
+  patches = [
+    # included in next release
+    (fetchpatch {
+      url = "https://github.com/linux-nvme/libnvme/commit/ff742e792725c316ba6de0800188bf36751bd1d1.patch";
+      hash = "sha256-IUjPUBmGQC4oAKFFlBrjonqD2YdyNPC9siK4t/t2slE=";
+    })
+  ];
+
+  postPatch = ''
+    patchShebangs scripts
+  '';
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    perl # for kernel-doc
+    pkg-config
+    python3.pythonOnBuildForHost
+    swig
+  ];
+
+  buildInputs = [
+    keyutils
+    json_c
+    openssl
+    systemd
+    python3
+  ];
+
+  mesonFlags = [
+    "-Ddocs=man"
+    (lib.mesonBool "tests" finalAttrs.doCheck)
+    (lib.mesonBool "docs-build" withDocs)
+  ];
+
+  preConfigure = ''
+    export KBUILD_BUILD_TIMESTAMP="$(date -u -d @$SOURCE_DATE_EPOCH)"
+  '';
+
+  # mocked ioctl conflicts with the musl one: https://github.com/NixOS/nixpkgs/pull/263768#issuecomment-1782877974
+  doCheck = !stdenv.hostPlatform.isMusl;
+
+  meta = with lib; {
+    description = "C Library for NVM Express on Linux";
+    homepage = "https://github.com/linux-nvme/libnvme";
+    maintainers = with maintainers; [ fogti vifino ];
+    license = with licenses; [ lgpl21Plus ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/os-specific/linux/libpsm2/default.nix b/pkgs/os-specific/linux/libpsm2/default.nix
index 1ac4580b13f..0dab09de4c1 100644
--- a/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/pkgs/os-specific/linux/libpsm2/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libpsm2";
-  version = "11.2.185";
+  version = "12.0.1";
 
   preConfigure= ''
     export UDEVDIR=$out/etc/udev
@@ -11,7 +11,14 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildInputs = [ numactl pkg-config ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ numactl ];
+
+  makeFlags = [
+    # Disable blanket -Werror to avoid build failures
+    # on fresh toolchains like gcc-11.
+    "WERROR="
+  ];
 
   installFlags = [
     "DESTDIR=$(out)"
@@ -23,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "opa-psm2";
     rev = "PSM2_${version}";
-    sha256 = "062hg4r6gz7pla9df70nqs5i2a3mp1wszmp4l0g771fykhhrxsjg";
+    sha256 = "sha256-MzocxY+X2a5rJvTo+gFU0U10YzzazR1IxzgEporJyhI=";
   };
 
   postInstall = ''
@@ -35,7 +42,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/intel/opa-psm2";
     description = "The PSM2 library supports a number of fabric media and stacks";
     license = with licenses; [ gpl2 bsd3 ];
-   platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" ];
     maintainers = [ maintainers.bzizou ];
   };
 }
diff --git a/pkgs/os-specific/linux/libratbag/default.nix b/pkgs/os-specific/linux/libratbag/default.nix
index a264c454487..a35ab1dcc01 100644
--- a/pkgs/os-specific/linux/libratbag/default.nix
+++ b/pkgs/os-specific/linux/libratbag/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libratbag";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner  = "libratbag";
     repo   = "libratbag";
     rev    = "v${version}";
-    sha256 = "sha256-wJLG0Gxm1RWwW5SCGoa2QscU1VC0r93KZfEMNVg3Tko=";
+    sha256 = "sha256-TQ8DVj4yqq3IA0oGnLDz+QNTyNRmGqspEjkPeBmXNew=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/libselinux/default.nix b/pkgs/os-specific/linux/libselinux/default.nix
index fbf7e4bd995..695012effc5 100644
--- a/pkgs/os-specific/linux/libselinux/default.nix
+++ b/pkgs/os-specific/linux/libselinux/default.nix
@@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, pcre, pkg-config, libsepol
-, enablePython ? true, swig ? null, python3 ? null
+{ lib, stdenv, fetchurl, fetchpatch, buildPackages, pcre, pkg-config, libsepol
+, enablePython ? !stdenv.hostPlatform.isStatic, swig ? null, python3 ? null
 , fts
 }:
 
@@ -9,24 +9,45 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libselinux";
-  version = "3.0";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   outputs = [ "bin" "out" "dev" "man" ] ++ optional enablePython "py";
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libselinux-${version}.tar.gz";
-    sha256 = "0cr4p0qkr4qd5z1x677vwhz6mlz55kxyijwi2dmrvbhxcw7v78if";
+    url = "${se_url}/${version}/libselinux-${version}.tar.gz";
+    sha256 = "0mvh793g7fg6wb6zqhkdyrv80x6k84ypqwi8ii89c91xcckyxzdc";
   };
 
-  nativeBuildInputs = [ pkg-config ] ++ optionals enablePython [ swig python3 ];
+  patches = [
+    # Make it possible to disable shared builds (for pkgsStatic).
+    #
+    # We can't use fetchpatch because it processes includes/excludes
+    # /after/ stripping the prefix, which wouldn't work here because
+    # there would be no way to distinguish between
+    # e.g. libselinux/src/Makefile and libsepol/src/Makefile.
+    #
+    # This is a static email, so we shouldn't have to worry about
+    # normalizing the patch.
+    (fetchurl {
+      url = "https://lore.kernel.org/selinux/20211113141616.361640-1-hi@alyssa.is/raw";
+      sha256 = "16a2s2ji9049892i15yyqgp4r20hi1hij4c1s4s8law9jsx65b3n";
+      postFetch = ''
+        mv "$out" $TMPDIR/patch
+        ${buildPackages.patchutils_0_3_3}/bin/filterdiff \
+            -i 'a/libselinux/*' --strip 1 <$TMPDIR/patch >"$out"
+      '';
+    })
+  ];
+
+  nativeBuildInputs = [ pkg-config python3 ] ++ optionals enablePython [ swig ];
   buildInputs = [ libsepol pcre fts ] ++ optionals enablePython [ python3 ];
 
   # drop fortify here since package uses it by default, leading to compile error:
   # command-line>:0:0: error: "_FORTIFY_SOURCE" redefined [-Werror]
   hardeningDisable = [ "fortify" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
   makeFlags = [
     "PREFIX=$(out)"
@@ -39,8 +60,11 @@ stdenv.mkDerivation rec {
     "SHLIBDIR=$(out)/lib"
 
     "LIBSEPOLA=${lib.getLib libsepol}/lib/libsepol.a"
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+  ] ++ optionals stdenv.hostPlatform.isStatic [
+    "DISABLE_SHARED=y"
   ] ++ optionals enablePython [
-    "PYTHON=${python3.pythonForBuild.interpreter}"
+    "PYTHON=${python3.pythonOnBuildForHost.interpreter}"
     "PYTHONLIBDIR=$(py)/${python3.sitePackages}"
   ];
 
diff --git a/pkgs/os-specific/linux/libsemanage/default.nix b/pkgs/os-specific/linux/libsemanage/default.nix
index 11a6f2755d4..2f5a0f7172c 100644
--- a/pkgs/os-specific/linux/libsemanage/default.nix
+++ b/pkgs/os-specific/linux/libsemanage/default.nix
@@ -6,19 +6,21 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "libsemanage";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.5";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libsemanage-${version}.tar.gz";
-    sha256 = "075w6y3l9hiy5hicgwrmijyxmhfyd1r7cnc08qxyg4j46jfk8xi5";
+    url = "${se_url}/${version}/libsemanage-${version}.tar.gz";
+    sha256 = "sha256-9TU05QJHU4KA7Q12xs6B2Ps5Ob1kytuJ2hDbpC5A3Zw=";
    };
 
   outputs = [ "out" "dev" "man" ] ++ optional enablePython "py";
 
-  nativeBuildInputs = [ bison flex pkg-config ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ bison flex pkg-config ] ++ optional enablePython swig;
   buildInputs = [ libsepol libselinux bzip2 audit ]
-    ++ optionals enablePython [ swig python ];
+    ++ optional enablePython python;
 
   makeFlags = [
     "PREFIX=$(out)"
@@ -26,6 +28,7 @@ stdenv.mkDerivation rec {
     "MAN3DIR=$(man)/share/man/man3"
     "MAN5DIR=$(man)/share/man/man5"
     "PYTHON=python"
+    "PYPREFIX=python"
     "PYTHONLIBDIR=$(py)/${python.sitePackages}"
     "DEFAULT_SEMANAGE_CONF_LOCATION=$(out)/etc/selinux/semanage.conf"
   ];
@@ -38,10 +41,12 @@ stdenv.mkDerivation rec {
   #  1278 |  int i;
   #       |      ^
   # cc1: all warnings being treated as errors
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=clobbered" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=clobbered" ];
 
   installTargets = [ "install" ] ++ optionals enablePython [ "install-pywrap" ];
 
+  enableParallelBuilding = true;
+
   meta = removeAttrs libsepol.meta ["outputsToInstall"] // {
     description = "Policy management tools for SELinux";
     license = lib.licenses.lgpl21;
diff --git a/pkgs/os-specific/linux/libsepol/default.nix b/pkgs/os-specific/linux/libsepol/default.nix
index 732ad88c70d..5d1c1cfc89c 100644
--- a/pkgs/os-specific/linux/libsepol/default.nix
+++ b/pkgs/os-specific/linux/libsepol/default.nix
@@ -1,16 +1,15 @@
-{ lib, stdenv, fetchurl, flex }:
+{ lib, stdenv, fetchurl, fetchpatch, flex }:
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
-  version = "3.0";
-  se_release = "20191204";
+  version = "3.5";
   se_url = "https://github.com/SELinuxProject/selinux/releases/download";
 
   outputs = [ "bin" "out" "dev" "man" ];
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/libsepol-${version}.tar.gz";
-    sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
+    url = "${se_url}/${version}/libsepol-${version}.tar.gz";
+    sha256 = "sha256-eP2vaZJNt4C6x4VG5D2cRAdLrXmMLEFdC5u5bQZe6KI=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
@@ -30,15 +29,18 @@ stdenv.mkDerivation rec {
     "SHLIBDIR=$(out)/lib"
   ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
-  passthru = { inherit se_release se_url; };
+  enableParallelBuilding = true;
+
+  passthru = { inherit se_url; };
 
   meta = with lib; {
     description = "SELinux binary policy manipulation library";
     homepage = "http://userspace.selinuxproject.org";
     platforms = platforms.linux;
-    maintainers = [ maintainers.phreedom ];
+    maintainers = [ ];
     license = lib.licenses.gpl2Plus;
+    pkgConfigModules = [ "libselinux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/libsmbios/default.nix b/pkgs/os-specific/linux/libsmbios/default.nix
index 46d0e94bb14..df4337a6caf 100644
--- a/pkgs/os-specific/linux/libsmbios/default.nix
+++ b/pkgs/os-specific/linux/libsmbios/default.nix
@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, autoreconfHook, help2man, gettext
-, libxml2, perl, python3, doxygen }:
-
+{ lib, stdenv, fetchFromGitHub, fetchurl
+, pkg-config, autoreconfHook, help2man, gettext, libxml2, perl, python3, doxygen
+}:
 
 stdenv.mkDerivation rec {
   pname = "libsmbios";
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "0krwwydyvb9224r884y1mlmzyxhlfrcqw73vi1j8787rl0gl5a2i";
   };
 
+  patches = [
+    (fetchurl {
+      name = "musl.patch";
+      url = "https://git.alpinelinux.org/aports/plain/community/libsmbios/fixes.patch?id=bdc4f67889c958c1266fa5d0cab71c3cd639122f";
+      sha256 = "aVVc52OovDYvqWRyKcRAi62daa9AalkKvnVOGvrTmRk=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook doxygen gettext libxml2 help2man perl pkg-config ];
 
   buildInputs = [ python3 ];
@@ -27,7 +35,10 @@ stdenv.mkDerivation rec {
     cp -a out/public-include/smbios_c $out/include/
   '';
 
-  preFixup = ''rm -rf "$(pwd)" ''; # Hack to avoid TMPDIR in RPATHs
+  # remove forbidden reference to $TMPDIR
+  preFixup = ''
+    patchelf --shrink-rpath --allowed-rpath-prefixes "$NIX_STORE" "$out/sbin/smbios-sys-info-lite"
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/dell/libsmbios";
diff --git a/pkgs/os-specific/linux/libtraceevent/default.nix b/pkgs/os-specific/linux/libtraceevent/default.nix
new file mode 100644
index 00000000000..5b8aa329b78
--- /dev/null
+++ b/pkgs/os-specific/linux/libtraceevent/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl, meson, ninja, cunit }:
+
+stdenv.mkDerivation rec {
+  pname = "libtraceevent";
+  version = "1.7.3";
+
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
+    rev = "libtraceevent-${version}";
+    sha256 = "sha256-poF+Cqcdj0KIgEJWW7XDAlRLz2/Egi948s1M24ETvBo=";
+  };
+
+  postPatch = ''
+    chmod +x Documentation/install-docs.sh.in
+    patchShebangs --build check-manpages.sh Documentation/install-docs.sh.in
+  '';
+
+  outputs = [ "out" "dev" "devman" "doc" ];
+  nativeBuildInputs = [ meson ninja pkg-config asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
+
+  ninjaFlags = [ "all" "docs" ];
+
+  doCheck = true;
+  checkInputs = [ cunit ];
+
+  meta = with lib; {
+    description = "Linux kernel trace event library";
+    homepage    = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git/";
+    license     = licenses.lgpl21Only;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ wentasah ];
+  };
+}
diff --git a/pkgs/os-specific/linux/libtracefs/default.nix b/pkgs/os-specific/linux/libtracefs/default.nix
new file mode 100644
index 00000000000..3e9c9115645
--- /dev/null
+++ b/pkgs/os-specific/linux/libtracefs/default.nix
@@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchgit
+, pkg-config
+, libtraceevent
+, asciidoc
+, xmlto
+, docbook_xml_dtd_45
+, docbook_xsl
+, coreutils
+, valgrind
+, sourceHighlight
+, meson
+, flex
+, bison
+, ninja
+, cunit
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libtracefs";
+  version = "1.7.0";
+
+  src = fetchgit {
+    url = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git";
+    rev = "libtracefs-${version}";
+    sha256 = "sha256-64eXFFdnZHHf4C3vbADtPuIMsfJ85VZ6t8A1gIc1CW0=";
+  };
+
+  postPatch = ''
+    chmod +x samples/extract-example.sh
+    patchShebangs --build check-manpages.sh samples/extract-example.sh Documentation/install-docs.sh.in
+  '';
+
+  outputs = [ "out" "dev" "devman" "doc" ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    asciidoc
+    xmlto
+    docbook_xml_dtd_45
+    docbook_xsl
+    valgrind
+    sourceHighlight
+    flex
+    bison
+  ];
+  buildInputs = [ libtraceevent ];
+
+  ninjaFlags = [ "all" "docs" ];
+
+  doCheck = true;
+  checkInputs = [ cunit ];
+
+  meta = with lib; {
+    description = "Linux kernel trace file system library";
+    homepage    = "https://git.kernel.org/pub/scm/libs/libtrace/libtracefs.git/";
+    license     = licenses.lgpl21Only;
+    platforms   = platforms.linux;
+    maintainers = with maintainers; [ wentasah ];
+  };
+}
diff --git a/pkgs/os-specific/linux/libvolume_id/default.nix b/pkgs/os-specific/linux/libvolume_id/default.nix
index 87b7d33c5d8..653094c9188 100644
--- a/pkgs/os-specific/linux/libvolume_id/default.nix
+++ b/pkgs/os-specific/linux/libvolume_id/default.nix
@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl}:
 
-stdenv.mkDerivation {
-  name = "libvolume_id-0.81.1";
+stdenv.mkDerivation rec {
+  pname = "libvolume_id";
+  version = "0.81.1";
 
   src = fetchurl {
-    url = "https://www.marcuscom.com/downloads/libvolume_id-0.81.1.tar.bz2";
+    url = "https://www.marcuscom.com/downloads/libvolume_id-${version}.tar.bz2";
     sha256 = "029z04vdxxsl8gycm9whcljhv6dy4b12ybsxdb99jr251gl1ifs5";
   };
 
@@ -21,5 +22,6 @@ stdenv.mkDerivation {
   meta = with lib; {
     platforms = platforms.linux;
     license = licenses.gpl2;
+    homepage = "http://www.marcuscom.com/downloads/";
   };
 }
diff --git a/pkgs/os-specific/linux/libzbc/default.nix b/pkgs/os-specific/linux/libzbc/default.nix
new file mode 100644
index 00000000000..94f5c93f949
--- /dev/null
+++ b/pkgs/os-specific/linux/libzbc/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, autoreconfHook
+, fetchFromGitHub
+, gtk3
+, libtool
+, pkg-config
+, guiSupport ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libzbc";
+  version = "5.13.0";
+
+  src = fetchFromGitHub {
+    owner = "westerndigitalcorporation";
+    repo = "libzbc";
+    rev = "v${version}";
+    sha256 = "6xkA96bgQ2Ik1vEwkw7hwjMbjMSlopzv5ziTh60Mjx0=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    libtool
+  ] ++ lib.optionals guiSupport [ pkg-config ];
+
+  buildInputs = lib.optionals guiSupport [ gtk3 ];
+
+  configureFlags = lib.optional guiSupport "--enable-gui";
+
+  meta = with lib; {
+    description = "ZBC device manipulation library";
+    homepage = "https://github.com/westerndigitalcorporation/libzbc";
+    maintainers = [ maintainers.fogti ];
+    license = with licenses; [ bsd2 lgpl3Plus ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/libzbd/default.nix b/pkgs/os-specific/linux/libzbd/default.nix
new file mode 100644
index 00000000000..0c77f73cf2f
--- /dev/null
+++ b/pkgs/os-specific/linux/libzbd/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, autoconf-archive
+, autoreconfHook
+, fetchFromGitHub
+, gtk3
+, libtool
+, pkg-config
+, guiSupport ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libzbd";
+  version = "2.0.4";
+
+  src = fetchFromGitHub {
+    owner = "westerndigitalcorporation";
+    repo = "libzbd";
+    rev = "v${version}";
+    sha256 = "sha256-iMQjOWsgsS+uI8mqoOXHRAV1+SIu1McUAcrsY+/zcu8=";
+  };
+
+  nativeBuildInputs = [
+    autoconf-archive # this can be removed with the next release
+    autoreconfHook
+    libtool
+  ] ++ lib.optionals guiSupport [ pkg-config ];
+
+  buildInputs = lib.optionals guiSupport [ gtk3 ];
+
+  configureFlags = lib.optional guiSupport "--enable-gui";
+
+  meta = with lib; {
+    description = "Zoned block device manipulation library and tools";
+    homepage = "https://github.com/westerndigitalcorporation/libzbd";
+    maintainers = [ maintainers.fogti ];
+    license = with licenses; [ lgpl3Plus gpl3Plus ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/light/default.nix b/pkgs/os-specific/linux/light/default.nix
index 995381c5340..6caa8e39450 100644
--- a/pkgs/os-specific/linux/light/default.nix
+++ b/pkgs/os-specific/linux/light/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, coreutils }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, coreutils }:
 
 stdenv.mkDerivation rec {
   version = "1.2.2";
@@ -10,6 +10,16 @@ stdenv.mkDerivation rec {
     sha256 = "1a70zcf88ifsnwll486aicjnh48zisdf8f7vi34ihw61kdadsq9s";
   };
 
+  patches = [
+    # Pull upstream fix for -fno-common toolchains:
+    #  https://github.com/haikarainen/light/pull/135
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/haikarainen/light/commit/eae912ca7ff3356805e47739114861d2b6ae7ec0.patch";
+      sha256 = "15jp8hm5scl0myiy1jmvd6m52lhx5jscvi3rgb5siwakmnkgzx9j";
+    })
+  ];
+
   configureFlags = [ "--with-udev" ];
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/os-specific/linux/lightum/default.nix b/pkgs/os-specific/linux/lightum/default.nix
index ec56a89ce88..e9925b95bcd 100644
--- a/pkgs/os-specific/linux/lightum/default.nix
+++ b/pkgs/os-specific/linux/lightum/default.nix
@@ -1,20 +1,24 @@
-{ lib, stdenv, fetchgit, libX11, libXScrnSaver, libXext, glib, dbus, pkg-config, systemd }:
+{ lib, stdenv, fetchFromGitHub, libX11, libXScrnSaver, libXext, glib, dbus, pkg-config, systemd }:
 
 stdenv.mkDerivation {
-  name = "lightum-2014-06-07";
-  src = fetchgit {
-    url = "https://github.com/poliva/lightum";
+  pname = "lightum";
+  version = "unstable-2014-06-07";
+
+  src = fetchFromGitHub {
+    owner = "poliva";
+    repo = "lightum";
     rev = "123e6babe0669b23d4c1dfa5511088608ff2baa8";
-    sha256 = "01x24rcrkgksyvqpgkr9zafg3jgs8nqng8yf0hx0kbmcimar8dbp";
+    sha256 = "sha256-dzWUVY2srgk6BM6jZ7FF+snxnPopz3fx9nq+mVkmogc=";
   };
 
+  nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [
     dbus
     glib
     libX11
     libXScrnSaver
     libXext
-    pkg-config
     systemd
   ];
 
diff --git a/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix b/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
new file mode 100644
index 00000000000..01607be58fc
--- /dev/null
+++ b/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
@@ -0,0 +1,105 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, which
+, pkg-config
+, glib
+, gtk3
+, iw
+, makeWrapper
+, qrencode
+, hostapd
+, getopt
+, dnsmasq
+, iproute2
+, flock
+, iptables
+, gawk
+, coreutils
+, gnugrep
+, gnused
+, kmod
+, networkmanager
+, procps
+}:
+
+
+stdenv.mkDerivation rec {
+  pname = "linux-wifi-hotspot";
+  version = "4.6.0";
+
+  src = fetchFromGitHub {
+    owner = "lakinduakash";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-u9OdSpdxnjHOrK6PP/SFvGRtezssoZSoJFGVdRbOIPU=";
+  };
+
+  nativeBuildInputs = [
+    which
+    pkg-config
+    makeWrapper
+    qrencode
+    hostapd
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+  ];
+
+  outputs = [ "out" ];
+
+  postPatch = ''
+    substituteInPlace ./src/scripts/Makefile \
+      --replace "etc" "$out/etc"
+    substituteInPlace ./src/scripts/wihotspot \
+      --replace "/usr" "$out"
+    substituteInPlace ./src/desktop/wifihotspot.desktop \
+      --replace "/usr" "$out"
+    substituteInPlace ./src/scripts/policies/polkit.policy \
+      --replace "/usr" "$out"
+  '';
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/create_ap \
+      --prefix PATH : ${lib.makeBinPath [
+          coreutils
+          dnsmasq
+          flock
+          gawk
+          getopt
+          gnugrep
+          gnused
+          hostapd
+          iproute2
+          iptables
+          iw
+          kmod
+          networkmanager
+          procps
+          which
+        ]}
+
+    wrapProgram $out/bin/wihotspot-gui \
+      --prefix PATH : ${lib.makeBinPath [ iw ]} \
+      --prefix PATH : "${placeholder "out"}/bin"
+
+    wrapProgram $out/bin/wihotspot \
+      --prefix PATH : ${lib.makeBinPath [ iw ]} \
+      --prefix PATH : "${placeholder "out"}/bin"
+  '';
+
+  meta = with lib; {
+    description = "Feature-rich wifi hotspot creator for Linux which provides both GUI and command-line interface";
+    homepage = "https://github.com/lakinduakash/linux-wifi-hotspot";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ onny ];
+    platforms = platforms.unix;
+  };
+
+}
diff --git a/pkgs/os-specific/linux/linuxptp/default.nix b/pkgs/os-specific/linux/linuxptp/default.nix
index 4c14d2ecae3..e5a1443d322 100644
--- a/pkgs/os-specific/linux/linuxptp/default.nix
+++ b/pkgs/os-specific/linux/linuxptp/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "linuxptp";
-  version = "3.1.1";
+  version = "4.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/linuxptp/${pname}-${version}.tgz";
-    sha256 = "1nf0w4xyzg884v8blb81zkk6q8p6zbiq9lx61jdqwbbzkdgqbmll";
+    hash = "sha256-4XQ9RPggiJfjCJXaNXnmcP+Rm5FP60talJ8+Qh3d5TU=";
   };
 
   postPatch = ''
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Implementation of the Precision Time Protocol (PTP) according to IEEE standard 1588 for Linux";
-    homepage = "http://linuxptp.sourceforge.net/";
+    homepage = "https://linuxptp.sourceforge.net/";
     maintainers = [ maintainers.markuskowa ];
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/liquidtux/default.nix b/pkgs/os-specific/linux/liquidtux/default.nix
new file mode 100644
index 00000000000..317801bb3cd
--- /dev/null
+++ b/pkgs/os-specific/linux/liquidtux/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  name = "liquidtux-${version}-${kernel.version}";
+  version = "unstable-2021-12-16";
+
+  src = fetchFromGitHub {
+    owner = "liquidctl";
+    repo = "liquidtux";
+    rev = "342defc0e22ea58f8ab2ab0f191ad3fd302c44cb";
+    sha256 = "12rc3vzfq8vnq9x9ca6swk5ag0xkpgkzmga8ga7q80mah9kxbaax";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    install nzxt-grid3.ko nzxt-kraken2.ko nzxt-kraken3.ko nzxt-smart2.ko -Dm444 -t ${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/hwmon
+  '';
+
+  meta = with lib; {
+    description = "Linux kernel hwmon drivers for AIO liquid coolers and other devices";
+    homepage = "https://github.com/liquidctl/liquidtux";
+    license = licenses.gpl2;
+    platforms = [ "x86_64-linux" "i686-linux" ];
+    maintainers = with maintainers; [ nickhu ];
+    broken = lib.versionOlder kernel.version "5.10";
+  };
+}
diff --git a/pkgs/os-specific/linux/lkrg/default.nix b/pkgs/os-specific/linux/lkrg/default.nix
new file mode 100644
index 00000000000..4d6118f8b9f
--- /dev/null
+++ b/pkgs/os-specific/linux/lkrg/default.nix
@@ -0,0 +1,53 @@
+{ lib, stdenv, fetchpatch, fetchFromGitHub, kernel }:
+let
+  isKernelRT = (kernel.structuredExtraConfig ? PREEMPT_RT) && (kernel.structuredExtraConfig.PREEMPT_RT == lib.kernel.yes);
+in
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}-${kernel.version}";
+  pname = "lkrg";
+  version = "0.9.5";
+
+  src = fetchFromGitHub {
+    owner = "lkrg-org";
+    repo = "lkrg";
+    rev = "v${version}";
+    sha256 = "sha256-+yIKkTvfVbLnFBoXSKGebB1A8KqpaRmsLh8SsNuI9Dc=";
+  };
+  patches = [
+    (fetchpatch {
+      name = "fix-aarch64.patch";
+      url = "https://github.com/lkrg-org/lkrg/commit/a4e5c00f13f7081b346bc3736e4c035e3d17d3f7.patch";
+      sha256 = "sha256-DPscqi+DySHwFxGuGe7P2itPkoyb3XGu5Xp2S/ezP4Y=";
+    })
+  ];
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNEL=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  dontConfigure = true;
+
+  prePatch = ''
+    substituteInPlace Makefile --replace "KERNEL := " "KERNEL ?= "
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -D lkrg.ko $out/lib/modules/${kernel.modDirVersion}/extra/lkrg.ko
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "LKRG Linux Kernel module";
+    longDescription = "LKRG performs runtime integrity checking of the Linux kernel and detection of security vulnerability exploits against the kernel.";
+    homepage = "https://lkrg.org/";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ chivay ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.10" || kernel.kernelAtLeast "6.1" || isKernelRT;
+  };
+}
diff --git a/pkgs/os-specific/linux/lksctp-tools/default.nix b/pkgs/os-specific/linux/lksctp-tools/default.nix
index 8bbd3ab7f42..24915143fbd 100644
--- a/pkgs/os-specific/linux/lksctp-tools/default.nix
+++ b/pkgs/os-specific/linux/lksctp-tools/default.nix
@@ -1,16 +1,17 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "lksctp-tools-1.0.17";
+  pname = "lksctp-tools";
+  version = "1.0.17";
 
   src = fetchurl {
-    url = "mirror://sourceforge/lksctp/${name}.tar.gz";
+    url = "mirror://sourceforge/lksctp/lksctp-tools-${version}.tar.gz";
     sha256 = "05da6c2v3acc18ndvmkrag6x5lf914b7s0xkkr6wkvrbvd621sqs";
   };
 
   meta = with lib; {
     description = "Linux Kernel Stream Control Transmission Protocol Tools";
-    homepage = "http://lksctp.sourceforge.net/";
+    homepage = "https://lksctp.sourceforge.net/";
     license = with licenses; [ gpl2 lgpl21 ]; # library is lgpl21
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/lm-sensors/default.nix b/pkgs/os-specific/linux/lm-sensors/default.nix
index 21324a5d6ce..9b37b7c7e63 100644
--- a/pkgs/os-specific/linux/lm-sensors/default.nix
+++ b/pkgs/os-specific/linux/lm-sensors/default.nix
@@ -1,5 +1,13 @@
-{ lib, stdenv, fetchzip, bison, flex, which, perl
-, sensord ? false, rrdtool ? null
+{ lib
+, stdenv
+, fetchFromGitHub
+, bash
+, bison
+, flex
+, which
+, perl
+, sensord ? false
+, rrdtool ? null
 }:
 
 assert sensord -> rrdtool != null;
@@ -7,16 +15,26 @@ assert sensord -> rrdtool != null;
 stdenv.mkDerivation rec {
   pname = "lm-sensors";
   version = "3.6.0";
-  dashedVersion = lib.replaceStrings ["."] ["-"] version;
+  dashedVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
-  src = fetchzip {
-    url = "https://github.com/lm-sensors/lm-sensors/archive/V${dashedVersion}.tar.gz";
-    sha256 = "1ipf6wjx037sqyhy0r5jh4983h216anq9l68ckn2x5c3qc4wfmzn";
+  src = fetchFromGitHub {
+    owner = "lm-sensors";
+    repo = "lm-sensors";
+    rev = "V${dashedVersion}";
+    hash = "sha256-9lfHCcODlS7sZMjQhK0yQcCBEoGyZOChx/oM0CU37sY=";
   };
 
+  # Upstream build system have knob to enable and disable building of static
+  # library, shared library is built unconditionally.
+  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+    sed -i 'lib/Module.mk' -e '/LIBTARGETS :=/,+1d; /-m 755/ d'
+    substituteInPlace prog/sensors/Module.mk --replace 'lib/$(LIBSHBASENAME)' ""
+  '';
+
   nativeBuildInputs = [ bison flex which ];
-  buildInputs = [ perl ]
-   ++ lib.optional sensord rrdtool;
+  # bash is required for correctly replacing the shebangs in all tools for cross-compilation.
+  buildInputs = [ bash perl ]
+    ++ lib.optional sensord rrdtool;
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
@@ -28,12 +46,21 @@ stdenv.mkDerivation rec {
     "ETCDIR=${placeholder "out"}/etc"
   ];
 
+  # Making regexp to patch-out installing of .so symlinks from Makefile is
+  # complicated, it is easier to remove them post-install.
+  postInstall = ''
+    mkdir -p $out/share/doc/${pname}
+    cp -r configs doc/* $out/share/doc/${pname}
+  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
+    rm $out/lib/*.so*
+  '';
+
   meta = with lib; {
     homepage = "https://hwmon.wiki.kernel.org/lm_sensors";
     changelog = "https://raw.githubusercontent.com/lm-sensors/lm-sensors/V${dashedVersion}/CHANGES";
     description = "Tools for reading hardware sensors";
     license = with licenses; [ lgpl21Plus gpl2Plus ];
-    maintainers = with maintainers; [ pengmeiyu ];
+    maintainers = with maintainers; [ pmy ];
     platforms = platforms.linux;
     mainProgram = "sensors";
   };
diff --git a/pkgs/os-specific/linux/lockdep/default.nix b/pkgs/os-specific/linux/lockdep/default.nix
index 190941b1633..1ea2de63560 100644
--- a/pkgs/os-specific/linux/lockdep/default.nix
+++ b/pkgs/os-specific/linux/lockdep/default.nix
@@ -23,6 +23,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ flex bison ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: lockdep.o:/build/linux-5.0.21/tools/lib/lockdep/../../include/linux/rcu.h:5: multiple definition of
+  #     `rcu_scheduler_active'; common.o:/build/linux-5.0.21/tools/lib/lockdep/../../include/linux/rcu.h:5: first defined here
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
+
   buildPhase = ''
     make defconfig
     make headers_install
@@ -31,7 +37,7 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = true;
-  checkInputs = [ valgrind ];
+  nativeCheckInputs = [ valgrind ];
   checkPhase = ''
     # there are more /bin/bash references than just shebangs
     for f in lockdep run_tests.sh tests/*.sh; do
diff --git a/pkgs/os-specific/linux/logitech-udev-rules/default.nix b/pkgs/os-specific/linux/logitech-udev-rules/default.nix
deleted file mode 100644
index 0b0e9e8f203..00000000000
--- a/pkgs/os-specific/linux/logitech-udev-rules/default.nix
+++ /dev/null
@@ -1,19 +0,0 @@
-{ lib, stdenv, solaar }:
-
-# ltunifi and solaar both provide udev rules but solaar's rules are more
-# up-to-date so we simply use that instead of having to maintain our own rules
-
-stdenv.mkDerivation {
-  pname = "logitech-udev-rules";
-  inherit (solaar) version;
-
-  buildCommand = ''
-    install -Dm444 -t $out/etc/udev/rules.d ${solaar.src}/rules.d/*.rules
-  '';
-
-  meta = with lib; {
-    description = "udev rules for Logitech devices";
-    inherit (solaar.meta) homepage license platforms;
-    maintainers = with maintainers; [ peterhoeg ];
-  };
-}
diff --git a/pkgs/os-specific/linux/lsb-release/lsb_release.sh b/pkgs/os-specific/linux/lsb-release/lsb_release.sh
index 47b449c3161..ae524181e88 100644
--- a/pkgs/os-specific/linux/lsb-release/lsb_release.sh
+++ b/pkgs/os-specific/linux/lsb-release/lsb_release.sh
@@ -32,7 +32,7 @@ short=0
 @getopt@/bin/getopt --test > /dev/null && rc=$? || rc=$?
 if [[ $rc -ne 4 ]]; then
   # This shouldn't happen.
-  echo "Warning: Enhanced getopt not supported, please open an issue." >&2
+  echo "Warning: Enhanced getopt not supported, please open an issue in nixpkgs." >&2
 else
   # Define all short and long options.
   SHORT=hvidrcas
diff --git a/pkgs/os-specific/linux/lsirec/default.nix b/pkgs/os-specific/linux/lsirec/default.nix
new file mode 100644
index 00000000000..10da88b691d
--- /dev/null
+++ b/pkgs/os-specific/linux/lsirec/default.nix
@@ -0,0 +1,38 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lsirec";
+  version = "unstable-2019-03-03";
+
+  src = fetchFromGitHub {
+    owner = "marcan";
+    repo = "lsirec";
+    rev = "2dfb6dc92649feb01a3ddcfd117d4a99098084f2";
+    sha256 = "sha256-8v+KKjAJlJNpUT0poedRTQfPiDiwahrosXD35Bmh3jM=";
+  };
+
+  buildInputs = [ python3 ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 'lsirec' "$out/bin/lsirec"
+    install -Dm755 'sbrtool.py' "$out/bin/sbrtool"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "LSI SAS2008/SAS2108 low-level recovery tool for Linux";
+    homepage = "https://github.com/marcan/lsirec";
+    platforms = platforms.linux;
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ Luflosi ];
+    # never built on aarch64-linux since first introduction in nixpkgs
+    broken = stdenv.isLinux && stdenv.isAarch64;
+  };
+}
diff --git a/pkgs/os-specific/linux/lsiutil/default.nix b/pkgs/os-specific/linux/lsiutil/default.nix
index f88cdcda523..d880e6a60e0 100644
--- a/pkgs/os-specific/linux/lsiutil/default.nix
+++ b/pkgs/os-specific/linux/lsiutil/default.nix
@@ -14,12 +14,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-aTi+EogY1aDWYq3anjRkjz1mzINVfUPQbOPHthxrvS4=";
   };
 
-  buildPhase = ''
-    runHook preBuild
-
+  postPatch = ''
     substituteInPlace lsiutil.c \
       --replace /sbin/modprobe "${kmod}/bin/modprobe" \
       --replace /bin/mknod "${coreutils}/bin/mknod"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
     gcc -Wall -O lsiutil.c -o lsiutil
 
     runHook postBuild
diff --git a/pkgs/os-specific/linux/lsscsi/default.nix b/pkgs/os-specific/linux/lsscsi/default.nix
index 6286735b758..d87820f2466 100644
--- a/pkgs/os-specific/linux/lsscsi/default.nix
+++ b/pkgs/os-specific/linux/lsscsi/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
-stdenv.mkDerivation {
-  name = "lsscsi-0.32";
+stdenv.mkDerivation rec {
+  pname = "lsscsi";
+  version = "0.32";
 
   src = fetchurl {
-    url = "http://sg.danny.cz/scsi/lsscsi-0.32.tgz";
+    url = "http://sg.danny.cz/scsi/lsscsi-${version}.tgz";
     sha256 = "sha256-CoAOnpTcoqtwLWXXJ3eujK4Hjj100Ly+1kughJ6AKaE=";
   };
 
diff --git a/pkgs/os-specific/linux/lttng-modules/default.nix b/pkgs/os-specific/linux/lttng-modules/default.nix
index 7f4036c775f..89b49068d40 100644
--- a/pkgs/os-specific/linux/lttng-modules/default.nix
+++ b/pkgs/os-specific/linux/lttng-modules/default.nix
@@ -1,24 +1,26 @@
-{ lib, stdenv, fetchurl, kernel }:
+{ lib, stdenv, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
   pname = "lttng-modules-${kernel.version}";
-  version = "2.12.6";
+  version = "2.13.10";
 
-  src = fetchurl {
-    url = "https://lttng.org/files/lttng-modules/lttng-modules-${version}.tar.bz2";
-    sha256 = "sha256-lawqLPkthdI/+9rKah7A18FnIR0eD7hQq5AASj9HXqo=";
+  src = fetchFromGitHub {
+    owner = "lttng";
+    repo = "lttng-modules";
+    rev = "v${version}";
+    hash = "sha256-R5qwB1ayw0KueMBSSxm0TwINt78N6w356kY7WGBX0zM=";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
-  preConfigure = ''
-    export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    export INSTALL_MOD_PATH="$out"
-  '';
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
 
   installTargets = [ "modules_install" ];
 
@@ -30,5 +32,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ lgpl21Only gpl2Only mit ];
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];
+    broken = (lib.versions.majorMinor kernel.modDirVersion) == "5.10" || (lib.versions.majorMinor kernel.modDirVersion) == "5.4";
   };
 }
diff --git a/pkgs/os-specific/linux/lvm2/2_03.nix b/pkgs/os-specific/linux/lvm2/2_03.nix
new file mode 100644
index 00000000000..b2f6b0aa8a2
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/2_03.nix
@@ -0,0 +1,4 @@
+import ./common.nix {
+  version = "2.03.22";
+  hash = "sha256-TFppI70aznzgRHRgioSTfOBTupGxrOnwsAFyaOcy3Hw=";
+}
diff --git a/pkgs/os-specific/linux/lvm2/common.nix b/pkgs/os-specific/linux/lvm2/common.nix
new file mode 100644
index 00000000000..27a160033b1
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/common.nix
@@ -0,0 +1,161 @@
+{ version, hash }:
+
+{ lib, stdenv
+, fetchurl
+, pkg-config
+, coreutils
+, libuuid
+, libaio
+, substituteAll
+, enableCmdlib ? false
+, enableDmeventd ? false
+, udevSupport ? !stdenv.hostPlatform.isStatic, udev
+, onlyLib ? stdenv.hostPlatform.isStatic
+  # Otherwise we have a infinity recursion during static compilation
+, enableUtilLinux ? !stdenv.hostPlatform.isStatic, util-linux
+, enableVDO ? false, vdo
+, enableMdadm ? false, mdadm
+, enableMultipath ? false, multipath-tools
+, nixosTests
+}:
+
+# configure: error: --enable-dmeventd requires --enable-cmdlib to be used as well
+assert enableDmeventd -> enableCmdlib;
+
+stdenv.mkDerivation rec {
+  pname = "lvm2" + lib.optionalString enableDmeventd "-with-dmeventd" + lib.optionalString enableVDO "-with-vdo";
+  inherit version;
+
+  src = fetchurl {
+    urls = [
+      "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz"
+      "ftp://sourceware.org/pub/lvm2/LVM2.${version}.tgz"
+    ];
+    inherit hash;
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    libaio
+  ] ++ lib.optionals udevSupport [
+    udev
+  ] ++ lib.optionals (!onlyLib) [
+    libuuid
+  ] ++ lib.optionals enableVDO [
+    vdo
+  ];
+
+  configureFlags = [
+    "--disable-readline"
+    "--enable-pkgconfig"
+    "--with-default-locking-dir=/run/lock/lvm"
+    "--with-default-run-dir=/run/lvm"
+    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+    "--with-systemd-run=/run/current-system/systemd/bin/systemd-run"
+  ] ++ lib.optionals (!enableCmdlib) [
+    "--bindir=${placeholder "bin"}/bin"
+    "--sbindir=${placeholder "bin"}/bin"
+    "--libdir=${placeholder "lib"}/lib"
+    "--with-libexecdir=${placeholder "lib"}/libexec"
+  ] ++ lib.optional enableCmdlib "--enable-cmdlib"
+  ++ lib.optionals enableDmeventd [
+    "--enable-dmeventd"
+    "--with-dmeventd-pidfile=/run/dmeventd/pid"
+    "--with-default-dm-run-dir=/run/dmeventd"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "ac_cv_func_malloc_0_nonnull=yes"
+    "ac_cv_func_realloc_0_nonnull=yes"
+  ] ++ lib.optionals udevSupport [
+    "--enable-udev_rules"
+    "--enable-udev_sync"
+  ] ++ lib.optionals enableVDO [
+    "--enable-vdo"
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    "--enable-static_link"
+  ];
+
+  preConfigure = ''
+    sed -i /DEFAULT_SYS_DIR/d Makefile.in
+    sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
+
+    substituteInPlace make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
+    substituteInPlace libdm/make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
+
+    substituteInPlace scripts/blk_availability_systemd_red_hat.service.in \
+      --replace '/usr/bin/true' '${coreutils}/bin/true'
+  '';
+
+  postConfigure = ''
+    sed -i 's|^#define LVM_CONFIGURE_LINE.*$|#define LVM_CONFIGURE_LINE "<removed>"|g' ./include/configure.h
+  '';
+
+  patches = [
+    # fixes paths to and checks for tools
+    (substituteAll (let
+      optionalTool = cond: pkg: if cond then pkg else "/run/current-system/sw";
+    in {
+      src = ./fix-blkdeactivate.patch;
+      inherit coreutils;
+      util_linux = optionalTool enableUtilLinux util-linux;
+      mdadm = optionalTool enableMdadm mdadm;
+      multipath_tools = optionalTool enableMultipath multipath-tools;
+      vdo = optionalTool enableVDO vdo;
+    }))
+    # Musl fix from Alpine
+    ./fix-stdio-usage.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isStatic [
+    ./no-shared.patch
+  ];
+
+  doCheck = false; # requires root
+
+  makeFlags = lib.optionals udevSupport [
+    "SYSTEMD_GENERATOR_DIR=${placeholder "out"}/lib/systemd/system-generators"
+  ] ++ lib.optionals onlyLib [
+    "libdm.device-mapper"
+  ];
+
+  # To prevent make install from failing.
+  installFlags = [ "OWNER=" "GROUP=" "confdir=$(out)/etc" ];
+
+  # Install systemd stuff.
+  installTargets = [ "install" ] ++ lib.optionals udevSupport [
+    "install_systemd_generators"
+    "install_systemd_units"
+    "install_tmpfiles_configuration"
+  ];
+
+  installPhase = lib.optionalString onlyLib ''
+    install -D -t $out/lib libdm/ioctl/libdevmapper.${if stdenv.hostPlatform.isStatic then "a" else "so"}
+    make -C libdm install_include
+    make -C libdm install_pkgconfig
+  '';
+
+  # only split bin and lib out from out if cmdlib isn't enabled
+  outputs = [
+    "out"
+  ] ++ lib.optionals (!onlyLib) [
+    "dev"
+    "man"
+  ] ++ lib.optionals (!onlyLib && !enableCmdlib) [
+    "bin"
+    "lib"
+  ];
+
+  postInstall = lib.optionalString (enableCmdlib != true) ''
+    moveToOutput lib/libdevmapper.so $lib
+  '';
+
+  passthru.tests = {
+    installer = nixosTests.installer.lvm;
+    lvm2 = nixosTests.lvm2;
+  };
+
+  meta = with lib; {
+    homepage = "http://sourceware.org/lvm2/";
+    description = "Tools to support Logical Volume Management (LVM) on Linux";
+    platforms = platforms.linux;
+    license = with licenses; [ gpl2 bsd2 lgpl21 ];
+    maintainers = with maintainers; [ raskin ajs124 ];
+  };
+}
diff --git a/pkgs/os-specific/linux/lvm2/default.nix b/pkgs/os-specific/linux/lvm2/default.nix
deleted file mode 100644
index d822ceed714..00000000000
--- a/pkgs/os-specific/linux/lvm2/default.nix
+++ /dev/null
@@ -1,128 +0,0 @@
-{ lib, stdenv
-, fetchpatch
-, fetchurl
-, pkg-config
-, util-linux
-, libuuid
-, thin-provisioning-tools, libaio
-, enableCmdlib ? false
-, enableDmeventd ? false
-, udev ? null
-, nixosTests
-}:
-
-# configure: error: --enable-dmeventd requires --enable-cmdlib to be used as well
-assert enableDmeventd -> enableCmdlib;
-
-stdenv.mkDerivation rec {
-  pname = "lvm2" + lib.optionalString enableDmeventd "with-dmeventd";
-  version = "2.03.12";
-
-  src = fetchurl {
-    url = "https://mirrors.kernel.org/sourceware/lvm2/LVM2.${version}.tgz";
-    sha256 = "1shczwfd0888dchjiaqzd48ampm6f8y0ngsqd99fy4nxlbr5q1vn";
-  };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ udev libuuid thin-provisioning-tools libaio ];
-
-  configureFlags = [
-    "--disable-readline"
-    "--enable-pkgconfig"
-    "--with-default-locking-dir=/run/lock/lvm"
-    "--with-default-run-dir=/run/lvm"
-    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-  ] ++ lib.optionals (!enableCmdlib) [
-    "--bindir=${placeholder "bin"}/bin"
-    "--sbindir=${placeholder "bin"}/bin"
-    "--libdir=${placeholder "lib"}/lib"
-  ] ++ lib.optional enableCmdlib "--enable-cmdlib"
-  ++ lib.optionals enableDmeventd [
-    "--enable-dmeventd"
-    "--with-dmeventd-pidfile=/run/dmeventd/pid"
-    "--with-default-dm-run-dir=/run/dmeventd"
-  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-    "ac_cv_func_malloc_0_nonnull=yes"
-    "ac_cv_func_realloc_0_nonnull=yes"
-  ] ++
-  lib.optionals (udev != null) [
-    "--enable-udev_rules"
-    "--enable-udev_sync"
-  ];
-
-  preConfigure = ''
-    sed -i /DEFAULT_SYS_DIR/d Makefile.in
-    sed -i /DEFAULT_PROFILE_DIR/d conf/Makefile.in
-    substituteInPlace scripts/lvm2_activation_generator_systemd_red_hat.c \
-      --replace /usr/bin/udevadm /run/current-system/systemd/bin/udevadm
-    # https://github.com/lvmteam/lvm2/issues/36
-    substituteInPlace udev/69-dm-lvm-metad.rules.in \
-      --replace "(BINDIR)/systemd-run" /run/current-system/systemd/bin/systemd-run
-
-    substituteInPlace make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
-    substituteInPlace libdm/make.tmpl.in --replace "@systemdsystemunitdir@" "$out/lib/systemd/system"
-  '';
-
-  postConfigure = ''
-    sed -i 's|^#define LVM_CONFIGURE_LINE.*$|#define LVM_CONFIGURE_LINE "<removed>"|g' ./include/configure.h
-  '';
-
-
-  patches = lib.optionals stdenv.hostPlatform.isMusl [
-    (fetchpatch {
-      name = "fix-stdio-usage.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/lvm2/fix-stdio-usage.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
-      sha256 = "0m6wr6qrvxqi2d2h054cnv974jq1v65lqxy05g1znz946ga73k3p";
-    })
-    (fetchpatch {
-      name = "mallinfo.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/lvm2/mallinfo.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
-      sha256 = "0g6wlqi215i5s30bnbkn8w7axrs27y3bnygbpbnf64wwx7rxxlj0";
-    })
-    (fetchpatch {
-      name = "mlockall-default-config.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/lvm2/mlockall-default-config.patch?h=3.7-stable&id=31bd4a8c2dc00ae79a821f6fe0ad2f23e1534f50";
-      sha256 = "1ivbj3sphgf8n1ykfiv5rbw7s8dgnj5jcr9jl2v8cwf28lkacw5l";
-    })
-  ];
-
-  doCheck = false; # requires root
-
-  makeFlags = lib.optionals (udev != null) [
-    "SYSTEMD_GENERATOR_DIR=$(out)/lib/systemd/system-generators"
-  ];
-
-  # To prevent make install from failing.
-  installFlags = [ "OWNER=" "GROUP=" "confdir=$(out)/etc" ];
-
-  # Install systemd stuff.
-  installTargets = [ "install" ] ++ lib.optionals (udev != null) [
-    "install_systemd_generators"
-    "install_systemd_units"
-    "install_tmpfiles_configuration"
-  ];
-
-  # only split bin and lib out from out if cmdlib isn't enabled
-  outputs = [
-    "out"
-    "dev"
-    "man"
-  ] ++ lib.optionals (enableCmdlib != true) [
-    "bin"
-    "lib"
-  ];
-
-  postInstall = lib.optionalString (enableCmdlib != true) ''
-    moveToOutput lib/libdevmapper.so $lib
-  '';
-
-  passthru.tests.installer = nixosTests.installer.lvm;
-
-  meta = with lib; {
-    homepage = "http://sourceware.org/lvm2/";
-    description = "Tools to support Logical Volume Management (LVM) on Linux";
-    platforms = platforms.linux;
-    license = with licenses; [ gpl2 bsd2 lgpl21 ];
-    maintainers = with maintainers; [ raskin ajs124 ];
-  };
-}
diff --git a/pkgs/os-specific/linux/lvm2/fix-blkdeactivate.patch b/pkgs/os-specific/linux/lvm2/fix-blkdeactivate.patch
new file mode 100644
index 00000000000..db8cfaeae9e
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/fix-blkdeactivate.patch
@@ -0,0 +1,51 @@
+diff --git a/scripts/blkdeactivate.sh.in b/scripts/blkdeactivate.sh.in
+index 7c517b87b..e51a33778 100644
+--- a/scripts/blkdeactivate.sh.in
++++ b/scripts/blkdeactivate.sh.in
+@@ -34,11 +34,11 @@ TOOL=blkdeactivate
+ DEV_DIR="/dev"
+ SYS_BLK_DIR="/sys/block"
+ 
+-MDADM="/sbin/mdadm"
+-MOUNTPOINT="/bin/mountpoint"
+-MPATHD="/sbin/multipathd"
+-UMOUNT="/bin/umount"
+-VDO="/bin/vdo"
++MDADM="@mdadm@/bin/mdadm"
++MOUNTPOINT="@util_linux@/bin/mountpoint"
++MPATHD="@multipath_tools@/bin/multipathd"
++UMOUNT="@util_linux@/bin/umount"
++VDO="@vdo@/bin/vdo"
+ 
+ sbindir="@SBINDIR@"
+ DMSETUP="$sbindir/dmsetup"
+@@ -48,7 +48,7 @@ if "$UMOUNT" --help | grep -- "--all-targets" >"$DEV_DIR/null"; then
+ 	UMOUNT_OPTS="--all-targets "
+ else
+ 	UMOUNT_OPTS=""
+-	FINDMNT="/bin/findmnt -r --noheadings -u -o TARGET"
++	FINDMNT="@util_linux@/bin/findmnt -r --noheadings -u -o TARGET"
+ 	FINDMNT_READ="read -r mnt"
+ fi
+ DMSETUP_OPTS=""
+@@ -57,10 +57,10 @@ MDADM_OPTS=""
+ MPATHD_OPTS=""
+ VDO_OPTS=""
+ 
+-LSBLK="/bin/lsblk -r --noheadings -o TYPE,KNAME,NAME,MOUNTPOINT"
++LSBLK="@util_linux@/bin/lsblk -r --noheadings -o TYPE,KNAME,NAME,MOUNTPOINT"
+ LSBLK_VARS="local devtype local kname local name local mnt"
+ LSBLK_READ="read -r devtype kname name mnt"
+-SORT_MNT="/bin/sort -r -u -k 4"
++SORT_MNT="@coreutils@/bin/sort -r -u -k 4"
+ 
+ # Do not show tool errors by default (only done/skipping summary
+ # message provided by this script) and no verbose mode by default.
+@@ -102,6 +102,7 @@ declare -A SKIP_VG_LIST=()
+ # (list is an associative array!)
+ #
+ declare -A SKIP_UMOUNT_LIST=(["/"]=1 \
++                             ["/nix"]=1 ["/nix/store"]=1 \
+                              ["/lib"]=1 ["/lib64"]=1 \
+                              ["/bin"]=1 ["/sbin"]=1 \
+                              ["/var"]=1 ["/var/log"]=1 \
diff --git a/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch b/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch
new file mode 100644
index 00000000000..98cdc6eb3ec
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/fix-stdio-usage.patch
@@ -0,0 +1,66 @@
+From 63b1c7332bee6080bffecf9ce9d75ff15d799166 Mon Sep 17 00:00:00 2001
+From: Natanael Copa <ncopa@alpinelinux.org>
+Date: Wed, 16 Nov 2022 10:42:39 +0100
+Subject: [PATCH] fix stdio usage
+
+---
+ lib/commands/toolcontext.c | 4 ++--
+ tools/lvmcmdline.c         | 6 +++---
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/lib/commands/toolcontext.c b/lib/commands/toolcontext.c
+index b630554a9..f20080d18 100644
+--- a/lib/commands/toolcontext.c
++++ b/lib/commands/toolcontext.c
+@@ -1667,7 +1667,7 @@ struct cmd_context *create_toolcontext(unsigned is_clvmd,
+ 	/* FIXME Make this configurable? */
+ 	reset_lvm_errno(1);
+ 
+-#ifndef VALGRIND_POOL
++#if !defined(VALGRIND_POOL) && defined(__GLIBC__)
+ 	/* Set in/out stream buffering before glibc */
+ 	if (set_buffering
+ #ifdef SYS_gettid
+@@ -2045,7 +2045,7 @@ void destroy_toolcontext(struct cmd_context *cmd)
+ 		dm_hash_destroy(cmd->cft_def_hash);
+ 
+ 	dm_device_list_destroy(&cmd->cache_dm_devs);
+-#ifndef VALGRIND_POOL
++#if !defined(VALGRIND_POOL) && defined(__GLIBC__)
+ 	if (cmd->linebuffer) {
+ 		/* Reset stream buffering to defaults */
+ 		if (is_valid_fd(STDIN_FILENO) &&
+diff --git a/tools/lvmcmdline.c b/tools/lvmcmdline.c
+index a5bb6a5c5..0ebfa375c 100644
+--- a/tools/lvmcmdline.c
++++ b/tools/lvmcmdline.c
+@@ -3422,7 +3422,7 @@ static int _check_standard_fds(void)
+ 	int err = is_valid_fd(STDERR_FILENO);
+ 
+ 	if (!is_valid_fd(STDIN_FILENO) &&
+-	    !(stdin = fopen(_PATH_DEVNULL, "r"))) {
++	    !freopen(_PATH_DEVNULL, "r", stdin)) {
+ 		if (err)
+ 			perror("stdin stream open");
+ 		else
+@@ -3432,7 +3432,7 @@ static int _check_standard_fds(void)
+ 	}
+ 
+ 	if (!is_valid_fd(STDOUT_FILENO) &&
+-	    !(stdout = fopen(_PATH_DEVNULL, "w"))) {
++	    !freopen(_PATH_DEVNULL, "w", stdout)) {
+ 		if (err)
+ 			perror("stdout stream open");
+ 		/* else no stdout */
+@@ -3440,7 +3440,7 @@ static int _check_standard_fds(void)
+ 	}
+ 
+ 	if (!is_valid_fd(STDERR_FILENO) &&
+-	    !(stderr = fopen(_PATH_DEVNULL, "w"))) {
++	    !freopen(_PATH_DEVNULL, "w", stderr)) {
+ 		printf("stderr stream open: %s\n",
+ 		       strerror(errno));
+ 		return 0;
+-- 
+2.38.1
+
diff --git a/pkgs/os-specific/linux/lvm2/no-shared.patch b/pkgs/os-specific/linux/lvm2/no-shared.patch
new file mode 100644
index 00000000000..23a82a0fa29
--- /dev/null
+++ b/pkgs/os-specific/linux/lvm2/no-shared.patch
@@ -0,0 +1,46 @@
+diff --git a/libdm/Makefile.in b/libdm/Makefile.in
+index 2758648e6..f305a12b0 100644
+--- a/libdm/Makefile.in
++++ b/libdm/Makefile.in
+@@ -47,7 +47,6 @@ endif
+ 
+ LIB_SHARED = $(interface)/libdevmapper.$(LIB_SUFFIX)
+ LIB_VERSION = $(LIB_VERSION_DM)
+-TARGETS = libdevmapper.$(LIB_SUFFIX) libdevmapper.$(LIB_SUFFIX).$(LIB_VERSION) .symver_check
+ 
+ CFLOW_LIST = $(SOURCES)
+ CFLOW_LIST_TARGET = libdevmapper.cflow
+diff --git a/libdm/make.tmpl.in b/libdm/make.tmpl.in
+index a731687c2..9366cdf1c 100644
+--- a/libdm/make.tmpl.in
++++ b/libdm/make.tmpl.in
+@@ -314,7 +314,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
+ SUBDIRS.clean := $(SUBDIRS:=.clean)
+ SUBDIRS.distclean := $(SUBDIRS:=.distclean)
+ 
+-TARGETS += $(LIB_SHARED) $(LIB_STATIC)
++TARGETS += $(LIB_STATIC)
+ 
+ all: $(SUBDIRS) $(TARGETS)
+ 
+@@ -431,7 +431,6 @@ DEFS+=-D_FILE_OFFSET_BITS=64
+ 
+ ifneq (,$(LIB_SHARED))
+ 
+-TARGETS += $(LIB_SHARED).$(LIB_VERSION)
+ $(LIB_SHARED).$(LIB_VERSION): $(OBJECTS) $(LDDEPS)
+ 	@echo "    [CC] $@"
+ ifeq ("@LIB_SUFFIX@","so")
+diff --git a/make.tmpl.in b/make.tmpl.in
+index b73176f5a..6100d0dfd 100644
+--- a/make.tmpl.in
++++ b/make.tmpl.in
+@@ -368,7 +368,7 @@ SUBDIRS.cflow := $(SUBDIRS:=.cflow)
+ SUBDIRS.clean := $(SUBDIRS:=.clean)
+ SUBDIRS.distclean := $(SUBDIRS:=.distclean)
+ 
+-TARGETS += $(LIB_SHARED) $(LIB_STATIC)
++TARGETS += $(LIB_STATIC)
+ 
+ INTERNAL_LIBS = \
+ 	$(top_builddir)/libdaemon/client/libdaemonclient.a \
diff --git a/pkgs/os-specific/linux/lxc/default.nix b/pkgs/os-specific/linux/lxc/default.nix
index e10af3abf92..49f16db002f 100644
--- a/pkgs/os-specific/linux/lxc/default.nix
+++ b/pkgs/os-specific/linux/lxc/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, autoreconfHook, pkg-config, perl, docbook2x
-, docbook_xml_dtd_45, python3Packages, pam
+, docbook_xml_dtd_45, python3Packages, pam, fetchpatch
 
 # Optional Dependencies
 , libapparmor ? null, gnutls ? null, libselinux ? null, libseccomp ? null
@@ -9,11 +9,11 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = "lxc";
-  version = "4.0.10";
+  version = "4.0.12";
 
   src = fetchurl {
     url = "https://linuxcontainers.org/downloads/lxc/lxc-${version}.tar.gz";
-    sha256 = "1sgsic9dzj3wv2k5bx2vhcgappivhp1glkqfc2yrgr6jas052351";
+    sha256 = "1vyk2j5w9gfyh23w3ar09cycyws16mxh3clbb33yhqzwcs1jy96v";
   };
 
   nativeBuildInputs = [
@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./support-db2x.patch
+
+    # Backport of https://github.com/lxc/lxc/pull/4179 for glibc-2.36 build
+    (fetchpatch {
+      url = "https://github.com/lxc/lxc/commit/c1115e1503bf955c97f4cf3b925a6a9f619764c3.patch";
+      sha256 = "sha256-aC1XQesRJfkyQnloB3NvR4p/1WITrqkGYzw50PDxDrs=";
+      excludes = [ "meson.build" ];
+    })
   ];
 
   postPatch = ''
@@ -94,6 +101,6 @@ stdenv.mkDerivation rec {
     '';
 
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/lxcfs/default.nix b/pkgs/os-specific/linux/lxcfs/default.nix
index 3ed80269d3a..96477c5f442 100644
--- a/pkgs/os-specific/linux/lxcfs/default.nix
+++ b/pkgs/os-specific/linux/lxcfs/default.nix
@@ -5,15 +5,19 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = "lxcfs";
-  version = "4.0.9";
+  version = "4.0.12";
 
   src = fetchFromGitHub {
     owner = "lxc";
     repo = "lxcfs";
     rev = "lxcfs-${version}";
-    sha256 = "0zx58lair8hwi4bxm5h7i8n1j5fcdgw5cr6f4wk9qhks0sr5dip5";
+    sha256 = "sha256-+wp29GD+toXGfQbPGYbDJ7/P+FY1uQY4uK3OQxTE9GM=";
   };
 
+  postPatch = ''
+    sed -i -e '1i #include <sys/pidfd.h>' src/bindings.c
+  '';
+
   nativeBuildInputs = [ pkg-config help2man autoreconfHook makeWrapper ];
   buildInputs = [ fuse ];
 
@@ -46,6 +50,6 @@ stdenv.mkDerivation rec {
     changelog = "https://linuxcontainers.org/lxcfs/news/";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ mic92 fpletz ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/macchanger/default.nix b/pkgs/os-specific/linux/macchanger/default.nix
index 1c516707049..c862fd4e167 100644
--- a/pkgs/os-specific/linux/macchanger/default.nix
+++ b/pkgs/os-specific/linux/macchanger/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A utility for viewing/manipulating the MAC address of network interfaces";
-    maintainers = with maintainers; [ joachifm ma27 dotlambda ];
+    maintainers = with maintainers; [ joachifm dotlambda ];
     license = licenses.gpl2Plus;
     homepage = "https://github.com/alobbs/macchanger";
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/mba6x_bl/default.nix b/pkgs/os-specific/linux/mba6x_bl/default.nix
index 441476d5f06..3add5eb227f 100644
--- a/pkgs/os-specific/linux/mba6x_bl/default.nix
+++ b/pkgs/os-specific/linux/mba6x_bl/default.nix
@@ -1,13 +1,14 @@
 { fetchFromGitHub, kernel, lib, stdenv }:
 
 stdenv.mkDerivation {
-  name = "mba6x_bl-2016-12-08";
+  pname = "mba6x_bl";
+  version = "unstable-2017-12-30";
 
   src = fetchFromGitHub {
     owner = "patjak";
     repo = "mba6x_bl";
-    rev = "b96aafd30c18200b4ad1f6eb995bc19200f60c47";
-    sha256 = "10payvfxahazdxisch4wm29fhl8y07ki72q4c78sl4rn73sj6yjq";
+    rev = "639719f516b664051929c2c0c1140ea4bf30ce81";
+    sha256 = "sha256-QwxBpNa5FitKO+2ne54IIcRgwVYeNSQWI4f2hPPB8ls=";
   };
 
   enableParallelBuilding = true;
@@ -15,7 +16,7 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "INSTALL_MOD_PATH=$(out)"
   ];
diff --git a/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix b/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
index 070b4a6207e..0b4fec4dfb4 100644
--- a/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
+++ b/pkgs/os-specific/linux/mbp-modules/mbp2018-bridge-drv/default.nix
@@ -11,14 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-o6yGiR+Y5SnX1johdi7fQWP5ts7HdDMqeju75UOhgik=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
+
   buildPhase = ''
     make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build \
-      -j$NIX_BUILD_CORES M=$(pwd) modules
+      -j$NIX_BUILD_CORES M=$(pwd) modules $makeFlags
   '';
 
   installPhase = ''
     make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build  \
-      INSTALL_MOD_PATH=$out M=$(pwd) modules_install
+      INSTALL_MOD_PATH=$out M=$(pwd) modules_install $makeFlags
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/mbpfan/default.nix b/pkgs/os-specific/linux/mbpfan/default.nix
index 675d9417a01..50fc74d7fa0 100644
--- a/pkgs/os-specific/linux/mbpfan/default.nix
+++ b/pkgs/os-specific/linux/mbpfan/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "mbpfan";
-  version = "2.2.1";
+  version = "2.4.0";
   src = fetchFromGitHub {
     owner = "dgraziotin";
     repo = "mbpfan";
     rev = "v${version}";
-    sha256 = "0gc9ypxi55vxs77nx8ihhh9zk7fr9v0m0zfm76q7x0bi6jz11mbr";
+    sha256 = "sha256-F9IWUcILOuLn5K4zRSU5jn+1Wk1xy0CONSI6JTXU2pA=";
   };
   installPhase = ''
     mkdir -p $out/bin $out/etc
@@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/dgraziotin/mbpfan";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/mceinject/default.nix b/pkgs/os-specific/linux/mceinject/default.nix
new file mode 100644
index 00000000000..52422576374
--- /dev/null
+++ b/pkgs/os-specific/linux/mceinject/default.nix
@@ -0,0 +1,38 @@
+{ lib, stdenv, fetchFromGitHub, bison, flex }:
+
+stdenv.mkDerivation rec {
+  pname = "mceinject";
+  version = "unstable-2013-01-19";
+
+  src = fetchFromGitHub {
+    owner  = "andikleen";
+    repo   = "mce-inject";
+    rev    = "4cbe46321b4a81365ff3aafafe63967264dbfec5";
+    sha256 = "0gjapg2hrlxp8ssrnhvc19i3r1xpcnql7xv0zjgbv09zyha08g6z";
+  };
+
+  nativeBuildInputs = [ flex bison ];
+
+  env.NIX_CFLAGS_COMPILE = "-Os -g -Wall";
+
+  NIX_LDFLAGS = [ "-lpthread" ];
+
+  makeFlags = [ "prefix=" ];
+
+  enableParallelBuilding = true;
+
+  installFlags = [ "destdir=$(out)" "manprefix=/share" ];
+
+  meta = with lib; {
+    description = "A tool to inject machine checks into x86 kernel for testing";
+    longDescription = ''
+      mce-inject allows to inject machine check errors on the software level
+      into a running Linux kernel. This is intended for validation of the
+      kernel machine check handler.
+    '';
+    homepage = "https://github.com/andikleen/mce-inject/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ arkivm ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/mcelog/default.nix b/pkgs/os-specific/linux/mcelog/default.nix
index b20632be334..916c79a4298 100644
--- a/pkgs/os-specific/linux/mcelog/default.nix
+++ b/pkgs/os-specific/linux/mcelog/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mcelog";
-  version = "175";
+  version = "180";
 
   src = fetchFromGitHub {
     owner  = "andikleen";
     repo   = "mcelog";
     rev    = "v${version}";
-    sha256 = "sha256-Xzbck/nRdTR9H5o2XVFlFdNLz2ve65KEcefKAKe0eW8=";
+    sha256 = "1xy1082c67yd48idg5vwvrw7yx74gn6jj2d9c67d0rh6yji091ki";
   };
 
   postPatch = ''
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
       errors are logged to /var/log/mcelog or syslog or the journal.
     '';
     homepage = "http://mcelog.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/mdadm/default.nix b/pkgs/os-specific/linux/mdadm/default.nix
index 935ded63709..e7aa16d3dd3 100644
--- a/pkgs/os-specific/linux/mdadm/default.nix
+++ b/pkgs/os-specific/linux/mdadm/default.nix
@@ -1,11 +1,12 @@
-{ lib, stdenv, util-linux, coreutils, fetchurl, groff, system-sendmail }:
+{ lib, stdenv, util-linux, coreutils, fetchurl, groff, system-sendmail, udev }:
 
 stdenv.mkDerivation rec {
-  name = "mdadm-4.1";
+  pname = "mdadm";
+  version = "4.2";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/raid/mdadm/${name}.tar.xz";
-    sha256 = "0jjgjgqijpdp7ijh8slzzjjw690kydb1jjadf0x5ilq85628hxmb";
+    url = "mirror://kernel/linux/utils/raid/mdadm/mdadm-${version}.tar.xz";
+    sha256 = "sha256-RhwhVnCGS7dKTRo2IGhKorL4KW3/oGdD8m3aVVes8B0=";
   };
 
   patches = [ ./no-self-references.patch ];
@@ -23,6 +24,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  buildInputs = [ udev ];
+
   nativeBuildInputs = [ groff ];
 
   postPatch = ''
@@ -45,6 +48,7 @@ stdenv.mkDerivation rec {
     description = "Programs for managing RAID arrays under Linux";
     homepage = "http://neil.brown.name/blog/mdadm";
     license = licenses.gpl2;
+    mainProgram = "mdadm";
     maintainers = with maintainers; [ ekleog ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/mdadm/no-self-references.patch b/pkgs/os-specific/linux/mdadm/no-self-references.patch
index cf0366e52d1..3b3dc4d8460 100644
--- a/pkgs/os-specific/linux/mdadm/no-self-references.patch
+++ b/pkgs/os-specific/linux/mdadm/no-self-references.patch
@@ -1,8 +1,8 @@
 diff --git a/Makefile b/Makefile
-index d82e30f..d231cf9 100644
+index 2a51d813..a31ac48a 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -51,6 +51,9 @@ endif
+@@ -63,6 +63,9 @@ endif
  ifdef DEBIAN
  CPPFLAGS += -DDEBIAN
  endif
@@ -12,7 +12,7 @@ index d82e30f..d231cf9 100644
  ifdef DEFAULT_OLD_METADATA
   CPPFLAGS += -DDEFAULT_OLD_METADATA
   DEFAULT_METADATA=0.90
-@@ -105,6 +108,7 @@ endif
+@@ -129,6 +132,7 @@ endif
  INSTALL = /usr/bin/install
  DESTDIR =
  BINDIR  = /sbin
@@ -20,14 +20,8 @@ index d82e30f..d231cf9 100644
  MANDIR  = /usr/share/man
  MAN4DIR = $(MANDIR)/man4
  MAN5DIR = $(MANDIR)/man5
-@@ -259,20 +263,20 @@ sha1.o : sha1.c sha1.h md5.h
- 	$(CC) $(CFLAGS) -DHAVE_STDINT_H -o sha1.o -c sha1.c
- 
- install : mdadm mdmon install-man install-udev
--	$(INSTALL) -D $(STRIP) -m 755 mdadm $(DESTDIR)$(BINDIR)/mdadm
--	$(INSTALL) -D $(STRIP) -m 755 mdmon $(DESTDIR)$(BINDIR)/mdmon
-+	$(INSTALL) -D $(STRIP) -m 755 mdadm $(DESTDIR)$(INSTALL_BINDIR)/mdadm
-+	$(INSTALL) -D $(STRIP) -m 755 mdmon $(DESTDIR)$(INSTALL_BINDIR)/mdmon
+@@ -253,16 +257,16 @@ sha1.o : sha1.c sha1.h md5.h
+ install : install-bin install-man install-udev
  
  install-static : mdadm.static install-man
 -	$(INSTALL) -D $(STRIP) -m 755 mdadm.static $(DESTDIR)$(BINDIR)/mdadm
@@ -47,8 +41,8 @@ index d82e30f..d231cf9 100644
  
  install-man: mdadm.8 md.4 mdadm.conf.5 mdmon.8
  	$(INSTALL) -D -m 644 mdadm.8 $(DESTDIR)$(MAN8DIR)/mdadm.8
-@@ -305,7 +309,7 @@ install-systemd: systemd/mdmon@.service
- 	if [ -f /etc/SuSE-release -o -n "$(SUSE)" ] ;then $(INSTALL) -D -m 755 systemd/SUSE-mdadm_env.sh $(DESTDIR)$(SYSTEMD_DIR)/../scripts/mdadm_env.sh ;fi
+@@ -305,7 +309,7 @@ install-bin: mdadm mdmon
+ 	$(INSTALL) -D $(STRIP) -m 755 mdmon $(DESTDIR)$(BINDIR)/mdmon
  
  uninstall:
 -	rm -f $(DESTDIR)$(MAN8DIR)/mdadm.8 $(DESTDIR)$(MAN8DIR)/mdmon.8 $(DESTDIR)$(MAN4DIR)/md.4 $(DESTDIR)$(MAN5DIR)/mdadm.conf.5 $(DESTDIR)$(BINDIR)/mdadm
@@ -57,10 +51,10 @@ index d82e30f..d231cf9 100644
  test: mdadm mdmon test_stripe swap_super raid6check
  	@echo "Please run './test' as root"
 diff --git a/policy.c b/policy.c
-index 064d349..6b2f2b1 100644
+index eee9ef63..9f916e9d 100644
 --- a/policy.c
 +++ b/policy.c
-@@ -796,12 +796,39 @@ char *find_rule(struct rule *rule, char *rule_type)
+@@ -817,12 +817,39 @@ char *find_rule(struct rule *rule, char *rule_type)
  #define UDEV_RULE_FORMAT \
  "ACTION==\"add\", SUBSYSTEM==\"block\", " \
  "ENV{DEVTYPE}==\"%s\", ENV{ID_PATH}==\"%s\", " \
@@ -102,7 +96,7 @@ index 064d349..6b2f2b1 100644
  
  /* Write rule in the rule file. Use format from UDEV_RULE_FORMAT */
  int write_rule(struct rule *rule, int fd, int force_part)
-@@ -815,9 +842,9 @@ int write_rule(struct rule *rule, int fd, int force_part)
+@@ -836,9 +863,9 @@ int write_rule(struct rule *rule, int fd, int force_part)
  	if (force_part)
  		typ = type_part;
  	if (typ)
@@ -115,10 +109,10 @@ index 064d349..6b2f2b1 100644
  }
  
 diff --git a/util.c b/util.c
-index cc98d3b..1ada2f4 100644
+index 3d05d074..e004a798 100644
 --- a/util.c
 +++ b/util.c
-@@ -1700,7 +1700,9 @@ int start_mdmon(char *devnm)
+@@ -1913,7 +1913,9 @@ int start_mdmon(char *devnm)
  	char pathbuf[1024];
  	char *paths[4] = {
  		pathbuf,
diff --git a/pkgs/os-specific/linux/mdevctl/default.nix b/pkgs/os-specific/linux/mdevctl/default.nix
new file mode 100644
index 00000000000..80c3c1316d8
--- /dev/null
+++ b/pkgs/os-specific/linux/mdevctl/default.nix
@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, fetchCrate
+, docutils
+, installShellFiles
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "mdevctl";
+  version = "1.2.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-0X/3DWNDPOgSNNTqcj44sd7DNGFt+uGBjkc876dSgU8=";
+  };
+
+  cargoHash = "sha256-TmumQBWuH5fJOe2qzcDtEGbmCs2G9Gfl8mH7xifzRGc=";
+
+  nativeBuildInputs = [
+    docutils
+    installShellFiles
+  ];
+
+  postInstall = ''
+    ln -s mdevctl $out/bin/lsmdev
+
+    install -Dm444 60-mdevctl.rules -t $out/lib/udev/rules.d
+
+    installManPage $releaseDir/build/mdevctl-*/out/mdevctl.8
+    ln -s mdevctl.8 $out/share/man/man8/lsmdev.8
+
+    installShellCompletion $releaseDir/build/mdevctl-*/out/{lsmdev,mdevctl}.bash
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/mdevctl/mdevctl";
+    description = "A mediated device management utility for linux";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ edwtjo ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/mdevd/default.nix b/pkgs/os-specific/linux/mdevd/default.nix
deleted file mode 100644
index 58299ba5e87..00000000000
--- a/pkgs/os-specific/linux/mdevd/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib, skawarePackages }:
-
-with skawarePackages;
-
-buildPackage {
-  pname = "mdevd";
-  version = "0.1.4.0";
-  sha256 = "1lnwk7qa6x7iia0v12i2jckg42ypi35hk3sa7cjm23ngnhiv5lzz";
-
-  description = "mdev-compatible Linux hotplug manager daemon";
-  platforms = lib.platforms.linux;
-
-  outputs = [ "bin" "out" "dev" "doc" ];
-
-  configureFlags = [
-    "--with-sysdeps=${skalibs.lib}/lib/skalibs/sysdeps"
-    "--with-include=${skalibs.dev}/include"
-    "--with-lib=${skalibs.lib}/lib"
-  ];
-
-  postInstall = ''
-    # remove all mdevd executables from build directory
-    rm $(find -type f -mindepth 1 -maxdepth 1 -executable)
-
-    mv doc $doc/share/doc/mdevd/html
-    mv examples $doc/share/doc/mdevd/examples
-  '';
-}
diff --git a/pkgs/os-specific/linux/microcode/amd.nix b/pkgs/os-specific/linux/microcode/amd.nix
index 72f413f9cb6..3c82cdec29f 100644
--- a/pkgs/os-specific/linux/microcode/amd.nix
+++ b/pkgs/os-specific/linux/microcode/amd.nix
@@ -1,23 +1,25 @@
-{ lib, stdenv, firmwareLinuxNonfree, libarchive }:
+{ lib, stdenv, linux-firmware, libarchive }:
 
 stdenv.mkDerivation {
-  name = "amd-ucode-${firmwareLinuxNonfree.version}";
+  pname = "amd-ucode";
+  version = linux-firmware.version;
 
-  src = firmwareLinuxNonfree;
+  src = linux-firmware;
 
   sourceRoot = ".";
 
-  buildInputs = [ libarchive ];
+  nativeBuildInputs = [ libarchive ];
 
   buildPhase = ''
     mkdir -p kernel/x86/microcode
-    find ${firmwareLinuxNonfree}/lib/firmware/amd-ucode -name \*.bin \
-      -exec sh -c 'cat {} >> kernel/x86/microcode/AuthenticAMD.bin' \;
+    find ${linux-firmware}/lib/firmware/amd-ucode -name \*.bin -print0 | sort -z |\
+      xargs -0 -I{} sh -c 'cat {} >> kernel/x86/microcode/AuthenticAMD.bin'
   '';
 
   installPhase = ''
     mkdir -p $out
-    echo kernel/x86/microcode/AuthenticAMD.bin | bsdcpio -o -H newc -R 0:0 > $out/amd-ucode.img
+    touch -d @$SOURCE_DATE_EPOCH kernel/x86/microcode/AuthenticAMD.bin
+    echo kernel/x86/microcode/AuthenticAMD.bin | bsdtar --uid 0 --gid 0 -cnf - -T - | bsdtar --null -cf - --format=newc @- > $out/amd-ucode.img
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index f8bb7c67d8e..de51beb2cc1 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20210608";
+  version = "20231114";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    sha256 = "08nk353z2lcqsjbm2qdsfapfgrvlfw0rj7r9scr9pllzkjj5n9x3";
+    hash = "sha256-cZ7APDjwjarPCzk1HWxqIXdGwNOl6HG0KSCtffmEhx0=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
@@ -18,16 +18,18 @@ stdenv.mkDerivation rec {
 
     mkdir -p $out kernel/x86/microcode
     iucode_tool -w kernel/x86/microcode/GenuineIntel.bin intel-ucode/
-    echo kernel/x86/microcode/GenuineIntel.bin | bsdcpio -o -H newc -R 0:0 > $out/intel-ucode.img
+    touch -d @$SOURCE_DATE_EPOCH kernel/x86/microcode/GenuineIntel.bin
+    echo kernel/x86/microcode/GenuineIntel.bin | bsdtar --uid 0 --gid 0 -cnf - -T - | bsdtar --null -cf - --format=newc @- > $out/intel-ucode.img
 
     runHook postInstall
   '';
 
   meta = with lib; {
-    homepage = "http://www.intel.com/";
+    homepage = "https://www.intel.com/";
+    changelog = "https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/${src.rev}";
     description = "Microcode for Intel processors";
     license = licenses.unfreeRedistributableFirmware;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ andir ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/microcode/iucode-tool.nix b/pkgs/os-specific/linux/microcode/iucode-tool.nix
index e38dd83e0db..d27e3ca6987 100644
--- a/pkgs/os-specific/linux/microcode/iucode-tool.nix
+++ b/pkgs/os-specific/linux/microcode/iucode-tool.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, autoreconfHook }:
+{ lib, stdenv, fetchFromGitLab, autoreconfHook, fetchpatch, argp-standalone }:
 
 stdenv.mkDerivation rec {
   pname = "iucode-tool";
@@ -11,7 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "04dlisw87dd3q3hhmkqc5dd58cp22fzx3rzah7pvcyij135yjc3a";
   };
 
+  patches = [
+    # build fix for musl libc, pending upstream review
+    # https://gitlab.com/iucode-tool/iucode-tool/-/merge_requests/4
+    (fetchpatch {
+      url = "https://gitlab.com/iucode-tool/iucode-tool/-/commit/fda4aaa4727601dbe817fac001f234c19420351a.patch";
+      hash = "sha256-BxYrXALpZFyJtFrgU5jFmzd1dIMPmpNgvYArgkwGt/w=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = lib.optional stdenv.hostPlatform.isMusl argp-standalone;
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/mingetty/default.nix b/pkgs/os-specific/linux/mingetty/default.nix
index 8a2cf69dd36..eb58dc55367 100644
--- a/pkgs/os-specific/linux/mingetty/default.nix
+++ b/pkgs/os-specific/linux/mingetty/default.nix
@@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:
 
-stdenv.mkDerivation {
-  name = "mingetty-1.08";
+stdenv.mkDerivation rec {
+  pname = "mingetty";
+  version = "1.08";
 
   src = fetchurl {
-    url = "mirror://sourceforge/mingetty/mingetty-1.08.tar.gz";
+    url = "mirror://sourceforge/mingetty/mingetty-${version}.tar.gz";
     sha256 = "05yxrp44ky2kg6qknk1ih0kvwkgbn9fbz77r3vci7agslh5wjm8g";
   };
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bash/2.nix b/pkgs/os-specific/linux/minimal-bootstrap/bash/2.nix
new file mode 100644
index 00000000000..5eea877803a
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bash/2.nix
@@ -0,0 +1,157 @@
+{ lib
+, derivationWithMeta
+, fetchurl
+, kaem
+, tinycc
+, gnumake
+, gnupatch
+, coreutils
+, mescc-tools-extra
+, bash_2_05
+}:
+let
+  pname = "bash";
+  version = "2.05b";
+
+  src = fetchurl {
+    url = "mirror://gnu/bash/bash-${version}.tar.gz";
+    sha256 = "1r1z2qdw3rz668nxrzwa14vk2zcn00hw7mpjn384picck49d80xs";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/bash-2.05b/bash-2.05b.kaem
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/bash-2.05b";
+
+  main_mk = fetchurl {
+    url = "${liveBootstrap}/mk/main.mk";
+    sha256 = "0hj29q3pq3370p18sxkpvv9flb7yvx2fs96xxlxqlwa8lkimd0j4";
+  };
+
+  common_mk = fetchurl {
+    url = "${liveBootstrap}/mk/common.mk";
+    sha256 = "09rigxxf85p2ybnq248sai1gdx95yykc8jmwi4yjx389zh09mcr8";
+  };
+
+  builtins_mk = fetchurl {
+    url = "${liveBootstrap}/mk/builtins.mk";
+    sha256 = "0939dy5by1xhfmsjj6w63nlgk509fjrhpb2crics3dpcv7prl8lj";
+  };
+
+  patches = [
+    # mes libc does not have locale support
+    (fetchurl {
+      url = "${liveBootstrap}/patches/mes-libc.patch";
+      sha256 = "0zksdjf6zbb3p4hqg6plq631y76hhhgab7kdvf7cnpk8bcykn12z";
+    })
+    # int name, namelen; is wrong for mes libc, it is char* name, so we modify tinycc
+    # to reflect this.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/tinycc.patch";
+      sha256 = "042d2kr4a8klazk1hlvphxr6frn4mr53k957aq3apf6lbvrjgcj2";
+    })
+    # add ifdef's for features we don't want
+    (fetchurl {
+      url = "${liveBootstrap}/patches/missing-defines.patch";
+      sha256 = "1q0k1kj5mrvjkqqly7ki5575a5b3hy1ywnmvhrln318yh67qnkj4";
+    })
+    # mes libc + setting locale = not worky
+    (fetchurl {
+      url = "${liveBootstrap}/patches/locale.patch";
+      sha256 = "1p1q1slhafsgj8x4k0dpn9h6ryq5fwfx7dicbbxhldbw7zvnnbx9";
+    })
+    # We do not have /dev at this stage of the bootstrap, including /dev/tty
+    (fetchurl {
+      url = "${liveBootstrap}/patches/dev-tty.patch";
+      sha256 = "1315slv5f7ziajqyxg4jlyanf1xwd06xw14y6pq7xpm3jzjk55j9";
+    })
+  ];
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    coreutils
+  ];
+
+  passthru.runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name buildCommand;
+      builder = "${bash_2_05}/bin/bash";
+      args = [
+        "-e"
+        (builtins.toFile "bash-builder.sh" ''
+          export CONFIG_SHELL=$SHELL
+
+          # Normalize the NIX_BUILD_CORES variable. The value might be 0, which
+          # means that we're supposed to try and auto-detect the number of
+          # available CPU cores at run-time. We don't have nproc to detect the
+          # number of available CPU cores so default to 1 if not set.
+          NIX_BUILD_CORES="''${NIX_BUILD_CORES:-1}"
+          if [ $NIX_BUILD_CORES -le 0 ]; then
+            NIX_BUILD_CORES=1
+          fi
+          export NIX_BUILD_CORES
+
+          bash -eux $buildCommandPath
+        '')
+      ];
+      passAsFile = [ "buildCommand" ];
+
+      SHELL = "${bash_2_05}/bin/bash";
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [
+        bash_2_05
+        coreutils
+        # provides untar, ungz, and unbz2
+        mescc-tools-extra
+      ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
+  passthru.tests.get-version = result:
+    kaem.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/bash --version
+      mkdir ''${out}
+    '';
+
+  meta = with lib; {
+    description = "GNU Bourne-Again Shell, the de facto standard shell on Linux";
+    homepage = "https://www.gnu.org/software/bash";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output bash.tar
+  untar --file bash.tar
+  rm bash.tar
+  cd bash-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+  # Configure
+  cp ${main_mk} Makefile
+  cp ${builtins_mk} builtins/Makefile
+  cp ${common_mk} common.mk
+  touch config.h
+  touch include/version.h
+  touch include/pipesize.h
+
+  # Build
+  make \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    mkbuiltins
+  cd builtins
+  make \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    libbuiltins.a
+  cd ..
+  make CC="tcc -B ${tinycc.libs}/lib"
+
+  # Install
+  install -D bash ''${out}/bin/bash
+  ln -s bash ''${out}/bin/sh
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
new file mode 100644
index 00000000000..86fa3a58687
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
@@ -0,0 +1,117 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bootBash
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gnutar
+, gawk
+, gzip
+, diffutils
+, tinycc
+, derivationWithMeta
+, bash
+, coreutils
+}:
+let
+  pname = "bash";
+  version = "5.2.15";
+
+  src = fetchurl {
+    url = "mirror://gnu/bash/bash-${version}.tar.gz";
+    sha256 = "132qng0jy600mv1fs95ylnlisx2wavkkgpb19c6kmz7lnmjhjwhk";
+  };
+
+  patches = [
+    # flush output for generated code
+    ./mksignames-flush.patch
+  ];
+in
+bootBash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    coreutils
+    tinycc.compiler
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+    gnutar
+    gawk
+    gzip
+    diffutils
+  ];
+
+  passthru.runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name buildCommand;
+      builder = "${bash}/bin/bash";
+      args = [
+        "-e"
+        (builtins.toFile "bash-builder.sh" ''
+          export CONFIG_SHELL=$SHELL
+
+          # Normalize the NIX_BUILD_CORES variable. The value might be 0, which
+          # means that we're supposed to try and auto-detect the number of
+          # available CPU cores at run-time.
+          NIX_BUILD_CORES="''${NIX_BUILD_CORES:-1}"
+          if ((NIX_BUILD_CORES <= 0)); then
+            guess=$(nproc 2>/dev/null || true)
+            ((NIX_BUILD_CORES = guess <= 0 ? 1 : guess))
+          fi
+          export NIX_BUILD_CORES
+
+          bash -eux $buildCommandPath
+        '')
+      ];
+      passAsFile = [ "buildCommand" ];
+
+      SHELL = "${bash}/bin/bash";
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [
+        bash
+        coreutils
+      ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
+  passthru.tests.get-version = result:
+    bootBash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/bash --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU Bourne-Again Shell, the de facto standard shell on Linux";
+    homepage = "https://www.gnu.org/software/bash";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd bash-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export LD=tcc
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --without-bash-malloc
+
+  # Build
+  make -j $NIX_BUILD_CORES SHELL=bash
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+  ln -s bash $out/bin/sh
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bash/mksignames-flush.patch b/pkgs/os-specific/linux/minimal-bootstrap/bash/mksignames-flush.patch
new file mode 100644
index 00000000000..6e64dfa7fa3
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bash/mksignames-flush.patch
@@ -0,0 +1,10 @@
+--- a/support/mksignames.c
++++ b/support/mksignames.c
+@@ -68,6 +68,7 @@ write_signames (stream)
+   fprintf (stream, "};\n\n");
+   fprintf (stream, "#define initialize_signames()\n\n");
+ #endif
++  fflush(stream);
+ }
+ 
+ int
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
new file mode 100644
index 00000000000..71e391efb55
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
@@ -0,0 +1,114 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, coreutils
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gawk
+, diffutils
+, gnutar
+, xz
+, tinycc
+}:
+
+let
+  # Based on https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a1-static-binutils.nix
+  pname = "binutils";
+  version = "2.41";
+
+  src = fetchurl {
+    url = "mirror://gnu/binutils/binutils-${version}.tar.xz";
+    hash = "sha256-rppXieI0WeWWBuZxRyPy0//DHAMXQZHvDQFb3wYAdFA=";
+  };
+
+  patches = [
+    # Make binutils output deterministic by default.
+    ./deterministic.patch
+  ];
+
+  configureFlags = [
+    "--prefix=${placeholder "out"}"
+    "--build=${buildPlatform.config}"
+    "--host=${hostPlatform.config}"
+    "--with-sysroot=/"
+    "--enable-deterministic-archives"
+    # depends on bison
+    "--disable-gprofng"
+
+    # Turn on --enable-new-dtags by default to make the linker set
+    # RUNPATH instead of RPATH on binaries.  This is important because
+    # RUNPATH can be overridden using LD_LIBRARY_PATH at runtime.
+    "--enable-new-dtags"
+
+    # By default binutils searches $libdir for libraries. This brings in
+    # libbfd and libopcodes into a default visibility. Drop default lib
+    # path to force users to declare their use of these libraries.
+    "--with-lib-path=:"
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+    gawk
+    diffutils
+    gnutar
+    xz
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/ld --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "Tools for manipulating binaries (linker, assembler, etc.)";
+    homepage = "https://www.gnu.org/software/binutils";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  cp ${src} binutils.tar.xz
+  unxz binutils.tar.xz
+  tar xf binutils.tar
+  rm binutils.tar
+  cd binutils-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+  sed -i 's|/bin/sh|${bash}/bin/bash|' \
+    missing install-sh mkinstalldirs
+  # see libtool's 74c8993c178a1386ea5e2363a01d919738402f30
+  sed -i 's/| \$NL2SP/| sort | $NL2SP/' ltmain.sh
+  # alias makeinfo to true
+  mkdir aliases
+  ln -s ${coreutils}/bin/true aliases/makeinfo
+  export PATH="$(pwd)/aliases/:$PATH"
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export lt_cv_sys_max_cmd_len=32768
+  export CFLAGS="-D__LITTLE_ENDIAN__=1"
+  bash ./configure ${lib.concatStringsSep " " configureFlags}
+
+  # Build
+  make -j $NIX_BUILD_CORES all-libiberty all-gas all-bfd all-libctf all-zlib all-gprof
+  make all-ld # race condition on ld/.deps/ldwrite.Po, serialize
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/deterministic.patch b/pkgs/os-specific/linux/minimal-bootstrap/binutils/deterministic.patch
new file mode 100644
index 00000000000..736e0aca6ce
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/deterministic.patch
@@ -0,0 +1,12 @@
+diff -ur orig/binutils-2.23.1/ld/ldlang.c binutils-2.23.1/ld/ldlang.c
+--- orig/ld/ldlang.c
++++ new/ld/ldlang.c
+@@ -3095,6 +3095,8 @@
+                           ldfile_output_machine))
+     einfo (_("%P%F:%s: can not set architecture: %E\n"), name);
+ 
++  link_info.output_bfd->flags |= BFD_DETERMINISTIC_OUTPUT;
++
+   link_info.hash = bfd_link_hash_table_create (link_info.output_bfd);
+   if (link_info.hash == NULL)
+     einfo (_("%P%F: can not create hash table: %E\n"));
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix
new file mode 100644
index 00000000000..05da061ac26
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnutar
+, gzip
+}:
+let
+  pname = "bzip2";
+  version = "1.0.8";
+
+  src = fetchurl {
+    url = "https://sourceware.org/pub/bzip2/bzip2-${version}.tar.gz";
+    sha256 = "0s92986cv0p692icqlw1j42y9nld8zd83qwhzbqd61p1dqbh6nmb";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/bzip2 --help
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "High-quality data compression program";
+    homepage = "https://www.sourceware.org/bzip2";
+    license = licenses.bsdOriginal;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd bzip2-${version}
+
+  # Build
+  make \
+    -j $NIX_BUILD_CORES \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    AR="tcc -ar" \
+    bzip2 bzip2recover
+
+  # Install
+  make install -j $NIX_BUILD_CORES PREFIX=$out
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
new file mode 100644
index 00000000000..9d7480d239f
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
@@ -0,0 +1,117 @@
+{ lib
+, fetchurl
+, kaem
+, tinycc
+, gnumake
+, gnupatch
+}:
+let
+  pname = "bootstrap-coreutils";
+  version = "5.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
+    sha256 = "10wq6k66i8adr4k08p0xmg87ff4ypiazvwzlmi7myib27xgffz62";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/a8752029f60217a5c41c548b16f5cdd2a1a0e0db/sysa/coreutils-5.0/coreutils-5.0.kaem
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/a8752029f60217a5c41c548b16f5cdd2a1a0e0db/sysa/coreutils-5.0";
+
+  makefile = fetchurl {
+    url = "${liveBootstrap}/mk/main.mk";
+    sha256 = "0njg4xccxfqrslrmlb8ls7h6hlnfmdx42nvxwmca8flvczwrplfd";
+  };
+
+  patches = [
+    # modechange.h uses functions defined in sys/stat.h, so we need to move it to
+    # after sys/stat.h include.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/modechange.patch";
+      sha256 = "04xa4a5w2syjs3xs6qhh8kdzqavxnrxpxwyhc3qqykpk699p3ms5";
+    })
+    # mbstate_t is a struct that is required. However, it is not defined by mes libc.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/mbstate.patch";
+      sha256 = "0rz3c0sflgxjv445xs87b83i7gmjpl2l78jzp6nm3khdbpcc53vy";
+    })
+    # strcoll() does not exist in mes libc, change it to strcmp.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/ls-strcmp.patch";
+      sha256 = "0lx8rz4sxq3bvncbbr6jf0kyn5bqwlfv9gxyafp0541dld6l55p6";
+    })
+    # getdate.c is pre-compiled from getdate.y
+    # At this point we don't have bison yet and in any case getdate.y does not
+    # compile when generated with modern bison.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/touch-getdate.patch";
+      sha256 = "1xd3z57lvkj7r8vs5n0hb9cxzlyp58pji7d335snajbxzwy144ma";
+    })
+    # touch: add -h to change symlink timestamps, where supported
+    (fetchurl {
+      url = "${liveBootstrap}/patches/touch-dereference.patch";
+      sha256 = "0wky5r3k028xwyf6g6ycwqxzc7cscgmbymncjg948vv4qxsxlfda";
+    })
+    # strcoll() does not exist in mes libc, change it to strcmp.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/expr-strcmp.patch";
+      sha256 = "19f31lfsm1iwqzvp2fyv97lmqg4730prfygz9zip58651jf739a9";
+    })
+    # strcoll() does not exist in mes libc, change it to strcmp.
+    # hard_LC_COLLATE is used but not declared when HAVE_SETLOCALE is unset.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/sort-locale.patch";
+      sha256 = "0bdch18mpyyxyl6gyqfs0wb4pap9flr11izqdyxccx1hhz0a2i6c";
+    })
+    # don't assume fopen cannot return stdin or stdout.
+    (fetchurl {
+      url = "${liveBootstrap}/patches/uniq-fopen.patch";
+      sha256 = "0qs6shyxl9j4h34v5j5sgpxrr4gjfljd2hxzw416ghwc3xzv63fp";
+    })
+  ];
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+  ];
+
+  meta = with lib; {
+    description = "The GNU Core Utilities";
+    homepage = "https://www.gnu.org/software/coreutils";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output coreutils.tar
+  untar --file coreutils.tar
+  rm coreutils.tar
+  cd coreutils-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+  # Configure
+  catm config.h
+  cp lib/fnmatch_.h lib/fnmatch.h
+  cp lib/ftw_.h lib/ftw.h
+  cp lib/search_.h lib/search.h
+  rm src/dircolors.h
+
+  # Build
+  make -f ${makefile} \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    PREFIX=''${out}
+
+  # Check
+  ./src/echo "Hello coreutils!"
+
+  # Install
+  ./src/mkdir -p ''${out}/bin
+  make -f ${makefile} install PREFIX=''${out}
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
new file mode 100644
index 00000000000..14584e0a7e6
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
@@ -0,0 +1,74 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnugrep
+, gnused
+, gawk
+, gnutar
+, gzip
+}:
+let
+  pname = "bootstrap-coreutils-musl";
+  version = "9.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
+    hash = "sha256-X2ANkJOXOwr+JTk9m8GMRPIjJlf0yg2V6jHHAutmtzk=";
+  };
+
+  configureFlags = [
+    "--prefix=${placeholder "out"}"
+    "--build=${buildPlatform.config}"
+    "--host=${hostPlatform.config}"
+    # musl 1.1.x doesn't use 64bit time_t
+    "--disable-year2038"
+    # libstdbuf.so fails in static builds
+    "--enable-no-install-program=stdbuf"
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/cat --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "The GNU Core Utilities";
+    homepage = "https://www.gnu.org/software/coreutils";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd coreutils-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
+  bash ./configure ${lib.concatStringsSep " " configureFlags}
+
+  # Build
+  make -j $NIX_BUILD_CORES AR="tcc -ar" MAKEINFO="true"
+
+  # Install
+  make -j $NIX_BUILD_CORES install MAKEINFO="true"
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
new file mode 100644
index 00000000000..a246b587dd4
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -0,0 +1,229 @@
+{ lib
+, config
+, buildPlatform
+, hostPlatform
+, fetchurl
+, checkMeta
+}:
+
+lib.makeScope
+  # Prevent using top-level attrs to protect against introducing dependency on
+  # non-bootstrap packages by mistake. Any top-level inputs must be explicitly
+  # declared here.
+  (extra: lib.callPackageWith ({ inherit lib config buildPlatform hostPlatform fetchurl checkMeta; } // extra))
+  (self: with self; {
+
+    bash_2_05 = callPackage ./bash/2.nix { tinycc = tinycc-mes; };
+
+    bash = callPackage ./bash {
+      bootBash = bash_2_05;
+      tinycc = tinycc-musl;
+      coreutils = coreutils-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+    };
+
+    binutils = callPackage ./binutils {
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+    };
+
+    bzip2 = callPackage ./bzip2 {
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+    };
+
+    coreutils = callPackage ./coreutils { tinycc = tinycc-mes; };
+    coreutils-musl = callPackage ./coreutils/musl.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+    };
+
+    diffutils = callPackage ./diffutils {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+    };
+
+    findutils = callPackage ./findutils {
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+    };
+
+    gawk-mes = callPackage ./gawk/mes.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      gnused = gnused-mes;
+    };
+
+    gawk = callPackage ./gawk {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+      bootGawk = gawk-mes;
+    };
+
+    gcc46 = callPackage ./gcc/4.6.nix {
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+      # FIXME: not sure why new gawk doesn't work
+      gawk = gawk-mes;
+    };
+    gcc46-cxx = callPackage ./gcc/4.6.cxx.nix {
+      gcc = gcc46;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+      # FIXME: not sure why new gawk doesn't work
+      gawk = gawk-mes;
+    };
+
+    gcc8 = callPackage ./gcc/8.nix {
+      gcc = gcc46-cxx;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-latest;
+      # FIXME: not sure why new gawk doesn't work
+      gawk = gawk-mes;
+    };
+
+    gcc-latest = callPackage ./gcc/latest.nix {
+      gcc = gcc8;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-latest;
+      # FIXME: not sure why new gawk doesn't work
+      gawk = gawk-mes;
+    };
+
+    gnugrep = callPackage ./gnugrep {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    gnumake = callPackage ./gnumake { tinycc = tinycc-mes; };
+
+    gnumake-musl = callPackage ./gnumake/musl.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gawk = gawk-mes;
+      gnumakeBoot = gnumake;
+    };
+
+    gnupatch = callPackage ./gnupatch { tinycc = tinycc-mes; };
+
+    gnused = callPackage ./gnused {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gnused = gnused-mes;
+    };
+    gnused-mes = callPackage ./gnused/mes.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    gnutar = callPackage ./gnutar/mes.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      gnused = gnused-mes;
+    };
+
+    gnutar-musl = callPackage ./gnutar/musl.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gnused = gnused-mes;
+    };
+
+    # FIXME: better package naming scheme
+    gnutar-latest = callPackage ./gnutar/latest.nix {
+      gcc = gcc46;
+      gnumake = gnumake-musl;
+      gnutarBoot = gnutar-musl;
+    };
+
+    gzip = callPackage ./gzip {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      gnused = gnused-mes;
+    };
+
+    heirloom = callPackage ./heirloom {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+    };
+
+    heirloom-devtools = callPackage ./heirloom-devtools { tinycc = tinycc-mes; };
+
+    linux-headers = callPackage ./linux-headers { bash = bash_2_05; };
+
+    ln-boot = callPackage ./ln-boot { };
+
+    mes = lib.recurseIntoAttrs (callPackage ./mes { });
+    mes-libc = callPackage ./mes/libc.nix { };
+
+    musl11 = callPackage ./musl/1.1.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      gnused = gnused-mes;
+    };
+
+    musl = callPackage ./musl {
+      gcc = gcc46;
+      gnumake = gnumake-musl;
+    };
+
+    stage0-posix = callPackage ./stage0-posix { };
+
+    inherit (self.stage0-posix) kaem m2libc mescc-tools mescc-tools-extra;
+
+    tinycc-bootstrappable = lib.recurseIntoAttrs (callPackage ./tinycc/bootstrappable.nix { });
+    tinycc-mes = lib.recurseIntoAttrs (callPackage ./tinycc/mes.nix { });
+    tinycc-musl = lib.recurseIntoAttrs (callPackage ./tinycc/musl.nix {
+      bash = bash_2_05;
+      musl = musl11;
+    });
+
+    xz = callPackage ./xz {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+    };
+
+    inherit (callPackage ./utils.nix { }) derivationWithMeta writeTextFile writeText;
+
+    test = kaem.runCommand "minimal-bootstrap-test" {} ''
+      echo ${bash.tests.get-version}
+      echo ${bash_2_05.tests.get-version}
+      echo ${binutils.tests.get-version}
+      echo ${bzip2.tests.get-version}
+      echo ${coreutils-musl.tests.get-version}
+      echo ${diffutils.tests.get-version}
+      echo ${findutils.tests.get-version}
+      echo ${gawk-mes.tests.get-version}
+      echo ${gawk.tests.get-version}
+      echo ${gcc46.tests.get-version}
+      echo ${gcc46-cxx.tests.hello-world}
+      echo ${gcc8.tests.hello-world}
+      echo ${gcc-latest.tests.hello-world}
+      echo ${gnugrep.tests.get-version}
+      echo ${gnused.tests.get-version}
+      echo ${gnused-mes.tests.get-version}
+      echo ${gnutar.tests.get-version}
+      echo ${gnutar-musl.tests.get-version}
+      echo ${gnutar-latest.tests.get-version}
+      echo ${gzip.tests.get-version}
+      echo ${heirloom.tests.get-version}
+      echo ${mes.compiler.tests.get-version}
+      echo ${musl.tests.hello-world}
+      echo ${tinycc-mes.compiler.tests.chain}
+      echo ${tinycc-musl.compiler.tests.hello-world}
+      echo ${xz.tests.get-version}
+      mkdir ''${out}
+    '';
+  })
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
new file mode 100644
index 00000000000..24cd643b349
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnugrep
+, gnused
+, gawk
+, gnutar
+, xz
+}:
+let
+  pname = "diffutils";
+  # last version that can be built by tinycc-musl 0.9.27
+  version = "3.8";
+
+  src = fetchurl {
+    url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
+    hash = "sha256-pr3X0bMSZtEcT03mwbdI1GB6sCMa9RiPwlM9CuJDj+w=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    xz
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/diff --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "Commands for showing the differences between files (diff, cmp, etc.)";
+    homepage = "https://www.gnu.org/software/diffutils/diffutils.html";
+    license = licenses.gpl3Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  cp ${src} diffutils.tar.xz
+  unxz diffutils.tar.xz
+  tar xf diffutils.tar
+  rm diffutils.tar
+  cd diffutils-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config}
+
+  # Build
+  make -j $NIX_BUILD_CORES AR="tcc -ar"
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
new file mode 100644
index 00000000000..97418d218fb
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
@@ -0,0 +1,75 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnugrep
+, gnused
+, gawk
+, gnutar
+, xz
+}:
+let
+  pname = "findutils";
+  version = "4.9.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
+    hash = "sha256-or+4wJ1DZ3DtxZ9Q+kg+eFsWGjt7nVR1c8sIBl/UYv4=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    xz
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/find --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU Find Utilities, the basic directory searching utilities of the GNU operating system";
+    homepage = "https://www.gnu.org/software/findutils";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  cp ${src} findutils.tar.xz
+  unxz findutils.tar.xz
+  tar xf findutils.tar
+  rm findutils.tar
+  cd findutils-${version}
+
+  # Patch
+  # configure fails to accurately detect PATH_MAX support
+  sed -i 's/chdir_long/chdir/' gl/lib/save-cwd.c
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export LD=tcc
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config}
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/common.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/common.nix
new file mode 100644
index 00000000000..d95c66d8633
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/common.nix
@@ -0,0 +1,11 @@
+{ lib }:
+
+{
+  meta = with lib; {
+    description = "GNU implementation of the Awk programming language";
+    homepage = "https://www.gnu.org/software/gawk";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
new file mode 100644
index 00000000000..879b98bf00c
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
@@ -0,0 +1,61 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnugrep
+, gnused
+, gnutar
+, gzip
+, bootGawk
+}:
+let
+  inherit (import ./common.nix { inherit lib; }) meta;
+  pname = "gawk";
+  version = "5.2.2";
+
+  src = fetchurl {
+    url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
+    hash = "sha256-lFrvfM/xAfILIqEIArwAXplKsrjqPnJMwaGXxi9B9lA=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+    gnutar
+    gzip
+    bootGawk
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/awk --version
+      mkdir $out
+    '';
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd gawk-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export LD=tcc
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config}
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/mes.nix b/pkgs/os-specific/linux/minimal-bootstrap/gawk/mes.nix
new file mode 100644
index 00000000000..c1439930930
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/mes.nix
@@ -0,0 +1,70 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+}:
+let
+  inherit (import ./common.nix { inherit lib; }) meta;
+  pname = "gawk-mes";
+  # >=3.1.x is incompatible with mes-libc
+  version = "3.0.6";
+
+  src = fetchurl {
+    url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
+    sha256 = "1z4bibjm7ldvjwq3hmyifyb429rs2d9bdwkvs0r171vv1khpdwmb";
+  };
+
+  patches = [
+    # for reproducibility don't generate date stamp
+    ./no-stamp.patch
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/awk --version
+      mkdir $out
+    '';
+} ''
+  # Unpack
+  ungz --file ${src} --output gawk.tar
+  untar --file gawk.tar
+  rm gawk.tar
+  cd gawk-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export ac_cv_func_getpgrp_void=yes
+  export ac_cv_func_tzset=yes
+  bash ./configure \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-nls \
+    --prefix=$out
+
+  # Build
+  make gawk
+
+  # Install
+  install -D gawk $out/bin/gawk
+  ln -s gawk $out/bin/awk
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gawk/no-stamp.patch b/pkgs/os-specific/linux/minimal-bootstrap/gawk/no-stamp.patch
new file mode 100644
index 00000000000..74af25ba210
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gawk/no-stamp.patch
@@ -0,0 +1,10 @@
+--- configure
++++ configure
+@@ -3676,7 +3676,6 @@ cat >> $CONFIG_STATUS <<EOF
+ 
+ EOF
+ cat >> $CONFIG_STATUS <<\EOF
+-date > stamp-h
+ exit 0
+ EOF
+ chmod +x $CONFIG_STATUS
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
new file mode 100644
index 00000000000..277c5e82cc3
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
@@ -0,0 +1,140 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, coreutils
+, gcc
+, musl
+, binutils
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gawk
+, diffutils
+, findutils
+, gnutar
+, gzip
+}:
+let
+  pname = "gcc-cxx";
+  version = "4.6.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-core-${version}.tar.gz";
+    sha256 = "173kdb188qg79pcz073cj9967rs2vzanyjdjyxy9v0xb0p5sad75";
+  };
+
+  ccSrc = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-g++-${version}.tar.gz";
+    sha256 = "1fqqk5zkmdg4vmqzdmip9i42q6b82i3f6yc0n86n9021cr7ms2k9";
+  };
+
+  gmpVersion = "4.3.2";
+  gmp = fetchurl {
+    url = "mirror://gnu/gmp/gmp-${gmpVersion}.tar.gz";
+    sha256 = "15rwq54fi3s11izas6g985y9jklm3xprfsmym3v1g6xr84bavqvv";
+  };
+
+  mpfrVersion = "2.4.2";
+  mpfr = fetchurl {
+    url = "mirror://gnu/mpfr/mpfr-${mpfrVersion}.tar.gz";
+    sha256 = "0dxn4904dra50xa22hi047lj8kkpr41d6vb9sd4grca880c7wv94";
+  };
+
+  mpcVersion = "1.0.3";
+  mpc = fetchurl {
+    url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
+    sha256 = "1hzci2zrrd7v3g1jk35qindq05hbl0bhjcyyisq9z209xb3fqzb1";
+  };
+
+  patches = [
+    # Remove hardcoded NATIVE_SYSTEM_HEADER_DIR
+    ./no-system-headers.patch
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+    gawk
+    diffutils
+    findutils
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.hello-world = result:
+    bash.runCommand "${pname}-simple-program-${version}" {
+        nativeBuildInputs = [ binutils musl result ];
+      } ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        musl-gcc -o test test.c
+        ./test
+        mkdir $out
+      '';
+
+  meta = with lib; {
+    description = "GNU Compiler Collection, version ${version}";
+    homepage = "https://gcc.gnu.org";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  tar xzf ${ccSrc}
+  tar xzf ${gmp}
+  tar xzf ${mpfr}
+  tar xzf ${mpc}
+  cd gcc-${version}
+
+  ln -s ../gmp-${gmpVersion} gmp
+  ln -s ../mpfr-${mpfrVersion} mpfr
+  ln -s ../mpc-${mpcVersion} mpc
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+  # doesn't recognise musl
+  sed -i 's|"os/gnu-linux"|"os/generic"|' libstdc++-v3/configure.host
+
+  # Configure
+  export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export C_INCLUDE_PATH="${musl}/include"
+  export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
+  export LIBRARY_PATH="${musl}/lib"
+
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --with-native-system-header-dir=${musl}/include \
+    --with-build-sysroot=${musl} \
+    --enable-languages=c,c++ \
+    --disable-bootstrap \
+    --disable-libmudflap \
+    --disable-libstdcxx-pch \
+    --disable-lto \
+    --disable-multilib
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
new file mode 100644
index 00000000000..8b56dff5882
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
@@ -0,0 +1,145 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, binutils
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gawk
+, diffutils
+, findutils
+, gnutar
+, gzip
+}:
+let
+  pname = "gcc";
+  version = "4.6.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-core-${version}.tar.gz";
+    sha256 = "173kdb188qg79pcz073cj9967rs2vzanyjdjyxy9v0xb0p5sad75";
+  };
+
+  ccSrc = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-g++-${version}.tar.gz";
+    sha256 = "1fqqk5zkmdg4vmqzdmip9i42q6b82i3f6yc0n86n9021cr7ms2k9";
+  };
+
+  gmpVersion = "4.3.2";
+  gmp = fetchurl {
+    url = "mirror://gnu/gmp/gmp-${gmpVersion}.tar.gz";
+    sha256 = "15rwq54fi3s11izas6g985y9jklm3xprfsmym3v1g6xr84bavqvv";
+  };
+
+  mpfrVersion = "2.4.2";
+  mpfr = fetchurl {
+    url = "mirror://gnu/mpfr/mpfr-${mpfrVersion}.tar.gz";
+    sha256 = "0dxn4904dra50xa22hi047lj8kkpr41d6vb9sd4grca880c7wv94";
+  };
+
+  mpcVersion = "1.0.3";
+  mpc = fetchurl {
+    url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
+    sha256 = "1hzci2zrrd7v3g1jk35qindq05hbl0bhjcyyisq9z209xb3fqzb1";
+  };
+
+  patches = [
+    # Remove hardcoded NATIVE_SYSTEM_HEADER_DIR
+    ./no-system-headers.patch
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    binutils
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+    gawk
+    diffutils
+    findutils
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/gcc --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU Compiler Collection, version ${version}";
+    homepage = "https://gcc.gnu.org";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  tar xzf ${ccSrc}
+  tar xzf ${gmp}
+  tar xzf ${mpfr}
+  tar xzf ${mpc}
+  cd gcc-${version}
+
+  ln -s ../gmp-${gmpVersion} gmp
+  ln -s ../mpfr-${mpfrVersion} mpfr
+  ln -s ../mpc-${mpcVersion} mpc
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export C_INCLUDE_PATH="${tinycc.libs}/include:$(pwd)/mpfr/src"
+  export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
+
+  # Avoid "Link tests are not allowed after GCC_NO_EXECUTABLES"
+  export lt_cv_shlibpath_overrides_runpath=yes
+  export ac_cv_func_memcpy=yes
+  export ac_cv_func_strerror=yes
+
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --with-native-system-header-dir=${tinycc.libs}/include \
+    --with-build-sysroot=${tinycc.libs}/include \
+    --disable-bootstrap \
+    --disable-decimal-float \
+    --disable-libatomic \
+    --disable-libcilkrts \
+    --disable-libgomp \
+    --disable-libitm \
+    --disable-libmudflap \
+    --disable-libquadmath \
+    --disable-libsanitizer \
+    --disable-libssp \
+    --disable-libvtv \
+    --disable-lto \
+    --disable-lto-plugin \
+    --disable-multilib \
+    --disable-plugin \
+    --disable-threads \
+    --enable-languages=c \
+    --enable-static \
+    --disable-shared \
+    --enable-threads=single \
+    --disable-libstdcxx-pch \
+    --disable-build-with-cxx
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/8.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/8.nix
new file mode 100644
index 00000000000..ea9fdaf8854
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/8.nix
@@ -0,0 +1,141 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, coreutils
+, gcc
+, musl
+, binutils
+, gnumake
+, gnused
+, gnugrep
+, gawk
+, diffutils
+, findutils
+, gnutar
+, gzip
+, bzip2
+, xz
+}:
+let
+  pname = "gcc";
+  version = "8.5.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz";
+    hash = "sha256-0wiEGlEbuDCmEAOXsAQtskzhH2Qtq26m7kSELlMl7VA=";
+  };
+
+  # last version to compile with gcc 4.6
+  gmpVersion = "6.2.1";
+  gmp = fetchurl {
+    url = "mirror://gnu/gmp/gmp-${gmpVersion}.tar.xz";
+    hash = "sha256-/UgpkSzd0S+EGBw0Ucx1K+IkZD6H+sSXtp7d2txJtPI=";
+  };
+
+  mpfrVersion = "4.2.1";
+  mpfr = fetchurl {
+    url = "mirror://gnu/mpfr/mpfr-${mpfrVersion}.tar.xz";
+    hash = "sha256-J3gHNTpnJpeJlpRa8T5Sgp46vXqaW3+yeTiU4Y8fy7I=";
+  };
+
+  mpcVersion = "1.3.1";
+  mpc = fetchurl {
+    url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
+    hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
+  };
+
+  islVersion = "0.24";
+  isl = fetchurl {
+    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
+    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    diffutils
+    findutils
+    gnutar
+    gzip
+    bzip2
+    xz
+  ];
+
+  passthru.tests.hello-world = result:
+    bash.runCommand "${pname}-simple-program-${version}" {
+        nativeBuildInputs = [ binutils musl result ];
+      } ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        musl-gcc -o test test.c
+        ./test
+        mkdir $out
+      '';
+
+  meta = with lib; {
+    description = "GNU Compiler Collection, version ${version}";
+    homepage = "https://gcc.gnu.org";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xf ${src}
+  tar xf ${gmp}
+  tar xf ${mpfr}
+  tar xf ${mpc}
+  tar xf ${isl}
+  cd gcc-${version}
+
+  ln -s ../gmp-${gmpVersion} gmp
+  ln -s ../mpfr-${mpfrVersion} mpfr
+  ln -s ../mpc-${mpcVersion} mpc
+  ln -s ../isl-${islVersion} isl
+
+  # Patch
+  # doesn't recognise musl
+  sed -i 's|"os/gnu-linux"|"os/generic"|' libstdc++-v3/configure.host
+
+  # Configure
+  export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export C_INCLUDE_PATH="${musl}/include"
+  export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
+  export LIBRARY_PATH="${musl}/lib"
+
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --with-native-system-header-dir=/include \
+    --with-sysroot=${musl} \
+    --enable-languages=c,c++ \
+    --disable-bootstrap \
+    --disable-libmpx \
+    --disable-libsanitizer \
+    --disable-lto \
+    --disable-multilib \
+    --disable-plugin
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install-strip
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
new file mode 100644
index 00000000000..fba3b731a00
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
@@ -0,0 +1,137 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, coreutils
+, gcc
+, musl
+, binutils
+, gnumake
+, gnused
+, gnugrep
+, gawk
+, diffutils
+, findutils
+, gnutar
+, gzip
+, bzip2
+, xz
+}:
+let
+  pname = "gcc";
+  version = "13.2.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz";
+    hash = "sha256-4nXnZEKmBnNBon8Exca4PYYTFEAEwEE1KIY9xrXHQ9o=";
+  };
+
+  gmpVersion = "6.3.0";
+  gmp = fetchurl {
+    url = "mirror://gnu/gmp/gmp-${gmpVersion}.tar.xz";
+    hash = "sha256-o8K4AgG4nmhhb0rTC8Zq7kknw85Q4zkpyoGdXENTiJg=";
+  };
+
+  mpfrVersion = "4.2.1";
+  mpfr = fetchurl {
+    url = "mirror://gnu/mpfr/mpfr-${mpfrVersion}.tar.xz";
+    hash = "sha256-J3gHNTpnJpeJlpRa8T5Sgp46vXqaW3+yeTiU4Y8fy7I=";
+  };
+
+  mpcVersion = "1.3.1";
+  mpc = fetchurl {
+    url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
+    hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
+  };
+
+  islVersion = "0.24";
+  isl = fetchurl {
+    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
+    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    diffutils
+    findutils
+    gnutar
+    gzip
+    bzip2
+    xz
+  ];
+
+  passthru.tests.hello-world = result:
+    bash.runCommand "${pname}-simple-program-${version}" {
+        nativeBuildInputs = [ binutils musl result ];
+      } ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        musl-gcc -o test test.c
+        ./test
+        mkdir $out
+      '';
+
+  meta = with lib; {
+    description = "GNU Compiler Collection, version ${version}";
+    homepage = "https://gcc.gnu.org";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xf ${src}
+  tar xf ${gmp}
+  tar xf ${mpfr}
+  tar xf ${mpc}
+  tar xf ${isl}
+  cd gcc-${version}
+
+  ln -s ../gmp-${gmpVersion} gmp
+  ln -s ../mpfr-${mpfrVersion} mpfr
+  ln -s ../mpc-${mpcVersion} mpc
+  ln -s ../isl-${islVersion} isl
+
+  # Patch
+  # force musl even if host triple is gnu
+  sed -i 's|"os/gnu-linux"|"os/generic"|' libstdc++-v3/configure.host
+
+  # Configure
+  export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export LIBRARY_PATH="${musl}/lib"
+
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --with-native-system-header-dir=/include \
+    --with-sysroot=${musl} \
+    --enable-languages=c,c++ \
+    --disable-bootstrap \
+    --disable-libsanitizer \
+    --disable-lto \
+    --disable-multilib \
+    --disable-plugin
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install-strip
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/no-system-headers.patch b/pkgs/os-specific/linux/minimal-bootstrap/gcc/no-system-headers.patch
new file mode 100644
index 00000000000..318553bf916
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/no-system-headers.patch
@@ -0,0 +1,11 @@
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -440,7 +440,7 @@ LINKER_PLUGIN_API_H = $(srcdir)/../include/plugin-api.h
+ LTO_SYMTAB_H = $(srcdir)/../include/lto-symtab.h
+ 
+ # Default native SYSTEM_HEADER_DIR, to be overridden by targets.
+-NATIVE_SYSTEM_HEADER_DIR = /usr/include
++# NATIVE_SYSTEM_HEADER_DIR = /usr/include
+ # Default cross SYSTEM_HEADER_DIR, to be overridden by targets.
+ CROSS_SYSTEM_HEADER_DIR = @CROSS_SYSTEM_HEADER_DIR@
+ 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix
new file mode 100644
index 00000000000..b2899961dfa
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnugrep/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+}:
+let
+  pname = "gnugrep";
+  version = "2.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/grep/grep-${version}.tar.gz";
+    sha256 = "05iayw5sfclc476vpviz67hdy03na0pz2kb5csa50232nfx34853";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/grep-2.4
+  makefile = fetchurl {
+    url = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/grep-2.4/mk/main.mk";
+    sha256 = "08an9ljlqry3p15w28hahm6swnd3jxizsd2188przvvsj093j91k";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/grep --version
+      mkdir ''${out}
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the Unix grep command";
+    homepage = "https://www.gnu.org/software/grep";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "grep";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output grep.tar
+  untar --file grep.tar
+  rm grep.tar
+  cd grep-${version}
+
+  # Configure
+  cp ${makefile} Makefile
+
+  # Build
+  make CC="tcc -B ${tinycc.libs}/lib"
+
+  # Install
+  make install PREFIX=$out
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0001-No-impure-bin-sh.patch b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0001-No-impure-bin-sh.patch
new file mode 100644
index 00000000000..58ee2d6fe09
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0001-No-impure-bin-sh.patch
@@ -0,0 +1,35 @@
+From e00a5257a6ca5fedbf68b09eee7df3502971a057 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sat, 24 Apr 2021 10:11:40 +0200
+Subject: [PATCH 1/2] No impure bin sh
+
+default_shell is used to populuate default shell used to execute jobs.
+Unless SHELL is set to a different value this would be /bin/sh.
+Our stdenv provides sh in form of bash anyway. Having this value not
+hard-coded has some advantages:
+
+- It would ensure that on all systems it uses sh from its PATH rather
+  than /bin/sh, which helps as different systems might have different
+  shells there (bash vs. dash)
+- In the past I had issues with LD_PRELOAD with BEAR, where /bin/sh
+  used a different glibc than BEAR which came from my development shell.
+---
+ src/job.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/job.c b/src/job.c
+index ae1f18b..6b4ddb3 100644
+--- a/src/job.c
++++ b/src/job.c
+@@ -77,7 +77,7 @@ char * vms_strsignal (int status);
+ 
+ #else
+ 
+-const char *default_shell = "/bin/sh";
++const char *default_shell = "sh";
+ int batch_mode_shell = 0;
+ 
+ #endif
+-- 
+2.31.1
+
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0002-remove-impure-dirs.patch b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0002-remove-impure-dirs.patch
new file mode 100644
index 00000000000..e62aee7d999
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0002-remove-impure-dirs.patch
@@ -0,0 +1,40 @@
+From 795d63d3c8b5c0dbb7e544954f75507b371b7228 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sat, 24 Apr 2021 10:20:16 +0200
+Subject: [PATCH 2/2] remove impure dirs
+
+---
+ src/read.c   | 3 ---
+ src/remake.c | 2 --
+ 2 files changed, 5 deletions(-)
+
+diff --git a/src/read.c b/src/read.c
+index fa197fb..defacfb 100644
+--- a/src/read.c
++++ b/src/read.c
+@@ -109,9 +109,6 @@ static const char *default_include_directories[] =
+ #endif
+     INCLUDEDIR,
+ #ifndef _AMIGA
+-    "/usr/gnu/include",
+-    "/usr/local/include",
+-    "/usr/include",
+ #endif
+     0
+   };
+diff --git a/src/remake.c b/src/remake.c
+index fb237c5..94bff7d 100644
+--- a/src/remake.c
++++ b/src/remake.c
+@@ -1601,8 +1601,6 @@ library_search (const char *lib, FILE_TIMESTAMP *mtime_ptr)
+   static const char *dirs[] =
+     {
+ #ifndef _AMIGA
+-      "/lib",
+-      "/usr/lib",
+ #endif
+ #if defined(WINDOWS32) && !defined(LIBDIR)
+ /*
+-- 
+2.31.1
+
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0003-tinycc-support.patch b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0003-tinycc-support.patch
new file mode 100644
index 00000000000..e2e3f339515
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/0003-tinycc-support.patch
@@ -0,0 +1,58 @@
+diff --git a/src/dir.c b/src/dir.c
+index 3e94b98..cfaa6a2 100644
+--- a/src/dir.c
++++ b/src/dir.c
+@@ -1331,10 +1331,9 @@ local_stat (const char *path, struct stat *buf)
+ 
+ /* Similarly for lstat.  */
+ #if !defined(lstat) && !defined(WINDOWS32) || defined(VMS)
+-# ifndef VMS
+-#  ifndef HAVE_SYS_STAT_H
++// mes-libc implements but does not declare lstat
++# if (!defined(VMS) && !defined(HAVE_SYS_STAT_H)) || defined(__TINYC__)
+ int lstat (const char *path, struct stat *sbuf);
+-#  endif
+ # else
+     /* We are done with the fake lstat.  Go back to the real lstat */
+ #   ifdef lstat
+diff --git a/src/job.c b/src/job.c
+index ea88561..8388a82 100644
+--- a/src/job.c
++++ b/src/job.c
+@@ -2052,7 +2052,8 @@ job_next_command (struct child *child)
+ static int
+ load_too_high (void)
+ {
+-#if defined(__MSDOS__) || defined(VMS) || defined(_AMIGA) || defined(__riscos__)
++// mes-libc does not support getloadavg
++#if defined(__MSDOS__) || defined(VMS) || defined(_AMIGA) || defined(__riscos__) || defined (__TINYC__)
+   return 1;
+ #else
+   static double last_sec;
+diff --git a/src/main.c b/src/main.c
+index a9d3a64..664d40f 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -2770,7 +2770,7 @@ main (int argc, char **argv, char **envp)
+               char *b = alloca (40);
+               sprintf (b, "MAKE_RESTARTS=%s%u",
+                        OUTPUT_IS_TRACED () ? "-" : "", restarts);
+-              putenv (b);
++              // mes-libc does not support putenv
+             }
+ 
+           fflush (stdout);
+diff --git a/src/misc.c b/src/misc.c
+index eb14f40..bffca82 100644
+--- a/src/misc.c
++++ b/src/misc.c
+@@ -653,7 +653,8 @@ get_tmppath ()
+ 
+ # ifdef HAVE_MKTEMP
+   path = get_tmptemplate ();
+-  if (*mktemp (path) == '\0')
++  // tinycc: "src/misc.c:656: error: pointer expected"
++  if (!strcmp(mktemp (path), ""))
+     {
+       OSS (error, NILF,
+            _("cannot generate temp path from %s: %s"), path, strerror (errno));
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
new file mode 100644
index 00000000000..823d314f280
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
@@ -0,0 +1,190 @@
+{ lib
+, fetchurl
+, kaem
+, tinycc
+, gnupatch
+}:
+let
+  pname = "gnumake";
+  version = "4.4.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/make/make-${version}.tar.gz";
+    sha256 = "1cwgcmwdn7gqn5da2ia91gkyiqs9birr10sy5ykpkaxzcwfzn5nx";
+  };
+
+  patches = [
+    # Replaces /bin/sh with sh, see patch file for reasoning
+    ./0001-No-impure-bin-sh.patch
+    # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
+    # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
+    # included Makefiles, don't look in /usr/include and friends.
+    ./0002-remove-impure-dirs.patch
+    # Fixes for tinycc. See comments in patch file for reasoning
+    ./0003-tinycc-support.patch
+  ];
+
+  CFLAGS = [
+    "-I./src"
+    "-I./lib"
+    "-DHAVE_CONFIG_H"
+    "-DMAKE_MAINTAINER_MODE"
+    "-DLIBDIR=\\\"${placeholder "out"}/lib\\\""
+    "-DLOCALEDIR=\\\"/fake-locale\\\""
+    "-DPOSIX=1"
+    # mes-libc doesn't implement osync_* methods
+    "-DNO_OUTPUT_SYNC=1"
+    # mes-libc doesn't define O_TMPFILE
+    "-DO_TMPFILE=020000000"
+  ] ++ config;
+
+  /*
+    Maintenance notes:
+
+    Generated by
+        ./configure \
+          --build i686-pc-linux-gnu \
+          --host i686-pc-linux-gnu \
+          CC="${tinycc.compiler}/bin/tcc -B ${tinycc.libs}/lib" \
+          ac_cv_func_dup=no
+    - `ac_cv_func_dup` disabled as mes-libc doesn't implement tmpfile()
+
+    The output src/config.h was then manually filtered, removing definitions that
+    didn't have uses in the source code
+  */
+  config = [
+    "-DFILE_TIMESTAMP_HI_RES=0"
+    "-DHAVE_ALLOCA"
+    "-DHAVE_ALLOCA_H"
+    "-DHAVE_ATEXIT"
+    "-DHAVE_DECL_BSD_SIGNAL=0"
+    "-DHAVE_DECL_GETLOADAVG=0"
+    "-DHAVE_DECL_SYS_SIGLIST=0"
+    "-DHAVE_DECL__SYS_SIGLIST=0"
+    "-DHAVE_DECL___SYS_SIGLIST=0"
+    "-DHAVE_DIRENT_H"
+    "-DHAVE_DUP2"
+    "-DHAVE_FCNTL_H"
+    "-DHAVE_FDOPEN"
+    "-DHAVE_GETCWD"
+    "-DHAVE_GETTIMEOFDAY"
+    "-DHAVE_INTTYPES_H"
+    "-DHAVE_ISATTY"
+    "-DHAVE_LIMITS_H"
+    "-DHAVE_LOCALE_H"
+    "-DHAVE_MEMORY_H"
+    "-DHAVE_MKTEMP"
+    "-DHAVE_SA_RESTART"
+    "-DHAVE_SETVBUF"
+    "-DHAVE_SIGACTION"
+    "-DHAVE_SIGSETMASK"
+    "-DHAVE_STDINT_H"
+    "-DHAVE_STDLIB_H"
+    "-DHAVE_STRDUP"
+    "-DHAVE_STRERROR"
+    "-DHAVE_STRINGS_H"
+    "-DHAVE_STRING_H"
+    "-DHAVE_STRTOLL"
+    "-DHAVE_SYS_FILE_H"
+    "-DHAVE_SYS_PARAM_H"
+    "-DHAVE_SYS_RESOURCE_H"
+    "-DHAVE_SYS_SELECT_H"
+    "-DHAVE_SYS_STAT_H"
+    "-DHAVE_SYS_TIMEB_H"
+    "-DHAVE_SYS_TIME_H"
+    "-DHAVE_SYS_WAIT_H"
+    "-DHAVE_TTYNAME"
+    "-DHAVE_UMASK"
+    "-DHAVE_UNISTD_H"
+    "-DHAVE_WAITPID"
+    "-DMAKE_JOBSERVER"
+    "-DMAKE_SYMLINKS"
+    "-DPATH_SEPARATOR_CHAR=':'"
+    "-DSCCS_GET=\\\"get\\\""
+    "-DSTDC_HEADERS"
+    "-Dsig_atomic_t=int"
+    "-Dvfork=fork"
+  ];
+
+  # Maintenance note: list of source files derived from Basic.mk
+  make_SOURCES = [
+    "src/ar.c"
+    "src/arscan.c"
+    "src/commands.c"
+    "src/default.c"
+    "src/dir.c"
+    "src/expand.c"
+    "src/file.c"
+    "src/function.c"
+    "src/getopt.c"
+    "src/getopt1.c"
+    "src/guile.c"
+    "src/hash.c"
+    "src/implicit.c"
+    "src/job.c"
+    "src/load.c"
+    "src/loadapi.c"
+    "src/main.c"
+    "src/misc.c"
+    "src/output.c"
+    "src/read.c"
+    "src/remake.c"
+    "src/rule.c"
+    "src/shuffle.c"
+    "src/signame.c"
+    "src/strcache.c"
+    "src/variable.c"
+    "src/version.c"
+    "src/vpath.c"
+  ];
+  glob_SOURCES = [ "lib/fnmatch.c" "lib/glob.c" ];
+  remote_SOURCES = [ "src/remote-stub.c" ];
+  sources = make_SOURCES ++ glob_SOURCES ++ remote_SOURCES ++ [
+    "src/posixos.c"
+  ];
+
+  objects = map (x: lib.replaceStrings [".c"] [".o"] (builtins.baseNameOf x)) sources;
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [ tinycc.compiler gnupatch ];
+
+  meta = with lib; {
+    description = "A tool to control the generation of non-source files from sources";
+    homepage = "https://www.gnu.org/software/make";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "make";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output make.tar
+  untar --file make.tar
+  rm make.tar
+  cd make-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
+  # Configure
+  catm src/config.h src/mkconfig.h src/mkcustom.h
+  cp lib/glob.in.h lib/glob.h
+  cp lib/fnmatch.in.h lib/fnmatch.h
+
+  # Compile
+  alias CC="tcc -B ${tinycc.libs}/lib ${lib.concatStringsSep " " CFLAGS}"
+  ${lib.concatMapStringsSep "\n" (f: "CC -c ${f}") sources}
+
+  # Link
+  CC -o make ${lib.concatStringsSep " " objects}
+
+  # Check
+  ./make --version
+
+  # Install
+  mkdir -p ''${out}/bin
+  cp ./make ''${out}/bin
+  chmod 555 ''${out}/bin/make
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
new file mode 100644
index 00000000000..504095732e8
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
@@ -0,0 +1,82 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumakeBoot
+, gnupatch
+, gnused
+, gnugrep
+, gawk
+, gnutar
+, gzip
+}:
+let
+  pname = "gnumake-musl";
+  version = "4.4.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/make/make-${version}.tar.gz";
+    hash = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
+  };
+
+  patches = [
+    # Replaces /bin/sh with sh, see patch file for reasoning
+    ./0001-No-impure-bin-sh.patch
+    # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
+    # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
+    # included Makefiles, don't look in /usr/include and friends.
+    ./0002-remove-impure-dirs.patch
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumakeBoot
+    gnupatch
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/make --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "A tool to control the generation of non-source files from sources";
+    homepage = "https://www.gnu.org/software/make";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "make";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd make-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config}
+
+  # Build
+  make AR="tcc -ar"
+
+  # Install
+  make install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix
new file mode 100644
index 00000000000..8e6f6696c68
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix
@@ -0,0 +1,107 @@
+{ lib
+, fetchurl
+, kaem
+, tinycc
+}:
+let
+  pname = "gnupatch";
+  # 2.6.x and later use features not implemented in mes-libc (eg. quotearg.h)
+  version = "2.5.9";
+
+  src = fetchurl {
+    url = "mirror://gnu/patch/patch-${version}.tar.gz";
+    sha256 = "12nv7jx3gxfp50y11nxzlnmqqrpicjggw6pcsq0wyavkkm3cddgc";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/patch-2.5.9/mk/main.mk
+  CFLAGS = [
+    "-I."
+    "-DHAVE_DECL_GETENV"
+    "-DHAVE_DECL_MALLOC"
+    "-DHAVE_DIRENT_H"
+    "-DHAVE_LIMITS_H"
+    "-DHAVE_GETEUID"
+    "-DHAVE_MKTEMP"
+    "-DPACKAGE_BUGREPORT="
+    "-Ded_PROGRAM=\\\"/nullop\\\""
+    "-Dmbstate_t=int" # When HAVE_MBRTOWC is not enabled uses of mbstate_t are always a no-op
+    "-DRETSIGTYPE=int"
+    "-DHAVE_MKDIR"
+    "-DHAVE_RMDIR"
+    "-DHAVE_FCNTL_H"
+    "-DPACKAGE_NAME=\\\"patch\\\""
+    "-DPACKAGE_VERSION=\\\"${version}\\\""
+    "-DHAVE_MALLOC"
+    "-DHAVE_REALLOC"
+    "-DSTDC_HEADERS"
+    "-DHAVE_STRING_H"
+    "-DHAVE_STDLIB_H"
+  ];
+
+  # Maintenance note: List of sources from Makefile.in
+  SRCS = [
+    "addext.c"
+    "argmatch.c"
+    "backupfile.c"
+    "basename.c"
+    "dirname.c"
+    "getopt.c"
+    "getopt1.c"
+    "inp.c"
+    "maketime.c"
+    "partime.c"
+    "patch.c"
+    "pch.c"
+    "quote.c"
+    "quotearg.c"
+    "quotesys.c"
+    "util.c"
+    "version.c"
+    "xmalloc.c"
+  ];
+  sources = SRCS ++ [
+    # mes-libc doesn't implement `error()`
+    "error.c"
+  ];
+
+  objects = map (x: lib.replaceStrings [".c"] [".o"] (builtins.baseNameOf x)) sources;
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [ tinycc.compiler ];
+
+  meta = with lib; {
+    description = "GNU Patch, a program to apply differences to files";
+    homepage = "https://www.gnu.org/software/patch";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "patch";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output patch.tar
+  untar --file patch.tar
+  rm patch.tar
+  cd patch-${version}
+
+  # Configure
+  catm config.h
+
+  # Build
+  alias CC="tcc -B ${tinycc.libs}/lib ${lib.concatStringsSep " " CFLAGS}"
+  ${lib.concatMapStringsSep "\n" (f: "CC -c ${f}") sources}
+
+  # Link
+  CC -o patch ${lib.concatStringsSep " " objects}
+
+  # Check
+  ./patch --version
+
+  # Install
+  mkdir -p ''${out}/bin
+  cp ./patch ''${out}/bin
+  chmod 555 ''${out}/bin/patch
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/common.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/common.nix
new file mode 100644
index 00000000000..658f05923ac
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/common.nix
@@ -0,0 +1,12 @@
+{ lib }:
+
+{
+  meta = with lib; {
+    description = "GNU sed, a batch stream editor";
+    homepage = "https://www.gnu.org/software/sed";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "sed";
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
new file mode 100644
index 00000000000..ee566f93c16
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
@@ -0,0 +1,63 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gnumake
+, tinycc
+, gnused
+, gnugrep
+, gnutar
+, gzip
+}:
+
+let
+  inherit (import ./common.nix { inherit lib; }) meta;
+  pname = "gnused";
+  # last version that can be bootstrapped with our slightly buggy gnused-mes
+  version = "4.2";
+
+  src = fetchurl {
+    url = "mirror://gnu/sed/sed-${version}.tar.gz";
+    hash = "sha256-20XNY/0BDmUFN9ZdXfznaJplJ0UjZgbl5ceCk3Jn2YM=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    gnumake
+    tinycc.compiler
+    gnused
+    gnugrep
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/sed --version
+      mkdir ''${out}
+    '';
+} (''
+  # Unpack
+  tar xzf ${src}
+  cd sed-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
+  ./configure \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-shared \
+    --disable-nls \
+    --disable-dependency-tracking \
+    --prefix=$out
+
+  # Build
+  make AR="tcc -ar"
+
+  # Install
+  make install
+'')
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnused/mes.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnused/mes.nix
new file mode 100644
index 00000000000..031b5b5f0db
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnused/mes.nix
@@ -0,0 +1,59 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gnumake
+, tinycc
+}:
+
+let
+  inherit (import ./common.nix { inherit lib; }) meta;
+  pname = "gnused-mes";
+  # last version that can be compiled with mes-libc
+  version = "4.0.9";
+
+  src = fetchurl {
+    url = "mirror://gnu/sed/sed-${version}.tar.gz";
+    sha256 = "0006gk1dw2582xsvgx6y6rzs9zw8b36rhafjwm288zqqji3qfrf3";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/sed-4.0.9/sed-4.0.9.kaem
+  makefile = fetchurl {
+    url = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/sed-4.0.9/mk/main.mk";
+    sha256 = "0w1f5ri0g5zla31m6l6xyzbqwdvandqfnzrsw90dd6ak126w3mya";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    gnumake
+    tinycc.compiler
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/sed --version
+      mkdir ''${out}
+    '';
+} (''
+  # Unpack
+  ungz --file ${src} --output sed.tar
+  untar --file sed.tar
+  rm sed.tar
+  cd sed-${version}
+
+  # Configure
+  cp ${makefile} Makefile
+  catm config.h
+
+  # Build
+  make \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    LIBC=mes
+
+  # Install
+  make install PREFIX=$out
+'')
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/latest.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/latest.nix
new file mode 100644
index 00000000000..717ea9868fd
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/latest.nix
@@ -0,0 +1,71 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gcc
+, musl
+, binutils
+, gnumake
+, gnused
+, gnugrep
+, gawk
+, gzip
+, gnutarBoot
+}:
+let
+  pname = "gnutar";
+  version = "1.35";
+
+  src = fetchurl {
+    url = "mirror://gnu/tar/tar-${version}.tar.gz";
+    hash = "sha256-FNVeMgY+qVJuBX+/Nfyr1TN452l4fv95GcN1WwLStX4=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    musl
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gzip
+    gnutarBoot
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/tar --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the `tar' archiver";
+    homepage = "https://www.gnu.org/software/tar";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "tar";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd tar-${version}
+
+  # Configure
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    CC=musl-gcc
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
new file mode 100644
index 00000000000..e07561b3e7e
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
@@ -0,0 +1,65 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnused
+, gnugrep
+}:
+let
+  pname = "gnutar";
+  # >= 1.13 is incompatible with mes-libc
+  version = "1.12";
+
+  src = fetchurl {
+    url = "mirror://gnu/tar/tar-${version}.tar.gz";
+    sha256 = "02m6gajm647n8l9a5bnld6fnbgdpyi4i3i83p7xcwv0kif47xhy6";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/tar --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the `tar' archiver";
+    homepage = "https://www.gnu.org/software/tar";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "tar";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output tar.tar
+  untar --file tar.tar
+  rm tar.tar
+  cd tar-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  bash ./configure \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-nls \
+    --prefix=$out
+
+  # Build
+  make AR="tcc -ar"
+
+  # Install
+  make install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
new file mode 100644
index 00000000000..0818a0de39a
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
@@ -0,0 +1,70 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnugrep
+, gnused
+}:
+let
+  # gnutar with musl preserves modify times, allowing make to not try
+  # rebuilding pregenerated files
+  pname = "gnutar-musl";
+  version = "1.12";
+
+  src = fetchurl {
+    url = "mirror://gnu/tar/tar-${version}.tar.gz";
+    hash = "sha256-xsN+iIsTbM76uQPFEUn0t71lnWnUrqISRfYQU6V6pgo=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/tar --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the `tar' archiver";
+    homepage = "https://www.gnu.org/software/tar";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "tar";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output tar.tar
+  untar --file tar.tar
+  rm tar.tar
+  cd tar-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
+  export ac_cv_sizeof_unsigned_long=4
+  export ac_cv_sizeof_long_long=8
+  export ac_cv_header_netdb_h=no
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-nls
+
+  # Build
+  make AR="tcc -ar"
+
+  # Install
+  make install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gzip/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gzip/default.nix
new file mode 100644
index 00000000000..39353bf2b48
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gzip/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnused
+, gnugrep
+}:
+let
+  pname = "gzip";
+  version = "1.2.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/gzip/gzip-${version}.tar.gz";
+    sha256 = "0ryr5b00qz3xcdcv03qwjdfji8pasp0007ay3ppmk71wl8c1i90w";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/gzip --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU zip compression program";
+    homepage = "https://www.gnu.org/software/gzip";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output gzip.tar
+  untar --file gzip.tar
+  rm gzip.tar
+  cd gzip-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib -Dstrlwr=unused"
+  bash ./configure --prefix=$out
+
+  # Build
+  make
+
+  # Install
+  mkdir $out
+  make install
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom-devtools/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/heirloom-devtools/default.nix
new file mode 100644
index 00000000000..88637811b95
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom-devtools/default.nix
@@ -0,0 +1,97 @@
+{ lib
+, fetchurl
+, kaem
+, tinycc
+, gnumake
+, gnupatch
+, coreutils
+}:
+let
+  pname = "heirloom-devtools";
+  version = "070527";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/heirloom/heirloom-devtools/heirloom-devtools-${version}.tar.bz2";
+    sha256 = "9f233d8b78e4351fe9dd2d50d83958a0e5af36f54e9818521458a08e058691ba";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/d918b984ad6fe4fc7680f3be060fd82f8c9fddd9/sysa/heirloom-devtools-070527/heirloom-devtools-070527.kaem
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/d918b984ad6fe4fc7680f3be060fd82f8c9fddd9/sysa/heirloom-devtools-070527";
+
+  patches = [
+    # Remove all kinds of wchar support. Mes Libc does not support wchar in any form
+    (fetchurl {
+      url = "${liveBootstrap}/patches/yacc_remove_wchar.patch";
+      sha256 = "0wgiz02bb7xzjy2gnbjp8y31qy6rc4b29v01zi32zh9lw54j68hc";
+    })
+    # Similarly to yacc, remove wchar. See yacc patch for further information
+    (fetchurl {
+      url = "${liveBootstrap}/patches/lex_remove_wchar.patch";
+      sha256 = "168dfngi51ljjqgd55wbvmffaq61gk48gak50ymnl1br92qkp4zh";
+    })
+  ];
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    coreutils
+  ];
+
+  meta = with lib; {
+    description = "Portable yacc and lex derived from OpenSolaris";
+    homepage = "https://heirloom.sourceforge.net/devtools.html";
+    license = with licenses; [ cddl bsdOriginalUC caldera ];
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  unbz2 --file ${src} --output heirloom-devtools.tar
+  untar --file heirloom-devtools.tar
+  rm heirloom-devtools.tar
+  build=''${NIX_BUILD_TOP}/heirloom-devtools-${version}
+  cd ''${build}
+
+  # Patch
+  ${lib.concatLines (map (f: "patch -Np0 -i ${f}") patches)}
+
+  # Build yacc
+  cd yacc
+  make -f Makefile.mk \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    AR="tcc -ar" \
+    CFLAGS="-DMAXPATHLEN=4096 -DEILSEQ=84 -DMB_LEN_MAX=100" \
+    LDFLAGS="-lgetopt" \
+    RANLIB=true \
+    LIBDIR=''${out}/lib
+
+  # Install yacc
+  install -D yacc ''${out}/bin/yacc
+  install -Dm 444 liby.a ''${out}/lib/liby.a
+  install -Dm 444 yaccpar ''${out}/lib/yaccpar
+
+  # Make yacc available to lex
+  PATH="''${out}/bin:''${PATH}"
+
+  # Build lex
+  cd ../lex
+  make -f Makefile.mk \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    AR="tcc -ar" \
+    CFLAGS="-DEILSEQ=84 -DMB_LEN_MAX=100" \
+    LDFLAGS="-lgetopt" \
+    RANLIB=true \
+    LIBDIR=''${out}/lib
+
+  # Install lex
+  install -D lex ''${out}/bin/lex
+  install -Dm 444 ncform ''${out}/lib/lex/ncform
+  install -Dm 444 nceucform ''${out}/lib/lex/nceucform
+  install -Dm 444 nrform ''${out}/lib/lex/nrform
+  install -Dm 444 libl.a ''${out}/lib/libl.a
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/cp-no-socket.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/cp-no-socket.patch
new file mode 100644
index 00000000000..88d6e7d6fa4
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/cp-no-socket.patch
@@ -0,0 +1,84 @@
+--- cp/cp.c
++++ cp/cp.c
+@@ -42,8 +42,6 @@ static const char sccsid[] USED = "@(#)cp.sl	1.84 (gritter) 3/4/06";
+ 
+ #include	<sys/types.h>
+ #include	<sys/stat.h>
+-#include	<sys/socket.h>
+-#include	<sys/un.h>
+ #include	<sys/time.h>
+ #include	<sys/resource.h>
+ #include	<fcntl.h>
+@@ -427,6 +425,7 @@ fdcopy(const char *src, const struct stat *ssp, const int sfd,
+ #endif
+ 
+ #ifdef	__linux__
++#ifdef	O_DIRECT
+ 	if (!bflag && !Dflag && ssp->st_size > 0) {
+ 		long long	sent;
+ 
+@@ -436,6 +435,7 @@ fdcopy(const char *src, const struct stat *ssp, const int sfd,
+ 		if (sent < 0)
+ 			goto err;
+ 	}
++#endif
+ #endif	/* __linux__ */
+ 	if (pagesize == 0)
+ 		if ((pagesize = 4096) < 0)
+@@ -702,37 +702,6 @@ symlinkcopy(const char *src, const struct stat *ssp,
+ 	}
+ }
+ 
+-static void
+-socketcopy(const char *src, const struct stat *ssp,
+-		const char *tgt, const struct stat *dsp)
+-{
+-	int	fd, addrsz;
+-	struct sockaddr_un	addr;
+-	size_t	len;
+-
+-	if (do_unlink(tgt, dsp) != OKAY)
+-		return;
+-	len = strlen(tgt);
+-	memset(&addr, 0, sizeof addr);
+-	addr.sun_family = AF_UNIX;
+-	addrsz = sizeof addr - sizeof addr.sun_path + len;
+-	if ((len >= sizeof addr.sun_path ? errno = ENAMETOOLONG, fd = -1, 1 :
+-			(strncpy(addr.sun_path,tgt,sizeof addr.sun_path), 0)) ||
+-			(fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0 ||
+-			bind(fd, (struct sockaddr *)&addr, addrsz) < 0) {
+-		fprintf(stderr, "%s: cannot create socket %s\n%s: %s\n",
+-				progname, tgt,
+-				progname, strerror(errno));
+-		if (fd >= 0)
+-			close(fd);
+-		errcnt |= 01;
+-		return;
+-	}
+-	close(fd);
+-	if (pflag)
+-		permissions(tgt, ssp);
+-}
+-
+ static void
+ specialcopy(const char *src, const struct stat *ssp,
+ 		const char *tgt, const struct stat *dsp)
+@@ -748,9 +717,6 @@ specialcopy(const char *src, const struct stat *ssp,
+ 	case S_IFLNK:
+ 		symlinkcopy(src, ssp, tgt, dsp);
+ 		break;
+-	case S_IFSOCK:
+-		socketcopy(src, ssp, tgt, dsp);
+-		break;
+ 	case S_IFDOOR:
+ 		ignoring("door", src);
+ 		break;
+@@ -1043,7 +1009,7 @@ ln(const char *src, const char *tgt, struct stat *dsp, int level,
+ 		errcnt |= 01;
+ 		return;
+ 	}
+-#if (defined (SUS) || defined (S42)) && (defined (__linux__) || defined (__sun))
++#if (defined (SUS) || defined (S42)) && (defined (__linux__) || defined (__sun)) && !defined (__TINYC__)
+ 	if (sflag == 0) {
+ 		char	*rpbuf = alloca(PATH_MAX+1);
+ 		if (realpath(src, rpbuf) == NULL) {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix
new file mode 100644
index 00000000000..182e515c2f1
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/default.nix
@@ -0,0 +1,130 @@
+{ lib
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnupatch
+, heirloom-devtools
+, heirloom
+}:
+let
+  pname = "heirloom";
+  version = "070715";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/heirloom/heirloom/${version}/heirloom-${version}.tar.bz2";
+    sha256 = "sha256-6zP3C8wBmx0OCkHx11UtRcV6FicuThxIY07D5ESWow8=";
+  };
+
+  patches = [
+    # we pre-generate nawk's proctab.c as meslibc is not capable of running maketab
+    # during build time (insufficient sscanf support)
+    ./proctab.patch
+
+    # disable utilities that don't build successfully
+    ./disable-programs.patch
+
+    # "tcc -ar" doesn't support creating empty archives
+    ./tcc-empty-ar.patch
+    # meslibc doesn't have seperate libm
+    ./dont-link-lm.patch
+    # meslibc's vprintf doesn't support %ll
+    ./vprintf.patch
+    # meslibc doesn't support sysconf()
+    ./sysconf.patch
+    # meslibc doesn't support locale
+    ./strcoll.patch
+    # meslibc doesn't support termios.h
+    ./termios.patch
+    # meslibc doesn't support utime.h
+    ./utime.patch
+    # meslibc doesn't support langinfo.h
+    ./langinfo.patch
+    # support building with meslibc
+    ./meslibc-support.patch
+    # remove socket functionality as unsupported by meslibc
+    ./cp-no-socket.patch
+  ];
+
+  makeFlags = [
+    # mk.config build options
+    "CC='tcc -B ${tinycc.libs}/lib -include ${./stubs.h} -include ${./musl.h}'"
+    "AR='tcc -ar'"
+    "RANLIB=true"
+    "STRIP=true"
+    "SHELL=${bash}/bin/sh"
+    "POSIX_SHELL=${bash}/bin/sh"
+    "DEFBIN=/bin"
+    "SV3BIN=/5bin"
+    "S42BIN=/5bin/s42"
+    "SUSBIN=/bin"
+    "SU3BIN=/5bin/posix2001"
+    "UCBBIN=/ucb"
+    "CCSBIN=/ccs/bin"
+    "DEFLIB=/lib"
+    "DEFSBIN=/bin"
+    "MANDIR=/share/man"
+    "LCURS=" # disable ncurses
+    "USE_ZLIB=0" # disable zlib
+    "IWCHAR='-I../libwchar'"
+    "LWCHAR='-L../libwchar -lwchar'"
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    heirloom-devtools
+  ];
+
+  passthru.sed =
+    bash.runCommand "${pname}-sed-${version}" {} ''
+      install -D ${heirloom}/bin/sed $out/bin/sed
+    '';
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/banner Hello Heirloom
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "The Heirloom Toolchest is a collection of standard Unix utilities";
+    homepage = "https://heirloom.sourceforge.net/tools.html";
+    license = with licenses; [
+      # All licenses according to LICENSE/
+      zlib
+      caldera
+      bsdOriginalUC
+      cddl
+      bsd3
+      gpl2Plus
+      lgpl21Plus
+      lpl-102
+      info-zip
+    ];
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  unbz2 --file ${src} --output heirloom.tar
+  untar --file heirloom.tar
+  rm heirloom.tar
+  cd heirloom-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+  cp ${./proctab.c} nawk/proctab.c
+
+  # Build
+  # These tools are required during later build steps
+  export PATH="$PATH:$PWD/ed:$PWD/nawk:$PWD/sed"
+  make ${lib.concatStringsSep " " makeFlags}
+
+  # Install
+  make install ROOT=$out ${lib.concatStringsSep " " makeFlags}
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/disable-programs.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/disable-programs.patch
new file mode 100644
index 00000000000..2b15ae29680
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/disable-programs.patch
@@ -0,0 +1,43 @@
+--- makefile
++++ makefile
+@@ -1,21 +1,24 @@
+-SHELL = /bin/sh
++SHELL = sh
+ 
+-SUBDIRS = build libwchar libcommon libuxre _install \
+-	banner basename bc bdiff bfs \
+-	cal calendar cat chmod chown \
+-	cksum cmp col comm copy cp cpio csplit cut \
+-	date dc dd deroff diff diff3 dircmp dirname df du \
++SUBDIRS = libwchar libcommon libuxre _install \
++	banner basename bdiff bfs \
++	cat chmod chown \
++	cksum cmp col comm copy cp csplit cut \
++	dc dirname \
+ 	echo ed env expand expr \
+-	factor file find fmt fmtmsg fold \
+-	getconf getopt grep groups hd head hostname id join \
+-	kill line listusers ln logins logname ls \
+-	mail man mesg mkdir mkfifo mknod more mvdir \
+-	nawk news nice nl nohup oawk od \
+-	paste pathchk pg pgrep pr printenv printf priocntl ps psrinfo pwd \
+-	random renice rm rmdir \
+-	sdiff sed setpgrp shl sleep sort spell split stty su sum sync \
+-	tabs tail tapecntl tar tcopy tee test time touch tr true tsort tty \
+-	ul uname uniq units users wc what who whoami whodo xargs yes
++	file fmt fold \
++	getopt grep hd head join \
++	kill line ln logname ls \
++	mesg mkdir mknod \
++	nl nohup od \
++	paste pathchk pgrep pr printenv printf pwd \
++	random rm rmdir \
++	sed sleep sort split sum \
++	tee test touch tr true tsort tty \
++	uniq units wc what whoami xargs yes
++
++# These depend on some coreutils that we need to build first
++SUBDIRS += bc nawk build
+ 
+ dummy: makefiles all
+ 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/dont-link-lm.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/dont-link-lm.patch
new file mode 100644
index 00000000000..bf7a72b733e
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/dont-link-lm.patch
@@ -0,0 +1,44 @@
+--- csplit/Makefile.mk
++++ csplit/Makefile.mk
+@@ -1,19 +1,19 @@
+ all: csplit csplit_sus csplit_su3
+ 
+ csplit: csplit.o
+-	$(LD) $(LDFLAGS) csplit.o $(LCOMMON) $(LWCHAR) $(LIBS) -lm -o csplit
++	$(LD) $(LDFLAGS) csplit.o $(LCOMMON) $(LWCHAR) $(LIBS) -o csplit
+ 
+ csplit.o: csplit.c
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $(XO6FL) $(LARGEF) $(IWCHAR) $(ICOMMON) -c csplit.c
+ 
+ csplit_sus: csplit_sus.o
+-	$(LD) $(LDFLAGS) csplit_sus.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -lm -o csplit_sus
++	$(LD) $(LDFLAGS) csplit_sus.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o csplit_sus
+ 
+ csplit_sus.o: csplit.c
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $(XO6FL) $(LARGEF) $(IUXRE) $(IWCHAR) $(ICOMMON) -DSUS -c csplit.c -o csplit_sus.o
+ 
+ csplit_su3: csplit_su3.o
+-	$(LD) $(LDFLAGS) csplit_su3.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -lm -o csplit_su3
++	$(LD) $(LDFLAGS) csplit_su3.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o csplit_su3
+ 
+ csplit_su3.o: csplit.c
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $(XO6FL) $(LARGEF) $(IUXRE) $(IWCHAR) $(ICOMMON) -DSU3 -c csplit.c -o csplit_su3.o
+--- nawk/Makefile.mk
++++ nawk/Makefile.mk
+@@ -3,13 +3,13 @@ all: awk awk_sus awk_su3
+ OBJ = awk.lx.o b.o lib.o main.o parse.o proctab.o run.o tran.o
+ 
+ awk: awk.g.o $(OBJ) version.o
+-	$(LD) $(LDFLAGS) awk.g.o $(OBJ) version.o $(LUXRE) -lm $(LCOMMON) $(LWCHAR) $(LIBS) -o awk
++	$(LD) $(LDFLAGS) awk.g.o $(OBJ) version.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o awk
+ 
+ awk_sus: awk.g.o $(OBJ) version_sus.o
+-	$(LD) $(LDFLAGS) awk.g.o $(OBJ) version_sus.o $(LUXRE) -lm $(LCOMMON) $(LWCHAR) $(LIBS) -o awk_sus
++	$(LD) $(LDFLAGS) awk.g.o $(OBJ) version_sus.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o awk_sus
+ 
+ awk_su3: awk.g.2001.o $(OBJ) version_su3.o
+-	$(LD) $(LDFLAGS) awk.g.2001.o $(OBJ) version_su3.o $(LUXRE) -lm $(LCOMMON) $(LWCHAR) $(LIBS) -o awk_su3
++	$(LD) $(LDFLAGS) awk.g.2001.o $(OBJ) version_su3.o $(LUXRE) $(LCOMMON) $(LWCHAR) $(LIBS) -o awk_su3
+ 
+ awk.g.c: awk.g.y
+ 	$(YACC) -d awk.g.y
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/langinfo.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/langinfo.patch
new file mode 100644
index 00000000000..a8ad842b37c
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/langinfo.patch
@@ -0,0 +1,99 @@
+--- nawk/main.c
++++ nawk/main.c
+@@ -35,7 +35,6 @@
+ #include <errno.h>
+ #include <string.h>
+ #include <locale.h>
+-#include <langinfo.h>
+ #include <libgen.h>
+ 
+ #define	CMDCLASS	""/*"UX:"*/	/* Command classification */
+--- sort/sort.c
++++ sort/sort.c
+@@ -63,7 +63,6 @@ static const char sccsid[] USED = "@(#)sort.sl	1.37 (gritter) 5/29/05";
+ #include <locale.h>
+ #include <wchar.h>
+ #include <wctype.h>
+-#include <langinfo.h>
+ #include <inttypes.h>
+ #include <errno.h>
+ 
+@@ -287,18 +286,6 @@ main(int argc, char **argv)
+ 	else
+ 		chkblank();
+ 	compare = cmpf = ccoll ? mb_cur_max > 1 ? cmpm : cmpa : cmpl;
+-	setlocale(LC_NUMERIC, "");
+-	arg = nl_langinfo(RADIXCHAR);
+-	if (mb_cur_max > 1)
+-		next(radixchar, arg, i);
+-	else
+-		radixchar = *arg & 0377;
+-	arg = nl_langinfo(THOUSEP);
+-	if (mb_cur_max > 1)
+-		next(thousep, arg, i);
+-	else
+-		thousep = *arg & 0377;
+-	setlocale(LC_TIME, "");
+ 	fields = smalloc(NF * sizeof *fields);
+ 	copyproto();
+ 	eargv = argv;
+@@ -1088,8 +1075,7 @@ cmp(const char *i, const char *j)
+ 		} else {
+ 			sa = elicpy(collba, pa, la, '\n', ignore, code);
+ 			sb = elicpy(collbb, pb, lb, '\n', ignore, code);
+-			n = fp->Mflg ? monthcmp(collba, collbb) :
+-				strcoll(collba, collbb);
++			n = strcmp(collba, collbb);
+ 			if (n)
+ 				return n > 0 ? -fp->rflg : fp->rflg;
+ 			pa = &pa[sa];
+@@ -1570,49 +1556,6 @@ upcdup(const char *s)
+ 	return r;
+ }
+ 
+-static const char	*months[12];
+-
+-#define	COPY_ABMON(m)	months[m-1] = upcdup(nl_langinfo(ABMON_##m))
+-
+-static void
+-fillmonths(void)
+-{
+-	COPY_ABMON(1);
+-	COPY_ABMON(2);
+-	COPY_ABMON(3);
+-	COPY_ABMON(4);
+-	COPY_ABMON(5);
+-	COPY_ABMON(6);
+-	COPY_ABMON(7);
+-	COPY_ABMON(8);
+-	COPY_ABMON(9);
+-	COPY_ABMON(10);
+-	COPY_ABMON(11);
+-	COPY_ABMON(12);
+-}
+-
+-static int
+-monthcoll(const char *s)
+-{
+-	int	i;
+-	char	u[MB_LEN_MAX*3+1];
+-
+-	cpcu3(u, s);
+-	for (i = 0; i < 12; i++)
+-		if (strcmp(u, months[i]) == 0)
+-			return i;
+-	return 0;
+-}
+-
+-
+-static int
+-monthcmp(const char *pa, const char *pb)
+-{
+-	if (months[0] == NULL)
+-		fillmonths();
+-	return monthcoll(pa) - monthcoll(pb);
+-}
+-
+ /*
+  * isblank() consumes half of execution time (in skip()) with
+  * glibc 2.3.1. Check if it contains only space and tab, and
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/meslibc-support.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/meslibc-support.patch
new file mode 100644
index 00000000000..f8f7daede3b
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/meslibc-support.patch
@@ -0,0 +1,322 @@
+--- _install/install_ucb.c
++++ _install/install_ucb.c
+@@ -267,7 +267,7 @@ cp(const char *src, const char *tgt, struct stat *dsp)
+ 	if (check(src, tgt, dsp, &sst) != OKAY)
+ 		return;
+ 	unlink(tgt);
+-	if ((dfd = creat(tgt, 0700)) < 0 || fchmod(dfd, 0700) < 0 ||
++	if ((dfd = creat(tgt, 0700)) < 0 || chmod(tgt, 0700) < 0 ||
+ 			fstat(dfd, &nst) < 0) {
+ 		fprintf(stderr, "%s: %s: %s\n", progname, src,
+ 				strerror(errno));
+--- libcommon/Makefile.mk
++++ libcommon/Makefile.mk
+@@ -15,7 +15,7 @@ CHECK: CHECK.c
+ headers: CHECK
+ 	one() { \
+ 		rm -f "$$1.h"; \
+-		if grep "$$1_h[	 ]*=[ 	]*[^0][	 ]*;" CHECK >/dev/null; \
++		if true; \
+ 		then \
+ 			ln -s "_$$1.h" "$$1.h"; \
+ 		fi; \
+--- libcommon/atoll.h
++++ libcommon/atoll.h
+@@ -1,8 +1,10 @@
+ /*	Sccsid @(#)atoll.h	1.4 (gritter) 7/18/04	*/
+ 
+ #if defined (__hpux) || defined (_AIX) || \
+-	defined (__FreeBSD__) && (__FreeBSD__) < 5
++	(defined (__FreeBSD__) && (__FreeBSD__) < 5) || defined (__TINYC__)
++#ifndef __TINYC__
+ extern long long strtoll(const char *nptr, char **endptr, int base);
+ extern unsigned long long strtoull(const char *nptr, char **endptr, int base);
++#endif
+ extern long long atoll(const char *nptr);
+ #endif	/* __hpux || _AIX || __FreeBSD__ < 5 */
+--- libcommon/blank.h
++++ libcommon/blank.h
+@@ -5,7 +5,7 @@
+  */
+ /*	Sccsid @(#)blank.h	1.3 (gritter) 5/1/04	*/
+ 
+-#ifndef	__dietlibc__
++#if !defined(__dietlibc__) && !defined(__TINYC__)
+ #ifndef	LIBCOMMON_BLANK_H
+ #define	LIBCOMMON_BLANK_H	1
+ 
+--- libcommon/getdir.c
++++ libcommon/getdir.c
+@@ -52,7 +52,7 @@ extern int	getdents(int, struct dirent *, size_t);
+ #undef	d_ino
+ #endif	/* __FreeBSD__ || __NetBSD__ || __OpenBSD__ || __DragonFly__
+ 	 || __APPLE__ */
+-#elif defined	(__dietlibc__)
++#elif defined	(__dietlibc__) || defined(__TINYC__)
+ #include	<dirent.h>
+ #include	<unistd.h>
+ #else		/* !__GLIBC__, !__dietlibc__ */
+--- libcommon/memalign.c
++++ libcommon/memalign.c
+@@ -23,7 +23,7 @@
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (_AIX) || \
+ 	defined (__NetBSD__) || defined (__OpenBSD__) || \
+-	defined (__DragonFly__) || defined (__APPLE__)
++	defined (__DragonFly__) || defined (__APPLE__) || defined(__TINYC__)
+ /*
+  * FreeBSD malloc(3) promises to page-align the return of malloc() calls
+  * if size is at least a page. This serves for a poor man's memalign() 
+--- libcommon/memalign.h
++++ libcommon/memalign.h
+@@ -26,7 +26,7 @@
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (_AIX) || \
+ 	defined (__NetBSD__) || defined (__OpenBSD__) || \
+-	defined (__DragonFly__) || defined (__APPLE__)
++	defined (__DragonFly__) || defined (__APPLE__) || defined(__TINYC__)
+ #include	<stdlib.h>
+ 
+ extern void	*memalign(size_t, size_t);
+--- libcommon/pathconf.c
++++ libcommon/pathconf.c
+@@ -21,7 +21,7 @@
+  */
+ /*	Sccsid @(#)pathconf.c	1.2 (gritter) 5/1/04	*/
+ 
+-#ifdef	__dietlibc__
++#if defined(__dietlibc__) || defined(__TINYC__)
+ #include <unistd.h>
+ #include "pathconf.h"
+ 
+--- libcommon/pathconf.h
++++ libcommon/pathconf.h
+@@ -21,7 +21,7 @@
+  */
+ /*	Sccsid @(#)pathconf.h	1.2 (gritter) 5/1/04	*/
+ 
+-#ifdef	__dietlibc__
++#if defined(__dietlibc__) || defined(__TINYC__)
+ #include <unistd.h>
+ 
+ extern long	fpathconf(int, int);
+--- libcommon/regexp.h
++++ libcommon/regexp.h
+@@ -47,7 +47,7 @@
+ static const char regexp_h_sccsid[] REGEXP_H_USED =
+ 	"@(#)regexp.sl	1.56 (gritter) 5/29/05";
+ 
+-#if !defined (REGEXP_H_USED_FROM_VI) && !defined (__dietlibc__)
++#if !defined (REGEXP_H_USED_FROM_VI) && !defined (__dietlibc__) && !defined (__TINYC__)
+ #define	REGEXP_H_WCHARS
+ #endif
+ 
+--- libcommon/sfile.c
++++ libcommon/sfile.c
+@@ -21,7 +21,7 @@
+  */
+ /*	Sccsid @(#)sfile.c	1.9 (gritter) 6/7/04	*/
+ 
+-#ifdef	__linux__
++#if defined(__linux__) && !defined(__TINYC__)
+ #undef	_FILE_OFFSET_BITS
+ 
+ #include	<sys/types.h>
+--- libcommon/sighold.c
++++ libcommon/sighold.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sighold.c	1.7 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+--- libcommon/sigignore.c
++++ libcommon/sigignore.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigignore.c	1.6 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+--- libcommon/sigpause.c
++++ libcommon/sigpause.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigpause.c	1.6 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+--- libcommon/sigrelse.c
++++ libcommon/sigrelse.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigrelse.c	1.8 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+--- libcommon/sigset.c
++++ libcommon/sigset.c
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigset.c	1.7 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ #include <signal.h>
+ #include "sigset.h"
+ 
+@@ -46,10 +46,7 @@ void (*sigset(int sig, void (*func)(int)))(int)
+ 	if (sigaction(sig, func==SIG_HOLD?(struct sigaction *)0:&nact, &oact)
+ 			== -1)
+ 		return SIG_ERR;
+-	if (sigismember(&oset, sig))
+-		return SIG_HOLD;
+-	else
+-		return (oact.sa_handler);
++	return (oact.sa_handler);
+ }
+ #endif	/* __FreeBSD__ || __dietlibc__ || __NetBSD__ || __OpenBSD__ ||
+ 	__DragonFly__ || __APPLE__ */
+--- libcommon/sigset.h
++++ libcommon/sigset.h
+@@ -22,7 +22,7 @@
+ /*	Sccsid @(#)sigset.h	1.9 (gritter) 1/22/06	*/
+ 
+ #if defined (__FreeBSD__) || defined (__dietlibc__) || defined (__NetBSD__) || \
+-	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__)
++	defined (__OpenBSD__) || defined (__DragonFly__) || defined (__APPLE__) || defined (__TINYC__)
+ 
+ #ifndef	SIG_HOLD
+ #define	SIG_HOLD	((void (*)(int))2)
+--- libcommon/strtol.c
++++ libcommon/strtol.c
+@@ -1,7 +1,7 @@
+ /*	Sccsid @(#)strtol.c	1.6 (gritter) 7/18/04	*/
+ 
+ #if defined (__hpux) || defined (_AIX) || \
+-	defined (__FreeBSD__) && (__FreeBSD__) < 5
++	(defined (__FreeBSD__) && (__FreeBSD__) < 5) || defined (__TINYC__)
+ 
+ #include	<stdlib.h>
+ #include	<ctype.h>
+@@ -97,6 +97,7 @@ out:	if (pp <= bptr) {
+ 	return v * sign;
+ }
+ 
++#ifndef __TINYC__
+ long long
+ strtoll(const char *nptr, char **endptr, int base)
+ {
+@@ -108,6 +109,7 @@ strtoull(const char *nptr, char **endptr, int base)
+ {
+ 	return (unsigned long long)internal(nptr, endptr, base, 3);
+ }
++#endif
+ 
+ long long
+ atoll(const char *nptr)
+--- nawk/awk.h
++++ nawk/awk.h
+@@ -156,7 +156,6 @@ extern Cell	*rlengthloc;	/* RLENGTH */
+ #endif
+ 
+ #ifndef	IN_MAKETAB
+-#include <wchar.h>
+ 
+ /*
+  * Get next character from string s and store it in wc; n is set to
+--- nawk/awk.lx.l
++++ nawk/awk.lx.l
+@@ -71,7 +71,6 @@
+ 
+ #include	"awk.h"
+ #include	"y.tab.h"
+-#include	<pfmt.h>
+ #include	<unistd.h>
+ 
+ static void	awk_unputstr(const char *s);
+--- nawk/run.c
++++ nawk/run.c
+@@ -1467,14 +1467,6 @@ Cell *bltin(Node **a, int n)
+ 	case FRAND:
+ 		u = (Awkfloat) (rand() % 32767) / 32767.0;
+ 		break;
+-	case FSRAND:
+-		u = saved_srand; /* return previous seed */
+-		if (x->tval & REC)	/* no argument provided */
+-			saved_srand = time(NULL);
+-		else
+-			saved_srand = getfval(x);
+-		srand((int) saved_srand);
+-		break;
+ 	case FTOUPPER:
+ 	case FTOLOWER:
+ 		p = getsval(x);
+--- pgrep/pgrep.c
++++ pgrep/pgrep.c
+@@ -214,7 +214,7 @@ chdir_to_proc(void)
+ 		fprintf(stderr, "%s: cannot open %s\n", progname, PROCDIR);
+ 		exit(3);
+ 	}
+-	if (fchdir(fd) < 0) {
++	if (chdir(PROCDIR) < 0) {
+ 		fprintf(stderr, "%s: cannot chdir to %s\n", progname, PROCDIR);
+ 		exit(3);
+ 	}
+--- rm/rm.c
++++ rm/rm.c
+@@ -242,7 +242,7 @@ rm(size_t pend, const char *base, const int olddir, int ssub, int level)
+ 				}
+ 				return;
+ 			}
+-			if (fchdir(df) < 0) {
++			if (chdir(base) < 0) {
+ 				if (rmfile(base, &st) < 0) {
+ 					fprintf(stderr,
+ 						"%s: cannot chdir to %s\n",
+@@ -270,7 +270,7 @@ rm(size_t pend, const char *base, const int olddir, int ssub, int level)
+ 					progname, path);
+ 				errcnt |= 4;
+ 			}
+-			if (olddir >= 0 && fchdir(olddir) < 0) {
++			if (olddir >= 0) {
+ 				fprintf(stderr, "%s: cannot change backwards\n",
+ 						progname);
+ 				exit(1);
+@@ -316,24 +316,6 @@ subproc(size_t pend, const char *base, int level)
+ 		int status;
+ 
+ 		while (waitpid(pid, &status, 0) != pid);
+-		if (status && WIFSIGNALED(status)) {
+-			/*
+-			 * If the signal was sent due to a tty keypress,
+-			 * we should be terminated automatically and
+-			 * never reach this point. Otherwise, we terminate
+-			 * with the same signal, but make sure that we do
+-			 * not overwrite a possibly generated core file.
+-			 * This results in nearly the usual behavior except
+-			 * that the shell never prints a 'core dumped'
+-			 * message.
+-			 */
+-			struct rlimit	rl;
+-
+-			rl.rlim_cur = rl.rlim_max = 0;
+-			setrlimit(RLIMIT_CORE, &rl);
+-			raise(WTERMSIG(status));
+-			pause();
+-		}
+ 		return status ? WEXITSTATUS(status) : 0;
+ 	}
+ 	case -1:
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/musl.h b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/musl.h
new file mode 100644
index 00000000000..b4a31405607
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/musl.h
@@ -0,0 +1,53 @@
+/*
+  Copyright © 2005-2019 Rich Felker, et al.
+
+  Permission is hereby granted, free of charge, to any person obtaining
+  a copy of this software and associated documentation files (the
+  "Software"), to deal in the Software without restriction, including
+  without limitation the rights to use, copy, modify, merge, publish,
+  distribute, sublicense, and/or sell copies of the Software, and to
+  permit persons to whom the Software is furnished to do so, subject to
+  the following conditions:
+
+  The above copyright notice and this permission notice shall be
+  included in all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+  MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+  IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+  CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+  TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+  SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+// Additional utilities from musl 1.1.24
+
+// include/stdlib.h
+#define WEXITSTATUS(s) (((s) & 0xff00) >> 8)
+#define WTERMSIG(s) ((s) & 0x7f)
+#define WIFEXITED(s) (!WTERMSIG(s))
+#define WIFSIGNALED(s) (((s)&0xffff)-1U < 0xffu)
+
+// include/sys/sysmacros.h
+#define major(x) \
+	((unsigned)( (((x)>>31>>1) & 0xfffff000) | (((x)>>8) & 0x00000fff) ))
+#define minor(x) \
+	((unsigned)( (((x)>>12) & 0xffffff00) | ((x) & 0x000000ff) ))
+#define makedev(x,y) ( \
+        (((x)&0xfffff000ULL) << 32) | \
+	(((x)&0x00000fffULL) << 8) | \
+        (((y)&0xffffff00ULL) << 12) | \
+	(((y)&0x000000ffULL)) )
+
+// src/misc/basename.c
+#include <string.h>
+char *basename(char *s)
+{
+	size_t i;
+	if (!s || !*s) return ".";
+	i = strlen(s)-1;
+	for (; i&&s[i]=='/'; i--) s[i] = 0;
+	for (; i&&s[i-1]!='/'; i--);
+	return s+i;
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.c b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.c
new file mode 100644
index 00000000000..7a498a33f36
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.c
@@ -0,0 +1,205 @@
+#include <stdio.h>
+#include "awk.h"
+#include "y.tab.h"
+
+static unsigned char *printname[92] = {
+	(unsigned char *) "FIRSTTOKEN",	/* 258 */
+	(unsigned char *) "PROGRAM",	/* 259 */
+	(unsigned char *) "PASTAT",	/* 260 */
+	(unsigned char *) "PASTAT2",	/* 261 */
+	(unsigned char *) "XBEGIN",	/* 262 */
+	(unsigned char *) "XEND",	/* 263 */
+	(unsigned char *) "NL",	/* 264 */
+	(unsigned char *) "ARRAY",	/* 265 */
+	(unsigned char *) "MATCH",	/* 266 */
+	(unsigned char *) "NOTMATCH",	/* 267 */
+	(unsigned char *) "MATCHOP",	/* 268 */
+	(unsigned char *) "FINAL",	/* 269 */
+	(unsigned char *) "DOT",	/* 270 */
+	(unsigned char *) "ALL",	/* 271 */
+	(unsigned char *) "CCL",	/* 272 */
+	(unsigned char *) "NCCL",	/* 273 */
+	(unsigned char *) "CHAR",	/* 274 */
+	(unsigned char *) "MCHAR",	/* 275 */
+	(unsigned char *) "OR",	/* 276 */
+	(unsigned char *) "STAR",	/* 277 */
+	(unsigned char *) "QUEST",	/* 278 */
+	(unsigned char *) "PLUS",	/* 279 */
+	(unsigned char *) "AND",	/* 280 */
+	(unsigned char *) "BOR",	/* 281 */
+	(unsigned char *) "APPEND",	/* 282 */
+	(unsigned char *) "EQ",	/* 283 */
+	(unsigned char *) "GE",	/* 284 */
+	(unsigned char *) "GT",	/* 285 */
+	(unsigned char *) "LE",	/* 286 */
+	(unsigned char *) "LT",	/* 287 */
+	(unsigned char *) "NE",	/* 288 */
+	(unsigned char *) "IN",	/* 289 */
+	(unsigned char *) "ARG",	/* 290 */
+	(unsigned char *) "BLTIN",	/* 291 */
+	(unsigned char *) "BREAK",	/* 292 */
+	(unsigned char *) "CONTINUE",	/* 293 */
+	(unsigned char *) "DELETE",	/* 294 */
+	(unsigned char *) "DO",	/* 295 */
+	(unsigned char *) "EXIT",	/* 296 */
+	(unsigned char *) "FOR",	/* 297 */
+	(unsigned char *) "FUNC",	/* 298 */
+	(unsigned char *) "SUB",	/* 299 */
+	(unsigned char *) "GSUB",	/* 300 */
+	(unsigned char *) "IF",	/* 301 */
+	(unsigned char *) "INDEX",	/* 302 */
+	(unsigned char *) "LSUBSTR",	/* 303 */
+	(unsigned char *) "MATCHFCN",	/* 304 */
+	(unsigned char *) "NEXT",	/* 305 */
+	(unsigned char *) "ADD",	/* 306 */
+	(unsigned char *) "MINUS",	/* 307 */
+	(unsigned char *) "MULT",	/* 308 */
+	(unsigned char *) "DIVIDE",	/* 309 */
+	(unsigned char *) "MOD",	/* 310 */
+	(unsigned char *) "ASSIGN",	/* 311 */
+	(unsigned char *) "ASGNOP",	/* 312 */
+	(unsigned char *) "ADDEQ",	/* 313 */
+	(unsigned char *) "SUBEQ",	/* 314 */
+	(unsigned char *) "MULTEQ",	/* 315 */
+	(unsigned char *) "DIVEQ",	/* 316 */
+	(unsigned char *) "MODEQ",	/* 317 */
+	(unsigned char *) "POWEQ",	/* 318 */
+	(unsigned char *) "PRINT",	/* 319 */
+	(unsigned char *) "PRINTF",	/* 320 */
+	(unsigned char *) "SPRINTF",	/* 321 */
+	(unsigned char *) "ELSE",	/* 322 */
+	(unsigned char *) "INTEST",	/* 323 */
+	(unsigned char *) "CONDEXPR",	/* 324 */
+	(unsigned char *) "POSTINCR",	/* 325 */
+	(unsigned char *) "PREINCR",	/* 326 */
+	(unsigned char *) "POSTDECR",	/* 327 */
+	(unsigned char *) "PREDECR",	/* 328 */
+	(unsigned char *) "VAR",	/* 329 */
+	(unsigned char *) "IVAR",	/* 330 */
+	(unsigned char *) "VARNF",	/* 331 */
+	(unsigned char *) "CALL",	/* 332 */
+	(unsigned char *) "NUMBER",	/* 333 */
+	(unsigned char *) "STRING",	/* 334 */
+	(unsigned char *) "FIELD",	/* 335 */
+	(unsigned char *) "REGEXPR",	/* 336 */
+	(unsigned char *) "GETLINE",	/* 337 */
+	(unsigned char *) "RETURN",	/* 338 */
+	(unsigned char *) "SPLIT",	/* 339 */
+	(unsigned char *) "SUBSTR",	/* 340 */
+	(unsigned char *) "WHILE",	/* 341 */
+	(unsigned char *) "CAT",	/* 342 */
+	(unsigned char *) "NOT",	/* 343 */
+	(unsigned char *) "UMINUS",	/* 344 */
+	(unsigned char *) "POWER",	/* 345 */
+	(unsigned char *) "DECR",	/* 346 */
+	(unsigned char *) "INCR",	/* 347 */
+	(unsigned char *) "INDIRECT",	/* 348 */
+	(unsigned char *) "LASTTOKEN",	/* 349 */
+};
+
+
+Cell *(*proctab[92])(Node **, int) = {
+	nullproc,	/* FIRSTTOKEN */
+	program,	/* PROGRAM */
+	pastat,	/* PASTAT */
+	dopa2,	/* PASTAT2 */
+	nullproc,	/* XBEGIN */
+	nullproc,	/* XEND */
+	nullproc,	/* NL */
+	array,	/* ARRAY */
+	matchop,	/* MATCH */
+	matchop,	/* NOTMATCH */
+	nullproc,	/* MATCHOP */
+	nullproc,	/* FINAL */
+	nullproc,	/* DOT */
+	nullproc,	/* ALL */
+	nullproc,	/* CCL */
+	nullproc,	/* NCCL */
+	nullproc,	/* CHAR */
+	nullproc,	/* MCHAR */
+	nullproc,	/* OR */
+	nullproc,	/* STAR */
+	nullproc,	/* QUEST */
+	nullproc,	/* PLUS */
+	boolop,	/* AND */
+	boolop,	/* BOR */
+	nullproc,	/* APPEND */
+	relop,	/* EQ */
+	relop,	/* GE */
+	relop,	/* GT */
+	relop,	/* LE */
+	relop,	/* LT */
+	relop,	/* NE */
+	instat,	/* IN */
+	arg,	/* ARG */
+	bltin,	/* BLTIN */
+	jump,	/* BREAK */
+	jump,	/* CONTINUE */
+	delete,	/* DELETE */
+	dostat,	/* DO */
+	jump,	/* EXIT */
+	forstat,	/* FOR */
+	nullproc,	/* FUNC */
+	sub,	/* SUB */
+	gsub,	/* GSUB */
+	ifstat,	/* IF */
+	sindex,	/* INDEX */
+	nullproc,	/* LSUBSTR */
+	matchop,	/* MATCHFCN */
+	jump,	/* NEXT */
+	arith,	/* ADD */
+	arith,	/* MINUS */
+	arith,	/* MULT */
+	arith,	/* DIVIDE */
+	arith,	/* MOD */
+	assign,	/* ASSIGN */
+	nullproc,	/* ASGNOP */
+	assign,	/* ADDEQ */
+	assign,	/* SUBEQ */
+	assign,	/* MULTEQ */
+	assign,	/* DIVEQ */
+	assign,	/* MODEQ */
+	assign,	/* POWEQ */
+	print,	/* PRINT */
+	aprintf,	/* PRINTF */
+	awsprintf,	/* SPRINTF */
+	nullproc,	/* ELSE */
+	intest,	/* INTEST */
+	condexpr,	/* CONDEXPR */
+	incrdecr,	/* POSTINCR */
+	incrdecr,	/* PREINCR */
+	incrdecr,	/* POSTDECR */
+	incrdecr,	/* PREDECR */
+	nullproc,	/* VAR */
+	nullproc,	/* IVAR */
+	getnf,	/* VARNF */
+	call,	/* CALL */
+	nullproc,	/* NUMBER */
+	nullproc,	/* STRING */
+	nullproc,	/* FIELD */
+	nullproc,	/* REGEXPR */
+	getline,	/* GETLINE */
+	jump,	/* RETURN */
+	split,	/* SPLIT */
+	substr,	/* SUBSTR */
+	whilestat,	/* WHILE */
+	cat,	/* CAT */
+	boolop,	/* NOT */
+	arith,	/* UMINUS */
+	arith,	/* POWER */
+	nullproc,	/* DECR */
+	nullproc,	/* INCR */
+	indirect,	/* INDIRECT */
+	nullproc,	/* LASTTOKEN */
+};
+
+unsigned char *tokname(int n)
+{
+	static unsigned char buf[100];
+
+	if (n < FIRSTTOKEN || n > LASTTOKEN) {
+		snprintf((char *)buf, sizeof buf, "token %d", n);
+		return buf;
+	}
+	return printname[n-257];
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.patch
new file mode 100644
index 00000000000..30913c9022b
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/proctab.patch
@@ -0,0 +1,11 @@
+--- nawk/Makefile.mk
++++ nawk/Makefile.mk
+@@ -28,8 +28,6 @@ maketab: maketab.o
+ 	$(HOSTCC) maketab.o -o maketab
+ 	./maketab > proctab.c
+ 
+-proctab.c: maketab
+-
+ awk.g.o: awk.g.c
+ 	$(CC) $(CFLAGSS) $(CPPFLAGS) $(XO5FL) $(LARGEF) $(IWCHAR) $(ICOMMON) $(IUXRE) -c awk.g.c
+ 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/strcoll.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/strcoll.patch
new file mode 100644
index 00000000000..20ed5c5c352
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/strcoll.patch
@@ -0,0 +1,73 @@
+--- comm/comm.c
++++ comm/comm.c
+@@ -242,7 +242,7 @@ compare(const char *a, const char *b)
+ 			return(2);
+ 		}
+ 	} else {
+-		n = strcoll(a, b);
++		n = strcmp(a, b);
+ 		return n ? n > 0 ? 2 : 1 : 0;
+ 	}
+ }
+--- expr/expr.y
++++ expr/expr.y
+@@ -234,7 +234,7 @@ _rel(int op, register char *r1, register char *r2)
+ 	if (numeric(r1) && numeric(r2))
+ 		i = atoll(r1) - atoll(r2);
+ 	else
+-		i = strcoll(r1, r2);
++		i = strcmp(r1, r2);
+ 	switch(op) {
+ 	case EQ: i = i==0; break;
+ 	case GT: i = i>0; break;
+--- join/join.c
++++ join/join.c
+@@ -65,7 +65,7 @@ enum {
+ 	JF = -1
+ };
+ #define	ppi(f, j)	((j) >= 0 && (j) < ppisize[f] ? ppibuf[f][j] : null)
+-#define comp() strcoll(ppi(F1, j1),ppi(F2, j2))
++#define comp() strcmp(ppi(F1, j1),ppi(F2, j2))
+ 
+ #define	next(wc, s, n)	(*(s) & 0200 ? ((n) = mbtowi(&(wc), (s), mb_cur_max), \
+ 		(n) = ((n) > 0 ? (n) : (n) < 0 ? (wc=WEOF, 1) : 1)) : \
+--- ls/ls.c
++++ ls/ls.c
+@@ -575,13 +575,13 @@ _mergesort(struct file **al)
+ static int
+ namecmp(struct file *f1, struct file *f2)
+ {
+-	return strcoll(f1->name, f2->name);
++	return strcmp(f1->name, f2->name);
+ }
+ 
+ static int
+ extcmp(struct file *f1, struct file *f2)
+ {
+-	return strcoll(extension(f1->name), extension(f2->name));
++	return strcmp(extension(f1->name), extension(f2->name));
+ }
+ 
+ static int
+--- nawk/run.c
++++ nawk/run.c
+@@ -608,7 +608,7 @@ Cell *relop(Node **a, int n)
+ 		j = x->fval - y->fval;
+ 		i = j<0? -1: (j>0? 1: 0);
+ 	} else {
+-		i = strcoll((char*)getsval(x), (char*)getsval(y));
++		i = strcmp((char*)getsval(x), (char*)getsval(y));
+ 	}
+ 	tempfree(x, "");
+ 	tempfree(y, "");
+--- sort/sort.c
++++ sort/sort.c
+@@ -1148,7 +1148,7 @@ cmpl(const char *pa, const char *pb)
+ 
+ 	ecpy(collba, pa, '\n');
+ 	ecpy(collbb, pb, '\n');
+-	n = strcoll(collba, collbb);
++	n = strcmp(collba, collbb);
+ 	return n ? n > 0 ? -fields[0].rflg : fields[0].rflg : 0;
+ }
+ 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h
new file mode 100644
index 00000000000..5aef8168180
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/stubs.h
@@ -0,0 +1,64 @@
+#include <getopt.h>
+extern int optopt;
+
+int ftruncate(int fd, int offset) {
+  return -1;
+}
+
+int getsid (int pid) {
+  return -1;
+}
+
+static int isblank(int c)
+{
+	return c == ' ' || c == '\t';
+}
+
+#define lchown chown
+
+// meslibc implements lstat but is missing declaration
+#include <sys/stat.h>
+int lstat (char const *file_name, struct stat *statbuf);
+
+#include <fcntl.h>
+int mkstemp(char *t)
+{
+  mktemp(t);
+  int fd = open(t, O_CREAT|O_RDWR|O_TRUNC, 0600);
+  return fd;
+}
+
+int putenv(char *string)
+{
+  return 0;
+}
+
+char* realpath (char* path, char* resolved) {
+  return NULL;
+}
+
+#define strncasecmp(a,b,n) strncmp(strupr(a),strupr(b),n)
+
+
+#define nlink_t unsigned long
+
+#include <limits.h>
+#define USHRT_MAX UINT16_MAX
+#define SSIZE_MAX LONG_MAX
+#define MB_LEN_MAX 1 
+
+#define EPERM 1
+#define ESRCH 3
+#define EDOM 33
+#define S_IFSOCK 0140000
+#define S_ISVTX 01000
+#define S_IREAD S_IRUSR
+#define S_IWRITE S_IWUSR
+#define S_IEXEC S_IXUSR
+
+#define _PC_PATH_MAX PATH_MAX
+#define _PC_VDISABLE 8
+#define _POSIX_PATH_MAX PATH_MAX
+#define LINE_MAX 4096
+
+#define LC_TIME 0
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/sysconf.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/sysconf.patch
new file mode 100644
index 00000000000..3d1b3e152ee
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/sysconf.patch
@@ -0,0 +1,77 @@
+--- cmp/cmp.c
++++ cmp/cmp.c
+@@ -264,7 +264,7 @@ openfile(const char *fn)
+ 	struct file	*f;
+ 
+ 	if (pagesize == 0)
+-		if ((pagesize = sysconf(_SC_PAGESIZE)) < 0)
++		if ((pagesize = 4096) < 0)
+ 			pagesize = 4096;
+ 	if ((f = memalign(pagesize, sizeof *f)) == NULL) {
+ 		write(2, "no memory\n", 10);
+--- copy/copy.c
++++ copy/copy.c
+@@ -362,7 +362,7 @@ fdcopy(const char *src, const struct stat *sp, int sfd,
+ 			goto err;
+ 	}
+ #endif	/* __linux__ */
+-	if (pagesize == 0 && (pagesize = sysconf(_SC_PAGESIZE)) <= 0)
++	if (pagesize == 0 && (pagesize = 4096) <= 0)
+ 		pagesize = 4096;
+ 	if ((blksize = sp->st_blksize) <= 0)
+ 		blksize = 512;
+--- cp/cp.c
++++ cp/cp.c
+@@ -438,7 +438,7 @@ fdcopy(const char *src, const struct stat *ssp, const int sfd,
+ 	}
+ #endif	/* __linux__ */
+ 	if (pagesize == 0)
+-		if ((pagesize = sysconf(_SC_PAGESIZE)) < 0)
++		if ((pagesize = 4096) < 0)
+ 			pagesize = 4096;
+ 	if (bflag)
+ 		blksize = bflag;
+--- libcommon/ib_alloc.c
++++ libcommon/ib_alloc.c
+@@ -41,7 +41,7 @@ ib_alloc(int fd, unsigned blksize)
+ 	struct stat	st;
+ 
+ 	if (pagesize == 0)
+-		if ((pagesize = sysconf(_SC_PAGESIZE)) < 0)
++		if ((pagesize = 4096) < 0)
+ 			pagesize = 4096;
+ 	if (blksize == 0) {
+ 		if (fstat(fd, &st) < 0)
+--- libcommon/memalign.c
++++ libcommon/memalign.c
+@@ -40,7 +40,7 @@ memalign(size_t alignment, size_t size)
+ 	static long	pagesize;
+ 
+ 	if (pagesize == 0)
+-		pagesize = sysconf(_SC_PAGESIZE);
++		pagesize = 4096;
+ 	if (alignment != pagesize)
+ 		return NULL;
+ 	if (size < pagesize)
+--- libcommon/oblok.c
++++ libcommon/oblok.c
+@@ -100,7 +100,7 @@ ob_alloc(int fd, enum ob_mode bf)
+ 	struct oblok	*op;
+ 
+ 	if (pagesize == 0)
+-		if ((pagesize = sysconf(_SC_PAGESIZE)) < 0)
++		if ((pagesize = 4096) < 0)
+ 			pagesize = 4096;
+ 	if ((op = memalign(pagesize, sizeof *op)) == NULL)
+ 		return NULL;
+--- xargs/xargs.c
++++ xargs/xargs.c
+@@ -404,7 +404,7 @@ static void
+ endcmd(void)
+ {
+ 	a_agg = a_cnt;
+-	a_maxsize = sysconf(_SC_ARG_MAX) - envsz() - 2048 - a_asz;
++	a_maxsize = 65536 - envsz() - 2048 - a_asz;
+ 	if (nflag || sflag) {
+ 		long	newsize = sflag ? atol(sflag) :
+ #ifdef	WEIRD_LIMITS
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/tcc-empty-ar.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/tcc-empty-ar.patch
new file mode 100644
index 00000000000..7c57a54b93b
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/tcc-empty-ar.patch
@@ -0,0 +1,11 @@
+--- libwchar/Makefile.mk
++++ libwchar/Makefile.mk
+@@ -10,7 +10,7 @@ fake:
+ 	if test "x$(LWCHAR)" = x; \
+ 	then \
+ 		touch $(OBJ); \
+-		ar r libwchar.a $(OBJ); \
++		touch libwchar.a $(OBJ); \
+ 	fi
+ 
+ install:
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/termios.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/termios.patch
new file mode 100644
index 00000000000..ea40a8d7a04
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/termios.patch
@@ -0,0 +1,141 @@
+--- ed/ed.c
++++ ed/ed.c
+@@ -68,7 +68,6 @@ static const char sccsid[] USED = "@(#)ed.sl	1.99 (gritter) 7/27/06";
+ #include <stdlib.h>
+ #include <signal.h>
+ #include "sigset.h"
+-#include <termios.h>
+ #include <setjmp.h>
+ #include <libgen.h>
+ #include <inttypes.h>
+@@ -77,7 +76,6 @@ static const char sccsid[] USED = "@(#)ed.sl	1.99 (gritter) 7/27/06";
+ #include <ctype.h>
+ #include <wctype.h>
+ #include <limits.h>
+-#include <termios.h>
+ static int	FNSIZE;
+ static int	LBSIZE;
+ static int	RHSIZE;
+@@ -2273,22 +2271,10 @@ sclose(int fd)
+ static void
+ fspec(const char *lp)
+ {
+-	struct termios	ts;
+ 	const char	*cp;
+ 
+ 	freetabs();
+ 	maxlength = 0;
+-	if (tcgetattr(1, &ts) < 0
+-#ifdef	TAB3
+-			|| (ts.c_oflag&TAB3) == 0
+-#endif
+-			)
+-		return;
+-	while (lp[0]) {
+-		if (lp[0] == '<' && lp[1] == ':')
+-			break;
+-		lp++;
+-	}
+ 	if (lp[0]) {
+ 		lp += 2;
+ 		while ((cp = ftok(&lp)) != NULL) {
+--- ls/ls.c
++++ ls/ls.c
+@@ -102,7 +102,6 @@ static char ifmt_c[] = "-pc-d-b--nl-SD--";
+ #include <grp.h>
+ #include <errno.h>
+ #include <fcntl.h>
+-#include <termios.h>
+ #include <locale.h>
+ #include <limits.h>
+ #include <ctype.h>
+@@ -110,14 +109,6 @@ static char ifmt_c[] = "-pc-d-b--nl-SD--";
+ #include <wchar.h>
+ #include <wctype.h>
+ #include "config.h"
+-#ifndef	USE_TERMCAP
+-#ifndef	sun
+-#include <curses.h>
+-#include <term.h>
+-#endif
+-#else	/* USE_TERMCAP */
+-#include <termcap.h>
+-#endif	/* USE_TERMCAP */
+ 
+ #ifdef	_AIX
+ #include <sys/sysmacros.h>
+@@ -989,13 +980,6 @@ printname(const char *name, struct file *f, int doit)
+ 			bold++;
+ 		}
+ 		if (color) {
+-#ifndef	USE_TERMCAP
+-			if (bold)
+-				vidattr(A_BOLD);
+-#else	/* USE_TERMCAP */
+-			if (Bold)
+-				tputs(Bold, 1, putchar);
+-#endif	/* USE_TERMCAP */
+ 			printf(color);
+ 		}
+ 	}
+@@ -1056,13 +1040,6 @@ printname(const char *name, struct file *f, int doit)
+ 		}
+ 	}
+ 	if (doit && color) {
+-#if !defined (USE_TERMCAP)
+-		if (bold)
+-			vidattr(A_NORMAL);
+-#else	/* USE_TERMCAP */
+-		if (Normal)
+-			tputs(Normal, 1, putchar);
+-#endif	/* USE_TERMCAP */
+ 		printf(fc_get(FC_NORMAL));
+ 	}
+ 	if (f)
+@@ -1598,16 +1575,12 @@ main(int argc, char **argv)
+ {
+ 	struct file *flist = nil, **aflist = &flist;
+ 	enum depth depth;
+-	struct winsize ws;
+ 	int i;
+ 	char *cp;
+ 
+ #ifdef	__GLIBC__
+ 	putenv("POSIXLY_CORRECT=1");
+ #endif
+-	setlocale(LC_COLLATE, "");
+-	setlocale(LC_CTYPE, "");
+-	setlocale(LC_TIME, "");
+ #ifndef	UCB
+ 	if (getenv("SYSV3") != NULL)
+ 		sysv3 = 1;
+@@ -1624,16 +1597,6 @@ main(int argc, char **argv)
+ 	}
+ 	if (istty || isatty(1)) {
+ 		istty = 1;
+-#if !defined (USE_TERMCAP)
+-		setupterm(NULL, 1, &tinfostat);
+-#else	/* USE_TERMCAP */
+-		{
+-			char	buf[2048];
+-			if ((cp = getenv("TERM")) != NULL)
+-				if (tgetent(buf, cp) > 0)
+-					tinfostat = 1;
+-		}
+-#endif	/* USE_TERMCAP */
+ 		field |= FL_STATUS;
+ 	}
+ 	while ((i = getopt(argc, argv, personalities[personality].per_opt))
+@@ -1753,12 +1716,6 @@ main(int argc, char **argv)
+ 	if ((cp = getenv("COLUMNS")) != NULL) {
+ 		ncols = atoi(cp);
+ 	} else if ((present('C') || present('x') || present('m')) && istty) {
+-		if (ioctl(1, TIOCGWINSZ, &ws) == 0 && ws.ws_col > 0)
+-			ncols = ws.ws_col - 1;
+-#if !defined (USE_TERMCAP)
+-		else if (tinfostat == 1 && columns > 0)
+-			ncols = columns;
+-#endif	/* !USE_TERMCAP */
+ 	}
+ 	depth = SURFACE;
+ 	if (optind == argc) {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/utime.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/utime.patch
new file mode 100644
index 00000000000..081ac9d2ee3
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/utime.patch
@@ -0,0 +1,90 @@
+--- copy/copy.c
++++ copy/copy.c
+@@ -46,7 +46,6 @@ static const char sccsid[] USED = "@(#)copy.sl	1.15 (gritter) 5/29/05";
+ #include <libgen.h>
+ #include <limits.h>
+ #include <dirent.h>
+-#include <utime.h>
+ #include <stdarg.h>
+ #include "sfile.h"
+ #include "memalign.h"
+@@ -441,12 +440,6 @@ attribs(const char *dst, const struct stat *sp)
+ 	if (oflag && ((sp->st_mode&S_IFMT) == S_IFLNK ?
+ 			lchown:chown)(dst, sp->st_uid, sp->st_gid) < 0)
+ 		complain("Unable to chown %s", dst);
+-	if (mflag && (sp->st_mode&S_IFMT) != S_IFLNK) {
+-		struct utimbuf	ut;
+-		ut.actime = sp->st_atime;
+-		ut.modtime = sp->st_mtime;
+-		utime(dst, &ut);
+-	}
+ }
+ 
+ static void
+--- cp/cp.c
++++ cp/cp.c
+@@ -56,7 +56,6 @@ static const char sccsid[] USED = "@(#)cp.sl	1.84 (gritter) 3/4/06";
+ #include	<libgen.h>
+ #include	<limits.h>
+ #include	<dirent.h>
+-#include	<utime.h>
+ #include	"sfile.h"
+ #include	"memalign.h"
+ #include	"alloca.h"
+@@ -354,18 +353,6 @@ permissions(const char *path, const struct stat *ssp)
+ 
+ 	mode = ssp->st_mode & 07777;
+ 	if (pflag) {
+-		struct utimbuf ut;
+-		ut.actime = ssp->st_atime;
+-		ut.modtime = ssp->st_mtime;
+-		if (utime(path, &ut) < 0) {
+-#if defined (SUS) || defined (S42)
+-			fprintf(stderr, "%s: cannot set times for %s\n%s: %s\n",
+-					progname, path,
+-					progname, strerror(errno));
+-#endif /* SUS || S42 */
+-			if (pers != PERS_MV)
+-				errcnt |= 010;
+-		}
+ 		if (myuid == 0) {
+ 			if (chown(path, ssp->st_uid, ssp->st_gid) < 0) {
+ #if defined (SUS) || defined (S42)
+--- touch/touch.c
++++ touch/touch.c
+@@ -47,7 +47,6 @@ static const char sccsid[] USED = "@(#)touch.sl	1.21 (gritter) 5/29/05";
+ #include	<stdlib.h>
+ #include	<errno.h>
+ #include	<libgen.h>
+-#include	<utime.h>
+ #include	<ctype.h>
+ #include	<time.h>
+ 
+@@ -80,7 +79,6 @@ static void
+ touch(const char *fn)
+ {
+ 	struct stat st;
+-	struct utimbuf ut;
+ 
+ 	if (stat(fn, &st) < 0) {
+ 		if (errno == ENOENT) {
+@@ -113,19 +111,6 @@ touch(const char *fn)
+ 			return;
+ 		}
+ 	}
+-	if (aflag)
+-		ut.actime = nacc;
+-	else
+-		ut.actime = st.st_atime;
+-	if (mflag)
+-		ut.modtime = nmod;
+-	else
+-		ut.modtime = st.st_mtime;
+-	if (utime(fn, nulltime ? NULL : &ut) < 0) {
+-		fprintf(stderr, "%s: cannot change times on %s\n",
+-				progname, fn);
+-		errcnt++;
+-	}
+ }
+ 
+ static void
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/heirloom/vprintf.patch b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/vprintf.patch
new file mode 100644
index 00000000000..6abce89b2f3
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/heirloom/vprintf.patch
@@ -0,0 +1,128 @@
+--- cksum/cksum.c
++++ cksum/cksum.c
+@@ -147,7 +147,7 @@ cksum(const char *name)
+ 		s = (s << 8) ^ crctab[(s >> 24) ^ c];
+ 	}
+ 	s = ~s;
+-	printf("%u %llu", (unsigned)s, nbytes);
++	printf("%u %lu", (unsigned)s, nbytes);
+ 	if(name)
+ 		printf(" %s", name);
+ 	printf("\n");
+--- cmp/cmp.c
++++ cmp/cmp.c
+@@ -246,8 +246,8 @@ different:
+ 				errcnt = 1;
+ 			} else {
+ 				if (sflag == 0)
+-					printf("%s %s differ: char %lld,"
+-							" line %lld\n",
++					printf("%s %s differ: char %ld,"
++							" line %ld\n",
+ 						f1->f_nam, f2->f_nam,
+ 						(long long)offset(f1),
+ 						line);
+--- csplit/csplit.c
++++ csplit/csplit.c
+@@ -284,7 +284,7 @@ csplit(const char *fn)
+ 				op = nextfile();
+ 			if (op) {
+ 				if (!sflag)
+-					printf("%lld\n", bytes);
++					printf("%ld\n", bytes);
+ 				bytes = 0;
+ 				fclose(op);
+ 			}
+--- expr/expr.y
++++ expr/expr.y
+@@ -140,7 +140,7 @@ expression:	expr NOARG {
+ 			if (sus && numeric($1)) {
+ 				int64_t	n;
+ 				n = atoll($1);
+-				printf("%lld\n", n);
++				printf("%ld\n", n);
+ 				exit(n == 0);
+ 			} else
+ 				puts($1);
+@@ -447,10 +447,10 @@ numpr(int64_t val)
+ 	int	ret;
+ 
+ 	rv = smalloc(NUMSZ);
+-	ret = snprintf(rv, NUMSZ, "%lld", (long long)val);
++	ret = snprintf(rv, NUMSZ, "%ld", (long long)val);
+ 	if (ret < 0 || ret >= NUMSZ) {
+ 		rv = srealloc(rv, ret + 1);
+-		ret = snprintf(rv, ret, "%lld", (long long)val);
++		ret = snprintf(rv, ret, "%ld", (long long)val);
+ 		if (ret < 0)
+ 			yyerror("illegal number");
+ 	}
+--- grep/Makefile.mk
++++ grep/Makefile.mk
+@@ -92,7 +92,7 @@ config.h:
+ 	-echo 'long long foo;' >___build$$$$.c ; \
+ 	$(CC) $(CFLAGS2) $(CPPFLAGS) $(IWCHAR) $(ICOMMON) $(IUXRE) $(LARGEF) -c ___build$$$$.c >/dev/null 2>&1 ; \
+ 	if test $$? = 0 && test -f ___build$$$$.o ; \
+-	then	echo '#define	LONGLONG' >>config.h ; \
++	then	echo '' >>config.h ; \
+ 	fi ; \
+ 	rm -f ___build$$$$.o ___build$$$$.c
+ 
+--- ls/Makefile.mk
++++ ls/Makefile.mk
+@@ -76,7 +76,7 @@ config.h:
+ 	-echo 'long long foo;' >___build$$$$.c ; \
+ 	$(CC) $(CFLAGS) $(CPPFLAGS) $(LARGEF) $(IWCHAR) -c ___build$$$$.c >/dev/null 2>&1 ; \
+ 	if test $$? = 0 && test -f ___build$$$$.o ; \
+-	then	echo '#define	LONGLONG' >>config.h ; \
++	then	echo '' >>config.h ; \
+ 	fi ; \
+ 	rm -f ___build$$$$.o ___build$$$$.c
+ 	-echo '#include <sys/types.h>' >___build$$$$.c ; \
+--- pr/pr.c
++++ pr/pr.c
+@@ -548,7 +548,7 @@ print(const char *fp, const char **argp)
+ 			putcs("  ");
+ 			putcs(header);
+ 			snprintf(linebuf, sizeof linebuf,
+-					" Page %lld\n\n\n", page);
++					" Page %ld\n\n\n", page);
+ 			putcs(linebuf);
+ 		}
+ 		c = putpage();
+--- sed/sed1.c
++++ sed/sed1.c
+@@ -489,7 +489,7 @@ command(struct reptr *ipc)
+ 			break;
+ 
+ 		case EQCOM:
+-			fprintf(stdout, "%lld\n", lnum);
++			fprintf(stdout, "%ld\n", lnum);
+ 			break;
+ 
+ 		case GCOM:
+--- sum/sum.c
++++ sum/sum.c
+@@ -116,7 +116,7 @@ sum(const char *name)
+ 	else {
+ 		s = (s & 0xFFFF) + (s >> 16);
+ 		s = (s & 0xFFFF) + (s >> 16);
+-		printf("%u %llu", (unsigned)s,
++		printf("%u %lu", (unsigned)s,
+ 				(unsigned long long)(nbytes+UNIT-1)/UNIT);
+ 	}
+ 	if(name)
+--- wc/wc.c
++++ wc/wc.c
+@@ -89,9 +89,9 @@ report(unsigned long long count)
+ #if defined (S42)
+ 	if (putspace++)
+ 		printf(" ");
+-	printf("%llu", count);
++	printf("%lu", count);
+ #else	/* !S42 */
+-	printf("%7llu ", count);
++	printf("%7lu ", count);
+ #endif	/* !S42 */
+ }
+ 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix
new file mode 100644
index 00000000000..6addd11554d
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/linux-headers/default.nix
@@ -0,0 +1,49 @@
+{ lib
+, fetchurl
+, bash
+, gnutar
+, xz
+}:
+let
+  # WARNING: You probably don't want to use this package outside minimal-bootstrap
+  #
+  # We need some set of Linux kernel headers to build our bootstrap packages
+  # (gcc/binutils/glibc etc.) against. As long as it compiles it is "good enough".
+  # Therefore the requirement for correctness, completeness, platform-specific
+  # features, and being up-to-date, are very loose.
+  #
+  # Rebuilding the Linux headers from source correctly is something we can defer
+  # till we have access to gcc/binutils/perl. For now we can use Guix's assembled
+  # kernel header distribution and assume it's good enough.
+  pname = "linux-headers";
+  version = "4.14.67";
+
+  src = fetchurl {
+    url = "mirror://gnu/gnu/guix/bootstrap/i686-linux/20190815/linux-libre-headers-stripped-4.14.67-i686-linux.tar.xz";
+    sha256 = "0sm2z9x4wk45bh6qfs94p0w1d6hsy6dqx9sw38qsqbvxwa1qzk8s";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gnutar
+    xz
+  ];
+
+  meta = with lib; {
+    description = "Header files and scripts for Linux kernel";
+    license = licenses.gpl2;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.linux;
+  };
+} ''
+  # Unpack
+  cp ${src} linux-headers.tar.xz
+  unxz linux-headers.tar.xz
+  tar xf linux-headers.tar
+
+  # Install
+  mkdir $out
+  cp -r include $out
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
new file mode 100644
index 00000000000..c24504ec00a
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
@@ -0,0 +1,28 @@
+{ lib
+, kaem
+, mes
+}:
+let
+  pname = "ln-boot";
+  version = "unstable-2023-05-22";
+
+  src = ./ln.c;
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  meta = with lib; {
+    description = "Basic tool for creating symbolic links";
+    license = licenses.mit;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "ln";
+    platforms = platforms.unix;
+  };
+} ''
+  mkdir -p ''${out}/bin
+  ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+    -L ${mes.libs}/lib \
+    -lc+tcc \
+    -o ''${out}/bin/ln \
+    ${src}
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c b/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c
new file mode 100644
index 00000000000..b7a681f8270
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/ln.c
@@ -0,0 +1,17 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+
+int main(int argc, char** argv)
+{
+  if (argc != 4 || strcmp(argv[1], "-s")) {
+    fputs("Usage: ", stdout);
+    fputs(argv[0], stdout);
+    fputs(" -s TARGET LINK_NAME\n", stdout);
+    exit(EXIT_FAILURE);
+  }
+
+  symlink(argv[2], argv[3]);
+  exit(EXIT_SUCCESS);
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
new file mode 100644
index 00000000000..0cf66c5bc23
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
@@ -0,0 +1,237 @@
+{ lib
+, fetchurl
+, callPackage
+, kaem
+, m2libc
+, mescc-tools
+}:
+
+# Maintenance note:
+# Build steps have been adapted from build-aux/bootstrap.sh.in
+# as well as the live-bootstrap project
+# https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/mes-0.24.2/mes-0.24.2.kaem
+
+let
+  pname = "mes";
+  version = "0.24.2";
+
+  src = fetchurl {
+    url = "mirror://gnu/mes/mes-${version}.tar.gz";
+    sha256 = "0vp8v88zszh1imm3dvdfi3m8cywshdj7xcrsq4cgmss69s2y1nkx";
+  };
+
+  nyacc = callPackage ./nyacc.nix { inherit nyacc; };
+
+  config_h = builtins.toFile "config.h" ''
+    #undef SYSTEM_LIBC
+    #define MES_VERSION "${version}"
+  '';
+
+  sources = (import ./sources.nix).x86.linux.mescc;
+  inherit (sources) libc_mini_SOURCES libmescc_SOURCES libc_SOURCES mes_SOURCES;
+
+  # add symlink() to libc+tcc so we can use it in ln-boot
+  libc_tcc_SOURCES = sources.libc_tcc_SOURCES ++ [ "lib/linux/symlink.c" ];
+
+  meta = with lib; {
+    description = "Scheme interpreter and C compiler for bootstrapping";
+    homepage = "https://www.gnu.org/software/mes";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  srcPost = kaem.runCommand "${pname}-src-${version}" {
+    outputs = [ "out" "bin" ];
+    inherit meta;
+  } ''
+    # Unpack source
+    ungz --file ${src} --output mes.tar
+    mkdir ''${out}
+    cd ''${out}
+    untar --non-strict --file ''${NIX_BUILD_TOP}/mes.tar # ignore symlinks
+
+    MES_PREFIX=''${out}/mes-${version}
+
+    cd ''${MES_PREFIX}
+
+    cp ${config_h} include/mes/config.h
+
+    mkdir include/arch
+    cp include/linux/x86/syscall.h include/arch/syscall.h
+    cp include/linux/x86/kernel-stat.h include/arch/kernel-stat.h
+
+    # Remove pregenerated files
+    rm mes/module/mes/psyntax.pp mes/module/mes/psyntax.pp.header
+
+    # These files are symlinked in the repo
+    cp mes/module/srfi/srfi-9-struct.mes mes/module/srfi/srfi-9.mes
+    cp mes/module/srfi/srfi-9/gnu-struct.mes mes/module/srfi/srfi-9/gnu.mes
+
+    # Fixes to support newer M2-Planet
+    catm x86_defs.M1 ${m2libc}/x86/x86_defs.M1 lib/m2/x86/x86_defs.M1
+    cp x86_defs.M1 lib/m2/x86/x86_defs.M1
+    rm x86_defs.M1
+
+    # Remove environment impurities
+    __GUILE_LOAD_PATH="\"''${MES_PREFIX}/mes/module:''${MES_PREFIX}/module:${nyacc.guilePath}\""
+    boot0_scm=mes/module/mes/boot-0.scm
+    guile_mes=mes/module/mes/guile.mes
+    replace --file ''${boot0_scm} --output ''${boot0_scm} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
+    replace --file ''${guile_mes} --output ''${guile_mes} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
+
+    module_mescc_scm=module/mescc/mescc.scm
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"M1\")" --replace-with "\"${mescc-tools}/bin/M1\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"HEX2\")" --replace-with "\"${mescc-tools}/bin/hex2\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"BLOOD_ELF\")" --replace-with "\"${mescc-tools}/bin/blood-elf\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
+
+    mes_c=src/mes.c
+    replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
+    replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
+
+    # Increase runtime resource limits
+    gc_c=src/gc.c
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_ARENA\")" --replace-with "\"100000000\""
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_MAX_ARENA\")" --replace-with "\"100000000\""
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_STACK\")" --replace-with "\"6000000\""
+
+    # Create mescc.scm
+    mescc_in=scripts/mescc.scm.in
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"includedir\")" --replace-with "\"''${MES_PREFIX}/include\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"libdir\")" --replace-with "\"''${MES_PREFIX}/lib\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @prefix@ --replace-with ''${MES_PREFIX}
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @VERSION@ --replace-with ${version}
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_cpu@ --replace-with x86
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_kernel@ --replace-with linux
+    mkdir -p ''${bin}/bin
+    cp ''${mescc_in} ''${bin}/bin/mescc.scm
+
+    # Build mes-m2
+    mes_cpu=x86
+    stage0_cpu=x86
+    kaem --verbose --strict --file kaem.run
+    cp bin/mes-m2 ''${bin}/bin/mes-m2
+    chmod 555 ''${bin}/bin/mes-m2
+  '';
+
+  srcPrefix = "${srcPost.out}/mes-${version}";
+
+  cc = "${srcPost.bin}/bin/mes-m2";
+  ccArgs = [
+    "-e" "main"
+    "${srcPost.bin}/bin/mescc.scm"
+    "--"
+    "-D" "HAVE_CONFIG_H=1"
+    "-I" "${srcPrefix}/include"
+    "-I" "${srcPrefix}/include/linux/x86"
+  ];
+
+  CC = toString ([ cc ] ++ ccArgs);
+
+  stripExt = source:
+    lib.replaceStrings
+      [ ".c" ]
+      [ "" ]
+      (builtins.baseNameOf source);
+
+  compile = source: kaem.runCommand (stripExt source) {} ''
+    mkdir ''${out}
+    cd ''${out}
+    ${CC} -c ${srcPrefix}/${source}
+  '';
+
+  crt1 = compile "/lib/linux/x86-mes-mescc/crt1.c";
+
+  getRes = suffix: res: "${res}/${res.name}${suffix}";
+
+  archive = out: sources:
+    "catm ${out} ${lib.concatMapStringsSep " " (getRes ".o") sources}";
+  sourceArchive = out: sources:
+    "catm ${out} ${lib.concatMapStringsSep " " (getRes ".s") sources}";
+
+  mkLib = libname: sources: let
+    os = map compile sources;
+  in kaem.runCommand "${pname}-${libname}-${version}" {
+    inherit meta;
+  } ''
+    LIBDIR=''${out}/lib
+    mkdir -p ''${LIBDIR}
+    cd ''${LIBDIR}
+
+    ${archive "${libname}.a" os}
+    ${sourceArchive "${libname}.s" os}
+  '';
+
+  libc-mini = mkLib "libc-mini" libc_mini_SOURCES;
+  libmescc = mkLib "libmescc" libmescc_SOURCES;
+  libc = mkLib "libc" libc_SOURCES;
+  libc_tcc = mkLib "libc+tcc" libc_tcc_SOURCES;
+
+  # Recompile Mes and Mes C library using mes-m2 bootstrapped Mes
+  libs = kaem.runCommand "${pname}-m2-libs-${version}" {
+    inherit pname version;
+
+    passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/mes --version
+      mkdir ''${out}
+    '';
+
+    inherit meta;
+  }
+  ''
+    LIBDIR=''${out}/lib
+    mkdir -p ''${out} ''${LIBDIR}
+
+    mkdir -p ''${LIBDIR}/x86-mes
+
+    # crt1.o
+    cp ${crt1}/crt1.o ''${LIBDIR}/x86-mes
+    cp ${crt1}/crt1.s ''${LIBDIR}/x86-mes
+
+    # libc-mini.a
+    cp ${libc-mini}/lib/libc-mini.a ''${LIBDIR}/x86-mes
+    cp ${libc-mini}/lib/libc-mini.s ''${LIBDIR}/x86-mes
+
+    # libmescc.a
+    cp ${libmescc}/lib/libmescc.a ''${LIBDIR}/x86-mes
+    cp ${libmescc}/lib/libmescc.s ''${LIBDIR}/x86-mes
+
+    # libc.a
+    cp ${libc}/lib/libc.a ''${LIBDIR}/x86-mes
+    cp ${libc}/lib/libc.s ''${LIBDIR}/x86-mes
+
+    # libc+tcc.a
+    cp ${libc_tcc}/lib/libc+tcc.a ''${LIBDIR}/x86-mes
+    cp ${libc_tcc}/lib/libc+tcc.s ''${LIBDIR}/x86-mes
+  '';
+
+  # Build mes itself
+  compiler = kaem.runCommand "${pname}-${version}" {
+    inherit pname version;
+
+    passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/mes --version
+      mkdir ''${out}
+    '';
+
+    inherit meta;
+  }
+  ''
+    mkdir -p ''${out}/bin
+
+    ${srcPost.bin}/bin/mes-m2 -e main ${srcPost.bin}/bin/mescc.scm -- \
+      -L ''${srcPrefix}/lib \
+      -L ${libs}/lib \
+      -lc \
+      -lmescc \
+      -nostdlib \
+      -o ''${out}/bin/mes \
+      ${libs}/lib/x86-mes/crt1.o \
+      ${lib.concatMapStringsSep " " (getRes ".o") (map compile mes_SOURCES)}
+  '';
+in {
+  inherit srcPost srcPrefix nyacc;
+  inherit compiler libs;
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh b/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
new file mode 100755
index 00000000000..3a734129c1f
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/gen-sources.sh
@@ -0,0 +1,95 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash coreutils gnutar
+
+# Generate a sources.nix for a version of GNU mes. Creates lists of source files
+# from build-aux/configure-lib.sh.
+#
+# You may point this tool at a manually downloaded tarball, but more ideal is
+# using the source tarball from Nixpkgs. For example:
+#
+# MES_TARBALL="$(nix-build --no-link -A minimal-bootstrap.mes.src ../../../../..)"
+# ./gen-sources.sh "$MES_TARBALL" > ./new-sources.nix
+
+set -eu
+
+# Supported platforms
+ARCHS="x86"
+KERNELS="linux"
+COMPILERS="mescc gcc"
+
+
+format() {
+  echo -n "[ "
+  # Terrible hack to convert a newline-delimited string to space-delimited
+  echo $* | xargs printf '"%s" '
+  echo -n "]"
+}
+
+gen_sources() {
+  # Configuration variables used by configure-lib.sh
+  export mes_libc=mes
+  export mes_cpu=$1
+  export mes_kernel=$2
+  export compiler=$3
+
+  # Populate source file lists
+  source $CONFIGURE_LIB_SH
+
+  cat <<EOF
+  $mes_cpu.$mes_kernel.$compiler = {
+    libc_mini_SOURCES = $(format $libc_mini_SOURCES);
+    libmescc_SOURCES  = $(format $libmescc_SOURCES);
+    libtcc1_SOURCES   = $(format $libtcc1_SOURCES);
+    libc_SOURCES      = $(format $libc_SOURCES);
+    libc_tcc_SOURCES  = $(format $libc_tcc_SOURCES);
+    libc_gnu_SOURCES  = $(format $libc_gnu_SOURCES);
+    mes_SOURCES       = $(format $mes_SOURCES);
+  };
+EOF
+}
+
+
+MES_TARBALL=$1
+if [ ! -f $MES_TARBALL ]; then
+    echo "Provide path to mes-x.x.x.tar.gz as first argument" >&2
+    exit 1
+fi
+echo "Generating sources.nix from $MES_TARBALL" >&2
+
+TMP=$(mktemp -d)
+cd $TMP
+echo "Workdir: $TMP" >&2
+
+echo "Extracting $MES_TARBALL" >&2
+tar --strip-components 1 -xf $MES_TARBALL
+
+CONFIGURE_LIB_SH="$TMP/build-aux/configure-lib.sh"
+if [ ! -f $CONFIGURE_LIB_SH ]; then
+    echo "Could not find mes's configure-lib.sh script at $CONFIGURE_LIB_SH" >&2
+    exit 1
+fi
+
+# Create dummy config expected by configure-lib.sh
+touch config.sh
+chmod +x config.sh
+
+
+echo "Configuring with $CONFIGURE_LIB_SH" >&2
+
+cat <<EOF
+# This file is generated by ./gen-sources.sh.
+# Do not edit!
+{
+EOF
+
+for arch in $ARCHS; do
+  for kernel in $KERNELS; do
+    for compiler in $COMPILERS; do
+      gen_sources $arch $kernel $compiler
+    done
+  done
+done
+
+cat <<EOF
+}
+EOF
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
new file mode 100644
index 00000000000..807d043fa9e
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
@@ -0,0 +1,60 @@
+{ lib
+, kaem
+, ln-boot
+, mes
+, mes-libc
+}:
+let
+  pname = "mes-libc";
+  inherit (mes.compiler) version;
+
+  sources = (import ./sources.nix).x86.linux.gcc;
+  inherit (sources) libtcc1_SOURCES libc_gnu_SOURCES;
+
+  # Concatenate all source files into a convenient bundle
+  # "gcc" variants of source files (eg. "lib/linux/x86-mes-gcc") can also be
+  # compiled by tinycc
+  #
+  # Passing this many arguments is too much for kaem so we need to split
+  # the operation in two
+  firstLibc = lib.take 100 libc_gnu_SOURCES;
+  lastLibc = lib.drop 100 libc_gnu_SOURCES;
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [ ln-boot ];
+
+  passthru.CFLAGS = "-DHAVE_CONFIG_H=1 -I${mes-libc}/include -I${mes-libc}/include/linux/x86";
+
+  meta = with lib; {
+    description = "The Mes C Library";
+    homepage = "https://www.gnu.org/software/mes";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+} ''
+  cd ${mes.srcPrefix}
+
+  # mescc compiled libc.a
+  mkdir -p ''${out}/lib/x86-mes
+
+  # libc.c
+  catm ''${TMPDIR}/first.c ${lib.concatStringsSep " " firstLibc}
+  catm ''${out}/lib/libc.c ''${TMPDIR}/first.c ${lib.concatStringsSep " " lastLibc}
+
+  # crt{1,n,i}.c
+  cp lib/linux/x86-mes-gcc/crt1.c ''${out}/lib
+  cp lib/linux/x86-mes-gcc/crtn.c ''${out}/lib
+  cp lib/linux/x86-mes-gcc/crti.c ''${out}/lib
+
+  # libtcc1.c
+  catm ''${out}/lib/libtcc1.c ${lib.concatStringsSep " " libtcc1_SOURCES}
+
+  # getopt.c
+  cp lib/posix/getopt.c ''${out}/lib/libgetopt.c
+
+  # Install headers
+  ln -s ${mes.srcPrefix}/include ''${out}/include
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
new file mode 100644
index 00000000000..ed402cbaacf
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
@@ -0,0 +1,39 @@
+{ lib
+, fetchurl
+, kaem
+, nyacc
+}:
+let
+  pname = "nyacc";
+  # NYACC is a tightly coupled dependency of mes. This version is known to work
+  # with mes 0.24.2.
+  # https://git.savannah.gnu.org/cgit/mes.git/tree/INSTALL?h=v0.24.2&id=7562330ec746f09b4060d3081e3377fb7083897d#n31
+  version = "1.00.2";
+
+  src = fetchurl {
+    url = "mirror://savannah/nyacc/nyacc-${version}.tar.gz";
+    sha256 = "065ksalfllbdrzl12dz9d9dcxrv97wqxblslngsc6kajvnvlyvpk";
+  };
+in
+kaem.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  passthru.guilePath = "${nyacc}/share/${pname}-${version}/module";
+
+  meta = with lib; {
+    description = "Modules for generating parsers and lexical analyzers";
+    longDescription = ''
+      Not Yet Another Compiler Compiler is a set of guile modules for
+      generating computer language parsers and lexical analyzers.
+    '';
+    homepage = "https://savannah.nongnu.org/projects/nyacc";
+    license = licenses.lgpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.all;
+  };
+} ''
+  ungz --file ${src} --output nyacc.tar
+  mkdir -p ''${out}/share
+  cd ''${out}/share
+  untar --file ''${NIX_BUILD_TOP}/nyacc.tar
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix
new file mode 100644
index 00000000000..ac534284346
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/sources.nix
@@ -0,0 +1,22 @@
+# This file is generated by ./gen-sources.sh.
+# Do not edit!
+{
+  x86.linux.mescc = {
+    libc_mini_SOURCES = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-mescc/_exit.c" "lib/linux/x86-mes-mescc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/mes/mini-write.c" ];
+    libmescc_SOURCES  = [ "lib/mes/globals.c" "lib/linux/x86-mes-mescc/syscall-internal.c" ];
+    libtcc1_SOURCES   = [ "lib/libtcc1.c" ];
+    libc_SOURCES      = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-mescc/_exit.c" "lib/linux/x86-mes-mescc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-mescc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" ];
+    libc_tcc_SOURCES  = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-mescc/_exit.c" "lib/linux/x86-mes-mescc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-mescc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" "lib/ctype/islower.c" "lib/ctype/isupper.c" "lib/ctype/tolower.c" "lib/ctype/toupper.c" "lib/mes/abtod.c" "lib/mes/dtoab.c" "lib/mes/search-path.c" "lib/posix/execvp.c" "lib/stdio/fclose.c" "lib/stdio/fdopen.c" "lib/stdio/ferror.c" "lib/stdio/fflush.c" "lib/stdio/fopen.c" "lib/stdio/fprintf.c" "lib/stdio/fread.c" "lib/stdio/fseek.c" "lib/stdio/ftell.c" "lib/stdio/fwrite.c" "lib/stdio/printf.c" "lib/stdio/remove.c" "lib/stdio/snprintf.c" "lib/stdio/sprintf.c" "lib/stdio/sscanf.c" "lib/stdio/vfprintf.c" "lib/stdio/vprintf.c" "lib/stdio/vsnprintf.c" "lib/stdio/vsprintf.c" "lib/stdio/vsscanf.c" "lib/stdlib/calloc.c" "lib/stdlib/qsort.c" "lib/stdlib/strtod.c" "lib/stdlib/strtof.c" "lib/stdlib/strtol.c" "lib/stdlib/strtold.c" "lib/stdlib/strtoll.c" "lib/stdlib/strtoul.c" "lib/stdlib/strtoull.c" "lib/string/memmem.c" "lib/string/strcat.c" "lib/string/strchr.c" "lib/string/strlwr.c" "lib/string/strncpy.c" "lib/string/strrchr.c" "lib/string/strstr.c" "lib/string/strupr.c" "lib/stub/sigaction.c" "lib/stub/ldexp.c" "lib/stub/mprotect.c" "lib/stub/localtime.c" "lib/stub/sigemptyset.c" "lib/x86-mes-mescc/setjmp.c" "lib/linux/close.c" "lib/linux/rmdir.c" "lib/linux/stat.c" ];
+    libc_gnu_SOURCES  = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-mescc/_exit.c" "lib/linux/x86-mes-mescc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-mescc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" "lib/ctype/islower.c" "lib/ctype/isupper.c" "lib/ctype/tolower.c" "lib/ctype/toupper.c" "lib/mes/abtod.c" "lib/mes/dtoab.c" "lib/mes/search-path.c" "lib/posix/execvp.c" "lib/stdio/fclose.c" "lib/stdio/fdopen.c" "lib/stdio/ferror.c" "lib/stdio/fflush.c" "lib/stdio/fopen.c" "lib/stdio/fprintf.c" "lib/stdio/fread.c" "lib/stdio/fseek.c" "lib/stdio/ftell.c" "lib/stdio/fwrite.c" "lib/stdio/printf.c" "lib/stdio/remove.c" "lib/stdio/snprintf.c" "lib/stdio/sprintf.c" "lib/stdio/sscanf.c" "lib/stdio/vfprintf.c" "lib/stdio/vprintf.c" "lib/stdio/vsnprintf.c" "lib/stdio/vsprintf.c" "lib/stdio/vsscanf.c" "lib/stdlib/calloc.c" "lib/stdlib/qsort.c" "lib/stdlib/strtod.c" "lib/stdlib/strtof.c" "lib/stdlib/strtol.c" "lib/stdlib/strtold.c" "lib/stdlib/strtoll.c" "lib/stdlib/strtoul.c" "lib/stdlib/strtoull.c" "lib/string/memmem.c" "lib/string/strcat.c" "lib/string/strchr.c" "lib/string/strlwr.c" "lib/string/strncpy.c" "lib/string/strrchr.c" "lib/string/strstr.c" "lib/string/strupr.c" "lib/stub/sigaction.c" "lib/stub/ldexp.c" "lib/stub/mprotect.c" "lib/stub/localtime.c" "lib/stub/sigemptyset.c" "lib/x86-mes-mescc/setjmp.c" "lib/linux/close.c" "lib/linux/rmdir.c" "lib/linux/stat.c" "lib/ctype/isalnum.c" "lib/ctype/isalpha.c" "lib/ctype/isascii.c" "lib/ctype/iscntrl.c" "lib/ctype/isgraph.c" "lib/ctype/isprint.c" "lib/ctype/ispunct.c" "lib/dirent/__getdirentries.c" "lib/dirent/closedir.c" "lib/dirent/opendir.c" "lib/dirent/readdir.c" "lib/math/ceil.c" "lib/math/fabs.c" "lib/math/floor.c" "lib/mes/fdgets.c" "lib/posix/alarm.c" "lib/posix/execl.c" "lib/posix/execlp.c" "lib/posix/mktemp.c" "lib/posix/sbrk.c" "lib/posix/sleep.c" "lib/posix/unsetenv.c" "lib/stdio/clearerr.c" "lib/stdio/feof.c" "lib/stdio/fgets.c" "lib/stdio/fileno.c" "lib/stdio/freopen.c" "lib/stdio/fscanf.c" "lib/stdio/perror.c" "lib/stdio/vfscanf.c" "lib/stdlib/__exit.c" "lib/stdlib/abort.c" "lib/stdlib/abs.c" "lib/stdlib/alloca.c" "lib/stdlib/atexit.c" "lib/stdlib/atof.c" "lib/stdlib/atol.c" "lib/stdlib/mbstowcs.c" "lib/string/bcmp.c" "lib/string/bcopy.c" "lib/string/bzero.c" "lib/string/index.c" "lib/string/rindex.c" "lib/string/strcspn.c" "lib/string/strdup.c" "lib/string/strerror.c" "lib/string/strncat.c" "lib/string/strpbrk.c" "lib/string/strspn.c" "lib/stub/__cleanup.c" "lib/stub/atan2.c" "lib/stub/bsearch.c" "lib/stub/chown.c" "lib/stub/cos.c" "lib/stub/ctime.c" "lib/stub/exp.c" "lib/stub/fpurge.c" "lib/stub/freadahead.c" "lib/stub/frexp.c" "lib/stub/getgrgid.c" "lib/stub/getgrnam.c" "lib/stub/getlogin.c" "lib/stub/getpgid.c" "lib/stub/getpgrp.c" "lib/stub/getpwnam.c" "lib/stub/getpwuid.c" "lib/stub/gmtime.c" "lib/stub/log.c" "lib/stub/mktime.c" "lib/stub/modf.c" "lib/stub/pclose.c" "lib/stub/popen.c" "lib/stub/pow.c" "lib/stub/rand.c" "lib/stub/rewind.c" "lib/stub/setbuf.c" "lib/stub/setgrent.c" "lib/stub/setlocale.c" "lib/stub/setvbuf.c" "lib/stub/sigaddset.c" "lib/stub/sigblock.c" "lib/stub/sigdelset.c" "lib/stub/sigsetmask.c" "lib/stub/sin.c" "lib/stub/sqrt.c" "lib/stub/strftime.c" "lib/stub/sys_siglist.c" "lib/stub/system.c" "lib/stub/times.c" "lib/stub/ttyname.c" "lib/stub/umask.c" "lib/stub/utime.c" "lib/linux/chdir.c" "lib/linux/fcntl.c" "lib/linux/fstat.c" "lib/linux/getdents.c" "lib/linux/getegid.c" "lib/linux/geteuid.c" "lib/linux/getgid.c" "lib/linux/getppid.c" "lib/linux/getrusage.c" "lib/linux/getuid.c" "lib/linux/ioctl.c" "lib/linux/link.c" "lib/linux/lstat.c" "lib/linux/mkdir.c" "lib/linux/mknod.c" "lib/linux/nanosleep.c" "lib/linux/pipe.c" "lib/linux/readlink.c" "lib/linux/rename.c" "lib/linux/setgid.c" "lib/linux/settimer.c" "lib/linux/setuid.c" "lib/linux/signal.c" "lib/linux/sigprogmask.c" "lib/linux/symlink.c" ];
+    mes_SOURCES       = [ "src/builtins.c" "src/cc.c" "src/core.c" "src/display.c" "src/eval-apply.c" "src/gc.c" "src/globals.c" "src/hash.c" "src/lib.c" "src/math.c" "src/mes.c" "src/module.c" "src/posix.c" "src/reader.c" "src/stack.c" "src/string.c" "src/struct.c" "src/symbol.c" "src/vector.c" ];
+  };
+  x86.linux.gcc = {
+    libc_mini_SOURCES = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-gcc/_exit.c" "lib/linux/x86-mes-gcc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/mes/mini-write.c" ];
+    libmescc_SOURCES  = [ "lib/mes/globals.c" "lib/linux/x86-mes-gcc/syscall-internal.c" ];
+    libtcc1_SOURCES   = [ "lib/libtcc1.c" ];
+    libc_SOURCES      = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-gcc/_exit.c" "lib/linux/x86-mes-gcc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-gcc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" ];
+    libc_tcc_SOURCES  = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-gcc/_exit.c" "lib/linux/x86-mes-gcc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-gcc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" "lib/ctype/islower.c" "lib/ctype/isupper.c" "lib/ctype/tolower.c" "lib/ctype/toupper.c" "lib/mes/abtod.c" "lib/mes/dtoab.c" "lib/mes/search-path.c" "lib/posix/execvp.c" "lib/stdio/fclose.c" "lib/stdio/fdopen.c" "lib/stdio/ferror.c" "lib/stdio/fflush.c" "lib/stdio/fopen.c" "lib/stdio/fprintf.c" "lib/stdio/fread.c" "lib/stdio/fseek.c" "lib/stdio/ftell.c" "lib/stdio/fwrite.c" "lib/stdio/printf.c" "lib/stdio/remove.c" "lib/stdio/snprintf.c" "lib/stdio/sprintf.c" "lib/stdio/sscanf.c" "lib/stdio/vfprintf.c" "lib/stdio/vprintf.c" "lib/stdio/vsnprintf.c" "lib/stdio/vsprintf.c" "lib/stdio/vsscanf.c" "lib/stdlib/calloc.c" "lib/stdlib/qsort.c" "lib/stdlib/strtod.c" "lib/stdlib/strtof.c" "lib/stdlib/strtol.c" "lib/stdlib/strtold.c" "lib/stdlib/strtoll.c" "lib/stdlib/strtoul.c" "lib/stdlib/strtoull.c" "lib/string/memmem.c" "lib/string/strcat.c" "lib/string/strchr.c" "lib/string/strlwr.c" "lib/string/strncpy.c" "lib/string/strrchr.c" "lib/string/strstr.c" "lib/string/strupr.c" "lib/stub/sigaction.c" "lib/stub/ldexp.c" "lib/stub/mprotect.c" "lib/stub/localtime.c" "lib/stub/sigemptyset.c" "lib/x86-mes-gcc/setjmp.c" "lib/linux/close.c" "lib/linux/rmdir.c" "lib/linux/stat.c" ];
+    libc_gnu_SOURCES  = [ "lib/mes/eputs.c" "lib/mes/oputs.c" "lib/mes/globals.c" "lib/stdlib/exit.c" "lib/linux/x86-mes-gcc/_exit.c" "lib/linux/x86-mes-gcc/_write.c" "lib/stdlib/puts.c" "lib/string/strlen.c" "lib/ctype/isnumber.c" "lib/mes/abtol.c" "lib/mes/cast.c" "lib/mes/eputc.c" "lib/mes/fdgetc.c" "lib/mes/fdputc.c" "lib/mes/fdputs.c" "lib/mes/fdungetc.c" "lib/mes/itoa.c" "lib/mes/ltoa.c" "lib/mes/ltoab.c" "lib/mes/mes_open.c" "lib/mes/ntoab.c" "lib/mes/oputc.c" "lib/mes/ultoa.c" "lib/mes/utoa.c" "lib/stub/__raise.c" "lib/ctype/isdigit.c" "lib/ctype/isspace.c" "lib/ctype/isxdigit.c" "lib/mes/assert_msg.c" "lib/posix/write.c" "lib/stdlib/atoi.c" "lib/linux/lseek.c" "lib/mes/__assert_fail.c" "lib/mes/__buffered_read.c" "lib/mes/__mes_debug.c" "lib/posix/execv.c" "lib/posix/getcwd.c" "lib/posix/getenv.c" "lib/posix/isatty.c" "lib/posix/open.c" "lib/posix/buffered-read.c" "lib/posix/setenv.c" "lib/posix/wait.c" "lib/stdio/fgetc.c" "lib/stdio/fputc.c" "lib/stdio/fputs.c" "lib/stdio/getc.c" "lib/stdio/getchar.c" "lib/stdio/putc.c" "lib/stdio/putchar.c" "lib/stdio/ungetc.c" "lib/stdlib/free.c" "lib/stdlib/realloc.c" "lib/string/memchr.c" "lib/string/memcmp.c" "lib/string/memcpy.c" "lib/string/memmove.c" "lib/string/memset.c" "lib/string/strcmp.c" "lib/string/strcpy.c" "lib/string/strncmp.c" "lib/posix/raise.c" "lib/linux/access.c" "lib/linux/brk.c" "lib/linux/chmod.c" "lib/linux/clock_gettime.c" "lib/linux/dup.c" "lib/linux/dup2.c" "lib/linux/execve.c" "lib/linux/fork.c" "lib/linux/fsync.c" "lib/linux/_getcwd.c" "lib/linux/gettimeofday.c" "lib/linux/ioctl3.c" "lib/linux/_open3.c" "lib/linux/malloc.c" "lib/linux/_read.c" "lib/linux/time.c" "lib/linux/unlink.c" "lib/linux/waitpid.c" "lib/linux/x86-mes-gcc/syscall.c" "lib/linux/getpid.c" "lib/linux/kill.c" "lib/ctype/islower.c" "lib/ctype/isupper.c" "lib/ctype/tolower.c" "lib/ctype/toupper.c" "lib/mes/abtod.c" "lib/mes/dtoab.c" "lib/mes/search-path.c" "lib/posix/execvp.c" "lib/stdio/fclose.c" "lib/stdio/fdopen.c" "lib/stdio/ferror.c" "lib/stdio/fflush.c" "lib/stdio/fopen.c" "lib/stdio/fprintf.c" "lib/stdio/fread.c" "lib/stdio/fseek.c" "lib/stdio/ftell.c" "lib/stdio/fwrite.c" "lib/stdio/printf.c" "lib/stdio/remove.c" "lib/stdio/snprintf.c" "lib/stdio/sprintf.c" "lib/stdio/sscanf.c" "lib/stdio/vfprintf.c" "lib/stdio/vprintf.c" "lib/stdio/vsnprintf.c" "lib/stdio/vsprintf.c" "lib/stdio/vsscanf.c" "lib/stdlib/calloc.c" "lib/stdlib/qsort.c" "lib/stdlib/strtod.c" "lib/stdlib/strtof.c" "lib/stdlib/strtol.c" "lib/stdlib/strtold.c" "lib/stdlib/strtoll.c" "lib/stdlib/strtoul.c" "lib/stdlib/strtoull.c" "lib/string/memmem.c" "lib/string/strcat.c" "lib/string/strchr.c" "lib/string/strlwr.c" "lib/string/strncpy.c" "lib/string/strrchr.c" "lib/string/strstr.c" "lib/string/strupr.c" "lib/stub/sigaction.c" "lib/stub/ldexp.c" "lib/stub/mprotect.c" "lib/stub/localtime.c" "lib/stub/sigemptyset.c" "lib/x86-mes-gcc/setjmp.c" "lib/linux/close.c" "lib/linux/rmdir.c" "lib/linux/stat.c" "lib/ctype/isalnum.c" "lib/ctype/isalpha.c" "lib/ctype/isascii.c" "lib/ctype/iscntrl.c" "lib/ctype/isgraph.c" "lib/ctype/isprint.c" "lib/ctype/ispunct.c" "lib/dirent/__getdirentries.c" "lib/dirent/closedir.c" "lib/dirent/opendir.c" "lib/dirent/readdir.c" "lib/math/ceil.c" "lib/math/fabs.c" "lib/math/floor.c" "lib/mes/fdgets.c" "lib/posix/alarm.c" "lib/posix/execl.c" "lib/posix/execlp.c" "lib/posix/mktemp.c" "lib/posix/sbrk.c" "lib/posix/sleep.c" "lib/posix/unsetenv.c" "lib/stdio/clearerr.c" "lib/stdio/feof.c" "lib/stdio/fgets.c" "lib/stdio/fileno.c" "lib/stdio/freopen.c" "lib/stdio/fscanf.c" "lib/stdio/perror.c" "lib/stdio/vfscanf.c" "lib/stdlib/__exit.c" "lib/stdlib/abort.c" "lib/stdlib/abs.c" "lib/stdlib/alloca.c" "lib/stdlib/atexit.c" "lib/stdlib/atof.c" "lib/stdlib/atol.c" "lib/stdlib/mbstowcs.c" "lib/string/bcmp.c" "lib/string/bcopy.c" "lib/string/bzero.c" "lib/string/index.c" "lib/string/rindex.c" "lib/string/strcspn.c" "lib/string/strdup.c" "lib/string/strerror.c" "lib/string/strncat.c" "lib/string/strpbrk.c" "lib/string/strspn.c" "lib/stub/__cleanup.c" "lib/stub/atan2.c" "lib/stub/bsearch.c" "lib/stub/chown.c" "lib/stub/cos.c" "lib/stub/ctime.c" "lib/stub/exp.c" "lib/stub/fpurge.c" "lib/stub/freadahead.c" "lib/stub/frexp.c" "lib/stub/getgrgid.c" "lib/stub/getgrnam.c" "lib/stub/getlogin.c" "lib/stub/getpgid.c" "lib/stub/getpgrp.c" "lib/stub/getpwnam.c" "lib/stub/getpwuid.c" "lib/stub/gmtime.c" "lib/stub/log.c" "lib/stub/mktime.c" "lib/stub/modf.c" "lib/stub/pclose.c" "lib/stub/popen.c" "lib/stub/pow.c" "lib/stub/rand.c" "lib/stub/rewind.c" "lib/stub/setbuf.c" "lib/stub/setgrent.c" "lib/stub/setlocale.c" "lib/stub/setvbuf.c" "lib/stub/sigaddset.c" "lib/stub/sigblock.c" "lib/stub/sigdelset.c" "lib/stub/sigsetmask.c" "lib/stub/sin.c" "lib/stub/sqrt.c" "lib/stub/strftime.c" "lib/stub/sys_siglist.c" "lib/stub/system.c" "lib/stub/times.c" "lib/stub/ttyname.c" "lib/stub/umask.c" "lib/stub/utime.c" "lib/linux/chdir.c" "lib/linux/fcntl.c" "lib/linux/fstat.c" "lib/linux/getdents.c" "lib/linux/getegid.c" "lib/linux/geteuid.c" "lib/linux/getgid.c" "lib/linux/getppid.c" "lib/linux/getrusage.c" "lib/linux/getuid.c" "lib/linux/ioctl.c" "lib/linux/link.c" "lib/linux/lstat.c" "lib/linux/mkdir.c" "lib/linux/mknod.c" "lib/linux/nanosleep.c" "lib/linux/pipe.c" "lib/linux/readlink.c" "lib/linux/rename.c" "lib/linux/setgid.c" "lib/linux/settimer.c" "lib/linux/setuid.c" "lib/linux/signal.c" "lib/linux/sigprogmask.c" "lib/linux/symlink.c" ];
+    mes_SOURCES       = [ "src/builtins.c" "src/cc.c" "src/core.c" "src/display.c" "src/eval-apply.c" "src/gc.c" "src/globals.c" "src/hash.c" "src/lib.c" "src/math.c" "src/mes.c" "src/module.c" "src/posix.c" "src/reader.c" "src/stack.c" "src/string.c" "src/struct.c" "src/symbol.c" "src/vector.c" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix
new file mode 100644
index 00000000000..704ee42edeb
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix
@@ -0,0 +1,116 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gnutar
+, gzip
+}:
+
+let
+  inherit (import ./common.nix { inherit lib; }) pname meta;
+  version = "1.1.24";
+
+  src = fetchurl {
+    url = "https://musl.libc.org/releases/musl-${version}.tar.gz";
+    hash = "sha256-E3DJqBKyzyp9koAlEMygBYzDfmanvt1wBR8KNAFQIqM=";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/d98f97e21413efc32c770d0356f1feda66025686/sysa/musl-1.1.24/musl-1.1.24.sh
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/d98f97e21413efc32c770d0356f1feda66025686/sysa/musl-1.1.24";
+  patches = [
+    (fetchurl {
+      url = "${liveBootstrap}/patches/avoid_set_thread_area.patch";
+      hash = "sha256-TsbBZXk4/KMZG9EKi7cF+sullVXrxlizLNH0UHGXsPs=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/avoid_sys_clone.patch";
+      hash = "sha256-/ZmH64J57MmbxdfQ4RNjamAiBdkImMTlHsHdgV4gMj4=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/fenv.patch";
+      hash = "sha256-vMVGjoN4deAJW5gsSqA207SJqAbvhrnOsGK49DdEiTI=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/makefile.patch";
+      hash = "sha256-03iYBAUnsrEdLIIhhhq5mM6BGnPn2EfUmIHu51opxbw=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/musl_weak_symbols.patch";
+      hash = "sha256-/d9a2eUkpe9uyi1ye6T4CiYc9MR3FZ9na0Gb90+g4v0=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/set_thread_area.patch";
+      hash = "sha256-RIZYqbbRSx4X/0iFUhriwwBRmoXVR295GNBUjf2UrM0=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/sigsetjmp.patch";
+      hash = "sha256-wd2Aev1zPJXy3q933aiup5p1IMKzVJBquAyl3gbK4PU=";
+    })
+    # FIXME: this patch causes the build to fail
+    # (fetchurl {
+    #   url = "${liveBootstrap}/patches/stdio_flush_on_exit.patch";
+    #   hash = "sha256-/z5ze3h3QTysay8nRvyvwPv3pmTcKptdkBIaMCoeLDg=";
+    # })
+    # HACK: always flush stdio immediately
+    ./always-flush.patch
+    (fetchurl {
+      url = "${liveBootstrap}/patches/va_list.patch";
+      hash = "sha256-UmcMIl+YCi3wIeVvjbsCyqFlkyYsM4ECNwTfXP+s7vg=";
+    })
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+    gnutar
+    gzip
+  ];
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd musl-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+  # tcc does not support complex types
+  rm -rf src/complex
+  # Configure fails without this
+  mkdir -p /dev
+  # https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a3-intermediate-musl.nix
+  sed -i 's|/bin/sh|${bash}/bin/bash|' \
+    tools/*.sh
+  chmod 755 tools/*.sh
+  # patch popen/system to search in PATH instead of hardcoding /bin/sh
+  sed -i 's|posix_spawn(&pid, "/bin/sh",|posix_spawnp(\&pid, "sh",|' \
+    src/stdio/popen.c src/process/system.c
+  sed -i 's|execl("/bin/sh", "sh", "-c",|execlp("sh", "-c",|'\
+    src/misc/wordexp.c
+
+  # Configure
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-shared \
+    CC=tcc
+
+  # Build
+  make AR="tcc -ar" RANLIB=true CFLAGS="-DSYSCALL_NO_TLS"
+
+  # Install
+  make install
+  cp ${tinycc.libs}/lib/libtcc1.a $out/lib
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/always-flush.patch b/pkgs/os-specific/linux/minimal-bootstrap/musl/always-flush.patch
new file mode 100644
index 00000000000..cdeddf962d9
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/always-flush.patch
@@ -0,0 +1,12 @@
+diff --git src/env/__libc_start_main.c src/env/__libc_start_main.c
+index 8fbe526..9476c22 100644
+--- src/env/__libc_start_main.c
++++ src/env/__libc_start_main.c
+@@ -91,6 +91,7 @@ static int libc_start_main_stage2(int (*main)(int,char **,char **), int argc, ch
+ 	__libc_start_init();
+ 
+ 	/* Pass control to the application */
++	setbuf(stdout, NULL);
+ 	exit(main(argc, argv, envp));
+ 	return 0;
+ }
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
new file mode 100644
index 00000000000..52db5f94742
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
@@ -0,0 +1,13 @@
+{ lib }:
+
+{
+  pname = "musl";
+
+  meta = with lib; {
+    description = "An efficient, small, quality libc implementation";
+    homepage = "https://musl.libc.org";
+    license = licenses.mit;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix
new file mode 100644
index 00000000000..437ef342f6a
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix
@@ -0,0 +1,81 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gcc
+, binutils
+, gnumake
+, gnugrep
+, gnused
+, gnutar
+, gzip
+}:
+let
+  inherit (import ./common.nix { inherit lib; }) pname meta;
+  version = "1.2.4";
+
+  src = fetchurl {
+    url = "https://musl.libc.org/releases/musl-${version}.tar.gz";
+    hash = "sha256-ejXq4z1TcqfA2hGI3nmHJvaIJVE7euPr6XqqpSEU8Dk=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.hello-world = result:
+    bash.runCommand "${pname}-simple-program-${version}" {
+        nativeBuildInputs = [ gcc binutils result ];
+      } ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        musl-gcc -o test test.c
+        ./test
+        mkdir $out
+      '';
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd musl-${version}
+
+  # Patch
+  # https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a3-intermediate-musl.nix
+  sed -i 's|/bin/sh|${bash}/bin/bash|' \
+    tools/*.sh
+  # patch popen/system to search in PATH instead of hardcoding /bin/sh
+  sed -i 's|posix_spawn(&pid, "/bin/sh",|posix_spawnp(\&pid, "sh",|' \
+    src/stdio/popen.c src/process/system.c
+  sed -i 's|execl("/bin/sh", "sh", "-c",|execlp("sh", "-c",|'\
+    src/misc/wordexp.c
+
+  # Configure
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --syslibdir=$out/lib \
+    --enable-wrapper
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+  sed -i 's|/bin/sh|${bash}/bin/bash|' $out/bin/*
+  ln -s ../lib/libc.so $out/bin/ldd
+''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
new file mode 100644
index 00000000000..7f2e8ab81a3
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@@ -0,0 +1,96 @@
+{ hostPlatform
+}:
+
+rec {
+  name = "stage0-posix-${version}-source";
+  version = "1.6.0";
+  rev = "Release_${version}";
+  outputHashAlgo = "sha256";
+  outputHash = "sha256-epUaShjKiAd749ICvc6rS6WhUkS8R4heKuPdwUjEtsQ=";
+
+  /*
+  Since `make-minimal-bootstrap-sources` requires nixpkgs and nix it
+  will create a circular dependency if it is used in place of the
+  binary bootstrap-files.  To break the circular dependency,
+  `minimal-bootstrap-sources` extends `make-minimal-bootstrap-sources`
+  by adding Fixed Output Derivation (FOD) attributes.  These cause
+  the builder to be skipped if the expected output is found (by
+  its hash) in the store or on a substituter.
+
+  # How do I update the hash?
+
+  Run the following command:
+  ```
+  nix hash path $(nix build --print-out-paths -f '<nixpkgs>' make-minimal-bootstrap-sources)
+  ```
+
+  # Why do we need this `.nar` archive?
+
+  This archive exists only because of a quirk/limitation of Nix: in
+  restricted mode the builtin fetchers can download only single
+  files; they have no way to unpack multi-file archives except for
+  NAR archives:
+
+  https://github.com/NixOS/nixpkgs/pull/232576#issuecomment-1592415619
+
+  # Why don't we have to upload this to tarballs.nixos.org like the binary bootstrap-files did?
+
+  Unlike this archive, the binary bootstrap-files contained binaries,
+  which meant that we had to:
+
+  1. Make sure they came from a trusted builder (Hydra)
+  2. Keep careful track of exactly what toolchain (i.e. nixpkgs
+     commit) that builder used to create them.
+  3. Keep copies of the built binaries, in case the toolchains that
+     produced them failed to be perfectly deterministic.
+
+  The curated archives at tarballs.nixos.org exist in order to
+  satisfy these requirements.
+
+  The second point created a significant burden: since the nixpkgs
+  toolchain used to build a given copy of the binary bootstrap-files
+  itself used a *previous* copy of the bootstrap-files, this meant
+  we had to track the provenance of all bootstrap-files tarballs
+  ever used, for all eternity.  There was no explanation of where
+  the "original" bootstrap-files came from: turtles all the way
+  down.  In spite of all this effort we still can't be sure of our
+  ability to reproduce the binary bootstrap-files, since the
+  compilers that built them don't always produce exactly bit-for-bit
+  deterministic results.
+
+  Since this archive contains no binaries and uses a format (NAR)
+  specifically designed for bit-exact reproducibility, none of the
+  requirements above apply to `minimal-bootstrap-sources`.
+  */
+  minimal-bootstrap-sources = derivation {
+    inherit name;
+    system = hostPlatform.system;
+    outputHashMode = "recursive";
+    inherit outputHashAlgo outputHash;
+
+    # This builder always fails, but fortunately Nix will print the
+    # "builder", which is really the error message that we want the
+    # user to see.
+    builder = ''
+      #
+      #
+      # Neither your store nor your substituters seems to have:
+      #
+      #  ${builtins.placeholder "out"}
+      #
+      # You can create this path from an already-bootstrapped nixpkgs
+      # using the following command:
+      #
+      #   nix-build '<nixpkgs>' -A make-minimal-bootstrap-sources
+      #
+      # Or, if you prefer, you can create this file using only `git`,
+      # `nix`, and `xz`.  For the commands needed in order to do this,
+      # see `make-bootstrap-sources.nix`.  Once you have the manual
+      # result, do:
+      #
+      #   nix-store --add-fixed --recursive ${outputHashAlgo} ./${name}
+      #
+      # to add it to your store.
+    '';
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
new file mode 100644
index 00000000000..9f3d61b92bc
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
@@ -0,0 +1,27 @@
+{ lib
+, newScope
+}:
+
+lib.makeScope newScope (self: with self; {
+  inherit (callPackage ./platforms.nix { }) platforms stage0Arch m2libcArch m2libcOS baseAddress;
+
+  inherit (self.callPackage ./bootstrap-sources.nix {}) version minimal-bootstrap-sources;
+
+  src = minimal-bootstrap-sources;
+
+  m2libc = src + "/M2libc";
+
+  hex0 = callPackage ./hex0.nix { };
+  inherit (self.hex0) hex0-seed;
+
+  kaem = callPackage ./kaem { };
+  kaem-minimal = callPackage ./kaem/minimal.nix { };
+
+  mescc-tools-boot = callPackage ./mescc-tools-boot.nix { };
+
+  inherit (self.mescc-tools-boot) blood-elf-0 hex2 kaem-unwrapped M1 M2;
+
+  mescc-tools = callPackage ./mescc-tools { };
+
+  mescc-tools-extra = callPackage ./mescc-tools-extra { };
+})
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
new file mode 100644
index 00000000000..9808e25711c
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
@@ -0,0 +1,49 @@
+{ lib
+, derivationWithMeta
+, hostPlatform
+, src
+, version
+, platforms
+, stage0Arch
+}:
+
+let
+  hash = {
+    "AArch64" = "sha256-XTPsoKeI6wTZAF0UwEJPzuHelWOJe//wXg4HYO0dEJo=";
+    "AMD64"   = "sha256-RCgK9oZRDQUiWLVkcIBSR2HeoB+Bh0czthrpjFEkCaY=";
+    "x86"     = "sha256-QU3RPGy51W7M2xnfFY1IqruKzusrSLU+L190ztN6JW8=";
+  }.${stage0Arch} or (throw "Unsupported system: ${hostPlatform.system}");
+
+  # Pinned from https://github.com/oriansj/stage0-posix/commit/3189b5f325b7ef8b88e3edec7c1cde4fce73c76c
+  # This 256 byte seed is the only pre-compiled binary in the bootstrap chain.
+  hex0-seed = import <nix/fetchurl.nix> {
+    name = "hex0-seed";
+    url = "https://github.com/oriansj/bootstrap-seeds/raw/b1263ff14a17835f4d12539226208c426ced4fba/POSIX/${stage0Arch}/hex0-seed";
+    executable = true;
+    inherit hash;
+  };
+in
+derivationWithMeta {
+  inherit version;
+  pname = "hex0";
+  builder = hex0-seed;
+  args = [
+    "${src}/${stage0Arch}/hex0_${stage0Arch}.hex0"
+    (placeholder "out")
+  ];
+
+  meta = with lib; {
+    description = "Minimal assembler for bootstrapping";
+    homepage = "https://github.com/oriansj/stage0-posix";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    inherit platforms;
+  };
+
+  passthru = { inherit hex0-seed; };
+
+  # Ensure the untrusted hex0-seed binary produces a known-good hex0
+  outputHashMode = "recursive";
+  outputHashAlgo = "sha256";
+  outputHash = hash;
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
new file mode 100644
index 00000000000..547790835c5
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, derivationWithMeta
+, writeText
+, kaem
+, kaem-unwrapped
+, mescc-tools
+, mescc-tools-extra
+, version
+, platforms
+}:
+
+# Once mescc-tools-extra is available we can install kaem at /bin/kaem
+# to make it findable in environments
+derivationWithMeta {
+  inherit version kaem-unwrapped;
+  pname = "kaem";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    (builtins.toFile "kaem-wrapper.kaem" ''
+      mkdir -p ''${out}/bin
+      cp ''${kaem-unwrapped} ''${out}/bin/kaem
+      chmod 555 ''${out}/bin/kaem
+    '')
+  ];
+  PATH = lib.makeBinPath [ mescc-tools-extra ];
+
+  passthru.runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name;
+
+      builder = "${kaem}/bin/kaem";
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (writeText "${name}-builder" buildCommand)
+      ];
+
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [ kaem mescc-tools mescc-tools-extra ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
+  meta = with lib; {
+    description = "Minimal build tool for running scripts on systems that lack any shell";
+    homepage = "https://github.com/oriansj/mescc-tools";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    inherit platforms;
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
new file mode 100644
index 00000000000..ae31302894a
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/minimal.nix
@@ -0,0 +1,26 @@
+{ lib
+, derivationWithMeta
+, src
+, hex0
+, version
+, platforms
+, stage0Arch
+}:
+derivationWithMeta {
+  inherit version;
+  pname = "kaem-minimal";
+  builder = hex0;
+  args = [
+    "${src}/${stage0Arch}/kaem-minimal.hex0"
+    (placeholder "out")
+  ];
+
+  meta = with lib; {
+    description = "First stage minimal scriptable build tool for bootstrapping";
+    homepage = "https://github.com/oriansj/stage0-posix";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    inherit platforms;
+  };
+}
+
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
new file mode 100644
index 00000000000..6cc7cddb82a
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
@@ -0,0 +1,58 @@
+# Packaged source files for the first bootstrapping stage.
+#
+# We don't have access to utilities such as fetchgit and fetchzip since this
+# is this is part of the bootstrap process and would introduce a circular
+# dependency. The only tool we have to fetch source trees is `import <nix/fetchurl.nix>`
+# with the unpack option, taking a NAR file as input. This requires source
+# tarballs to be repackaged.
+#
+# To build:
+#
+#   nix-build '<nixpkgs>' -A make-minimal-bootstrap-sources
+#
+
+{ lib
+, hostPlatform
+, fetchFromGitHub
+, fetchpatch
+}:
+
+let
+  expected = import ./bootstrap-sources.nix { inherit hostPlatform; };
+in
+
+fetchFromGitHub {
+  inherit (expected) name rev;
+  owner = "oriansj";
+  repo = "stage0-posix";
+  sha256 = expected.outputHash;
+  fetchSubmodules = true;
+  postFetch = ''
+    # Seed binaries will be fetched separately
+    echo "Removing seed binaries"
+    rm -rf $out/bootstrap-seeds/*
+
+    # Remove vendored/duplicate M2libc's
+    echo "Removing duplicate M2libc"
+    rm -rf \
+      $out/M2-Mesoplanet/M2libc \
+      $out/M2-Planet/M2libc \
+      $out/mescc-tools/M2libc \
+      $out/mescc-tools-extra/M2libc
+
+    # aarch64: syscall: mkdir -> mkdirat
+    # https://github.com/oriansj/M2libc/pull/17
+    patch -Np1 -d $out/M2libc -i ${(fetchpatch {
+      url = "https://github.com/oriansj/M2libc/commit/ff7c3023b3ab6cfcffc5364620b25f8d0279e96b.patch";
+      hash = "sha256-QAKddv4TixIQHpFa9SVu9fAkeKbzhQaxjaWzW2yJy7A=";
+    })}
+  '';
+
+  meta = with lib; {
+    description = "Packaged sources for the first bootstrapping stage";
+    homepage = "https://github.com/oriansj/stage0-posix";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix
new file mode 100644
index 00000000000..2114ffc707b
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix
@@ -0,0 +1,358 @@
+# Mes --- Maxwell Equations of Software
+# Copyright © 2017,2019 Jan Nieuwenhuizen <janneke@gnu.org>
+# Copyright © 2017,2019 Jeremiah Orians
+#
+# This file is part of Mes.
+#
+# Mes is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# Mes is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Mes.  If not, see <http://www.gnu.org/licenses/>.
+
+# This is a translation of stage0-posix/stage0-posix/x86/mescc-tools-mini-kaem.kaem to nix
+# https://github.com/oriansj/stage0-posix-x86/blob/56e6b8df3e95f4bc04f8b420a4cd8c82c70b9efa/mescc-tools-mini-kaem.kaem
+#
+# We have access to mini-kaem at this point but it doesn't support substituting
+# environment variables. Without variables there's no way of passing in store inputs,
+# or the $out path, other than as command line arguments directly
+
+# Warning all binaries prior to the use of blood-elf will not be readable by
+# Objdump, you may need to use ndism or gdb to view the assembly in the binary.
+
+{ lib
+, derivationWithMeta
+, hostPlatform
+, hex0
+, m2libc
+, src
+, version
+, platforms
+, stage0Arch
+, m2libcArch
+, baseAddress
+}:
+rec {
+  out = placeholder "out";
+
+  endianFlag = if hostPlatform.isLittleEndian then "--little-endian" else "--big-endian";
+
+  bloodFlags = lib.optional hostPlatform.is64bit "--64";
+
+  run = pname: builder: args:
+    derivationWithMeta {
+      inherit pname version builder args;
+
+      meta = with lib; {
+        description = "Collection of tools written for use in bootstrapping";
+        homepage = "https://github.com/oriansj/stage0-posix";
+        license = licenses.gpl3Plus;
+        maintainers = teams.minimal-bootstrap.members;
+        inherit platforms;
+      };
+    };
+
+  ################################
+  # Phase-1 Build hex1 from hex0 #
+  ################################
+
+  hex1 = run "hex1" hex0 ["${src}/${stage0Arch}/hex1_${stage0Arch}.hex0" out];
+
+  # hex1 adds support for single character labels and is available in various forms
+  # in mescc-tools/x86_bootstrap to allow you various ways to verify correctness
+
+  ################################
+  # Phase-2 Build hex2 from hex1 #
+  ################################
+
+  hex2-0 = run "hex2" hex1 ["${src}/${stage0Arch}/hex2_${stage0Arch}.hex1" out];
+
+  # hex2 adds support for long labels and absolute addresses thus allowing it
+  # to function as an effective linker for later stages of the bootstrap
+  # This is a minimal version which will be used to bootstrap a much more advanced
+  # version in a later stage.
+
+  #################################
+  # Phase-2b Build catm from hex2 #
+  #################################
+
+  catm =
+    if hostPlatform.isAarch64 then
+      run "catm" hex1 ["${src}/${stage0Arch}/catm_${stage0Arch}.hex1" out]
+    else
+      run "catm" hex2-0 ["${src}/${stage0Arch}/catm_${stage0Arch}.hex2" out];
+
+  # catm removes the need for cat or shell support for redirection by providing
+  # equivalent functionality via catm output_file input1 input2 ... inputN
+
+  ##############################
+  # Phase-3 Build M0 from hex2 #
+  ##############################
+
+  M0_hex2 = run "M0.hex2" catm [out "${m2libc}/${m2libcArch}/ELF-${m2libcArch}.hex2" "${src}/${stage0Arch}/M0_${stage0Arch}.hex2"];
+  M0 = run "M0" hex2-0 [M0_hex2 out];
+
+  # M0 is the architecture specific version of M1 and is by design single
+  # architecture only and will be replaced by the C code version of M1
+
+  ################################
+  # Phase-4 Build cc_arch from M0 #
+  ################################
+
+  cc_arch-0_hex2 = run "cc_arch-0.hex2" M0 ["${src}/${stage0Arch}/cc_${m2libcArch}.M1" out];
+  cc_arch-1_hex2 = run "cc_arch-1.hex2" catm [out "${m2libc}/${m2libcArch}/ELF-${m2libcArch}.hex2" cc_arch-0_hex2];
+  cc_arch = run "cc_arch" hex2-0 [cc_arch-1_hex2 out];
+
+  ########################################
+  # Phase-5 Build M2-Planet from cc_arch #
+  ########################################
+
+  M2-0_c = run "M2-0.c" catm [
+    out
+    "${m2libc}/${m2libcArch}/linux/bootstrap.c"
+    "${src}/M2-Planet/cc.h"
+    "${m2libc}/bootstrappable.c"
+    "${src}/M2-Planet/cc_globals.c"
+    "${src}/M2-Planet/cc_reader.c"
+    "${src}/M2-Planet/cc_strings.c"
+    "${src}/M2-Planet/cc_types.c"
+    "${src}/M2-Planet/cc_core.c"
+    "${src}/M2-Planet/cc_macro.c"
+    "${src}/M2-Planet/cc.c"
+  ];
+  M2-0_M1 = run "M2-0.M1" cc_arch [M2-0_c out];
+  M2-0-0_M1 = run "M2-0-0.M1" catm [out "${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1" "${m2libc}/${m2libcArch}/libc-core.M1" M2-0_M1];
+  M2-0_hex2 = run "M2-0.hex2" M0 [M2-0-0_M1 out];
+  M2-0-0_hex2 = run "M2-0-0.hex2" catm [out "${m2libc}/${m2libcArch}/ELF-${m2libcArch}.hex2" M2-0_hex2];
+  M2 = run "M2" hex2-0 [M2-0-0_hex2 out];
+
+  ############################################
+  # Phase-6 Build blood-elf-0 from C sources #
+  ############################################
+
+  blood-elf-0_M1 = run "blood-elf-0.M1" M2 [
+    "--architecture" m2libcArch
+    "-f" "${m2libc}/${m2libcArch}/linux/bootstrap.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/blood-elf.c"
+    "--bootstrap-mode"
+    "-o" out
+  ];
+
+  blood-elf-0-0_M1 = run "blood-elf-0-0.M1" catm [out "${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1" "${m2libc}/${m2libcArch}/libc-core.M1" blood-elf-0_M1];
+  blood-elf-0_hex2 = run "blood-elf-0.hex2" M0 [blood-elf-0-0_M1 out];
+  blood-elf-0-0_hex2 = run "blood-elf-0-0.hex2" catm [out "${m2libc}/${m2libcArch}/ELF-${m2libcArch}.hex2" blood-elf-0_hex2];
+  blood-elf-0 = run "blood-elf-0" hex2-0 [blood-elf-0-0_hex2 out];
+
+  # This is the last stage where the binaries will not have debug info
+  # and the last piece built that isn't part of the output binaries
+
+  #####################################
+  # Phase-7 Build M1-0 from C sources #
+  #####################################
+
+  M1-macro-0_M1 = run "M1-macro-0.M1" M2 [
+    "--architecture" m2libcArch
+    "-f" "${m2libc}/${m2libcArch}/linux/bootstrap.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/M1-macro.c"
+    "--bootstrap-mode"
+    "--debug"
+    "-o" out
+  ];
+
+  M1-macro-0-footer_M1 = run "M1-macro-0-footer.M1" blood-elf-0 (bloodFlags ++ ["-f" M1-macro-0_M1 endianFlag "-o" out]);
+  M1-macro-0-0_M1 = run "M1-macro-0-0.M1" catm [out "${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1" "${m2libc}/${m2libcArch}/libc-core.M1" M1-macro-0_M1 M1-macro-0-footer_M1];
+  M1-macro-0_hex2 = run "M1-macro-0.hex2" M0 [M1-macro-0-0_M1 out];
+  M1-macro-0-0_hex2 = run "M1-macro-0-0.hex2" catm [out "${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2" M1-macro-0_hex2];
+  M1-0 = run "M1-0" hex2-0 [M1-macro-0-0_hex2 out];
+
+  # This is the last stage where catm will need to be used and the last stage where
+  # M0 is used, as we will being using it's much more powerful and cross-platform
+  # version with a bunch of extra goodies.
+
+  #######################################
+  # Phase-8 Build hex2-1 from C sources #
+  #######################################
+
+  hex2_linker-0_M1 = run "hex2_linker-0.M1" M2 [
+    "--architecture" m2libcArch
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/${m2libcArch}/linux/unistd.c"
+    "-f" "${m2libc}/${m2libcArch}/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/${m2libcArch}/linux/sys/stat.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/hex2.h"
+    "-f" "${src}/mescc-tools/hex2_linker.c"
+    "-f" "${src}/mescc-tools/hex2_word.c"
+    "-f" "${src}/mescc-tools/hex2.c"
+    "--debug"
+    "-o" out
+  ];
+
+  hex2_linker-0-footer_M1 = run "hex2_linker-0-footer.M1" blood-elf-0 (bloodFlags ++ ["-f" hex2_linker-0_M1 endianFlag "-o" out]);
+
+  hex2_linker-0_hex2 = run "hex2_linker-0.hex2" M1-0 [
+    "--architecture" m2libcArch
+    endianFlag
+    "-f" "${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1"
+    "-f" "${m2libc}/${m2libcArch}/libc-full.M1"
+    "-f" hex2_linker-0_M1
+    "-f" hex2_linker-0-footer_M1
+    "-o" out
+  ];
+
+  hex2_linker-0-0_hex2 = run "hex2_linker-0-0.hex2" catm [out "${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2" hex2_linker-0_hex2];
+
+  hex2-1 = run "hex2-1" hex2-0 [hex2_linker-0-0_hex2 out];
+
+  # This is the last stage where we will be using the handwritten hex2 and instead
+  # be using the far more powerful, cross-platform version with a bunch more goodies
+
+  ###################################
+  # Phase-9 Build M1 from C sources #
+  ###################################
+
+  M1-macro-1_M1 = run "M1-macro-1.M1" M2 [
+    "--architecture" m2libcArch
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/${m2libcArch}/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/${m2libcArch}/linux/unistd.c"
+    "-f" "${m2libc}/string.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/stringify.c"
+    "-f" "${src}/mescc-tools/M1-macro.c"
+    "--debug"
+    "-o" out
+  ];
+
+  M1-macro-1-footer_M1 = run "M1-macro-1-footer.M1" blood-elf-0 (bloodFlags ++ ["-f" M1-macro-1_M1 endianFlag "-o" out]);
+
+  M1-macro-1_hex2 = run "M1-macro-1.hex2" M1-0 [
+    "--architecture" m2libcArch
+    endianFlag
+    "-f" "${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1"
+    "-f" "${m2libc}/${m2libcArch}/libc-full.M1"
+    "-f" M1-macro-1_M1
+    "-f" M1-macro-1-footer_M1
+    "-o" out
+  ];
+
+  M1 = run "M1" hex2-1 [
+    "--architecture" m2libcArch
+    endianFlag
+    "--base-address" baseAddress
+    "-f" "${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2"
+    "-f" M1-macro-1_hex2
+    "-o" out
+  ];
+
+  ######################################
+  # Phase-10 Build hex2 from C sources #
+  ######################################
+
+  hex2_linker-2_M1 = run "hex2_linker-2.M1" M2 [
+    "--architecture" m2libcArch
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/${m2libcArch}/linux/unistd.c"
+    "-f" "${m2libc}/${m2libcArch}/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/${m2libcArch}/linux/sys/stat.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/hex2.h"
+    "-f" "${src}/mescc-tools/hex2_linker.c"
+    "-f" "${src}/mescc-tools/hex2_word.c"
+    "-f" "${src}/mescc-tools/hex2.c"
+    "--debug"
+    "-o" out
+  ];
+
+  hex2_linker-2-footer_M1 = run "hex2_linker-2-footer.M1" blood-elf-0 (bloodFlags ++ ["-f" hex2_linker-2_M1 endianFlag "-o" out]);
+
+  hex2_linker-2_hex2 = run "hex2_linker-2.hex2" M1 [
+    "--architecture" m2libcArch
+    endianFlag
+    "-f" "${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1"
+    "-f" "${m2libc}/${m2libcArch}/libc-full.M1"
+    "-f" hex2_linker-2_M1
+    "-f" hex2_linker-2-footer_M1
+    "-o" out
+  ];
+
+  hex2 = run "hex2" hex2-1 [
+    "--architecture" m2libcArch
+    endianFlag
+    "--base-address" baseAddress
+    "-f" "${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2"
+    "-f" hex2_linker-2_hex2
+    "-o" out
+  ];
+
+  ######################################
+  # Phase-11 Build kaem from C sources #
+  ######################################
+
+  kaem_M1 = run "kaem.M1" M2 [
+    "--architecture" m2libcArch
+    "-f" "${m2libc}/sys/types.h"
+    "-f" "${m2libc}/stddef.h"
+    "-f" "${m2libc}/string.c"
+    "-f" "${m2libc}/${m2libcArch}/linux/unistd.c"
+    "-f" "${m2libc}/${m2libcArch}/linux/fcntl.c"
+    "-f" "${m2libc}/fcntl.c"
+    "-f" "${m2libc}/stdlib.c"
+    "-f" "${m2libc}/stdio.h"
+    "-f" "${m2libc}/stdio.c"
+    "-f" "${m2libc}/bootstrappable.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem.h"
+    "-f" "${src}/mescc-tools/Kaem/variable.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem_globals.c"
+    "-f" "${src}/mescc-tools/Kaem/kaem.c"
+    "--debug"
+    "-o" out
+  ];
+
+  kaem-footer_M1 = run "kaem-footer.M1" blood-elf-0 (bloodFlags ++ ["-f" kaem_M1 endianFlag "-o" out]);
+
+  kaem_hex2 = run "kaem.hex2" M1 [
+    "--architecture" m2libcArch
+    endianFlag
+    "-f" "${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1"
+    "-f" "${m2libc}/${m2libcArch}/libc-full.M1"
+    "-f" kaem_M1
+    "-f" kaem-footer_M1
+    "-o" out
+  ];
+
+  kaem-unwrapped = run "kaem-unwrapped" hex2 [
+    "--architecture" m2libcArch
+    endianFlag
+    "-f" "${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2"
+    "-f" kaem_hex2
+    "--base-address" baseAddress
+    "-o" out
+  ];
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem
new file mode 100644
index 00000000000..fb27eccab83
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/build.kaem
@@ -0,0 +1,39 @@
+# This is a modified version of mescc-tools-extra/mescc-tools-extra.kaem
+# https://github.com/oriansj/mescc-tools-extra/blob/ec53af69d6d2119b47b369cd0ec37ac806e7ad60/mescc-tools-extra.kaem
+# - Paths to build inputs have been changed for nix
+# - Added additional step to create $out directory
+
+## Copyright (C) 2017 Jeremiah Orians
+## This file is part of mescc-tools.
+##
+## mescc-tools is free software: you can redistribute it and/or modify
+## it under the terms of the GNU General Public License as published by
+## the Free Software Foundation, either version 3 of the License, or
+## (at your option) any later version.
+##
+## mescc-tools is distributed in the hope that it will be useful,
+## but WITHOUT ANY WARRANTY; without even the implied warranty of
+## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+## GNU General Public License for more details.
+##
+## You should have received a copy of the GNU General Public License
+## along with mescc-tools.  If not, see <http://www.gnu.org/licenses/>.
+
+alias CC="${mescc-tools}/bin/M2-Mesoplanet --operating-system ${m2libcOS} --architecture ${m2libcArch} -f"
+cd ${src}/mescc-tools-extra
+
+# Create output folder
+CC mkdir.c -o ${TMP}/mkdir
+${TMP}/mkdir -p ${out}/bin
+
+CC sha256sum.c -o ${out}/bin/sha256sum
+CC match.c -o ${out}/bin/match
+CC mkdir.c -o ${out}/bin/mkdir
+CC untar.c -o ${out}/bin/untar
+CC ungz.c -o ${out}/bin/ungz
+CC unbz2.c -o ${out}/bin/unbz2
+CC catm.c -o ${out}/bin/catm
+CC cp.c -o ${out}/bin/cp
+CC chmod.c -o ${out}/bin/chmod
+CC rm.c -o ${out}/bin/rm
+CC replace.c -o ${out}/bin/replace
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix
new file mode 100644
index 00000000000..eee00491c44
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-extra/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, derivationWithMeta
+, kaem-unwrapped
+, mescc-tools
+, src
+, version
+, platforms
+, m2libcArch
+, m2libcOS
+}:
+derivationWithMeta {
+  inherit version src mescc-tools m2libcArch m2libcOS;
+  pname = "mescc-tools-extra";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    ./build.kaem
+  ];
+
+  meta = with lib; {
+    description = "Collection of tools written for use in bootstrapping";
+    homepage = "https://github.com/oriansj/mescc-tools-extra";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    inherit platforms;
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem
new file mode 100644
index 00000000000..128ff360fd2
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/build.kaem
@@ -0,0 +1,204 @@
+# This is a modified version of stage0-posix/x86/mescc-tools-full-kaem.kaem
+# https://github.com/oriansj/stage0-posix-x86/blob/56e6b8df3e95f4bc04f8b420a4cd8c82c70b9efa/mescc-tools-full-kaem.kaem
+# - Paths to build inputs have been changed for nix
+
+# Mes --- Maxwell Equations of Software
+# Copyright © 2017,2019 Jan Nieuwenhuizen <janneke@gnu.org>
+# Copyright © 2017,2019 Jeremiah Orians
+#
+# This file is part of Mes.
+#
+# Mes is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or (at
+# your option) any later version.
+#
+# Mes is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with Mes.  If not, see <http://www.gnu.org/licenses/>.
+
+${mkdir} -p ${out}/bin
+${cp} ${M2} ${out}/bin/M2
+${chmod} 0555 ${out}/bin/M2
+${cp} ${M1} ${out}/bin/M1
+${chmod} 0555 ${out}/bin/M1
+${cp} ${hex2} ${out}/bin/hex2
+${chmod} 0555 ${out}/bin/hex2
+
+# M2-Mesoplanet searches for runtime dependencies in environment variables
+# We can hardcode them with the "replace" utility from mescc-tools-extra
+${replace} \
+	--file ${src}/M2-Mesoplanet/cc.c \
+	--output ./cc_patched.c \
+	--match-on "env_lookup(\"M2LIBC_PATH\")" \
+	--replace-with "\"${m2libc}\""
+${replace} \
+	--file ${src}/M2-Mesoplanet/cc_spawn.c \
+	--output ./cc_spawn_patched.c \
+	--match-on "env_lookup(\"PATH\")" \
+	--replace-with "\"${out}/bin:\""
+
+###############################################
+# Phase-12 Build M2-Mesoplanet from M2-Planet #
+###############################################
+
+${M2} --architecture ${m2libcArch} \
+  -f ${m2libc}/sys/types.h \
+  -f ${m2libc}/stddef.h \
+  -f ${m2libc}/${m2libcArch}/linux/fcntl.c \
+  -f ${m2libc}/fcntl.c \
+  -f ${m2libc}/${m2libcArch}/linux/unistd.c \
+  -f ${m2libc}/${m2libcArch}/linux/sys/stat.c \
+  -f ${m2libc}/stdlib.c \
+  -f ${m2libc}/stdio.h \
+  -f ${m2libc}/stdio.c \
+  -f ${m2libc}/string.c \
+  -f ${m2libc}/bootstrappable.c \
+  -f ${src}/M2-Mesoplanet/cc.h \
+  -f ${src}/M2-Mesoplanet/cc_globals.c \
+  -f ${src}/M2-Mesoplanet/cc_env.c \
+  -f ${src}/M2-Mesoplanet/cc_reader.c \
+  -f ./cc_spawn_patched.c \
+  -f ${src}/M2-Mesoplanet/cc_core.c \
+  -f ${src}/M2-Mesoplanet/cc_macro.c \
+  -f ./cc_patched.c \
+  --debug \
+  -o ./M2-Mesoplanet-1.M1
+
+${blood-elf-0} ${endianFlag} ${bloodFlag} -f ./M2-Mesoplanet-1.M1 -o ./M2-Mesoplanet-1-footer.M1
+
+${M1} --architecture ${m2libcArch} \
+  ${endianFlag} \
+  -f ${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1 \
+  -f ${m2libc}/${m2libcArch}/libc-full.M1 \
+  -f ./M2-Mesoplanet-1.M1 \
+  -f ./M2-Mesoplanet-1-footer.M1 \
+  -o ./M2-Mesoplanet-1.hex2
+
+${hex2} --architecture ${m2libcArch} \
+  ${endianFlag} \
+  --base-address ${baseAddress} \
+  -f ${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2 \
+  -f ./M2-Mesoplanet-1.hex2 \
+  -o ${out}/bin/M2-Mesoplanet
+
+#################################################
+# Phase-13 Build final blood-elf from C sources #
+#################################################
+
+${M2} --architecture ${m2libcArch} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${m2libcArch}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/${m2libcArch}/linux/unistd.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/mescc-tools/stringify.c \
+	-f ${src}/mescc-tools/blood-elf.c \
+	--debug \
+	-o ./blood-elf-1.M1
+
+${blood-elf-0} ${endianFlag} ${bloodFlag} -f ./blood-elf-1.M1 -o ./blood-elf-1-footer.M1
+
+${M1} --architecture ${m2libcArch} \
+	${endianFlag} \
+	-f ${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1 \
+	-f ${m2libc}/${m2libcArch}/libc-full.M1 \
+	-f ./blood-elf-1.M1 \
+	-f ./blood-elf-1-footer.M1 \
+	-o ./blood-elf-1.hex2
+
+${hex2} --architecture ${m2libcArch} \
+	${endianFlag} \
+	--base-address ${baseAddress} \
+	-f ${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2 \
+	-f ./blood-elf-1.hex2 \
+	-o ${out}/bin/blood-elf
+
+# Now we have our shipping debuggable blood-elf, the rest will be down hill from
+# here as we have ALL of the core pieces of compiling and assembling debuggable
+# programs in a debuggable form with corresponding C source code.
+
+#############################################
+# Phase-14 Build get_machine from C sources #
+#############################################
+
+${M2} --architecture ${m2libcArch} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${m2libcArch}/linux/unistd.c \
+	-f ${m2libc}/${m2libcArch}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/mescc-tools/get_machine.c \
+	--debug \
+	-o get_machine.M1
+
+${out}/bin/blood-elf ${endianFlag} ${bloodFlag} -f ./get_machine.M1 -o ./get_machine-footer.M1
+
+${M1} --architecture ${m2libcArch} \
+	${endianFlag} \
+	-f ${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1 \
+	-f ${m2libc}/${m2libcArch}/libc-full.M1 \
+	-f ./get_machine.M1 \
+	-f ./get_machine-footer.M1 \
+	-o ./get_machine.hex2
+
+${hex2} --architecture ${m2libcArch} \
+	${endianFlag} \
+	--base-address ${baseAddress} \
+	-f ${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2 \
+	-f ./get_machine.hex2 \
+	-o ${out}/bin/get_machine
+
+############################################
+# Phase-15 Build M2-Planet from M2-Planet  #
+############################################
+
+${M2} --architecture ${m2libcArch} \
+	-f ${m2libc}/sys/types.h \
+	-f ${m2libc}/stddef.h \
+	-f ${m2libc}/${m2libcArch}/linux/unistd.c \
+	-f ${m2libc}/${m2libcArch}/linux/fcntl.c \
+	-f ${m2libc}/fcntl.c \
+	-f ${m2libc}/stdlib.c \
+	-f ${m2libc}/stdio.h \
+	-f ${m2libc}/stdio.c \
+	-f ${m2libc}/bootstrappable.c \
+	-f ${src}/M2-Planet/cc.h \
+	-f ${src}/M2-Planet/cc_globals.c \
+	-f ${src}/M2-Planet/cc_reader.c \
+	-f ${src}/M2-Planet/cc_strings.c \
+	-f ${src}/M2-Planet/cc_types.c \
+	-f ${src}/M2-Planet/cc_core.c \
+	-f ${src}/M2-Planet/cc_macro.c \
+	-f ${src}/M2-Planet/cc.c \
+	--debug \
+	-o ./M2-1.M1
+
+${out}/bin/blood-elf ${endianFlag} ${bloodFlag} -f ./M2-1.M1 -o ./M2-1-footer.M1
+
+${M1} --architecture ${m2libcArch} \
+	${endianFlag} \
+	-f ${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1 \
+	-f ${m2libc}/${m2libcArch}/libc-full.M1 \
+	-f ./M2-1.M1 \
+	-f ./M2-1-footer.M1 \
+	-o ./M2-1.hex2
+
+${hex2} --architecture ${m2libcArch} \
+	${endianFlag} \
+	--base-address ${baseAddress} \
+	-f ${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2 \
+	-f ./M2-1.hex2 \
+	-o ${out}/bin/M2-Planet
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix
new file mode 100644
index 00000000000..4a9c734981e
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools/default.nix
@@ -0,0 +1,90 @@
+{ lib
+, derivationWithMeta
+, hostPlatform
+, kaem-unwrapped
+, M1
+, M2
+, blood-elf-0
+, hex2
+, m2libc
+, src
+, version
+, platforms
+, m2libcArch
+, baseAddress
+}:
+
+let
+  endianFlag = if hostPlatform.isLittleEndian then "--little-endian" else "--big-endian";
+  bloodFlag = if hostPlatform.is64bit then "--64" else " ";
+
+  # We need a few tools from mescc-tools-extra to assemble the output folder
+  buildMesccToolsExtraUtil = name:
+    derivationWithMeta {
+      pname = "mescc-tools-extra-${name}";
+      builder = kaem-unwrapped;
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (builtins.toFile "build-${name}.kaem" ''
+          ''${M2} --architecture ${m2libcArch} \
+            -f ''${m2libc}/sys/types.h \
+            -f ''${m2libc}/stddef.h \
+            -f ''${m2libc}/${m2libcArch}/linux/fcntl.c \
+            -f ''${m2libc}/fcntl.c \
+            -f ''${m2libc}/${m2libcArch}/linux/unistd.c \
+            -f ''${m2libc}/${m2libcArch}/linux/sys/stat.c \
+            -f ''${m2libc}/stdlib.c \
+            -f ''${m2libc}/stdio.h \
+            -f ''${m2libc}/stdio.c \
+            -f ''${m2libc}/string.c \
+            -f ''${m2libc}/bootstrappable.c \
+            -f ''${src}/mescc-tools-extra/${name}.c \
+            --debug \
+            -o ${name}.M1
+
+          ''${blood-elf-0} ${endianFlag} ${bloodFlag} -f ${name}.M1 -o ${name}-footer.M1
+
+          ''${M1} --architecture ${m2libcArch} \
+            ${endianFlag} \
+            -f ''${m2libc}/${m2libcArch}/${m2libcArch}_defs.M1 \
+            -f ''${m2libc}/${m2libcArch}/libc-full.M1 \
+            -f ${name}.M1 \
+            -f ${name}-footer.M1 \
+            -o ${name}.hex2
+
+          ''${hex2} --architecture ${m2libcArch} \
+            ${endianFlag} \
+            -f ''${m2libc}/${m2libcArch}/ELF-${m2libcArch}-debug.hex2 \
+            -f ${name}.hex2 \
+            --base-address ${baseAddress} \
+            -o ''${out}
+        '')
+      ];
+      inherit version M1 M2 blood-elf-0 hex2 m2libc src;
+    };
+  mkdir = buildMesccToolsExtraUtil "mkdir";
+  cp = buildMesccToolsExtraUtil "cp";
+  chmod = buildMesccToolsExtraUtil "chmod";
+  replace = buildMesccToolsExtraUtil "replace";
+in
+derivationWithMeta {
+  pname = "mescc-tools";
+  builder = kaem-unwrapped;
+  args = [
+    "--verbose"
+    "--strict"
+    "--file"
+    ./build.kaem
+  ];
+  inherit version M1 M2 blood-elf-0 hex2 mkdir cp chmod replace m2libc src m2libcArch baseAddress bloodFlag endianFlag;
+
+  meta = with lib; {
+    description = "Collection of tools written for use in bootstrapping";
+    homepage = "https://github.com/oriansj/mescc-tools";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    inherit platforms;
+  };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix
new file mode 100644
index 00000000000..53147df3344
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix
@@ -0,0 +1,32 @@
+# Platform specific constants
+{ lib
+, hostPlatform
+}:
+
+rec {
+  # meta.platforms
+  platforms = [
+    "aarch64-linux"
+    "i686-linux"
+    "x86_64-linux"
+  ];
+
+  # system arch as used within the stage0 project
+  stage0Arch = {
+    "aarch64-linux" = "AArch64";
+    "i686-linux"    = "x86";
+    "x86_64-linux"  = "AMD64";
+  }.${hostPlatform.system} or (throw "Unsupported system: ${hostPlatform.system}");
+
+  # lower-case form is widely used by m2libc
+  m2libcArch = lib.toLower stage0Arch;
+
+  # Passed to M2-Mesoplanet as --operating-system
+  m2libcOS = if hostPlatform.isLinux then "linux" else throw "Unsupported system: ${hostPlatform.system}";
+
+  baseAddress = {
+    "aarch64-linux" = "0x00600000";
+    "i686-linux"    = "0x08048000";
+    "x86_64-linux"  = "0x00600000";
+  }.${hostPlatform.system} or (throw "Unsupported system: ${hostPlatform.system}");
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
new file mode 100644
index 00000000000..83d89012b0f
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
@@ -0,0 +1,172 @@
+# Bootstrappable TCC is a fork from mainline TCC development
+# that can be compiled by MesCC
+
+# Build steps adapted from https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/tcc-0.9.26/tcc-0.9.26.kaem
+#
+# SPDX-FileCopyrightText: 2021-22 fosslinux <fosslinux@aussies.space>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+{ lib
+, callPackage
+, fetchurl
+, kaem
+, mes
+, mes-libc
+}:
+let
+  inherit (callPackage ./common.nix { }) buildTinyccMes recompileLibc;
+
+  version = "unstable-2023-04-20";
+  rev = "80114c4da6b17fbaabb399cc29f427e368309bc8";
+
+  tarball = fetchurl {
+    url = "https://gitlab.com/janneke/tinycc/-/archive/${rev}/tinycc-${rev}.tar.gz";
+    sha256 = "1a0cw9a62qc76qqn5sjmp3xrbbvsz2dxrw21lrnx9q0s74mwaxbq";
+  };
+  src = (kaem.runCommand "tinycc-bootstrappable-${version}-source" {} ''
+    ungz --file ${tarball} --output tinycc.tar
+    mkdir -p ''${out}
+    cd ''${out}
+    untar --file ''${NIX_BUILD_TOP}/tinycc.tar
+
+    # Patch
+    cd tinycc-${rev}
+    # Static link by default
+    replace --file libtcc.c --output libtcc.c --match-on "s->ms_extensions = 1;" --replace-with "s->ms_extensions = 1; s->static_link = 1;"
+  '') + "/tinycc-${rev}";
+
+  meta = with lib; {
+    description = "Tiny C Compiler's bootstrappable fork";
+    homepage = "https://gitlab.com/janneke/tinycc";
+    license = licenses.lgpl21Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  pname = "tinycc-boot-mes";
+
+  tinycc-boot-mes = rec {
+    compiler = kaem.runCommand "${pname}-${version}" {
+      passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+        ${result}/bin/tcc -version
+        mkdir ''${out}
+      '';
+    } ''
+      catm config.h
+      ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+        -S \
+        -o tcc.s \
+        -I . \
+        -D BOOTSTRAP=1 \
+        -I ${src} \
+        -D TCC_TARGET_I386=1 \
+        -D inline= \
+        -D CONFIG_TCCDIR=\"\" \
+        -D CONFIG_SYSROOT=\"\" \
+        -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+        -D CONFIG_TCC_ELFINTERP=\"/mes/loader\" \
+        -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+        -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
+        -D TCC_LIBGCC=\"${mes-libc}/lib/x86-mes/libc.a\" \
+        -D CONFIG_TCC_LIBTCC1_MES=0 \
+        -D CONFIG_TCCBOOT=1 \
+        -D CONFIG_TCC_STATIC=1 \
+        -D CONFIG_USE_LIBGCC=1 \
+        -D TCC_MES_LIBC=1 \
+        -D TCC_VERSION=\"${version}\" \
+        -D ONE_SOURCE=1 \
+        ${src}/tcc.c
+      mkdir -p ''${out}/bin
+      ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+        -L ${mes.libs}/lib \
+        -l c+tcc \
+        -o ''${out}/bin/tcc \
+        tcc.s
+    '';
+
+    libs = recompileLibc {
+      inherit pname version;
+      tcc = compiler;
+      src = mes-libc;
+      libtccOptions = mes-libc.CFLAGS;
+    };
+  };
+
+  # Bootstrap stage build flags obtained from
+  # https://gitlab.com/janneke/tinycc/-/blob/80114c4da6b17fbaabb399cc29f427e368309bc8/boot.sh
+
+  tinycc-boot0 = buildTinyccMes {
+    pname = "tinycc-boot0";
+    inherit src version meta;
+    prev = tinycc-boot-mes;
+    buildOptions = [
+      "-D HAVE_LONG_LONG_STUB=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_LONG_LONG_STUB=1"
+    ];
+  };
+
+  tinycc-boot1 = buildTinyccMes {
+    pname = "tinycc-boot1";
+    inherit src version meta;
+    prev = tinycc-boot0;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+
+  tinycc-boot2 = buildTinyccMes {
+    pname = "tinycc-boot2";
+    inherit src version meta;
+    prev = tinycc-boot1;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT_STUB=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT_STUB=1"
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+
+  tinycc-boot3 = buildTinyccMes {
+    pname = "tinycc-boot3";
+    inherit src version meta;
+    prev = tinycc-boot2;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+    ];
+  };
+in
+buildTinyccMes {
+  pname = "tinycc-bootstrappable";
+  inherit src version meta;
+  prev = tinycc-boot3;
+  buildOptions = [
+    "-D HAVE_BITFIELD=1"
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D HAVE_SETJMP=1"
+  ];
+  libtccBuildOptions = [
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+  ];
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
new file mode 100644
index 00000000000..28dde329876
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
@@ -0,0 +1,104 @@
+{ lib
+, kaem
+, mes-libc
+}:
+
+rec {
+
+  # Recompile libc: crt{1,n,i}, libtcc.a, libc.a, libgetopt.a
+  recompileLibc =
+    { tcc
+    , pname
+    , version
+    , src
+    , libtccOptions
+    }:
+    let
+
+    crt = kaem.runCommand "crt" {} ''
+      mkdir -p ''${out}/lib
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crt1.o ${mes-libc}/lib/crt1.c
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crtn.o ${mes-libc}/lib/crtn.c
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crti.o ${mes-libc}/lib/crti.c
+    '';
+
+    library = lib: options: source: kaem.runCommand "${lib}.a" {} ''
+      ${tcc}/bin/tcc ${options} -c -o ${lib}.o ${source}
+      ${tcc}/bin/tcc -ar cr ''${out} ${lib}.o
+    '';
+
+    libtcc1 = library "libtcc1" libtccOptions "${src}/lib/libtcc1.c";
+    libc = library "libc" mes-libc.CFLAGS "${mes-libc}/lib/libc.c";
+    libgetopt = library "libgetopt" mes-libc.CFLAGS "${mes-libc}/lib/libgetopt.c";
+  in
+  kaem.runCommand "${pname}-libs-${version}" {} ''
+    mkdir -p ''${out}/lib
+    cp ${crt}/lib/crt1.o ''${out}/lib
+    cp ${crt}/lib/crtn.o ''${out}/lib
+    cp ${crt}/lib/crti.o ''${out}/lib
+    cp ${libtcc1} ''${out}/lib/libtcc1.a
+    cp ${libc} ''${out}/lib/libc.a
+    cp ${libgetopt} ''${out}/lib/libgetopt.a
+  '';
+
+  buildTinyccMes =
+    { pname
+    , version
+    , src
+    , prev
+    , buildOptions
+    , libtccBuildOptions
+    , meta
+    }:
+    let
+      options = lib.strings.concatStringsSep " " buildOptions;
+      libtccOptions = lib.strings.concatStringsSep " "
+        (["-c" "-D" "TCC_TARGET_I386=1" ] ++ libtccBuildOptions);
+      compiler =  kaem.runCommand "${pname}-${version}" {
+        inherit pname version meta;
+        passthru.tests = rec {
+          get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+            ${result}/bin/tcc -version
+            mkdir ''${out}
+          '';
+          chain = result: kaem.runCommand "${pname}-chain-${version}" {} ''
+            echo ${prev.compiler.tests.chain or prev.compiler.tests.get-version};
+            ${result}/bin/tcc -version
+            mkdir ''${out}
+          '';
+        };
+      } ''
+        catm config.h
+        mkdir -p ''${out}/bin
+        ${prev.compiler}/bin/tcc \
+          -B ${prev.libs}/lib \
+          -g \
+          -v \
+          -o ''${out}/bin/tcc \
+          -D BOOTSTRAP=1 \
+          ${options} \
+          -I . \
+          -I ${src} \
+          -D TCC_TARGET_I386=1 \
+          -D CONFIG_TCCDIR=\"\" \
+          -D CONFIG_SYSROOT=\"\" \
+          -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+          -D CONFIG_TCC_ELFINTERP=\"\" \
+          -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+          -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
+          -D TCC_LIBGCC=\"libc.a\" \
+          -D TCC_LIBTCC1=\"libtcc1.a\" \
+          -D CONFIG_TCCBOOT=1 \
+          -D CONFIG_TCC_STATIC=1 \
+          -D CONFIG_USE_LIBGCC=1 \
+          -D TCC_MES_LIBC=1 \
+          -D TCC_VERSION=\"${version}\" \
+          -D ONE_SOURCE=1 \
+          ${src}/tcc.c
+      '';
+    libs = recompileLibc {
+      inherit pname version src libtccOptions;
+      tcc = compiler;
+    };
+  in { inherit prev compiler libs; };
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-duplicate-symbols.patch b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-duplicate-symbols.patch
new file mode 100644
index 00000000000..0aec8b465bf
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-duplicate-symbols.patch
@@ -0,0 +1,13 @@
+--- tccelf.c
++++ tccelf.c
+@@ -710,8 +710,9 @@ ST_FUNC int set_elf_sym(Section *s, addr_t value, unsigned long size,
+ #if 0
+                 printf("new_bind=%x new_shndx=%x new_vis=%x old_bind=%x old_shndx=%x old_vis=%x\n",
+                        sym_bind, shndx, new_vis, esym_bind, esym->st_shndx, esym_vis);
+-#endif
+                 tcc_error_noabort("'%s' defined twice", name);
++#endif
++                goto do_patch;
+             }
+         } else {
+             esym->st_other = other;
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-static-inside-array.patch b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-static-inside-array.patch
new file mode 100644
index 00000000000..8dc2fe3fcfb
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-static-inside-array.patch
@@ -0,0 +1,21 @@
+--- tccgen.c
++++ tccgen.c
+@@ -4941,7 +4941,7 @@ static int post_type(CType *type, AttributeDef *ad, int storage, int td)
+         next();
+         n = -1;
+         t1 = 0;
+-        if (td & TYPE_PARAM) while (1) {
++        while (1) {
+ 	    /* XXX The optional type-quals and static should only be accepted
+ 	       in parameter decls.  The '*' as well, and then even only
+ 	       in prototypes (not function defs).  */
+@@ -4972,7 +4972,8 @@ static int post_type(CType *type, AttributeDef *ad, int storage, int td)
+             }
+             break;
+ 
+-	} else if (tok != ']') {
++	}
++    if (tok != ']') {
+             if (!local_stack || (storage & VT_STATIC))
+                 vpushi(expr_const());
+             else {
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
new file mode 100644
index 00000000000..55f6321412d
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
@@ -0,0 +1,96 @@
+# Build steps adapted from https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/tcc-0.9.27/tcc-0.9.27.kaem
+#
+# SPDX-FileCopyrightText: 2021-22 fosslinux <fosslinux@aussies.space>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+{ lib
+, fetchurl
+, callPackage
+, kaem
+, tinycc-bootstrappable
+}:
+let
+  inherit (callPackage ./common.nix { }) buildTinyccMes;
+
+  version = "unstable-2023-04-20";
+  rev = "86f3d8e33105435946383aee52487b5ddf918140";
+
+  tarball = fetchurl {
+    url = "https://repo.or.cz/tinycc.git/snapshot/${rev}.tar.gz";
+    sha256 = "11idrvbwfgj1d03crv994mpbbbyg63j1k64lw1gjy7mkiifw2xap";
+  };
+  src = (kaem.runCommand "tinycc-${version}-source" {} ''
+    ungz --file ${tarball} --output tinycc.tar
+    mkdir -p ''${out}
+    cd ''${out}
+    untar --file ''${NIX_BUILD_TOP}/tinycc.tar
+
+    # Patch
+    cd tinycc-${builtins.substring 0 7 rev}
+    # Static link by default
+    replace --file libtcc.c --output libtcc.c --match-on "s->ms_extensions = 1;" --replace-with "s->ms_extensions = 1; s->static_link = 1;"
+  '') + "/tinycc-${builtins.substring 0 7 rev}";
+
+  meta = with lib; {
+    description = "Small, fast, and embeddable C compiler and interpreter";
+    homepage = "https://repo.or.cz/w/tinycc.git";
+    license = licenses.lgpl21Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  tccdefs = kaem.runCommand "tccdefs-${version}" {} ''
+    mkdir ''${out}
+    ${tinycc-bootstrappable.compiler}/bin/tcc \
+      -B ${tinycc-bootstrappable.libs}/lib \
+      -DC2STR \
+      -o c2str \
+      ${src}/conftest.c
+    ./c2str ${src}/include/tccdefs.h ''${out}/tccdefs_.h
+  '';
+
+  tinycc-mes-boot = buildTinyccMes {
+    pname = "tinycc-mes-boot";
+    inherit src version meta;
+    prev = tinycc-bootstrappable;
+    buildOptions = [
+      "-D HAVE_BITFIELD=1"
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D HAVE_SETJMP=1"
+      "-D CONFIG_TCC_PREDEFS=1"
+      "-I ${tccdefs}"
+      "-D CONFIG_TCC_SEMLOCK=0"
+    ];
+    libtccBuildOptions = [
+      "-D HAVE_FLOAT=1"
+      "-D HAVE_LONG_LONG=1"
+      "-D CONFIG_TCC_PREDEFS=1"
+      "-I ${tccdefs}"
+      "-D CONFIG_TCC_SEMLOCK=0"
+    ];
+  };
+in
+buildTinyccMes {
+  pname = "tinycc-mes";
+  inherit src version meta;
+  prev = tinycc-mes-boot;
+  buildOptions = [
+    "-std=c99"
+    "-D HAVE_BITFIELD=1"
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D HAVE_SETJMP=1"
+    "-D CONFIG_TCC_PREDEFS=1"
+    "-I ${tccdefs}"
+    "-D CONFIG_TCC_SEMLOCK=0"
+  ];
+  libtccBuildOptions = [
+    "-D HAVE_FLOAT=1"
+    "-D HAVE_LONG_LONG=1"
+    "-D CONFIG_TCC_PREDEFS=1"
+    "-I ${tccdefs}"
+    "-D CONFIG_TCC_SEMLOCK=0"
+  ];
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix
new file mode 100644
index 00000000000..4d26faac20b
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix
@@ -0,0 +1,155 @@
+{ lib
+, fetchurl
+, callPackage
+, bash
+, tinycc-bootstrappable
+, musl
+, gnupatch
+, gnutar
+, gzip
+}:
+let
+  pname = "tinycc-musl";
+  # next commit introduces use of realpath (unsupported in mes-libc)
+  version = "unstable-2023-07-10";
+  rev = "fd6d2180c5c801bb0b4c5dde27d61503059fc97d";
+
+  src = fetchurl {
+    url = "https://repo.or.cz/tinycc.git/snapshot/${rev}.tar.gz";
+    hash = "sha256-R81SNbEmh4s9FNQxCWZwUiMCYRkkwOHAdRf0aMnnRiA=";
+  };
+
+  patches = [
+    ./ignore-duplicate-symbols.patch
+    ./ignore-static-inside-array.patch
+    ./static-link.patch
+  ];
+
+  meta = with lib; {
+    description = "Small, fast, and embeddable C compiler and interpreter";
+    homepage = "https://repo.or.cz/w/tinycc.git";
+    license = licenses.lgpl21Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  tinycc-musl = bash.runCommand "${pname}-${version}" {
+    inherit pname version meta;
+
+    nativeBuildInputs = [
+      tinycc-bootstrappable.compiler
+      gnupatch
+      gnutar
+      gzip
+    ];
+  } ''
+    # Unpack
+    tar xzf ${src}
+    cd tinycc-${builtins.substring 0 7 rev}
+
+    # Patch
+    ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+    # Configure
+    touch config.h
+
+    # Build
+    # We first have to recompile using tcc-0.9.26 as tcc-0.9.27 is not self-hosting,
+    # but when linked with musl it is.
+    ln -s ${musl}/lib/libtcc1.a ./libtcc1.a
+
+    tcc \
+      -B ${tinycc-bootstrappable.libs}/lib \
+      -DC2STR \
+      -o c2str \
+      conftest.c
+    ./c2str include/tccdefs.h tccdefs_.h
+
+    tcc -v \
+      -static \
+      -o tcc-musl \
+      -D TCC_TARGET_I386=1 \
+      -D CONFIG_TCCDIR=\"\" \
+      -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+      -D CONFIG_TCC_ELFINTERP=\"/musl/loader\" \
+      -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+      -D CONFIG_TCC_SYSINCLUDEPATHS=\"${musl}/include\" \
+      -D TCC_LIBGCC=\"libc.a\" \
+      -D TCC_LIBTCC1=\"libtcc1.a\" \
+      -D CONFIG_TCC_STATIC=1 \
+      -D CONFIG_USE_LIBGCC=1 \
+      -D TCC_VERSION=\"0.9.27\" \
+      -D ONE_SOURCE=1 \
+      -D TCC_MUSL=1 \
+      -D CONFIG_TCC_PREDEFS=1 \
+      -D CONFIG_TCC_SEMLOCK=0 \
+      -B . \
+      -B ${tinycc-bootstrappable.libs}/lib \
+      tcc.c
+    # libtcc1.a
+    rm -f libtcc1.a
+    tcc -c -D HAVE_CONFIG_H=1 lib/libtcc1.c
+    tcc -ar cr libtcc1.a libtcc1.o
+
+    # Rebuild tcc-musl with itself
+    ./tcc-musl \
+      -v \
+      -static \
+      -o tcc-musl \
+      -D TCC_TARGET_I386=1 \
+      -D CONFIG_TCCDIR=\"\" \
+      -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+      -D CONFIG_TCC_ELFINTERP=\"/musl/loader\" \
+      -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+      -D CONFIG_TCC_SYSINCLUDEPATHS=\"${musl}/include\" \
+      -D TCC_LIBGCC=\"libc.a\" \
+      -D TCC_LIBTCC1=\"libtcc1.a\" \
+      -D CONFIG_TCC_STATIC=1 \
+      -D CONFIG_USE_LIBGCC=1 \
+      -D TCC_VERSION=\"0.9.27\" \
+      -D ONE_SOURCE=1 \
+      -D TCC_MUSL=1 \
+      -D CONFIG_TCC_PREDEFS=1 \
+      -D CONFIG_TCC_SEMLOCK=0 \
+      -B . \
+      -B ${musl}/lib \
+      tcc.c
+    # libtcc1.a
+    rm -f libtcc1.a
+    ./tcc-musl -c -D HAVE_CONFIG_H=1 lib/libtcc1.c
+    ./tcc-musl -c -D HAVE_CONFIG_H=1 lib/alloca.S
+    ./tcc-musl -ar cr libtcc1.a libtcc1.o alloca.o
+
+    # Install
+    install -D tcc-musl $out/bin/tcc
+    install -Dm444 libtcc1.a $out/lib/libtcc1.a
+  '';
+in
+{
+  compiler = bash.runCommand "${pname}-${version}-compiler" {
+    inherit pname version meta;
+    passthru.tests.hello-world = result:
+      bash.runCommand "${pname}-simple-program-${version}" {} ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        ${result}/bin/tcc -v -static -B${musl}/lib -o test test.c
+        ./test
+        mkdir $out
+      '';
+    passthru.tinycc-musl = tinycc-musl;
+  } "install -D ${tinycc-musl}/bin/tcc $out/bin/tcc";
+
+  libs = bash.runCommand "${pname}-${version}-libs" {
+    inherit pname version meta;
+  } ''
+    mkdir $out
+    cp -r ${musl}/* $out
+    chmod +w $out/lib/libtcc1.a
+    cp ${tinycc-musl}/lib/libtcc1.a $out/lib/libtcc1.a
+  '';
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/static-link.patch b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/static-link.patch
new file mode 100644
index 00000000000..671a3b37f98
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/static-link.patch
@@ -0,0 +1,10 @@
+--- libtcc.c
++++ libtcc.c
+@@ -793,6 +793,7 @@ LIBTCCAPI TCCState *tcc_new(void)
+ 
+     s->gnu_ext = 1;
+     s->tcc_ext = 1;
++    s->static_link = 1;
+     s->nocommon = 1;
+     s->dollars_in_identifiers = 1; /*on by default like in gcc/clang*/
+     s->cversion = 199901; /* default unless -std=c11 is supplied */
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
new file mode 100644
index 00000000000..cc8c0461916
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
@@ -0,0 +1,60 @@
+{ lib
+, buildPlatform
+, callPackage
+, kaem
+, mescc-tools-extra
+, checkMeta
+}:
+rec {
+  derivationWithMeta = attrs:
+    let
+      passthru = attrs.passthru or {};
+      validity = checkMeta.assertValidity { inherit meta attrs; };
+      meta = checkMeta.commonMeta { inherit validity attrs; };
+      baseDrv = derivation ({
+        inherit (buildPlatform) system;
+        inherit (meta) name;
+      } // (builtins.removeAttrs attrs [ "meta" "passthru" ]));
+      passthru' = passthru // lib.optionalAttrs (passthru ? tests) {
+        tests = lib.mapAttrs (_: f: f baseDrv) passthru.tests;
+      };
+    in
+    lib.extendDerivation
+      validity.handled
+      ({ inherit meta; passthru = passthru'; } // passthru')
+      baseDrv;
+
+  writeTextFile =
+    { name # the name of the derivation
+    , text
+    , executable ? false # run chmod +x ?
+    , destination ? ""   # relative path appended to $out eg "/bin/foo"
+    }:
+    derivationWithMeta {
+      inherit name text;
+      passAsFile = [ "text" ];
+
+      builder = "${kaem}/bin/kaem";
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (builtins.toFile "write-text-file.kaem" (''
+          target=''${out}''${destination}
+        '' + lib.optionalString (builtins.dirOf destination == ".") ''
+          mkdir -p ''${out}''${destinationDir}
+        '' + ''
+          cp ''${textPath} ''${target}
+        '' + lib.optionalString executable ''
+          chmod 555 ''${target}
+        ''))
+      ];
+
+      PATH = lib.makeBinPath [ mescc-tools-extra ];
+      destinationDir = builtins.dirOf destination;
+      inherit destination;
+    };
+
+  writeText = name: text: writeTextFile {inherit name text;};
+
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
new file mode 100644
index 00000000000..8dcccbacaca
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
@@ -0,0 +1,70 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnused
+, gnugrep
+, gawk
+, gnutar
+, gzip
+}:
+let
+  pname = "xz";
+  version = "5.4.3";
+
+  src = fetchurl {
+    url = "https://tukaani.org/xz/xz-${version}.tar.gz";
+    hash = "sha256-HDguC8Lk4K9YOYqQPdYv/35RAXHS3keh6+BtFSjpt+k=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/xz --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "A general-purpose data compression software, successor of LZMA";
+    homepage = "https://tukaani.org/xz";
+    license = with licenses; [ gpl2Plus lgpl21Plus ];
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd xz-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export LD=tcc
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-shared \
+    --disable-assembler
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/pkgs/os-specific/linux/miraclecast/default.nix b/pkgs/os-specific/linux/miraclecast/default.nix
index b5efaa40afe..7b502fa4ade 100644
--- a/pkgs/os-specific/linux/miraclecast/default.nix
+++ b/pkgs/os-specific/linux/miraclecast/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
     description = "Connect external monitors via Wi-Fi";
     homepage    = "https://github.com/albfan/miraclecast";
     license     = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ tstrobel ];
+    maintainers = with maintainers; [ ];
     platforms   = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
index eeea1d74dca..da2ba4b9ff2 100644
--- a/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/mkinitcpio-nfs-utils/default.nix
@@ -1,13 +1,14 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "mkinitcpio-nfs-utils-0.3";
+  pname = "mkinitcpio-nfs-utils";
+  version = "0.3";
 
   src = fetchurl {
-    url = "https://sources.archlinux.org/other/mkinitcpio/${name}.tar.xz";
+    url = "https://sources.archlinux.org/other/mkinitcpio/mkinitcpio-nfs-utils-${version}.tar.xz";
     sha256 = "0fc93sfk41ycpa33083kyd7i4y00ykpbhj5qlw611bjghj4x946j";
     # ugh, upstream...
-    name = "${name}.tar.gz";
+    name = "mkinitcpio-nfs-utils-${version}.tar.gz";
   };
 
   makeFlags = [ "DESTDIR=$(out)" "bindir=/bin" ];
diff --git a/pkgs/os-specific/linux/mmc-utils/default.nix b/pkgs/os-specific/linux/mmc-utils/default.nix
index 7430182e5d2..0fea46da56d 100644
--- a/pkgs/os-specific/linux/mmc-utils/default.nix
+++ b/pkgs/os-specific/linux/mmc-utils/default.nix
@@ -1,27 +1,35 @@
-{ lib, stdenv, fetchgit }:
+{ lib, stdenv, fetchzip, unstableGitUpdater }:
 
 stdenv.mkDerivation {
   pname = "mmc-utils";
-  version = "2021-05-11";
+  version = "unstable-2023-10-10";
 
-  src = fetchgit {
-    url = "git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc-utils.git";
-    rev = "43282e80e174cc73b09b81a4d17cb3a7b4dc5cfc";
-    sha256 = "0l06ahmprqshh75pkdpagb8fgnp2bwn8q8hwp1yl3laww2ghm8i5";
+  src = fetchzip rec {
+    url = "https://git.kernel.org/pub/scm/utils/mmc/mmc-utils.git/snapshot/mmc-utils-${passthru.rev}.tar.gz";
+    passthru.rev = "b5ca140312d279ad2f22068fd72a6230eea13436";
+    sha256 = "QU4r8eajrrhT6u6WHEf1xtB1iyecBeHxu4vS+QcwAgM=";
   };
 
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "prefix=$(out)" ];
 
-  installPhase = ''
-    make install prefix=$out
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
+
+  postInstall = ''
     mkdir -p $out/share/man/man1
     cp man/mmc.1 $out/share/man/man1/
   '';
 
+  enableParallelBuilding = true;
+
+  passthru.updateScript = unstableGitUpdater {
+    url = "https://git.kernel.org/pub/scm/utils/mmc/mmc-utils.git";
+  };
+
   meta = with lib; {
     description = "Configure MMC storage devices from userspace";
-    homepage = "http://git.kernel.org/cgit/linux/kernel/git/cjb/mmc-utils.git/";
-    license = licenses.gpl2;
+    homepage = "https://git.kernel.org/pub/scm/utils/mmc/mmc-utils.git/";
+    license = licenses.gpl2Only;
     maintainers = [ maintainers.dezgeg ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/molly-guard/default.nix b/pkgs/os-specific/linux/molly-guard/default.nix
index de396e4f5c7..1100751f451 100644
--- a/pkgs/os-specific/linux/molly-guard/default.nix
+++ b/pkgs/os-specific/linux/molly-guard/default.nix
@@ -11,10 +11,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ dpkg ];
 
-  sourceRoot = ".";
-
   unpackCmd = ''
-    dpkg-deb -x "$src" .
+    dpkg-deb -x "$src" source
   '';
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/msr/000-include-sysmacros.patch b/pkgs/os-specific/linux/msr/000-include-sysmacros.patch
new file mode 100644
index 00000000000..5fa96cd1469
--- /dev/null
+++ b/pkgs/os-specific/linux/msr/000-include-sysmacros.patch
@@ -0,0 +1,11 @@
+diff -Naur msr-old/msr.c msr-20060208/msr.c
+--- msr-old/msr.c	1969-12-31 21:00:01.000000000 -0300
++++ msr-20060208/msr.c	2021-11-02 21:19:34.576722617 -0300
+@@ -19,6 +19,7 @@
+ #include <stdio.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
++#include <sys/sysmacros.h>
+ #include <fcntl.h>
+ #include <errno.h>
+ #include <unistd.h>
diff --git a/pkgs/os-specific/linux/msr/default.nix b/pkgs/os-specific/linux/msr/default.nix
new file mode 100644
index 00000000000..0ffc4601209
--- /dev/null
+++ b/pkgs/os-specific/linux/msr/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchzip
+, installShellFiles
+}:
+
+stdenv.mkDerivation rec {
+  pname = "msr";
+  version = "20060208";
+
+  src = fetchzip {
+    name = "${pname}-${version}";
+    url = "http://www.etallen.com/msr/${pname}-${version}.src.tar.gz";
+    hash = "sha256-e01qYWbOALkXp5NpexuVodMxA3EBySejJ6ZBpZjyT+E=";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  patches = [
+    ./000-include-sysmacros.patch
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin/
+    cp msr $out/bin/
+    installManPage msr.man
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "http://www.etallen.com/msr.html";
+    description = "Linux tool to display or modify x86 model-specific registers (MSRs)";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/mstflint_access/default.nix b/pkgs/os-specific/linux/mstflint_access/default.nix
new file mode 100644
index 00000000000..6e29e27ccbf
--- /dev/null
+++ b/pkgs/os-specific/linux/mstflint_access/default.nix
@@ -0,0 +1,40 @@
+{ lib, stdenv, fetchurl, kernel, kmod, mstflint }:
+
+stdenv.mkDerivation rec {
+  pname = "mstflint_access";
+  inherit (mstflint) version;
+
+  src = fetchurl {
+    url = "https://github.com/Mellanox/mstflint/releases/download/v${version}/kernel-mstflint-${version}.tar.gz";
+    hash = "sha256-rfZts0m8x6clVazpbAa2xK+dYgRU9Us5rbcWa0uHJ1M=";
+  };
+
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "KVER=${kernel.modDirVersion}"
+    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  preConfigure = lib.optionals (lib.versionAtLeast kernel.version "6.4") ''
+    sed -i "s/class_create(THIS_MODULE, dev->name)/class_create(dev->name)/g" mst_main.c
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ${pname}.ko $out/lib/modules/${kernel.modDirVersion}/extra/${pname}.ko
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A kernel module for Nvidia NIC firmware update";
+    homepage = "https://github.com/Mellanox/mstflint";
+    license = [ licenses.gpl2Only ];
+    maintainers = with maintainers; [ thillux ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/multipath-tools/default.nix b/pkgs/os-specific/linux/multipath-tools/default.nix
index 24149805723..5ec8197451c 100644
--- a/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -1,26 +1,40 @@
-{ lib, stdenv, fetchurl, pkg-config, perl, lvm2, libaio, gzip, readline, systemd, liburcu, json_c, kmod }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, coreutils
+
+, perl
+, pkg-config
+
+, json_c
+, libaio
+, liburcu
+, linuxHeaders
+, lvm2
+, readline
+, systemd
+, util-linuxMinimal
+
+, cmocka
+, nixosTests
+}:
 
 stdenv.mkDerivation rec {
   pname = "multipath-tools";
-  version = "0.8.3";
+  version = "0.9.6";
 
-  src = fetchurl {
-    name = "${pname}-${version}.tar.gz";
-    url = "https://git.opensvc.com/gitweb.cgi?p=multipath-tools/.git;a=snapshot;h=refs/tags/${version};sf=tgz";
-    sha256 = "1mgjylklh1cx8px8ffgl12kyc0ln3445vbabd2sy8chq31rpiiq8";
+  src = fetchFromGitHub {
+    owner = "opensvc";
+    repo = "multipath-tools";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-X4sAMGn4oBMY3cQkVj1dMcrDF7FgMl8SbZeUnCCOY6Q=";
   };
 
-  patches = [
-    # fix build with json-c 0.14 https://www.redhat.com/archives/dm-devel/2020-May/msg00261.html
-    ./json-c-0.14.patch
-  ];
-
   postPatch = ''
-    substituteInPlace libmultipath/Makefile \
-      --replace /usr/include/libdevmapper.h ${lib.getDev lvm2}/include/libdevmapper.h
+    substituteInPlace create-config.mk \
+      --replace /bin/echo ${coreutils}/bin/echo
 
     substituteInPlace multipathd/multipathd.service \
-      --replace /sbin/modprobe ${lib.getBin kmod}/sbin/modprobe \
       --replace /sbin/multipathd "$out/bin/multipathd"
 
     sed -i -re '
@@ -30,22 +44,46 @@ stdenv.mkDerivation rec {
       kpartx/Makefile libmpathpersist/Makefile
     sed -i -e "s,GZIP,GZ," \
       $(find * -name Makefile\*)
+
+    sed '1i#include <assert.h>' -i tests/{util,vpd}.c
   '';
 
-  nativeBuildInputs = [ gzip pkg-config perl ];
-  buildInputs = [ systemd lvm2 libaio readline liburcu json_c ];
+  nativeBuildInputs = [
+    perl
+    pkg-config
+  ];
+  buildInputs = [
+    json_c
+    libaio
+    liburcu
+    linuxHeaders
+    lvm2
+    readline
+    systemd
+    util-linuxMinimal # for libmount
+  ];
 
   makeFlags = [
     "LIB=lib"
     "prefix=$(out)"
+    "systemd_prefix=$(out)"
+    "kernel_incdir=${linuxHeaders}/include/"
     "man8dir=$(out)/share/man/man8"
     "man5dir=$(out)/share/man/man5"
     "man3dir=$(out)/share/man/man3"
-    "SYSTEMDPATH=lib"
   ];
 
+  doCheck = true;
+  preCheck = ''
+    # skip test attempting to access /sys/dev/block
+    substituteInPlace tests/Makefile --replace ' devt ' ' '
+  '';
+  nativeCheckInputs = [ cmocka ];
+
+  passthru.tests = { inherit (nixosTests) iscsi-multipath-root; };
+
   meta = with lib; {
-    description = "Tools for the Linux multipathing driver";
+    description = "Tools for the Linux multipathing storage driver";
     homepage = "http://christophe.varoqui.free.fr/";
     license = licenses.gpl2;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch b/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch
deleted file mode 100644
index d5fee424883..00000000000
--- a/pkgs/os-specific/linux/multipath-tools/json-c-0.14.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/libdmmp/libdmmp_private.h b/libdmmp/libdmmp_private.h
-index ac85b63f..b1a6ddea 100644
---- a/libdmmp/libdmmp_private.h
-+++ b/libdmmp/libdmmp_private.h
-@@ -30,6 +30,7 @@
- #include <stdint.h>
- #include <string.h>
- #include <assert.h>
-+#include <stdbool.h>
- #include <json.h>
- 
- #include "libdmmp/libdmmp.h"
-@@ -82,7 +83,7 @@ static out_type func_name(struct dmmp_context *ctx, const char *var_name) { \
- do { \
- 	json_type j_type = json_type_null; \
- 	json_object *j_obj_tmp = NULL; \
--	if (json_object_object_get_ex(j_obj, key, &j_obj_tmp) != TRUE) { \
-+	if (json_object_object_get_ex(j_obj, key, &j_obj_tmp) != true) { \
- 		_error(ctx, "Invalid JSON output from multipathd IPC: " \
- 		       "key '%s' not found", key); \
- 		rc = DMMP_ERR_IPC_ERROR; \
diff --git a/pkgs/os-specific/linux/musl-obstack/default.nix b/pkgs/os-specific/linux/musl-obstack/default.nix
index f7682d37efd..ec183da7048 100644
--- a/pkgs/os-specific/linux/musl-obstack/default.nix
+++ b/pkgs/os-specific/linux/musl-obstack/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "musl-obstack";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "void-linux";
     repo = "musl-obstack";
     rev = "v${version}";
-    sha256 = "v0RTnrqAmJfOeGsJFc04lqFR8QZhYiLyvy8oRYiuC80=";
+    sha256 = "sha256-oydS7FubUniMHAUWfg84OH9+CZ0JCrTXy7jzwOyJzC8=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
diff --git a/pkgs/os-specific/linux/musl/default.nix b/pkgs/os-specific/linux/musl/default.nix
index ae175a36324..9f7867065ea 100644
--- a/pkgs/os-specific/linux/musl/default.nix
+++ b/pkgs/os-specific/linux/musl/default.nix
@@ -4,20 +4,24 @@
 }:
 let
   cdefs_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-cdefs.h";
+    name = "sys-cdefs.h";
+    url = "https://git.alpinelinux.org/aports/plain/main/libc-dev/sys-cdefs.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "16l3dqnfq0f20rzbkhc38v74nqcsh9n3f343bpczqq8b1rz6vfrh";
   };
   queue_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-queue.h";
+    name = "sys-queue.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-queue.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "12qm82id7zys92a1qh2l1qf2wqgq6jr4qlbjmqyfffz3s3nhfd61";
   };
   tree_h = fetchurl {
-    url = "http://git.alpinelinux.org/cgit/aports/plain/main/libc-dev/sys-tree.h";
+    name = "sys-tree.h";
+    url = "http://git.alpinelinux.org/aports/plain/main/libc-dev/sys-tree.h?id=7ca0ed62d4c0d713d9c7dd5b9a077fba78bce578";
     sha256 = "14igk6k00bnpfw660qhswagyhvr0gfqg4q55dxvaaq7ikfkrir71";
   };
 
   stack_chk_fail_local_c = fetchurl {
-    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?h=3.10-stable";
+    name = "__stack_chk_fail_local.c";
+    url = "https://git.alpinelinux.org/aports/plain/main/musl/__stack_chk_fail_local.c?id=9afbe3cbbf4c30ff23c733218c3c03d7e8c6461d";
     sha256 = "1nhkzzy9pklgjcq2yg89d3l18jif331srd3z3vhy5qwxl1spv6i9";
   };
 
@@ -40,11 +44,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "musl";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchurl {
     url    = "https://musl.libc.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "1p8r6bac64y98ln0wzmnixysckq3crca69ys7p16sy9d04i975lv";
+    sha256 = "sha256-fVsLYGJSHkYn4JnkydyCSNMqMChelZt+7Kp4DPjP1KQ=";
   };
 
   enableParallelBuilding = true;
@@ -67,6 +71,12 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/openwrt/openwrt/87606e25afac6776d1bbc67ed284434ec5a832b4/toolchain/musl/patches/300-relative.patch";
       sha256 = "0hfadrycb60sm6hb6by4ycgaqc9sgrhh42k39v8xpmcvdzxrsq2n";
     })
+
+    # fix parsing lines with optional fields in fstab etc. NOTE: Remove for the next release since it has been merged upstream
+    (fetchurl {
+      url = "https://git.musl-libc.org/cgit/musl/patch/?id=751bee0ee727e8d8b003c87cff77ac76f1dbecd6";
+      sha256 = "sha256-qCw132TCSaZrkISmtDb8Q8ufyt8sAJdwACkvfwuoi/0=";
+    })
   ];
   CFLAGS = [ "-fstack-protector-strong" ]
     ++ lib.optional stdenv.hostPlatform.isPower "-mlong-double-64";
@@ -79,20 +89,20 @@ stdenv.mkDerivation rec {
     "--syslibdir=${placeholder "out"}/lib"
   ];
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "bin" "dev" ];
 
   dontDisableStatic = true;
+  dontAddStaticConfigureFlags = true;
   separateDebugInfo = true;
 
   NIX_DONT_SET_RPATH = true;
 
   preBuild = ''
-    ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
+    ${lib.optionalString (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32)
     "# the -x c flag is required since the file extension confuses gcc
     # that detect the file as a linker script.
     $CC -x c -c ${stack_chk_fail_local_c} -o __stack_chk_fail_local.o
     $AR r libssp_nonshared.a __stack_chk_fail_local.o"
-      else ""
     }
   '';
 
@@ -101,19 +111,12 @@ stdenv.mkDerivation rec {
     # Apparently glibc provides scsi itself?
     (cd $dev/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
 
-    # Strip debug out of the static library
-    $STRIP -S $out/lib/libc.a
-    mkdir -p $out/bin
-
-
-    ${if (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32) then
-      "install -D libssp_nonshared.a $out/lib/libssp_nonshared.a
-      $STRIP -S $out/lib/libssp_nonshared.a"
-      else ""
+    ${lib.optionalString (stdenv.targetPlatform.libc == "musl" && stdenv.targetPlatform.isx86_32)
+      "install -D libssp_nonshared.a $out/lib/libssp_nonshared.a"
     }
 
     # Create 'ldd' symlink, builtin
-    ln -rs $out/lib/libc.so $out/bin/ldd
+    ln -s $out/lib/libc.so $bin/bin/ldd
 
     # (impure) cc wrapper around musl for interactive usuage
     for i in musl-gcc musl-clang ld.musl-clang; do
@@ -124,7 +127,7 @@ stdenv.mkDerivation rec {
       --replace $out/lib/musl-gcc.specs $dev/lib/musl-gcc.specs
 
     # provide 'iconv' utility, using just-built headers, libc/ldso
-    $CC ${iconv_c} -o $out/bin/iconv \
+    $CC ${iconv_c} -o $bin/bin/iconv \
       -I$dev/include \
       -L$out/lib -Wl,-rpath=$out/lib \
       -lc \
@@ -146,7 +149,13 @@ stdenv.mkDerivation rec {
     homepage    = "https://musl.libc.org/";
     changelog   = "https://git.musl-libc.org/cgit/musl/tree/WHATSNEW?h=v${version}";
     license     = licenses.mit;
-    platforms   = platforms.linux;
+    platforms   = [
+      "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux"
+      "armv7l-linux" "i686-linux" "x86_64-linux" "m68k-linux"
+      "microblaze-linux" "microblazeel-linux" "mips-linux" "mips64-linux"
+      "mipsel-linux" "mips64el-linux" "powerpc64-linux" "powerpc64le-linux"
+      "riscv64-linux" "s390x-linux"
+    ];
     maintainers = with maintainers; [ thoughtpolice dtzWill ];
   };
 }
diff --git a/pkgs/os-specific/linux/mwprocapture/default.nix b/pkgs/os-specific/linux/mwprocapture/default.nix
index ca5b82b8785..9185f50674f 100644
--- a/pkgs/os-specific/linux/mwprocapture/default.nix
+++ b/pkgs/os-specific/linux/mwprocapture/default.nix
@@ -4,25 +4,25 @@ with lib;
 
 let
   bits =
-  if stdenv.is64bit then "64"
-  else "32";
+    if stdenv.is64bit then "64"
+    else "32";
 
-  libpath = makeLibraryPath [ stdenv.cc.cc stdenv.glibc alsa-lib ];
+  libpath = makeLibraryPath [ stdenv.cc.cc stdenv.cc.libc alsa-lib ];
 
 in
 stdenv.mkDerivation rec {
-  name = "mwprocapture-1.3.0.${version}-${kernel.version}";
-  version = "4236";
+  pname = "mwprocapture";
+  subVersion = "4373";
+  version = "1.3.0.${subVersion}-${kernel.version}";
 
   src = fetchurl {
-    url = "https://www.magewell.com/files/drivers/ProCaptureForLinux_${version}.tar.gz";
-    sha256 = "1mfgj84km276sq5i8dny1vqp2ycqpvgplrmpbqwnk230d0w3qs74";
+    url = "https://www.magewell.com/files/drivers/ProCaptureForLinux_${subVersion}.tar.gz";
+    sha256 = "sha256-/6q+6CTlgkHOgq1PF8dSPfl/xm/UFczr/AGkac2mXZ8=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  preConfigure =
-  ''
+  preConfigure = ''
     cd ./src
     export INSTALL_MOD_PATH="$out"
   '';
@@ -33,6 +33,8 @@ stdenv.mkDerivation rec {
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-fallthrough";
+
   postInstall = ''
     cd ../
     mkdir -p $out/bin
@@ -55,11 +57,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = "http://www.magewell.com/";
+    homepage = "https://www.magewell.com/";
     description = "Linux driver for the Magewell Pro Capture family";
     license = licenses.unfreeRedistributable;
-    maintainers = with maintainers; [ MP2E ];
+    maintainers = with maintainers; [ flexiondotorg MP2E ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "3.2.0";
   };
 }
diff --git a/pkgs/os-specific/linux/mxu11x0/default.nix b/pkgs/os-specific/linux/mxu11x0/default.nix
index 3498625be75..17d0c693820 100644
--- a/pkgs/os-specific/linux/mxu11x0/default.nix
+++ b/pkgs/os-specific/linux/mxu11x0/default.nix
@@ -1,16 +1,19 @@
 { lib, stdenv, fetchurl, kernel }:
 
-stdenv.mkDerivation {
-  name = "mxu11x0-1.4-${kernel.version}";
+let
+  srcs = import (./srcs.nix) { inherit fetchurl; };
+in
+stdenv.mkDerivation rec {
+  pname = "mxu11x0";
 
-  src = fetchurl {
-    url = "https://www.moxa.com/Moxa/media/PDIM/S100000385/moxa-uport-1000-series-linux-3.x-and-4.x-for-uport-11x0-series-driver-v1.4.tgz";
-    sha256 = "1hz9ygabbp8pv49k1j4qcsr0v3zw9xy0bh1akqgxp5v29gbdgxjl";
-  };
+  src = if lib.versionAtLeast kernel.version "5.0" then srcs.mxu11x0_5.src else srcs.mxu11x0_4.src;
+  mxu_version = if lib.versionAtLeast kernel.version "5.0" then srcs.mxu11x0_5.version else srcs.mxu11x0_4.version;
+
+  version = mxu_version + "-${kernel.version}";
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   preBuild = ''
-    sed -i -e "s/\$(uname -r).*/${kernel.modDirVersion}/g" driver/mxconf
-    sed -i -e "s/\$(shell uname -r).*/${kernel.modDirVersion}/g" driver/Makefile
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/mxconf
     sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' driver/Makefile
   '';
@@ -32,6 +35,8 @@ stdenv.mkDerivation {
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ uralbash ];
     platforms = platforms.linux;
-    broken = kernel.kernelAtLeast "5.4";
+    # broken due to API change in write_room() > v5.14-rc1
+    # https://github.com/torvalds/linux/commit/94cc7aeaf6c0cff0b8aeb7cb3579cee46b923560
+    broken = kernel.kernelAtLeast "5.14";
   };
 }
diff --git a/pkgs/os-specific/linux/mxu11x0/srcs.nix b/pkgs/os-specific/linux/mxu11x0/srcs.nix
new file mode 100644
index 00000000000..1f7b75e6bc1
--- /dev/null
+++ b/pkgs/os-specific/linux/mxu11x0/srcs.nix
@@ -0,0 +1,18 @@
+{ fetchurl }:
+
+{
+  mxu11x0_4 = {
+    version = "4.1";
+    src = fetchurl {
+      url = "https://www.moxa.com/getmedia/b152d8c2-b9d6-4bc7-b0f4-420633b4bc2d/moxa-uport-1100-series-linux-kernel-4.x-driver-v4.1.tgz";
+      sha256 = "sha256-cM3imuMG483ZinFazVa8V4Id0kUGlHaezDHnYtSSb28=";
+    };
+  };
+  mxu11x0_5 = {
+    version = "5.1";
+    src = fetchurl {
+      url = "https://www.moxa.com/getmedia/57dfa4c1-8a2a-4da6-84c1-a36944ead74d/moxa-uport-1100-series-linux-kernel-5.x-driver-v5.1.tgz";
+      sha256 = "sha256-P1YMlyAhS955CSBiZ/tyu5m6ds2PiFMcHmyrdTjloPs=";
+    };
+  };
+}
diff --git a/pkgs/os-specific/linux/nct6687d/default.nix b/pkgs/os-specific/linux/nct6687d/default.nix
new file mode 100644
index 00000000000..493d0e6af10
--- /dev/null
+++ b/pkgs/os-specific/linux/nct6687d/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nct6687d";
+  version = "unstable-2023-09-22";
+
+  src = fetchFromGitHub {
+    owner = "Fred78290";
+    repo = "nct6687d";
+    rev = "cdfe855342a9383a9c4c918d51576c36d989070d";
+    hash = "sha256-iOLWxj4I6oYkNXFSkmw7meTQEnrIfb4Mw+/LkzgzDxM=";
+  };
+
+  setSourceRoot = ''
+    export sourceRoot=$(pwd)/source
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "-C" "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(sourceRoot)"
+  ];
+
+  buildFlags = [ "modules" ];
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = with lib; {
+    description = "Kernel module for the Nuvoton NCT6687-R chipset found on many B550/B650 motherboards from ASUS and MSI";
+    license = with licenses; [ gpl2Only ];
+    homepage = "https://github.com/Fred78290/nct6687d/";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ atemu ];
+  };
+}
diff --git a/pkgs/os-specific/linux/net-tools/default.nix b/pkgs/os-specific/linux/net-tools/default.nix
index 9630b5c0c7a..bedeaadc294 100644
--- a/pkgs/os-specific/linux/net-tools/default.nix
+++ b/pkgs/os-specific/linux/net-tools/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "2.10";
 
   src = fetchurl {
-    url = "mirror://gentoo/distfiles/${pname}-${version}.tar.xz";
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.xz";
     sha256 = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk=";
   };
 
diff --git a/pkgs/os-specific/linux/net-tools/mptcp.nix b/pkgs/os-specific/linux/net-tools/mptcp.nix
deleted file mode 100644
index 577b7c25311..00000000000
--- a/pkgs/os-specific/linux/net-tools/mptcp.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-{ lib, nettools, fetchFromGitHub  }:
-
-nettools.overrideAttrs(oa: rec {
-  name = "net-tools-mptcp";
-  version = "0.95";
-
-  src = fetchFromGitHub {
-    owner = "multipath-tcp";
-    repo = "net-tools";
-    rev = "mptcp_v${version}";
-    sha256 = "0i7gr1y699nc7j9qllsx8kicqkpkhw51x4chcmyl5xs06b2mdjri";
-  };
-
-  meta = with lib; {
-    homepage = "https://github.com/multipath-tcp/net-tools";
-    description = "A set of tools for controlling the network subsystem in Linux";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ teto ];
-  };
-})
diff --git a/pkgs/os-specific/linux/netatop/default.nix b/pkgs/os-specific/linux/netatop/default.nix
index 28f989929a4..d7d04e8368d 100644
--- a/pkgs/os-specific/linux/netatop/default.nix
+++ b/pkgs/os-specific/linux/netatop/default.nix
@@ -12,9 +12,11 @@ stdenv.mkDerivation {
     sha256 = "0qjw8glfdmngfvbn1w63q128vxdz2jlabw13y140ga9i5ibl6vvk";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
   buildInputs = [ kmod zlib ];
 
   hardeningDisable = [ "pic" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" ];
 
   patches = [
     # fix paths in netatop.service
@@ -36,6 +38,8 @@ stdenv.mkDerivation {
     kmod=${kmod} substituteAllInPlace netatop.service
   '';
 
+  makeFlags = kernel.makeFlags;
+
   preInstall = ''
     mkdir -p $out/lib/systemd/system $out/bin $out/sbin $out/share/man/man{4,8}
     mkdir -p $out/lib/modules/${kernel.modDirVersion}/extra
diff --git a/pkgs/os-specific/linux/new-lg4ff/default.nix b/pkgs/os-specific/linux/new-lg4ff/default.nix
new file mode 100644
index 00000000000..a92ee9ae64b
--- /dev/null
+++ b/pkgs/os-specific/linux/new-lg4ff/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, kernel, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "new-lg4ff";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "berarma";
+    repo = "new-lg4ff";
+    rev = version;
+    sha256 = "ZFwNdeJcSxzWtqjOF86SZpqhuz8jXZ2drvlQeIqsaNY=";
+  };
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "modules_install" "INSTALL_MOD_PATH=$out modules_install"
+    sed -i '/depmod/d' Makefile
+    sed -i "10i\\\trmmod hid-logitech 2> /dev/null || true" Makefile
+    sed -i "11i\\\trmmod hid-logitech-new 2> /dev/null || true" Makefile
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "KVERSION=${kernel.modDirVersion}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  meta = with lib; {
+    description = "Experimental Logitech force feedback module for Linux";
+    homepage = "https://github.com/berarma/new-lg4ff";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ matthiasbenaets ];
+    platforms = platforms.linux;
+    broken = stdenv.isAarch64;
+  };
+}
diff --git a/pkgs/os-specific/linux/nfs-utils/default.nix b/pkgs/os-specific/linux/nfs-utils/default.nix
index 7b5f6e72001..4fde1dcf910 100644
--- a/pkgs/os-specific/linux/nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/nfs-utils/default.nix
@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "nfs-utils";
-  version = "2.5.1";
+  version = "2.6.2";
 
   src = fetchurl {
-    url = "https://kernel.org/pub/linux/utils/nfs-utils/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1i1h3n2m35q9ixs1i2qf1rpjp10cipa3c25zdf1xj1vaw5q8270g";
+    url = "mirror://kernel/linux/utils/nfs-utils/${version}/${pname}-${version}.tar.xz";
+    hash = "sha256-UgCHPoHE1hDiRi/CYv4YE18tvni3l5+VrM0VmuZNUBE=";
   };
 
   # libnfsidmap is built together with nfs-utils from the same source,
@@ -46,13 +46,10 @@ stdenv.mkDerivation rec {
       "--enable-libmount-mount"
       "--with-pluginpath=${placeholder "lib"}/lib/libnfsidmap" # this installs libnfsidmap
       "--with-rpcgen=${buildPackages.rpcsvc-proto}/bin/rpcgen"
+      "--with-modprobedir=${placeholder "out"}/etc/modprobe.d"
     ];
 
   patches = lib.optionals stdenv.hostPlatform.isMusl [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/alpinelinux/aports/cb880042d48d77af412d4688f24b8310ae44f55f/main/nfs-utils/0011-exportfs-only-do-glibc-specific-hackery-on-glibc.patch";
-      sha256 = "0rrddrykz8prk0dcgfvmnz0vxn09dbgq8cb098yjjg19zz6d7vid";
-    })
     # http://openwall.com/lists/musl/2015/08/18/10
     (fetchpatch {
       url = "https://raw.githubusercontent.com/alpinelinux/aports/cb880042d48d77af412d4688f24b8310ae44f55f/main/nfs-utils/musl-getservbyport.patch";
@@ -71,6 +68,9 @@ stdenv.mkDerivation rec {
       substituteInPlace systemd/nfs-utils.service \
         --replace "/bin/true" "${coreutils}/bin/true"
 
+      substituteInPlace tools/nfsrahead/Makefile.in \
+        --replace "/usr/lib/udev/rules.d/" "$out/lib/udev/rules.d/"
+
       substituteInPlace utils/mount/Makefile.in \
         --replace "chmod 4511" "chmod 0511"
 
diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix
index f5fdee14c15..4482170d346 100644
--- a/pkgs/os-specific/linux/nftables/default.nix
+++ b/pkgs/os-specific/linux/nftables/default.nix
@@ -1,50 +1,60 @@
-{ lib, stdenv, fetchurl, pkg-config, bison, file, flex
+{ lib, stdenv, fetchurl, pkg-config, bison, flex
 , asciidoc, libxslt, findXMLCatalogs, docbook_xml_dtd_45, docbook_xsl
 , libmnl, libnftnl, libpcap
-, gmp, jansson, readline
+, gmp, jansson
+, autoreconfHook
 , withDebugSymbols ? false
-, withPython ? false , python3
-, withXtables ? false , iptables
+, withCli ? true, libedit
+, withPython ? false, python3
+, withXtables ? true, iptables
+, nixosTests
 }:
 
-with lib;
-
 stdenv.mkDerivation rec {
-  version = "0.9.9";
+  version = "1.0.9";
   pname = "nftables";
 
   src = fetchurl {
-    url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.bz2";
-    sha256 = "1d7iwc8xlyfsbgn6qx1sdfcq7jhpl8wpfj39hcd06y8dzp3jvvvn";
+    url = "https://netfilter.org/projects/nftables/files/${pname}-${version}.tar.xz";
+    hash = "sha256-o8MEzZugYSOe4EdPmvuTipu5nYm5YCRvZvDDoKheFM0=";
   };
 
   nativeBuildInputs = [
-    pkg-config bison file flex
+    autoreconfHook
+    pkg-config bison flex
     asciidoc docbook_xml_dtd_45 docbook_xsl findXMLCatalogs libxslt
   ];
 
   buildInputs = [
     libmnl libnftnl libpcap
-    gmp jansson readline
-  ] ++ optional withXtables iptables
-    ++ optional withPython python3;
-
-  preConfigure = ''
-    substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file
-  '';
+    gmp jansson
+  ] ++ lib.optional withCli libedit
+    ++ lib.optional withXtables iptables
+    ++ lib.optionals withPython [
+      python3
+      python3.pkgs.setuptools
+    ];
 
   configureFlags = [
     "--with-json"
-  ] ++ optional (!withDebugSymbols) "--disable-debug"
-    ++ optional (!withPython) "--disable-python"
-    ++ optional withPython "--enable-python"
-    ++ optional withXtables "--with-xtables";
+    (lib.withFeatureAs withCli "cli" "editline")
+  ] ++ lib.optional (!withDebugSymbols) "--disable-debug"
+    ++ lib.optional (!withPython) "--disable-python"
+    ++ lib.optional withPython "--enable-python"
+    ++ lib.optional withXtables "--with-xtables";
+
+  passthru.tests = {
+    inherit (nixosTests) firewall-nftables;
+    lxd-nftables = nixosTests.lxd.nftables;
+    nat = { inherit (nixosTests.nat.nftables) firewall standalone; };
+  };
 
-  meta = {
+  meta = with lib; {
     description = "The project that aims to replace the existing {ip,ip6,arp,eb}tables framework";
     homepage = "https://netfilter.org/projects/nftables/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ izorkin ];
+    maintainers = with maintainers; [ izorkin ajs124 ];
+    mainProgram = "nft";
   };
 }
diff --git a/pkgs/os-specific/linux/nix-ld/default.nix b/pkgs/os-specific/linux/nix-ld/default.nix
new file mode 100644
index 00000000000..84685e77aae
--- /dev/null
+++ b/pkgs/os-specific/linux/nix-ld/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, nixosTests
+}:
+let
+  libDir = if builtins.elem stdenv.system [ "x86_64-linux" "mips64-linux" "powerpc64le-linux" ]
+           then "/lib64"
+           else "/lib";
+in
+stdenv.mkDerivation rec {
+  pname = "nix-ld";
+  version = "1.2.2";
+
+  src = fetchFromGitHub {
+    owner = "mic92";
+    repo = "nix-ld";
+    rev = version;
+    hash = "sha256-+z9t7BLugZO1WhyYEq6FI38TMh2EwfgfAv3RDFSjwtc=";
+  };
+
+  doCheck = true;
+
+  nativeBuildInputs = [ meson ninja ];
+
+  mesonFlags = [
+    "-Dnix-system=${stdenv.system}"
+  ];
+
+  hardeningDisable = [
+    "stackprotector"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/nix-support
+
+    ldpath=${libDir}/$(basename $(< ${stdenv.cc}/nix-support/dynamic-linker))
+    echo "$ldpath" > $out/nix-support/ldpath
+    mkdir -p $out/lib/tmpfiles.d/
+    cat > $out/lib/tmpfiles.d/nix-ld.conf <<EOF
+      L+ $ldpath - - - - $out/libexec/nix-ld
+    EOF
+  '';
+
+  passthru.tests.nix-ld = nixosTests.nix-ld;
+
+  meta = with lib; {
+    description = "Run unpatched dynamic binaries on NixOS";
+    homepage = "https://github.com/Mic92/nix-ld";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mic92 ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/nixos-rebuild/_nixos-rebuild b/pkgs/os-specific/linux/nixos-rebuild/_nixos-rebuild
new file mode 100644
index 00000000000..84e8d223bd8
--- /dev/null
+++ b/pkgs/os-specific/linux/nixos-rebuild/_nixos-rebuild
@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+
+# We're faking a `nix build` command-line to re-use Nix's own completion
+# for the few options passed through to Nix.
+_nixos-rebuild_pretend-nix() {
+  COMP_LINE="nix build ${COMP_LINE}"
+  # number of prepended chars
+  (( COMP_POINT = COMP_POINT + 10))
+
+  COMP_WORDS=(
+    nix build
+    "${COMP_WORDS[@]}"
+  )
+  # Add the amount of prepended words
+  (( COMP_CWORD = COMP_CWORD + 2))
+  _complete_nix "nix"
+}
+
+_nixos-rebuild() {
+  local curr="$2"
+  local prev="$3"
+  local subcommandGiven=0
+  local word
+  local subcommand
+
+  __load_completion nix
+
+  # Arrays are re-ordered by the completion, so it's fine to sort them in logical chunks
+  local all_args=(
+    --verbose -v
+
+    # nixos-rebuild options
+    --fast
+    --no-build-nix
+    --profile-name -p # name
+    --rollback
+    --specialisation -c # name
+    --use-remote-sudo
+    --build-host # host
+    --target-host # host
+    # Used with list-generations
+    --json
+
+    # generation switching options
+    --install-bootloader
+
+    # nix-channel options
+    --upgrade
+    --upgrade-all
+
+    # flakes options
+    --commit-lock-file
+    --flake # flake-uri
+    --override-input # input-name flake-uri
+    --recreate-lock-file
+    --update-input
+    --no-flake
+    --no-registries
+    --no-update-lock-file
+    --no-write-lock-file
+
+    # Nix-copy options
+    --use-substitutes --substitute-on-destination -s
+
+    # Nix options
+    --option
+    --impure
+    --builders # builder-spec
+    --show-trace
+    --keep-failed -K
+    --keep-going -k
+    --max-jobs -j # number
+    --log-format # format
+    -I # NIX_PATH
+  )
+
+  local all_subcommands=(
+    boot
+    build
+    build-vm
+    build-vm-with-bootloader
+    dry-activate
+    dry-build
+    edit
+    list-generations
+    switch
+    test
+  )
+
+  # Suggest arguments that can be consumed under some conditions only
+  for word in "${COMP_WORDS[@]}"; do
+    for subcommand in "${all_subcommands[@]}"; do
+      if [[ "$word" == "$subcommand" ]]; then
+        subcommandGiven=1
+      fi
+    done
+  done
+
+  # Fake out a way to complete the second arg to some options
+  case "${COMP_WORDS[COMP_CWORD-2]}" in
+    "--override-input")
+      prev="--override-input_2"
+      ;;
+    "--option")
+      prev="--option_2"
+      ;;
+  esac
+
+  case "$prev" in
+    --max-jobs|-j)
+      COMPREPLY=( )
+      ;;
+
+    --profile-name|-p)
+      if [[ "$curr" == "" ]]; then
+        COMPREPLY=( /nix/var/nix/profiles/* )
+      else
+        COMPREPLY=( "$curr"* )
+      fi
+      ;;
+
+    --build-host|--target-host|-t|-h)
+      _known_hosts_real "$curr"
+    ;;
+
+    --specialisation|-c)
+      COMPREPLY=()
+      ;;
+
+    -I)
+      _nixos-rebuild_pretend-nix
+      ;;
+    --builders)
+      _nixos-rebuild_pretend-nix
+      ;;
+    --flake)
+      _nixos-rebuild_pretend-nix
+      ;;
+    --override-input)
+      _nixos-rebuild_pretend-nix
+      ;;
+    --override-input_2)
+      _nixos-rebuild_pretend-nix
+      ;;
+    --log-format)
+      _nixos-rebuild_pretend-nix
+      ;;
+    --option)
+      _nixos-rebuild_pretend-nix
+      ;;
+    --option_2)
+      _nixos-rebuild_pretend-nix
+      ;;
+
+    *)
+      if [[ "$curr" == -* ]] || (( subcommandGiven )); then
+        COMPREPLY=( $(compgen -W "${all_args[*]}" -- "$2") )
+      else
+        COMPREPLY=( $(compgen -W "${all_subcommands[*]}" -- "$2") )
+      fi
+    ;;
+  esac
+}
+
+complete -F _nixos-rebuild nixos-rebuild
diff --git a/pkgs/os-specific/linux/nixos-rebuild/default.nix b/pkgs/os-specific/linux/nixos-rebuild/default.nix
index b317c5a1fbf..6c150b1b8cd 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/default.nix
@@ -4,8 +4,11 @@
 , gnused
 , gnugrep
 , jq
+, util-linux
 , nix
 , lib
+, nixosTests
+, installShellFiles
 }:
 let
   fallback = import ./../../../../nixos/modules/installer/tools/nix-fallback-paths.nix;
@@ -19,5 +22,29 @@ substituteAll {
   nix_x86_64_linux = fallback.x86_64-linux;
   nix_i686_linux = fallback.i686-linux;
   nix_aarch64_linux = fallback.aarch64-linux;
-  path = lib.makeBinPath [ coreutils jq gnused gnugrep ];
+  path = lib.makeBinPath [ coreutils gnused gnugrep jq util-linux ];
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+  postInstall = ''
+    installManPage ${./nixos-rebuild.8}
+
+    installShellCompletion \
+      --bash ${./_nixos-rebuild}
+  '';
+
+  # run some a simple installer tests to make sure nixos-rebuild still works for them
+  passthru.tests = {
+    install-bootloader = nixosTests.nixos-rebuild-install-bootloader;
+    simple-installer = nixosTests.installer.simple;
+    specialisations = nixosTests.nixos-rebuild-specialisations;
+  };
+
+  meta = {
+    description = "Rebuild your NixOS configuration and switch to it, on local hosts and remote.";
+    homepage = "https://github.com/NixOS/nixpkgs/tree/master/pkgs/os-specific/linux/nixos-rebuild";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.Profpatsch ];
+    mainProgram = "nixos-rebuild";
+  };
 }
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8 b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
new file mode 100644
index 00000000000..d947361b3bc
--- /dev/null
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
@@ -0,0 +1,468 @@
+.Dd January 1, 1980
+.Dt nixos-rebuild 8
+.Os
+.Sh NAME
+.Nm nixos-rebuild
+.Nd reconfigure a NixOS machine
+.
+.
+.
+.Sh SYNOPSIS
+.Nm
+.Bro
+.Cm switch | boot | test | build | dry-build | dry-activate | edit | build-vm | build-vm-with-bootloader | list-generations Op Fl -json
+.Brc
+.br
+.Op Fl -upgrade | -upgrade-all
+.Op Fl -install-bootloader
+.Op Fl -no-build-nix
+.Op Fl -fast
+.Op Fl -rollback
+.Op Fl -builders Ar builder-spec
+.br
+.Op Fl -flake Ar flake-uri
+.Op Fl -no-flake
+.Op Fl -override-input Ar input-name flake-uri
+.br
+.Op Fl -profile-name | p Ar name
+.Op Fl -specialisation | c Ar name
+.br
+.Op Fl -build-host Va host
+.Op Fl -target-host Va host
+.Op Fl -use-remote-sudo
+.br
+.Op Fl -show-trace
+.Op Fl I Va NIX_PATH
+.Op Fl -verbose | v
+.Op Fl -impure
+.Op Fl -max-jobs | j Va number
+.Op Fl -keep-failed | K
+.Op Fl -keep-going | k
+.
+.
+.
+.Sh DESCRIPTION
+This command updates the system so that it corresponds to the
+configuration specified in
+.Pa /etc/nixos/configuration.nix
+or
+.Pa /etc/nixos/flake.nix Ns
+\&. Thus, every time you modify the configuration or any other NixOS module, you
+must run
+.Nm
+to make the changes take effect. It builds the new system in
+.Pa /nix/store Ns
+, runs its activation script, and stop and (re)starts any system services if
+needed. Please note that user services need to be started manually as they
+aren't detected by the activation script at the moment.
+.
+.Pp
+This command has one required argument, which specifies the desired
+operation. It must be one of the following:
+.Bl -tag -width indent
+.It Cm switch
+Build and activate the new configuration, and make it the boot default. That
+is, the configuration is added to the GRUB boot menu as the default
+menu entry, so that subsequent reboots will boot the system into the new
+configuration. Previous configurations activated with
+.Ic nixos-rebuild switch
+or
+.Ic nixos-rebuild boot
+remain available in the GRUB menu.
+.Pp
+Note that if you are using specializations, running just
+.Ic nixos-rebuild switch
+will switch you back to the unspecialized, base system \(em in that case, you
+might want to use this instead:
+.Bd -literal -offset indent
+$ nixos-rebuild switch --specialisation your-specialisation-name
+.Ed
+.Pp
+This command will build all specialisations and make them bootable just
+like regular
+.Ic nixos-rebuild switch
+does \(em the only thing different is that it will switch to given
+specialisation instead of the base system; it can be also used to switch from
+the base system into a specialised one, or to switch between specialisations.
+.
+.It Cm boot
+Build the new configuration and make it the boot default (as with
+.Ic nixos-rebuild switch Ns
+), but do not activate it. That is, the system continues to run the previous
+configuration until the next reboot.
+.
+.It Cm test
+Build and activate the new configuration, but do not add it to the GRUB
+boot menu. Thus, if you reboot the system (or if it crashes), you will
+automatically revert to the default configuration (i.e. the
+configuration resulting from the last call to
+.Ic nixos-rebuild switch
+or
+.Ic nixos-rebuild boot Ns
+).
+.Pp
+Note that if you are using specialisations, running just
+.Ic nixos-rebuild test
+will activate the unspecialised, base system \(em in that case, you might want
+to use this instead:
+.Bd -literal -offset indent
+$ nixos-rebuild test --specialisation your-specialisation-name
+.Ed
+.Pp
+This command can be also used to switch from the base system into a
+specialised one, or to switch between specialisations.
+.
+.It Cm build
+Build the new configuration, but neither activate it nor add it to the
+GRUB boot menu. It leaves a symlink named
+.Pa result
+in the current directory, which points to the output of the top-level
+.Dq system
+derivation. This is essentially the same as doing
+.Bd -literal -offset indent
+$ nix-build /path/to/nixpkgs/nixos -A system
+.Ed
+.Pp
+Note that you do not need to be root to run
+.Ic nixos-rebuild build Ns
+\&.
+.
+.It Cm dry-build
+Show what store paths would be built or downloaded by any of the
+operations above, but otherwise do nothing.
+.
+.It Cm dry-activate
+Build the new configuration, but instead of activating it, show what
+changes would be performed by the activation (i.e. by
+.Ic nixos-rebuild test Ns
+). For instance, this command will print which systemd units would be restarted.
+The list of changes is not guaranteed to be complete.
+.
+.It Cm edit
+Opens
+.Pa configuration.nix
+in the default editor.
+.
+.It Cm build-vm
+Build a script that starts a NixOS virtual machine with the desired
+configuration. It leaves a symlink
+.Pa result
+in the current directory that points (under
+.Ql result/bin/run\- Ns Va hostname Ns \-vm Ns
+)
+at the script that starts the VM. Thus, to test a NixOS configuration in
+a virtual machine, you should do the following:
+.Bd -literal -offset indent
+$ nixos-rebuild build-vm
+$ ./result/bin/run-*-vm
+.Ed
+.Pp
+The VM is implemented using the
+.Ql qemu
+package. For best performance, you should load the
+.Ql kvm-intel
+or
+.Ql kvm-amd
+kernel modules to get hardware virtualisation.
+.Pp
+The VM mounts the Nix store of the host through the 9P file system. The
+host Nix store is read-only, so Nix commands that modify the Nix store
+will not work in the VM. This includes commands such as
+.Nm Ns
+; to change the VM’s configuration, you must halt the VM and re-run the commands
+above.
+.Pp
+The VM has its own ext3 root file system, which is automatically created when
+the VM is first started, and is persistent across reboots of the VM. It is
+stored in
+.Ql ./ Ns Va hostname Ns .qcow2 Ns
+\&.
+.\" The entire file system hierarchy of the host is available in
+.\" the VM under
+.\" .Pa /hostfs Ns
+.\" .
+.
+.It Cm build-vm-with-bootloader
+Like
+.Cm build-vm Ns
+, but boots using the regular boot loader of your configuration (e.g. GRUB 1 or
+2), rather than booting directly into the kernel and initial ramdisk of the
+system. This allows you to test whether the boot loader works correctly. \
+However, it does not guarantee that your NixOS configuration will boot
+successfully on the host hardware (i.e., after running
+.Ic nixos-rebuild switch Ns
+), because the hardware and boot loader configuration in the VM are different.
+The boot loader is installed on an automatically generated virtual disk
+containing a
+.Pa /boot
+partition.
+.
+.It Cm list-generations Op Fl -json
+List the available generations in a similar manner to the boot loader
+menu. It shows the generation number, build date and time, NixOS version,
+kernel version and the configuration revision. This is useful to get
+information e.g. for which generation to roll back to with
+.Ic nixos-rebuild switch Fl -generation Ar N
+There is also a json version of output available.
+.El
+.
+.
+.
+.Sh OPTIONS
+.Bl -tag -width indent
+.It Fl -upgrade , -upgrade-all
+Update the root user's channel named
+.Ql nixos
+before rebuilding the system.
+.Pp
+In addition to the
+.Ql nixos
+channel, the root user's channels which have a file named
+.Ql .update-on-nixos-rebuild
+in their base directory will also be updated.
+.Pp
+Passing
+.Fl -upgrade-all
+updates all of the root user's channels.
+.
+.It Fl -install-bootloader
+Causes the boot loader to be (re)installed on the device specified by the
+relevant configuration options.
+.
+.It Fl -no-build-nix
+Normally,
+.Nm
+first builds the
+.Ql nixUnstable
+attribute in Nixpkgs, and uses the resulting instance of the Nix package manager
+to build the new system configuration. This is necessary if the NixOS modules
+use features not provided by the currently installed version of Nix. This option
+disables building a new Nix.
+.
+.It Fl -fast
+Equivalent to
+.Fl -no-build-nix Ns
+\&. This option is useful if you call
+.Nm
+frequently (e.g. if you’re hacking on a NixOS module).
+.
+.It Fl -rollback
+Instead of building a new configuration as specified by
+.Pa /etc/nixos/configuration.nix Ns
+, roll back to the previous configuration. (The previous configuration is
+defined as the one before the “current” generation of the Nix profile
+.Pa /nix/var/nix/profiles/system Ns
+\&.)
+.
+.It Fl -builders Ar builder-spec
+Allow ad-hoc remote builders for building the new system. This requires
+the user executing
+.Nm
+(usually root) to be configured as a trusted user in the Nix daemon. This can be
+achieved by using the
+.Va nix.settings.trusted-users
+NixOS option. Examples values for that option are described in the
+.Dq Remote builds
+chapter in the Nix manual, (i.e.
+.Ql --builders \(dqssh://bigbrother x86_64-linux\(dq Ns
+). By specifying an empty string existing builders specified in
+.Pa /etc/nix/machines
+can be ignored:
+.Ql --builders \(dq\(dq
+for example when they are not reachable due to network connectivity.
+.
+.It Fl -profile-name Ar name , Fl p Ar name
+Instead of using the Nix profile
+.Pa /nix/var/nix/profiles/system
+to keep track of the current and previous system configurations, use
+.Pa /nix/var/nix/profiles/system-profiles/ Ns Va name Ns
+\&. When you use GRUB 2, for every system profile created with this flag, NixOS
+will create a submenu named
+.Dq NixOS - Profile Va name
+in GRUB’s boot menu, containing the current and previous configurations of this profile.
+.Pp
+For instance, if you want to test a configuration file named
+.Pa test.nix
+without affecting the default system profile, you would do:
+.Bd -literal -offset indent
+$ nixos-rebuild switch -p test -I nixos-config=./test.nix
+.Ed
+.Pp
+The new configuration will appear in the GRUB 2 submenu
+.Dq NixOS - Profile 'test' Ns
+\&.
+.
+.It Fl -specialisation Ar name , Fl c Ar name
+Activates given specialisation; when not specified, switching and testing
+will activate the base, unspecialised system.
+.
+.It Fl -build-host Ar host
+Instead of building the new configuration locally, use the specified host
+to perform the build. The host needs to be accessible with
+.Ic ssh Ns ,
+and must be able to perform Nix builds. If the option
+.Fl -target-host
+is not set, the build will be copied back to the local machine when done.
+.Pp
+Note that, if
+.Fl -no-build-nix
+is not specified, Nix will be built both locally and remotely. This is because
+the configuration will always be evaluated locally even though the building
+might be performed remotely.
+.Pp
+You can include a remote user name in the host name
+.Ns ( Va user@host Ns
+). You can also set ssh options by defining the
+.Ev NIX_SSHOPTS
+environment variable.
+.
+.It Fl -target-host Ar host
+Specifies the NixOS target host. By setting this to something other than an
+empty string, the system activation will happen on the remote host instead of
+the local machine. The remote host needs to be accessible over
+.Ic ssh Ns ,
+and for the commands
+.Cm switch Ns
+,
+.Cm boot
+and
+.Cm test
+you need root access.
+.Pp
+If
+.Fl -build-host
+is not explicitly specified or empty, building will take place locally.
+.Pp
+You can include a remote user name in the host name
+.Ns ( Va user@host Ns
+). You can also set ssh options by defining the
+.Ev NIX_SSHOPTS
+environment variable.
+.Pp
+Note that
+.Nm
+honors the
+.Va nixpkgs.crossSystem
+setting of the given configuration but disregards the true architecture of the
+target host. Hence the
+.Va nixpkgs.crossSystem
+setting has to match the target platform or else activation will fail.
+.
+.It Fl -use-substitutes
+When set, nixos-rebuild will add
+.Fl -use-substitutes
+to each invocation of nix-copy-closure. This will only affect the behavior of
+nixos-rebuild if
+.Fl -target-host
+or
+.Fl -build-host
+is also set. This is useful when the target-host connection to cache.nixos.org
+is faster than the connection between hosts.
+.
+.It Fl -use-remote-sudo
+When set, nixos-rebuild prefixes remote commands that run on the
+.Fl -build-host
+and
+.Fl -target-host
+systems with
+.Ic sudo Ns
+\&. Setting this option allows deploying as a non-root user.
+.
+.It Fl -flake Va flake-uri Ns Op Va #name
+Build the NixOS system from the specified flake. It defaults to the directory
+containing the target of the symlink
+.Pa /etc/nixos/flake.nix Ns
+, if it exists. The flake must contain an output named
+.Ql nixosConfigurations. Ns Va name Ns
+\&. If
+.Va name
+is omitted, it default to the current host name.
+.
+.It Fl -no-flake
+Do not imply
+.Fl -flake
+if
+.Pa /etc/nixos/flake.nix
+exists. With this option, it is possible to build non-flake NixOS configurations
+even if the current NixOS systems uses flakes.
+.El
+.Pp
+In addition,
+.Nm
+accepts various Nix-related flags, including
+.Fl -max-jobs Ns ,
+.Fl j Ns ,
+.Fl I Ns ,
+.Fl -show-trace Ns ,
+.Fl -keep-failed Ns ,
+.Fl -keep-going Ns ,
+.Fl -impure Ns ,
+.Fl -verbose Ns , and
+.Fl v Ns
+\&. See the Nix manual for details.
+.
+.
+.
+.Sh ENVIRONMENT
+.Bl -tag -width indent
+.It Ev NIXOS_CONFIG
+Path to the main NixOS configuration module. Defaults to
+.Pa /etc/nixos/configuration.nix Ns
+\&.
+.
+.It Ev NIX_PATH
+A colon-separated list of directories used to look up Nix expressions enclosed
+in angle brackets (e.g. <nixpkgs>). Example:
+.Bd -literal -offset indent
+nixpkgs=./my-nixpkgs
+.Ed
+.
+.It Ev NIX_SSHOPTS
+Additional options to be passed to
+.Ic ssh
+on the command line.
+.Ed
+.
+.It Ev NIXOS_SWITCH_USE_DIRTY_ENV
+Expose the the current environment variables to post activation scripts. Will
+skip usage of
+.Ic systemd-run
+during system activation. Possibly dangerous, specially in remote environments
+(e.g.: via SSH). Will be removed in the future.
+.El
+.
+.
+.
+.Sh FILES
+.Bl -tag -width indent
+.It Pa /etc/nixos/flake.nix
+If this file exists, then
+.Nm
+will use it as if the
+.Fl -flake
+option was given. This file may be a symlink to a
+.Pa flake.nix
+in an actual flake; thus
+.Pa /etc/nixos
+need not be a flake.
+.
+.It Pa /run/current-system
+A symlink to the currently active system configuration in the Nix store.
+.
+.It Pa /nix/var/nix/profiles/system
+The Nix profile that contains the current and previous system
+configurations. Used to generate the GRUB boot menu.
+.El
+.
+.
+.
+.Sh BUGS
+This command should be renamed to something more descriptive.
+.
+.
+.
+.Sh AUTHORS
+.An -nosplit
+.An Eelco Dolstra
+and
+.An the Nixpkgs/NixOS contributors
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index b0363fa7a7c..dddae8da206 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -1,4 +1,5 @@
 #! @runtimeShell@
+# shellcheck shell=bash
 
 if [ -x "@runtimeShell@" ]; then export SHELL="@runtimeShell@"; fi;
 
@@ -16,9 +17,10 @@ showSyntax() {
 
 # Parse the command line.
 origArgs=("$@")
+copyFlags=()
 extraBuildFlags=()
 lockFlags=()
-flakeFlags=()
+flakeFlags=(--extra-experimental-features 'nix-command flakes')
 action=
 buildNix=1
 fast=
@@ -26,9 +28,20 @@ rollback=
 upgrade=
 upgrade_all=
 profile=/nix/var/nix/profiles/system
+specialisation=
 buildHost=
 targetHost=
-maybeSudo=()
+remoteSudo=
+verboseScript=
+noFlake=
+# comma separated list of vars to preserve when using sudo
+preservedSudoVars=NIXOS_INSTALL_BOOTLOADER
+json=
+
+# log the given argument to stderr
+log() {
+    echo "$@" >&2
+}
 
 while [ "$#" -gt 0 ]; do
     i="$1"; shift 1
@@ -36,12 +49,14 @@ while [ "$#" -gt 0 ]; do
       --help)
         showSyntax
         ;;
-      switch|boot|test|build|edit|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader)
+      switch|boot|test|build|edit|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader|list-generations)
         if [ "$i" = dry-run ]; then i=dry-build; fi
+        # exactly one action mandatory, bail out if multiple are given
+        if [ -n "$action" ]; then showSyntax; fi
         action="$i"
         ;;
       --install-grub)
-        echo "$0: --install-grub deprecated, use --install-bootloader instead" >&2
+        log "$0: --install-grub deprecated, use --install-bootloader instead"
         export NIXOS_INSTALL_BOOTLOADER=1
         ;;
       --install-bootloader)
@@ -60,11 +75,18 @@ while [ "$#" -gt 0 ]; do
         upgrade=1
         upgrade_all=1
         ;;
-      --max-jobs|-j|--cores|-I|--builders)
+      --use-substitutes|--substitute-on-destination|-s)
+        copyFlags+=("-s")
+        ;;
+      -I|--max-jobs|-j|--cores|--builders|--log-format)
         j="$1"; shift 1
         extraBuildFlags+=("$i" "$j")
         ;;
-      --show-trace|--keep-failed|-K|--keep-going|-k|--verbose|-v|-vv|-vvv|-vvvv|-vvvvv|--fallback|--repair|--no-build-output|-Q|-j*|-L|--refresh|--no-net|--offline|--impure)
+      -j*|--quiet|--print-build-logs|-L|--no-build-output|-Q| --show-trace|--keep-going|-k|--keep-failed|-K|--fallback|--refresh|--repair|--impure|--offline|--no-net)
+        extraBuildFlags+=("$i")
+        ;;
+      --verbose|-v|-vv|-vvv|-vvvv|-vvvvv)
+        verboseScript="true"
         extraBuildFlags+=("$i")
         ;;
       --option)
@@ -78,7 +100,7 @@ while [ "$#" -gt 0 ]; do
         ;;
       --profile-name|-p)
         if [ -z "$1" ]; then
-            echo "$0: ‘--profile-name’ requires an argument"
+            log "$0: ‘--profile-name’ requires an argument"
             exit 1
         fi
         if [ "$1" != system ]; then
@@ -87,22 +109,32 @@ while [ "$#" -gt 0 ]; do
         fi
         shift 1
         ;;
-      --build-host|h)
+      --specialisation|-c)
+        if [ -z "$1" ]; then
+            log "$0: ‘--specialisation’ requires an argument"
+            exit 1
+        fi
+        specialisation="$1"
+        shift 1
+        ;;
+      --build-host)
         buildHost="$1"
         shift 1
         ;;
-      --target-host|t)
+      --target-host)
         targetHost="$1"
         shift 1
         ;;
       --use-remote-sudo)
-        maybeSudo=(sudo --)
+        remoteSudo=1
         ;;
       --flake)
         flake="$1"
-        flakeFlags=(--extra-experimental-features 'nix-command flakes')
         shift 1
         ;;
+      --no-flake)
+        noFlake=1
+        ;;
       --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
         lockFlags+=("$i")
         ;;
@@ -115,61 +147,72 @@ while [ "$#" -gt 0 ]; do
         k="$1"; shift 1
         lockFlags+=("$i" "$j" "$k")
         ;;
+      --json)
+        json=1
+        ;;
       *)
-        echo "$0: unknown option \`$i'"
+        log "$0: unknown option \`$i'"
         exit 1
         ;;
     esac
 done
 
-if [ -n "$SUDO_USER" ]; then
-    maybeSudo=(sudo --)
+if [[ -n "$SUDO_USER" || -n $remoteSudo ]]; then
+    maybeSudo=(sudo --preserve-env="$preservedSudoVars" --)
 fi
 
-if [ -z "$buildHost" -a -n "$targetHost" ]; then
-    buildHost="$targetHost"
-fi
-if [ "$targetHost" = localhost ]; then
-    targetHost=
-fi
-if [ "$buildHost" = localhost ]; then
-    buildHost=
-fi
+# log the given argument to stderr if verbose mode is on
+logVerbose() {
+    if [ -n "$verboseScript" ]; then
+      echo "$@" >&2
+    fi
+}
+
+# Run a command, logging it first if verbose mode is on
+runCmd() {
+    logVerbose "$" "$@"
+    "$@"
+}
 
 buildHostCmd() {
     if [ -z "$buildHost" ]; then
-        "$@"
+        runCmd "$@"
     elif [ -n "$remoteNix" ]; then
-        ssh $SSHOPTS "$buildHost" "${maybeSudo[@]}" env PATH="$remoteNix":'$PATH' "$@"
+        runCmd ssh $SSHOPTS "$buildHost" "${maybeSudo[@]}" env PATH="$remoteNix":'$PATH' "$@"
     else
-        ssh $SSHOPTS "$buildHost" "${maybeSudo[@]}" "$@"
+        runCmd ssh $SSHOPTS "$buildHost" "${maybeSudo[@]}" "$@"
     fi
 }
 
 targetHostCmd() {
     if [ -z "$targetHost" ]; then
-        "${maybeSudo[@]}" "$@"
+        runCmd "${maybeSudo[@]}" "$@"
     else
-        ssh $SSHOPTS "$targetHost" "${maybeSudo[@]}" "$@"
+        runCmd ssh $SSHOPTS "$targetHost" "${maybeSudo[@]}" "$@"
     fi
 }
 
 copyToTarget() {
     if ! [ "$targetHost" = "$buildHost" ]; then
         if [ -z "$targetHost" ]; then
-            NIX_SSHOPTS=$SSHOPTS nix-copy-closure --from "$buildHost" "$1"
+            logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --from "$buildHost" "$1"
         elif [ -z "$buildHost" ]; then
-            NIX_SSHOPTS=$SSHOPTS nix-copy-closure --to "$targetHost" "$1"
+            logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
         else
-            buildHostCmd nix-copy-closure --to "$targetHost" "$1"
+            buildHostCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
         fi
     fi
 }
 
 nixBuild() {
+    logVerbose "Building in legacy (non-flake) mode."
     if [ -z "$buildHost" ]; then
-        nix-build "$@"
+        logVerbose "No --build-host given, running nix-build locally"
+        runCmd nix-build "$@"
     else
+        logVerbose "buildHost set to \"$buildHost\", running nix-build remotely"
         local instArgs=()
         local buildArgs=()
         local drv=
@@ -199,25 +242,26 @@ nixBuild() {
             esac
         done
 
-        drv="$(nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")"
+        drv="$(runCmd nix-instantiate "${instArgs[@]}" "${extraBuildFlags[@]}")"
         if [ -a "$drv" ]; then
-            NIX_SSHOPTS=$SSHOPTS nix-copy-closure --to "$buildHost" "$drv"
+            logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure --to "$buildHost" "$drv"
             buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
         else
-            echo "nix-instantiate failed"
+            log "nix-instantiate failed"
             exit 1
         fi
   fi
 }
 
 nixFlakeBuild() {
-    if [[ -z "$buildHost" && -z "$targetHost" ]] &&
-       ! [ "$action" = switch -o "$action" = boot ]
+    logVerbose "Building in flake mode."
+    if [[ -z "$buildHost" && -z "$targetHost" && "$action" != switch && "$action" != boot && "$action" != test && "$action" != dry-activate ]]
     then
-        nix "${flakeFlags[@]}" build "$@"
+        runCmd nix "${flakeFlags[@]}" build "$@"
         readlink -f ./result
     elif [ -z "$buildHost" ]; then
-        nix "${flakeFlags[@]}" build "$@" --out-link "${tmpDir}/result"
+        runCmd nix "${flakeFlags[@]}" build "$@" --out-link "${tmpDir}/result"
         readlink -f "${tmpDir}/result"
     else
         local attr="$1"
@@ -241,18 +285,21 @@ nixFlakeBuild() {
                 local k="$1"; shift 1
                 evalArgs+=("$i" "$j" "$k")
                 ;;
+              --impure) # We don't want this in buildArgs, it's only needed at evaluation time, and unsupported during realisation
+                ;;
               *)
                 buildArgs+=("$i")
                 ;;
             esac
         done
 
-        drv="$(nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")"
+        drv="$(runCmd nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")"
         if [ -a "$drv" ]; then
-            NIX_SSHOPTS=$SSHOPTS nix "${flakeFlags[@]}" copy --derivation --to "ssh://$buildHost" "$drv"
+            logVerbose "Running nix with these NIX_SSHOPTS: $SSHOPTS"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy "${copyFlags[@]}" --derivation --to "ssh://$buildHost" "$drv"
             buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
         else
-            echo "nix eval failed"
+            log "nix eval failed"
             exit 1
         fi
     fi
@@ -267,7 +314,7 @@ if [ -z "$action" ]; then showSyntax; fi
 # executed, so it's safe to run nixos-rebuild against a potentially
 # untrusted tree.
 canRun=
-if [ "$action" = switch -o "$action" = boot -o "$action" = test ]; then
+if [[ "$action" = switch || "$action" = boot || "$action" = test ]]; then
     canRun=1
 fi
 
@@ -283,11 +330,11 @@ if [[ -n $upgrade && -z $_NIXOS_REBUILD_REEXEC && -z $flake ]]; then
         channel_name=$(basename "$channelpath")
 
         if [[ "$channel_name" == "nixos" ]]; then
-            nix-channel --update "$channel_name"
+            runCmd nix-channel --update "$channel_name"
         elif [ -e "$channelpath/.update-on-nixos-rebuild" ]; then
-            nix-channel --update "$channel_name"
+            runCmd nix-channel --update "$channel_name"
         elif [[ -n $upgrade_all ]] ; then
-            nix-channel --update "$channel_name"
+            runCmd nix-channel --update "$channel_name"
         fi
     done
 fi
@@ -305,20 +352,10 @@ fi
 
 # Use /etc/nixos/flake.nix if it exists. It can be a symlink to the
 # actual flake.
-if [[ -z $flake && -e /etc/nixos/flake.nix ]]; then
+if [[ -z $flake && -e /etc/nixos/flake.nix && -z $noFlake ]]; then
     flake="$(dirname "$(readlink -f /etc/nixos/flake.nix)")"
 fi
 
-# Re-execute nixos-rebuild from the Nixpkgs tree.
-# FIXME: get nixos-rebuild from $flake.
-if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast && -z $flake ]]; then
-    if p=$(nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then
-        export _NIXOS_REBUILD_REEXEC=1
-        exec "$p/bin/nixos-rebuild" "${origArgs[@]}"
-        exit 1
-    fi
-fi
-
 # For convenience, use the hostname as the default configuration to
 # build from the flake.
 if [[ -n $flake ]]; then
@@ -337,41 +374,63 @@ if [[ -n $flake ]]; then
     fi
 fi
 
-# Resolve the flake.
-if [[ -n $flake ]]; then
-    flake=$(nix "${flakeFlags[@]}" flake metadata --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
+if [[ ! -z "$specialisation" && ! "$action" = switch && ! "$action" = test ]]; then
+    log "error: ‘--specialisation’ can only be used with ‘switch’ and ‘test’"
+    exit 1
+fi
+
+tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
+
+cleanup() {
+    for ctrl in "$tmpDir"/ssh-*; do
+        ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true
+    done
+    rm -rf "$tmpDir"
+}
+trap cleanup EXIT
+
+
+# Re-execute nixos-rebuild from the Nixpkgs tree.
+if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast ]]; then
+    if [[ -z $flake ]]; then
+        if p=$(runCmd nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then
+            SHOULD_REEXEC=1
+        fi
+    else
+        runCmd nix "${flakeFlags[@]}" build --out-link "${tmpDir}/nixos-rebuild" "$flake#$flakeAttr.config.system.build.nixos-rebuild" "${extraBuildFlags[@]}" "${lockFlags[@]}"
+        if p=$(readlink -e "${tmpDir}/nixos-rebuild"); then
+            SHOULD_REEXEC=1
+        fi
+    fi
+
+    if [[ -n $SHOULD_REEXEC ]]; then
+        export _NIXOS_REBUILD_REEXEC=1
+        # Manually call cleanup as the EXIT trap is not triggered when using exec
+        cleanup
+        runCmd exec "$p/bin/nixos-rebuild" "${origArgs[@]}"
+        exit 1
+    fi
 fi
 
 # Find configuration.nix and open editor instead of building.
 if [ "$action" = edit ]; then
     if [[ -z $flake ]]; then
-        NIXOS_CONFIG=${NIXOS_CONFIG:-$(nix-instantiate --find-file nixos-config)}
+        NIXOS_CONFIG=${NIXOS_CONFIG:-$(runCmd nix-instantiate --find-file nixos-config)}
         if [[ -d $NIXOS_CONFIG ]]; then
             NIXOS_CONFIG=$NIXOS_CONFIG/default.nix
         fi
-        exec ${EDITOR:-nano} "$NIXOS_CONFIG"
+        runCmd exec ${EDITOR:-nano} "$NIXOS_CONFIG"
     else
-        exec nix "${flakeFlags[@]}" edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
+        runCmd exec nix "${flakeFlags[@]}" edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
     fi
     exit 1
 fi
 
-
-tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
 SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60"
 
-cleanup() {
-    for ctrl in "$tmpDir"/ssh-*; do
-        ssh -o ControlPath="$ctrl" -O exit dummyhost 2>/dev/null || true
-    done
-    rm -rf "$tmpDir"
-}
-trap cleanup EXIT
-
-
 # First build Nix, since NixOS may require a newer version than the
 # current one.
-if [ -n "$rollback" -o "$action" = dry-build ]; then
+if [[ -n "$rollback" || "$action" = dry-build ]]; then
     buildNix=
 fi
 
@@ -392,32 +451,32 @@ prebuiltNix() {
     elif [[ "$machine" = aarch64 ]]; then
         echo @nix_aarch64_linux@
     else
-        echo "$0: unsupported platform"
+        log "$0: unsupported platform"
         exit 1
     fi
 }
 
 if [[ -n $buildNix && -z $flake ]]; then
-    echo "building Nix..." >&2
+    log "building Nix..."
     nixDrv=
-    if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root "$tmpDir/nix.drv" --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then
-        if ! nixDrv="$(nix-instantiate '<nixpkgs>' --add-root "$tmpDir/nix.drv" --indirect -A nix "${extraBuildFlags[@]}")"; then
-            if ! nixStorePath="$(nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A "$(nixSystem)" | sed -e 's/^"//' -e 's/"$//')"; then
+    if ! nixDrv="$(runCmd nix-instantiate '<nixpkgs/nixos>' --add-root "$tmpDir/nix.drv" --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then
+        if ! nixDrv="$(runCmd nix-instantiate '<nixpkgs>' --add-root "$tmpDir/nix.drv" --indirect -A nix "${extraBuildFlags[@]}")"; then
+            if ! nixStorePath="$(runCmd nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A "$(nixSystem)" | sed -e 's/^"//' -e 's/"$//')"; then
                 nixStorePath="$(prebuiltNix "$(uname -m)")"
             fi
-            if ! nix-store -r $nixStorePath --add-root $tmpDir/nix --indirect \
+            if ! runCmd nix-store -r "$nixStorePath" --add-root "${tmpDir}/nix" --indirect \
                 --option extra-binary-caches https://cache.nixos.org/; then
-                echo "warning: don't know how to get latest Nix" >&2
+                log "warning: don't know how to get latest Nix"
             fi
             # Older version of nix-store -r don't support --add-root.
             [ -e "$tmpDir/nix" ] || ln -sf "$nixStorePath" "$tmpDir/nix"
             if [ -n "$buildHost" ]; then
-                remoteNixStorePath="$(prebuiltNix "$(buildHostCmd uname -m)")"
+                remoteNixStorePath="$(runCmd prebuiltNix "$(buildHostCmd uname -m)")"
                 remoteNix="$remoteNixStorePath/bin"
                 if ! buildHostCmd nix-store -r "$remoteNixStorePath" \
                   --option extra-binary-caches https://cache.nixos.org/ >/dev/null; then
                     remoteNix=
-                    echo "warning: don't know how to get latest Nix" >&2
+                    log "warning: don't know how to get latest Nix"
                 fi
             fi
         fi
@@ -425,7 +484,7 @@ if [[ -n $buildNix && -z $flake ]]; then
     if [ -a "$nixDrv" ]; then
         nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null
         if [ -n "$buildHost" ]; then
-            nix-copy-closure --to "$buildHost" "$nixDrv"
+            nix-copy-closure "${copyFlags[@]}" --to "$buildHost" "$nixDrv"
             # The nix build produces multiple outputs, we add them all to the remote path
             for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
                 remoteNix="$remoteNix${remoteNix:+:}$p/bin"
@@ -439,8 +498,8 @@ fi
 # Update the version suffix if we're building from Git (so that
 # nixos-version shows something useful).
 if [[ -n $canRun && -z $flake ]]; then
-    if nixpkgs=$(nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then
-        suffix=$($SHELL "$nixpkgs/nixos/modules/installer/tools/get-version-suffix" "${extraBuildFlags[@]}" || true)
+    if nixpkgs=$(runCmd nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then
+        suffix=$(runCmd $SHELL "$nixpkgs/nixos/modules/installer/tools/get-version-suffix" "${extraBuildFlags[@]}" || true)
         if [ -n "$suffix" ]; then
             echo -n "$suffix" > "$nixpkgs/.version-suffix" || true
         fi
@@ -452,13 +511,94 @@ if [ "$action" = dry-build ]; then
     extraBuildFlags+=(--dry-run)
 fi
 
+if [ "$action" = list-generations ]; then
+    if [ ! -L "$profile" ]; then
+        log "No profile \`$(basename "$profile")' found"
+        exit 1
+    fi
+
+    generation_from_dir() {
+        generation_dir="$1"
+        generation_base="$(basename "$generation_dir")" # Has the format "system-123-link" for generation 123
+        no_link_gen="${generation_base%-link}"  # remove the "-link"
+        echo "${no_link_gen##*-}" # remove everything before the last dash
+    }
+    describe_generation(){
+        generation_dir="$1"
+        generation_number="$(generation_from_dir "$generation_dir")"
+        nixos_version="$(cat "$generation_dir/nixos-version" 2> /dev/null || echo "Unknown")"
+
+        kernel_dir="$(dirname "$(realpath "$generation_dir/kernel")")"
+        kernel_version="$(ls "$kernel_dir/lib/modules" || echo "Unknown")"
+
+        configurationRevision="$("$generation_dir/sw/bin/nixos-version" --configuration-revision 2> /dev/null || true)"
+
+        # Old nixos-version output ignored unknown flags and just printed the version
+        # therefore the following workaround is done not to show the default output
+        nixos_version_default="$("$generation_dir/sw/bin/nixos-version")"
+        if [ "$configurationRevision" == "$nixos_version_default" ]; then
+             configurationRevision=""
+        fi
+
+        # jq automatically quotes the output => don't try to quote it in output!
+        build_date="$(stat "$generation_dir" --format=%W | jq 'todate')"
+
+        pushd "$generation_dir/specialisation/" > /dev/null || :
+        specialisation_list=(*)
+        popd > /dev/null || :
+
+        specialisations="$(jq --compact-output --null-input '$ARGS.positional' --args -- "${specialisation_list[@]}")"
+
+        if [ "$(basename "$generation_dir")" = "$(readlink "$profile")" ]; then
+            current_generation_tag="true"
+        else
+            current_generation_tag="false"
+        fi
+
+        # Escape userdefined strings
+        nixos_version="$(jq -aR <<< "$nixos_version")"
+        kernel_version="$(jq -aR <<< "$kernel_version")"
+        configurationRevision="$(jq -aR <<< "$configurationRevision")"
+        cat << EOF
+{
+  "generation": $generation_number,
+  "date": $build_date,
+  "nixosVersion": $nixos_version,
+  "kernelVersion": $kernel_version,
+  "configurationRevision": $configurationRevision,
+  "specialisations": $specialisations,
+  "current": $current_generation_tag
+}
+EOF
+    }
+
+    find "$(dirname "$profile")" -regex "$profile-[0-9]+-link" |
+        sort -Vr |
+        while read -r generation_dir; do
+            describe_generation "$generation_dir"
+        done |
+        if [ -z "$json" ]; then
+            jq --slurp -r '.[] | [
+                    ([.generation, (if .current == true then "current" else "" end)] | join(" ")),
+                    (.date | fromdate | strflocaltime("%Y-%m-%d %H:%M:%S")),
+                    .nixosVersion, .kernelVersion, .configurationRevision,
+                    (.specialisations | join(" "))
+                ] | @tsv' |
+                column --separator $'\t' --table --table-columns "Generation,Build-date,NixOS version,Kernel,Configuration Revision,Specialisation" |
+                ${PAGER:cat}
+        else
+            jq --slurp .
+        fi
+    exit 0
+fi
+
 
 # Either upgrade the configuration in the system profile (for "switch"
 # or "boot"), or just build it and create a symlink "result" in the
 # current directory (for "build" and "test").
 if [ -z "$rollback" ]; then
-    echo "building the system configuration..." >&2
-    if [ "$action" = switch -o "$action" = boot ]; then
+    log "building the system configuration..."
+    if [[ "$action" = switch || "$action" = boot ]]; then
         if [[ -z $flake ]]; then
             pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
         else
@@ -466,7 +606,7 @@ if [ -z "$rollback" ]; then
         fi
         copyToTarget "$pathToConfig"
         targetHostCmd nix-env -p "$profile" --set "$pathToConfig"
-    elif [ "$action" = test -o "$action" = build -o "$action" = dry-build -o "$action" = dry-activate ]; then
+    elif [[ "$action" = test || "$action" = build || "$action" = dry-build || "$action" = dry-activate ]]; then
         if [[ -z $flake ]]; then
             pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
         else
@@ -488,14 +628,14 @@ if [ -z "$rollback" ]; then
         showSyntax
     fi
     # Copy build to target host if we haven't already done it
-    if ! [ "$action" = switch -o "$action" = boot ]; then
+    if ! [[ "$action" = switch || "$action" = boot ]]; then
         copyToTarget "$pathToConfig"
     fi
 else # [ -n "$rollback" ]
-    if [ "$action" = switch -o "$action" = boot ]; then
+    if [[ "$action" = switch || "$action" = boot ]]; then
         targetHostCmd nix-env --rollback -p "$profile"
         pathToConfig="$profile"
-    elif [ "$action" = test -o "$action" = build ]; then
+    elif [[ "$action" = test || "$action" = build ]]; then
         systemNumber=$(
             targetHostCmd nix-env -p "$profile" --list-generations |
             sed -n '/current/ {g; p;}; s/ *\([0-9]*\).*/\1/; h'
@@ -512,17 +652,64 @@ fi
 
 # If we're not just building, then make the new configuration the boot
 # default and/or activate it now.
-if [ "$action" = switch -o "$action" = boot -o "$action" = test -o "$action" = dry-activate ]; then
-    if ! targetHostCmd "$pathToConfig/bin/switch-to-configuration" "$action"; then
-        echo "warning: error(s) occurred while switching to the new configuration" >&2
+if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" = dry-activate ]]; then
+    # Using systemd-run here to protect against PTY failures/network
+    # disconnections during rebuild.
+    # See: https://github.com/NixOS/nixpkgs/issues/39118
+    cmd=(
+        "systemd-run"
+        "-E" "LOCALE_ARCHIVE" # Will be set to new value early in switch-to-configuration script, but interpreter starts out with old value
+        "-E" "NIXOS_INSTALL_BOOTLOADER"
+        "--collect"
+        "--no-ask-password"
+        "--pty"
+        "--quiet"
+        "--same-dir"
+        "--service-type=exec"
+        "--unit=nixos-rebuild-switch-to-configuration"
+        "--wait"
+    )
+    # Check if we have a working systemd-run. In chroot environments we may have
+    # a non-working systemd, so we fallback to not using systemd-run.
+    # You may also want to explicitly set NIXOS_SWITCH_USE_DIRTY_ENV environment
+    # variable, since systemd-run runs inside an isolated environment and
+    # this may break some post-switch scripts. However keep in mind that this
+    # may be dangerous in remote access (e.g. SSH).
+    if [[ -n "$NIXOS_SWITCH_USE_DIRTY_ENV" ]]; then
+        log "warning: skipping systemd-run since NIXOS_SWITCH_USE_DIRTY_ENV is set. This environment variable will be ignored in the future"
+        cmd=()
+    elif ! targetHostCmd "${cmd[@]}" true &>/dev/null; then
+        logVerbose "Skipping systemd-run to switch configuration since it is not working in target host."
+        cmd=(
+            "env"
+            "-i"
+            "LOCALE_ARCHIVE=$LOCALE_ARCHIVE"
+            "NIXOS_INSTALL_BOOTLOADER=$NIXOS_INSTALL_BOOTLOADER"
+        )
+    else
+        logVerbose "Using systemd-run to switch configuration."
+    fi
+    if [[ -z "$specialisation" ]]; then
+        cmd+=("$pathToConfig/bin/switch-to-configuration")
+    else
+        cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
+
+        if [[ ! -f "${cmd[-1]}" ]]; then
+            log "error: specialisation not found: $specialisation"
+            exit 1
+        fi
+    fi
+
+    if ! targetHostCmd "${cmd[@]}" "$action"; then
+        log "warning: error(s) occurred while switching to the new configuration"
         exit 1
     fi
 fi
 
 
-if [ "$action" = build-vm -o "$action" = build-vm-with-bootloader ]; then
+if [[ "$action" = build-vm || "$action" = build-vm-with-bootloader ]]; then
     cat >&2 <<EOF
 
-Done.  The virtual machine can be started by running $(echo $pathToConfig/bin/run-*-vm)
+Done.  The virtual machine can be started by running $(echo "${pathToConfig}/bin/"run-*-vm)
 EOF
 fi
diff --git a/pkgs/os-specific/linux/nmon/default.nix b/pkgs/os-specific/linux/nmon/default.nix
index 7ec84443cfe..30285f9c5b2 100644
--- a/pkgs/os-specific/linux/nmon/default.nix
+++ b/pkgs/os-specific/linux/nmon/default.nix
@@ -2,16 +2,22 @@
 
 stdenv.mkDerivation rec {
   pname = "nmon";
-  version = "16m";
+  version = "16p";
 
   src = fetchurl {
     url = "mirror://sourceforge/nmon/lmon${version}.c";
-    sha256 = "1hazgrq3m01dzv05639yis1mypcp0jf167n9gqwd3wgxzm2lvv9b";
+    sha256 = "sha256-XcYEX2cl4ySalpkY+uaWY6HWaRYgh3ILq825D86eayo=";
   };
 
   buildInputs = [ ncurses ];
   dontUnpack = true;
-  buildPhase = "cc -o nmon ${src} -g -O2 -D JFS -D GETUSER -Wall -D LARGEMEM -lncurses -lm -g -D X86";
+  buildPhase = "${stdenv.cc.targetPrefix}cc -o nmon ${src} -g -O2 -D JFS -D GETUSER -Wall -D LARGEMEM -lncurses -lm -g -D ${
+    with stdenv.hostPlatform;
+    if isx86 then "X86"
+    else if isAarch then "ARM"
+    else if isPower then "POWER"
+    else "UNKNOWN"
+  }";
   installPhase = ''
     mkdir -p $out/bin
     cp nmon $out/bin
@@ -19,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "AIX & Linux Performance Monitoring tool";
-    homepage = "http://nmon.sourceforge.net";
+    homepage = "https://nmon.sourceforge.net";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ sveitser ];
diff --git a/pkgs/os-specific/linux/nsncd/default.nix b/pkgs/os-specific/linux/nsncd/default.nix
new file mode 100644
index 00000000000..81590a6f869
--- /dev/null
+++ b/pkgs/os-specific/linux/nsncd/default.nix
@@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, nix-gitignore
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "nsncd";
+  version = "unstable-2023-10-26";
+
+  # https://github.com/twosigma/nsncd/pull/71 has not been upstreamed
+  # to twosigma/nsncd yet. Using the nix-community fork in the
+  # meantime.
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "nsncd";
+    rev =  "d6513421f420e407248c6d0aee39ae2f861a7cec";
+    hash = "sha256-PykzwpPxMDHJOr2HubXuw+Krk9Jbi0E3M2lEAOXhx2M=";
+  };
+
+  cargoSha256 = "sha256-cUM7rYXWpJ0aMiurXBp15IlxAmf/x5uiodxEqBPCQT0=";
+
+  meta = with lib; {
+    description = "the name service non-caching daemon";
+    longDescription = ''
+      nsncd is a nscd-compatible daemon that proxies lookups, without caching.
+    '';
+    homepage = "https://github.com/twosigma/nsncd";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ flokli picnoir ];
+    # never built on aarch64-darwin, x86_64-darwin since first introduction in nixpkgs
+    broken = stdenv.isDarwin;
+  };
+}
diff --git a/pkgs/os-specific/linux/nss_ldap/default.nix b/pkgs/os-specific/linux/nss_ldap/default.nix
index 0121c4a6f1c..23bc8ff0dfa 100644
--- a/pkgs/os-specific/linux/nss_ldap/default.nix
+++ b/pkgs/os-specific/linux/nss_ldap/default.nix
@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl, openldap, perl}:
 
-stdenv.mkDerivation {
-  name = "nss_ldap-265";
+stdenv.mkDerivation rec {
+  pname = "nss_ldap";
+  version = "265";
 
   src = fetchurl {
-    url = "http://www.padl.com/download/nss_ldap-265.tar.gz";
+    url = "http://www.padl.com/download/nss_ldap-${version}.tar.gz";
     sha256 = "1a16q9p97d2blrj0h6vl1xr7dg7i4s8x8namipr79mshby84vdbp";
   };
 
diff --git a/pkgs/os-specific/linux/numactl/default.nix b/pkgs/os-specific/linux/numactl/default.nix
index 2f8a4feb030..998b7d052b3 100644
--- a/pkgs/os-specific/linux/numactl/default.nix
+++ b/pkgs/os-specific/linux/numactl/default.nix
@@ -2,15 +2,17 @@
 
 stdenv.mkDerivation rec {
   pname = "numactl";
-  version = "2.0.14";
+  version = "2.0.16";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0hahpdp5xqy9cbg251bdxqkml341djn2h856g435h4ngz63sr9fs";
+    sha256 = "sha256-aDKzkmvrPDzQl4n0KgeiU5LOLhQA0tmwzGiXvJDp7ZI=";
   };
 
+  outputs = [ "out" "dev" "man" ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/numad/default.nix b/pkgs/os-specific/linux/numad/default.nix
index 21d5a871f4e..24fc9e18874 100644
--- a/pkgs/os-specific/linux/numad/default.nix
+++ b/pkgs/os-specific/linux/numad/default.nix
@@ -1,11 +1,13 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
-  name = "numad-0.5";
+  pname = "numad";
+  version = "0.5";
 
-  src = fetchurl {
-    url = "https://git.fedorahosted.org/cgit/numad.git/snapshot/${name}.tar.xz";
-    sha256 = "08zd1yc3w00yv4mvvz5sq1gf91f6p2s9ljcd72m33xgnkglj60v4";
+  src = fetchgit {
+    url = "https://pagure.io/numad.git";
+    rev = "334278ff3d774d105939743436d7378a189e8693";
+    sha256 = "sha256-6nrbfooUI1ufJhsPf68li5584oKQcznXQlxfpStuX5I=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/os-specific/linux/numatop/default.nix b/pkgs/os-specific/linux/numatop/default.nix
index ba972bb6916..f4995264b09 100644
--- a/pkgs/os-specific/linux/numatop/default.nix
+++ b/pkgs/os-specific/linux/numatop/default.nix
@@ -1,16 +1,33 @@
-{ lib, stdenv, fetchurl, pkg-config, numactl, ncurses, check }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, numactl, ncurses, check }:
 
 stdenv.mkDerivation rec {
   pname = "numatop";
-  version = "2.1";
-  src = fetchurl {
-    url = "https://github.com/intel/${pname}/releases/download/v${version}/${pname}-v${version}.tar.xz";
-    sha256 = "1s7psq1xyswj0lpx10zg5lnppav2xy9safkfx3rssrs9c2fp5d76";
+  version = "2.2";
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "numatop";
+    rev = "v${version}";
+    sha256 = "sha256-GJvTwqgx34ZW10eIJj/xiKe3ZkAfs7GlJImz8jrnjfI=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ numactl ncurses ];
-  checkInputs = [ check ];
+  nativeCheckInputs = [ check ];
+
+  patches = [
+    (fetchpatch {
+      # https://github.com/intel/numatop/pull/54
+      url = "https://github.com/intel/numatop/compare/eab0ac5253c5843aa0f0ac36e2eec7612207711b...c1001fd926c24eae2d40729492e07270ce133b72.patch";
+      sha256 = "sha256-TbMLv7TT9T8wE4uJ1a/AroyPPwrwL0eX5IBLsh9GTTM=";
+      name = "fix-string-operations.patch";
+    })
+    (fetchpatch {
+      # https://github.com/intel/numatop/pull/64
+      url = "https://github.com/intel/numatop/commit/635e2ce2ccb1ac793cc276a7fcb8a92b1ffefa5d.patch";
+      sha256 = "sha256-IevbSFJRTS5iQ5apHOVXzF67f3LJaW6j7DySFmVuyiM=";
+      name = "fix-format-strings-mvwprintw.patch";
+    })
+  ];
 
   doCheck  = true;
 
@@ -20,8 +37,8 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ dtzWill ];
     platforms = [
-      { kernel.name = "linux"; cpu.family = "x86"; }
-      { kernel.name = "linux"; cpu.family = "power"; }
+      "i686-linux" "x86_64-linux"
+      "powerpc64-linux" "powerpc64le-linux"
     ];
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index 448e91986fc..fbb116ab42a 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -1,8 +1,9 @@
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 unpackManually() {
     skip=$(sed 's/^skip=//; t; d' $src)
-    tail -n +$skip $src | xz -d | tar xvf -
+    tail -n +$skip $src | bsdtar xvf -
     sourceRoot=.
 }
 
@@ -17,10 +18,8 @@ buildPhase() {
         # Create the module.
         echo "Building linux driver against kernel: $kernel";
         cd kernel
-        sysSrc=$(echo $kernel/lib/modules/$kernelVersion/source)
-        sysOut=$(echo $kernel/lib/modules/$kernelVersion/build)
         unset src # used by the nv makefile
-        make IGNORE_PREEMPT_RT_PRESENCE=1 NV_BUILD_SUPPORTS_HMM=1 SYSSRC=$sysSrc SYSOUT=$sysOut module -j$NIX_BUILD_CORES
+        make $makeFlags -j $NIX_BUILD_CORES module
 
         cd ..
     fi
@@ -65,6 +64,7 @@ installPhase() {
     for i in $lib32 $out; do
         rm -f $i/lib/lib{glx,nvidia-wfb}.so.* # handled separately
         rm -f $i/lib/libnvidia-gtk* # built from source
+        rm -f $i/lib/libnvidia-wayland-client* # built from source
         if [ "$useGLVND" = "1" ]; then
             # Pre-built libglvnd
             rm $i/lib/lib{GL,GLX,EGL,GLESv1_CM,GLESv2,OpenGL,GLdispatch}.so.*
@@ -91,10 +91,11 @@ installPhase() {
                 sed -E "s#(libGLX_nvidia)#$i/lib/\\1#" nvidia_icd.json > nvidia_icd.json.fixed
             fi
 
-            if [ "$system" = "i686-linux" ]; then
+            # nvidia currently only supports x86_64 and i686
+            if [ "$i" == "$lib32" ]; then
                 install -Dm644 nvidia_icd.json.fixed $i/share/vulkan/icd.d/nvidia_icd.i686.json
             else
-                install -Dm644 nvidia_icd.json.fixed $i/share/vulkan/icd.d/nvidia_icd.json
+                install -Dm644 nvidia_icd.json.fixed $i/share/vulkan/icd.d/nvidia_icd.x86_64.json
             fi
         fi
 
@@ -108,12 +109,30 @@ installPhase() {
             sed -E "s#(libEGL_nvidia)#$i/lib/\\1#" 10_nvidia.json > 10_nvidia.json.fixed
             sed -E "s#(libnvidia-egl-wayland)#$i/lib/\\1#" 10_nvidia_wayland.json > 10_nvidia_wayland.json.fixed
 
-            install -Dm644 10_nvidia.json.fixed $i/share/glvnd/egl_vendor.d/nvidia.json
-            install -Dm644 10_nvidia_wayland.json.fixed $i/share/glvnd/egl_vendor.d/nvidia_wayland.json
+            install -Dm644 10_nvidia.json.fixed $i/share/glvnd/egl_vendor.d/10_nvidia.json
+            install -Dm644 10_nvidia_wayland.json.fixed $i/share/egl/egl_external_platform.d/10_nvidia_wayland.json
+
+            if [[ -f "15_nvidia_gbm.json" ]]; then
+              sed -E "s#(libnvidia-egl-gbm)#$i/lib/\\1#" 15_nvidia_gbm.json > 15_nvidia_gbm.json.fixed
+              install -Dm644 15_nvidia_gbm.json.fixed $i/share/egl/egl_external_platform.d/15_nvidia_gbm.json
+
+              mkdir -p $i/lib/gbm
+              ln -s $i/lib/libnvidia-allocator.so $i/lib/gbm/nvidia-drm_gbm.so
+            fi
         fi
 
+        # Install libraries needed by Proton to support DLSS
+        if [ -e nvngx.dll ] && [ -e _nvngx.dll ]; then
+            install -Dm644 -t $i/lib/nvidia/wine/ nvngx.dll _nvngx.dll
+        fi
     done
 
+
+    # OptiX tries loading `$ORIGIN/nvoptix.bin` first
+    if [ -e nvoptix.bin ]; then
+        install -Dm444 -t $out/lib/ nvoptix.bin
+    fi
+
     if [ -n "$bin" ]; then
         # Install the X drivers.
         mkdir -p $bin/lib/xorg/modules
@@ -140,6 +159,11 @@ installPhase() {
         fi
     fi
 
+    if [ -n "$firmware" ]; then
+        # Install the GSP firmware
+        install -Dm644 -t $firmware/lib/firmware/nvidia/$version firmware/gsp*.bin
+    fi
+
     # All libs except GUI-only are installed now, so fixup them.
     for libname in $(find "$out/lib/" $(test -n "$lib32" && echo "$lib32/lib/") $(test -n "$bin" && echo "$bin/lib/") -name '*.so.*')
     do
@@ -173,9 +197,12 @@ installPhase() {
         mkdir -p $bin/share/man/man1
         cp -p *.1.gz $bin/share/man/man1
         rm -f $bin/share/man/man1/{nvidia-xconfig,nvidia-settings,nvidia-persistenced}.1.gz
+        if [ -e "nvidia-dbus.conf" ]; then
+            install -Dm644 nvidia-dbus.conf $bin/share/dbus-1/system.d/nvidia-dbus.conf
+        fi
 
         # Install the programs.
-        for i in nvidia-cuda-mps-control nvidia-cuda-mps-server nvidia-smi nvidia-debugdump; do
+        for i in nvidia-cuda-mps-control nvidia-cuda-mps-server nvidia-smi nvidia-debugdump nvidia-powerd; do
             if [ -e "$i" ]; then
                 install -Dm755 $i $bin/bin/$i
                 # unmodified binary backup for mounting in containers
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index d763c1576cd..7fec21a8237 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -1,11 +1,9 @@
-{ lib, callPackage, fetchpatch, fetchurl, stdenv, pkgsi686Linux }:
+{ lib, callPackage, fetchFromGitHub, fetchurl, fetchpatch, stdenv, pkgsi686Linux }:
 
 let
   generic = args: let
     imported = import ./generic.nix args;
-  in if ((!lib.versionOlder args.version "391")
-    && stdenv.hostPlatform.system != "x86_64-linux") then null
-  else callPackage imported {
+  in callPackage imported {
     lib32 = (pkgsi686Linux.callPackage imported {
       libsOnly = true;
       kernel = null;
@@ -14,47 +12,127 @@ let
 
   kernel = callPackage # a hacky way of extracting parameters from callPackage
     ({ kernel, libsOnly ? false }: if libsOnly then { } else kernel) { };
+
+  selectHighestVersion = a: b: if lib.versionOlder a.version b.version
+    then b
+    else a;
 in
 rec {
+  mkDriver = generic;
+
+  # Official Unix Drivers - https://www.nvidia.com/en-us/drivers/unix/
+  # Branch/Maturity data - http://people.freedesktop.org/~aplattner/nvidia-versions.txt
+
   # Policy: use the highest stable version as the default (on our master).
-  stable = if stdenv.hostPlatform.system == "x86_64-linux"
-    then generic {
-      version = "470.57.02";
-      sha256_64bit = "sha256-VdeuEEgn+qeel1Mh/itg+d1C+/9lZCBTRDwOVv20xH0=";
-      settingsSha256 = "sha256-DJg5QbyuKJmPpLQVYgTLvucI1e9YgQOO16690VXIWvk=";
-      persistencedSha256 = "sha256-Cqv6oUFnsSi3S1sjplJKeq9bI2pqgBXPPb11HOJSlDo=";
-    }
-    else legacy_390;
-
-  beta = generic {
-    version = "470.42.01";
-    sha256_64bit = "04w9nmi3vyww07pmgbd2r1x37s5p6xiy4qg9s06a1kjwzpm59xfd";
-    settingsSha256 = "Ohbkm7j0/V0kzcxfsHujBkrdnaefneoLutf2Rju2hIQ=";
-    persistencedSha256 = "1gfj4ffkidbhgjzdi6sv2sngdcb27w7b0rvfnj129rs36mcxy02j";
+  stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
+
+  production = generic {
+    version = "535.129.03";
+    sha256_64bit = "sha256-5tylYmomCMa7KgRs/LfBrzOLnpYafdkKwJu4oSb/AC4=";
+    sha256_aarch64 = "sha256-i6jZYUV6JBvN+Rt21v4vNstHPIu9sC+2ZQpiLOLoWzM=";
+    openSha256 = "sha256-/Hxod/LQ4CGZN1B1GRpgE/xgoYlkPpMh+n8L7tmxwjs=";
+    settingsSha256 = "sha256-QKN/gLGlT+/hAdYKlkIjZTgvubzQTt4/ki5Y+2Zj3pk=";
+    persistencedSha256 = "sha256-FRMqY5uAJzq3o+YdM2Mdjj8Df6/cuUUAnh52Ne4koME=";
   };
 
+  latest = selectHighestVersion production (generic {
+    version = "545.29.02";
+    sha256_64bit = "sha256-RncPlaSjhvBFUCOzWdXSE3PAfRPCIrWAXyJMdLPKuIU=";
+    sha256_aarch64 = "sha256-Y2RDOuDtiIclr06gmLrPDfE5VFmFamXxiIIKtKAewro=";
+    openSha256 = "sha256-PukpOBtG5KvZKWYfJHVQO6SuToJUd/rkjpOlEi8pSmk=";
+    settingsSha256 = "sha256-zj173HCZJaxAbVV/A2sbJ9IPdT1+3yrwyxD+AQdkSD8=";
+    persistencedSha256 = "sha256-mmMi2pfwzI1WYOffMVdD0N1HfbswTGg7o57x9/IiyVU=";
+
+    patchFlags = [ "-p1" "-d" "kernel" ];
+    patches = [];
+  });
+
+  beta = selectHighestVersion latest (generic {
+    version = "545.23.06";
+    sha256_64bit = "sha256-QTnTKAGfcvKvKHik0BgAemV3PrRqRlM3B9jjZeupCC8=";
+    sha256_aarch64 = "sha256-qkVP6AiXNoRTqgqPvs/AfErEq8BTQw25rtJ6GS06JTM=";
+    openSha256 = "sha256-m7D5LZdhFCZYAIbhrgZ0pN2z19LsU3I3Q7qsKX7Z6mM=";
+    settingsSha256 = "sha256-+X6gDeU8Qlvprb05aB2quM55y0zEcBXtb65e3Rq9gKg=";
+    persistencedSha256 = "sha256-RQJAIwPqOUI5FB3uf0/Y4K/iwFfoLpU1/+BOK/KF5VA=";
+  });
+
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "455.46.04";
-    persistencedVersion = "455.45.01";
-    settingsVersion = "455.45.01";
-    sha256_64bit = "1iv42w3x1vc00bgn6y4w1hnfsvnh6bvj3vcrq8hw47760sqwa4xa";
-    settingsSha256 = "09v86y2c8xas9ql0bqr7vrjxx3if6javccwjzyly11dzffm02h7g";
-    persistencedSha256 = "13s4b73il0lq2hs81q03176n16mng737bfsp3bxnxgnrv3whrayz";
-    url = "https://developer.nvidia.com/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
+    version = "535.43.16";
+    persistencedVersion = "535.98";
+    settingsVersion = "535.98";
+    sha256_64bit = "sha256-c93CJSMPlGZgk+jhp9zTHCKSZ0LdnJu+ifLo+qMvIIk=";
+    openSha256 = "sha256-509KaBavGIOOpzdrdJuAR1PYq91Clwo8n+nhruxO1wM=";
+    settingsSha256 = "sha256-jCRfeB1w6/dA27gaz6t5/Qo7On0zbAPIi74LYLel34s=";
+    persistencedSha256 = "sha256-WviDU6B50YG8dO64CGvU3xK8WFUX8nvvVYm/fuGyroM=";
+    url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
+  };
+
+  # data center driver compatible with current default cudaPackages
+  dc = dc_520;
+  dc_520 = generic rec {
+    version = "520.61.05";
+    url = "https://us.download.nvidia.com/tesla/${version}/NVIDIA-Linux-x86_64-${version}.run";
+    sha256_64bit = "sha256-EPYWZwOur/6iN/otDMrNDpNXr1mzu8cIqQl8lXhQlzU==";
+    fabricmanagerSha256 = "sha256-o8Kbmkg7qczKQclaGvEyXNzEOWq9ZpQZn9syeffnEiE==";
+    useSettings = false;
+    usePersistenced = false;
+    useFabricmanager = true;
+  };
+
+  # Update note:
+  # If you add a legacy driver here, also update `top-level/linux-kernels.nix`,
+  # adding to the `nvidia_x11_legacy*` entries.
+
+  # Last one supporting Kepler architecture
+  legacy_470 = generic {
+    version = "470.223.02";
+    sha256_64bit = "sha256-s2hi1TNsw+br6Ow6tPiFsYPaJY8d+x4FrkBrP2xNRPg=";
+    sha256_aarch64 = "sha256-CFkg2ARlGWqlFQKm8SlbwMH6eLidHKA/q5QGVOpPGuU=";
+    settingsSha256 = "sha256-r6DuIH/rnsCm/y51iRgPNi5/kz+EFMVABREdTjBneZ0=";
+    persistencedSha256 = "sha256-e71fpPBBv8S/aoeXxBXkzKy5bsMMbv8y024cSLc8DYc=";
+
+    patchFlags = [ "-p1" "-d" "kernel" ];
+    patches = [];
   };
 
   # Last one supporting x86
   legacy_390 = generic {
-    version = "390.143";
-    sha256_32bit = "AelrdTTeo/3+ZdXK0iniZDB8gJUkeZQtNoRm25z+bQY=";
-    sha256_64bit = "tyKqcPM71ErK8ZZHLPtxmgrWzv6tfEmxBRveCSwTlO8=";
-    settingsSha256 = "EJPXZbxZS1CMENAYk9dCAIsHsRTXJpj473+JLuhGkWI=";
-    persistencedSha256 = "FtlPF3jCNr18NnImTmr8zJsaK9wbj/aWZ9LwoLr5SeE=";
+    version = "390.157";
+    sha256_32bit = "sha256-VdZeCkU5qct5YgDF8Qgv4mP7CVHeqvlqnP/rioD3B5k=";
+    sha256_64bit = "sha256-W+u8puj+1da52BBw+541HxjtxTSVJVPL3HHo/QubMoo=";
+    settingsSha256 = "sha256-uJZO4ak/w/yeTQ9QdXJSiaURDLkevlI81de0q4PpFpw=";
+    persistencedSha256 = "sha256-NuqUQbVt80gYTXgIcu0crAORfsj9BCRooyH3Gp1y1ns=";
+
+    broken = kernel.kernelAtLeast "6.2";
   };
 
-  legacy_340 = generic {
+  legacy_340 = let
+    # Source cooresponding to https://aur.archlinux.org/packages/nvidia-340xx-dkms
+    aurPatches = fetchFromGitHub {
+      owner = "archlinux-jerry";
+      repo = "nvidia-340xx";
+      rev = "fa434fb5da47e9423db2b19577817eb8c65d2f4e";
+      hash = "sha256-KeMTYHGuZSAPGnYaERZSMu/4lWyB25ZCIv4nJhXxABY=";
+    };
+    patchset = [
+      "0001-kernel-5.7.patch"
+      "0002-kernel-5.8.patch"
+      "0003-kernel-5.9.patch"
+      "0004-kernel-5.10.patch"
+      "0005-kernel-5.11.patch"
+      "0006-kernel-5.14.patch"
+      "0007-kernel-5.15.patch"
+      "0008-kernel-5.16.patch"
+      "0009-kernel-5.17.patch"
+      "0010-kernel-5.18.patch"
+      "0011-kernel-6.0.patch"
+      "0012-kernel-6.2.patch"
+      "0013-kernel-6.3.patch"
+      "0014-kernel-6.5.patch"
+    ];
+  in generic {
     version = "340.108";
     sha256_32bit = "1jkwa1phf0x4sgw8pvr9d6krmmr3wkgwyygrxhdazwyr2bbalci0";
     sha256_64bit = "06xp6c0sa7v1b82gf0pq0i5p0vdhmm3v964v0ypw36y0nzqx8wf6";
@@ -62,6 +140,7 @@ rec {
     persistencedSha256 = "1ax4xn3nmxg1y6immq933cqzw6cj04x93saiasdc0kjlv0pvvnkn";
     useGLVND = false;
 
-    patches = [ ./vm_operations_struct-fault.patch ];
+    broken = kernel.kernelAtLeast "6.6";
+    patches = map (patch: "${aurPatches}/${patch}") patchset;
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix b/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
new file mode 100644
index 00000000000..58cf8c0e355
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/fabricmanager.nix
@@ -0,0 +1,47 @@
+nvidia_x11: sha256:
+
+{ stdenv, lib, fetchurl, patchelf }:
+
+let
+  sys = with lib; concatStringsSep "-" (reverseList (splitString "-" stdenv.system));
+  bsys = builtins.replaceStrings ["_"] ["-"] sys;
+  fmver = nvidia_x11.version;
+in
+
+stdenv.mkDerivation rec {
+  pname = "fabricmanager";
+  version = fmver;
+  src = fetchurl {
+    url = "https://developer.download.nvidia.com/compute/cuda/redist/fabricmanager/" +
+          "${sys}/${pname}-${sys}-${fmver}-archive.tar.xz";
+    inherit sha256;
+  };
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    find .
+    mkdir -p $out/{bin,share/nvidia-fabricmanager}
+    for bin in nv{-fabricmanager,switch-audit};do
+    ${patchelf}/bin/patchelf \
+      --set-interpreter ${stdenv.cc.libc}/lib/ld-${bsys}.so.2 \
+      --set-rpath ${lib.makeLibraryPath [ stdenv.cc.libc ]} \
+      bin/$bin
+    done
+    mv bin/nv{-fabricmanager,switch-audit} $out/bin/.
+    for d in etc systemd share/nvidia;do
+      mv $d $out/share/nvidia-fabricmanager/.
+    done
+    for d in include lib;do
+      mv $d $out/.
+    done
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.nvidia.com/object/unix.html";
+    description = "Fabricmanager daemon for NVLink intialization and control";
+    license = licenses.unfreeRedistributable;
+    platforms = nvidia_x11.meta.platforms;
+    mainProgram = "nv-fabricmanager";
+    maintainers = with maintainers; [ edwtjo ];
+  };
+}
diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index 2d325ab3d56..8ec292f2725 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -2,79 +2,145 @@
 , url ? null
 , sha256_32bit ? null
 , sha256_64bit
-, settingsSha256
+, sha256_aarch64 ? null
+, openSha256 ? null
+, settingsSha256 ? null
 , settingsVersion ? version
-, persistencedSha256
+, persistencedSha256 ? null
 , persistencedVersion ? version
+, fabricmanagerSha256 ? null
+, fabricmanagerVersion ? version
 , useGLVND ? true
 , useProfiles ? true
 , preferGtk2 ? false
 , settings32Bit ? false
+, useSettings ? true
+, usePersistenced ? true
+, useFabricmanager ? false
+, ibtSupport ? false
 
 , prePatch ? ""
+, postPatch ? null
+, patchFlags ? null
 , patches ? []
 , broken ? false
+, brokenOpen ? broken
 }@args:
 
 { lib, stdenv, callPackage, pkgs, pkgsi686Linux, fetchurl
-, kernel ? null, perl, nukeReferences
+, kernel ? null, perl, nukeReferences, which, libarchive
 , # Whether to build the libraries only (i.e. not the kernel module or
   # nvidia-settings).  Used to support 32-bit binaries on 64-bit
   # Linux.
   libsOnly ? false
 , # don't include the bundled 32-bit libraries on 64-bit platforms,
   # even if it’s in downloaded binary
-  disable32Bit ? false
+  disable32Bit ? stdenv.hostPlatform.system == "aarch64-linux"
   # 32 bit libs only version of this package
 , lib32 ? null
+  # Whether to extract the GSP firmware, datacenter drivers needs to extract the
+  # firmware
+, firmware ? openSha256 != null || useFabricmanager
+  # Whether the user accepts the NVIDIA Software License
+, config, acceptLicense ? config.nvidia.acceptLicense or false
 }:
 
 with lib;
 
 assert !libsOnly -> kernel != null;
 assert versionOlder version "391" -> sha256_32bit != null;
-assert ! versionOlder version "391" -> stdenv.hostPlatform.system == "x86_64-linux";
+assert useSettings -> settingsSha256 != null;
+assert usePersistenced -> persistencedSha256 != null;
+assert useFabricmanager -> fabricmanagerSha256 != null;
+assert useFabricmanager -> !(useSettings || usePersistenced);
 
 let
   nameSuffix = optionalString (!libsOnly) "-${kernel.version}";
   pkgSuffix = optionalString (versionOlder version "304") "-pkg0";
   i686bundled = versionAtLeast version "391" && !disable32Bit;
 
-  libPathFor = pkgs: pkgs.lib.makeLibraryPath [ pkgs.libdrm pkgs.xorg.libXext pkgs.xorg.libX11
-    pkgs.xorg.libXv pkgs.xorg.libXrandr pkgs.xorg.libxcb pkgs.zlib pkgs.stdenv.cc.cc ];
+  libPathFor = pkgs: lib.makeLibraryPath (with pkgs; [
+    libdrm xorg.libXext xorg.libX11
+    xorg.libXv xorg.libXrandr xorg.libxcb zlib stdenv.cc.cc
+    wayland mesa libGL openssl
+    dbus # for nvidia-powerd
+  ]);
+
+  # maybe silly since we've ignored this previously and just unfree..
+  throwLicense = throw ''
+    Use of NVIDIA Software requires license acceptance of the license:
+
+      - License For Customer Use of NVIDIA Software [1]
+
+    You can express acceptance by setting acceptLicense to true your nixpkgs.config.
+    Example:
+
+      configuration.nix:
+        nixpkgs.config.allowUnfree = true;
+        nixpkgs.config.nvidia.acceptLicense = true;
+
+      config.nix:
+        allowUnfree = true;
+        nvidia.acceptLicense = true;
+
+    [1]: https://www.nvidia.com/content/DriverDownloads/licence.php?lang=us
+  '';
 
   self = stdenv.mkDerivation {
-    name = "nvidia-x11-${version}${nameSuffix}";
+    name = "nvidia-${if useFabricmanager then "dc" else "x11"}-${version}${nameSuffix}";
 
     builder = ./builder.sh;
 
     src =
+      if !acceptLicense && (openSha256 == null) then throwLicense else
       if stdenv.hostPlatform.system == "x86_64-linux" then
         fetchurl {
-          url = args.url or "https://us.download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run";
+          urls = if args ? url then [ args.url ] else [
+            "https://us.download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run"
+            "https://download.nvidia.com/XFree86/Linux-x86_64/${version}/NVIDIA-Linux-x86_64-${version}${pkgSuffix}.run"
+          ];
           sha256 = sha256_64bit;
         }
       else if stdenv.hostPlatform.system == "i686-linux" then
         fetchurl {
-          url = args.url or "https://download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run";
+          urls = if args ? url then [ args.url ] else [
+            "https://us.download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run"
+            "https://download.nvidia.com/XFree86/Linux-x86/${version}/NVIDIA-Linux-x86-${version}${pkgSuffix}.run"
+          ];
           sha256 = sha256_32bit;
         }
+      else if stdenv.hostPlatform.system == "aarch64-linux" && sha256_aarch64 != null then
+        fetchurl {
+          urls = if args ? url then [ args.url ] else [
+            "https://us.download.nvidia.com/XFree86/aarch64/${version}/NVIDIA-Linux-aarch64-${version}${pkgSuffix}.run"
+            "https://download.nvidia.com/XFree86/Linux-aarch64/${version}/NVIDIA-Linux-aarch64-${version}${pkgSuffix}.run"
+          ];
+          sha256 = sha256_aarch64;
+        }
       else throw "nvidia-x11 does not support platform ${stdenv.hostPlatform.system}";
 
     patches = if libsOnly then null else patches;
-    inherit prePatch;
+    inherit prePatch postPatch patchFlags;
     inherit version useGLVND useProfiles;
     inherit (stdenv.hostPlatform) system;
     inherit i686bundled;
 
     outputs = [ "out" ]
         ++ optional i686bundled "lib32"
-        ++ optional (!libsOnly) "bin";
+        ++ optional (!libsOnly) "bin"
+        ++ optional (!libsOnly && firmware) "firmware";
     outputDev = if libsOnly then null else "bin";
 
     kernel = if libsOnly then null else kernel.dev;
     kernelVersion = if libsOnly then null else kernel.modDirVersion;
 
+    makeFlags = optionals (!libsOnly) (kernel.makeFlags ++ [
+      "IGNORE_PREEMPT_RT_PRESENCE=1"
+      "NV_BUILD_SUPPORTS_HMM=1"
+      "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+      "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    ]);
+
     hardeningDisable = [ "pic" "format" ];
 
     dontStrip = true;
@@ -83,28 +149,43 @@ let
     libPath = libPathFor pkgs;
     libPath32 = optionalString i686bundled (libPathFor pkgsi686Linux);
 
-    nativeBuildInputs = [ perl nukeReferences ]
+    nativeBuildInputs = [ perl nukeReferences which libarchive ]
       ++ optionals (!libsOnly) kernel.moduleBuildDependencies;
 
-    disallowedReferences = optional (!libsOnly) [ kernel.dev ];
+    disallowedReferences = optionals (!libsOnly) [ kernel.dev ];
 
     passthru = {
-      settings = (if settings32Bit then pkgsi686Linux.callPackage else callPackage) (import ./settings.nix self settingsSha256) {
-        withGtk2 = preferGtk2;
-        withGtk3 = !preferGtk2;
-      };
-      persistenced = mapNullable (hash: callPackage (import ./persistenced.nix self hash) { }) persistencedSha256;
+      open = mapNullable (hash: callPackage ./open.nix {
+        inherit hash;
+        nvidia_x11 = self;
+        broken = brokenOpen;
+      }) openSha256;
+      settings = if useSettings then
+        (if settings32Bit then pkgsi686Linux.callPackage else callPackage) (import ./settings.nix self settingsSha256) {
+          withGtk2 = preferGtk2;
+          withGtk3 = !preferGtk2;
+        } else {};
+      persistenced = if usePersistenced then
+        mapNullable (hash: callPackage (import ./persistenced.nix self hash) { }) persistencedSha256
+      else {};
+      fabricmanager = if useFabricmanager then
+        mapNullable (hash: callPackage (import ./fabricmanager.nix self hash) { }) fabricmanagerSha256
+      else {};
       inherit persistencedVersion settingsVersion;
+      compressFirmware = false;
+      ibtSupport = ibtSupport || (lib.versionAtLeast version "530");
     } // optionalAttrs (!i686bundled) {
       inherit lib32;
     };
 
     meta = with lib; {
       homepage = "https://www.nvidia.com/object/unix.html";
-      description = "X.org driver and kernel module for NVIDIA graphics cards";
+      description = "${if useFabricmanager then "Data Center" else "X.org"} driver and kernel module for NVIDIA cards";
       license = licenses.unfreeRedistributable;
-      platforms = [ "x86_64-linux" ] ++ optionals (!i686bundled) [ "i686-linux" ];
-      maintainers = with maintainers; [ baracoder ];
+      platforms = [ "x86_64-linux" ]
+        ++ optionals (sha256_32bit != null) [ "i686-linux" ]
+        ++ optionals (sha256_aarch64 != null) [ "aarch64-linux" ];
+      maintainers = with maintainers; [ jonringer kiskae edwtjo ];
       priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
       inherit broken;
     };
diff --git a/pkgs/os-specific/linux/nvidia-x11/open.nix b/pkgs/os-specific/linux/nvidia-x11/open.nix
new file mode 100644
index 00000000000..a6795c3fd5e
--- /dev/null
+++ b/pkgs/os-specific/linux/nvidia-x11/open.nix
@@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, kernel
+, nvidia_x11
+, hash
+, broken ? false
+}:
+
+stdenv.mkDerivation ({
+  pname = "nvidia-open";
+  version = "${kernel.version}-${nvidia_x11.version}";
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "open-gpu-kernel-modules";
+    rev = nvidia_x11.version;
+    inherit hash;
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "SYSSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+    "SYSOUT=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"
+    {
+      aarch64-linux = "TARGET_ARCH=aarch64";
+      x86_64-linux = "TARGET_ARCH=x86_64";
+    }.${stdenv.hostPlatform.system}
+  ];
+
+  installTargets = [ "modules_install" ];
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "NVIDIA Linux Open GPU Kernel Module";
+    homepage = "https://github.com/NVIDIA/open-gpu-kernel-modules";
+    license = with licenses; [ gpl2Plus mit ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ nickcao ];
+    inherit broken;
+  };
+} // lib.optionalAttrs stdenv.hostPlatform.isAarch64 {
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+})
diff --git a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
index 9a3daa3d270..03ad03a472d 100644
--- a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ m4 ];
   buildInputs = [ libtirpc ];
 
+  inherit (nvidia_x11) makeFlags;
+
   installFlags = [ "PREFIX=$(out)" ];
 
   postFixup = ''
@@ -33,7 +35,7 @@ stdenv.mkDerivation rec {
       $out/bin/nvidia-persistenced
   '';
 
-  NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
   NIX_LDFLAGS = [ "-ltirpc" ];
 
   meta = with lib; {
@@ -42,5 +44,6 @@ stdenv.mkDerivation rec {
     license = licenses.unfreeRedistributable;
     platforms = nvidia_x11.meta.platforms;
     maintainers = with maintainers; [ abbradar ];
+    mainProgram = pname;
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/settings.nix b/pkgs/os-specific/linux/nvidia-x11/settings.nix
index d5bbf40e2b8..b11dc06c85e 100644
--- a/pkgs/os-specific/linux/nvidia-x11/settings.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/settings.nix
@@ -1,8 +1,25 @@
 nvidia_x11: sha256:
 
-{ stdenv, lib, fetchFromGitHub, pkg-config, m4, jansson, gtk2, dbus, gtk3, libXv, libXrandr, libXext, libXxf86vm, libvdpau
-, librsvg, wrapGAppsHook
-, withGtk2 ? false, withGtk3 ? true
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, pkg-config
+, m4
+, jansson
+, gtk2
+, dbus
+, gtk3
+, libXv
+, libXrandr
+, libXext
+, libXxf86vm
+, libvdpau
+, librsvg
+, wrapGAppsHook
+, addOpenGLRunpath
+, withGtk2 ? false
+, withGtk3 ? true
 }:
 
 let
@@ -43,29 +60,46 @@ in
 stdenv.mkDerivation {
   pname = "nvidia-settings";
   version = nvidia_x11.settingsVersion;
-  inherit src;
 
-  nativeBuildInputs = [ pkg-config m4 ];
+  inherit src;
 
-  buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 gtk2 dbus ]
-             ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
-
-  enableParallelBuilding = true;
-  makeFlags = [ "NV_USE_BUNDLED_LIBJANSSON=0" ];
-  installFlags = [ "PREFIX=$(out)" ];
+  patches = lib.optional (lib.versionOlder nvidia_x11.settingsVersion "440")
+    (fetchpatch {
+      # fixes "multiple definition of `VDPAUDeviceFunctions'" linking errors
+      url = "https://github.com/NVIDIA/nvidia-settings/commit/a7c1f5fce6303a643fadff7d85d59934bd0cf6b6.patch";
+      hash = "sha256-ZwF3dRTYt/hO8ELg9weoz1U/XcU93qiJL2d1aq1Jlak=";
+    })
+  ++ lib.optional
+    ((lib.versionAtLeast nvidia_x11.settingsVersion "515.43.04")
+      && (lib.versionOlder nvidia_x11.settingsVersion "545.29"))
+    (fetchpatch {
+      # fix wayland support for compositors that use wl_output version 4
+      url = "https://github.com/NVIDIA/nvidia-settings/pull/99/commits/2e0575197e2b3247deafd2a48f45afc038939a06.patch";
+      hash = "sha256-wKuO5CUTUuwYvsP46Pz+6fI0yxLNpZv8qlbL0TFkEFE=";
+    });
 
   postPatch = lib.optionalString nvidia_x11.useProfiles ''
     sed -i 's,/usr/share/nvidia/,${nvidia_x11.bin}/share/nvidia/,g' src/gtk+-2.x/ctkappprofile.c
   '';
 
+  enableParallelBuilding = true;
+  makeFlags = [ "NV_USE_BUNDLED_LIBJANSSON=0" ];
+
   preBuild = ''
     if [ -e src/libXNVCtrl/libXNVCtrl.a ]; then
       ( cd src/libXNVCtrl
-        make
+        make $makeFlags
       )
     fi
   '';
 
+  nativeBuildInputs = [ pkg-config m4 addOpenGLRunpath ];
+
+  buildInputs = [ jansson libXv libXrandr libXext libXxf86vm libvdpau nvidia_x11 gtk2 dbus ]
+    ++ lib.optionals withGtk3 [ gtk3 librsvg wrapGAppsHook ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
   postInstall = ''
     ${lib.optionalString (!withGtk2) ''
       rm -f $out/lib/libnvidia-gtk2.so.*
@@ -87,10 +121,11 @@ stdenv.mkDerivation {
   '';
 
   binaryName = if withGtk3 then ".nvidia-settings-wrapped" else "nvidia-settings";
-
   postFixup = ''
     patchelf --set-rpath "$(patchelf --print-rpath $out/bin/$binaryName):$out/lib:${libXv}/lib" \
       $out/bin/$binaryName
+
+    addOpenGLRunpath $out/bin/$binaryName
   '';
 
   passthru = {
@@ -102,6 +137,7 @@ stdenv.mkDerivation {
     description = "Settings application for NVIDIA graphics cards";
     license = licenses.unfreeRedistributable;
     platforms = nvidia_x11.meta.platforms;
+    mainProgram = "nvidia-settings";
     maintainers = with maintainers; [ abbradar ];
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/vm_operations_struct-fault.patch b/pkgs/os-specific/linux/nvidia-x11/vm_operations_struct-fault.patch
deleted file mode 100644
index 6ce5c1205e2..00000000000
--- a/pkgs/os-specific/linux/nvidia-x11/vm_operations_struct-fault.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-https://devtalk.nvidia.com/default/topic/1025051/fully-working-patches-2-of-them-for-nvidia-driver-340-104-compiler-installer-file-and-linux-kernels-4-13-amp-4-14/?offset=5
---- a/kernel/uvm/nvidia_uvm_lite.c
-+++ b/kernel/uvm/nvidia_uvm_lite.c
-@@ -818,8 +818,15 @@ done:
- }
-
- #if defined(NV_VM_OPERATIONS_STRUCT_HAS_FAULT)
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 11, 0)
- int _fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+#else
-+int _fault(struct vm_fault *vmf)
-+#endif
- {
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0)
-+    struct vm_area_struct *vma = vmf->vma;
-+#endif
- #if defined(NV_VM_FAULT_HAS_ADDRESS)
-     unsigned long vaddr = vmf->address;
- #else
-@@ -866,7 +873,11 @@ static struct vm_operations_struct uvmlite_vma_ops =
- // it's dealing with anonymous mapping (see handle_pte_fault).
- //
- #if defined(NV_VM_OPERATIONS_STRUCT_HAS_FAULT)
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 11, 0)
- int _sigbus_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-+#else
-+int _sigbus_fault(struct vm_fault *vmf)
-+#endif
- {
-     vmf->page = NULL;
-     return VM_FAULT_SIGBUS;
diff --git a/pkgs/os-specific/linux/nvidiabl/default.nix b/pkgs/os-specific/linux/nvidiabl/default.nix
index 7ce7c313485..0f4d485a4ed 100644
--- a/pkgs/os-specific/linux/nvidiabl/default.nix
+++ b/pkgs/os-specific/linux/nvidiabl/default.nix
@@ -28,9 +28,10 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Linux driver for setting the backlight brightness on laptops using NVIDIA GPU";
-    homepage = "https://github.com/guillaumezin/nvidiabl";
+    homepage = "https://github.com/yorickvP/nvidiabl";
     license = licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
     maintainers = with maintainers; [ yorickvp ];
+    broken = kernel.kernelAtLeast "5.18";
   };
 }
diff --git a/pkgs/os-specific/linux/nvme-cli/default.nix b/pkgs/os-specific/linux/nvme-cli/default.nix
index 3a306508488..e0d0372fd6f 100644
--- a/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -1,26 +1,41 @@
 { lib, stdenv, fetchFromGitHub, pkg-config
-, libuuid
+, meson
+, ninja
+, libnvme
+, json_c
+, zlib
+, libhugetlbfs
+, python3Packages
 }:
 
 stdenv.mkDerivation rec {
   pname = "nvme-cli";
-  version = "1.14";
+  version = "2.6";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    sha256 = "0dpadz945482srqpsbfx1bh7rc499fgpyzz1flhk9g9xjbpapkzc";
+    hash = "sha256-MFyBkwTNOBQdHWj7In1OquRIAsjsd4/DHYfUyFA9YDQ=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libuuid ];
+  mesonFlags = [
+    "-Dversion-tag=${version}"
+  ];
 
-  makeFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
-
-  # To omit the hostnqn and hostid files that are impure and should be unique
-  # for each target host:
-  installTargets = [ "install-spec" ];
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    python3Packages.nose2
+  ];
+  buildInputs = [
+    libnvme
+    json_c
+    zlib
+  ] ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform libhugetlbfs) [
+    libhugetlbfs
+  ];
 
   meta = with lib; {
     inherit (src.meta) homepage; # https://nvmexpress.org/
@@ -35,6 +50,7 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ mic92 ];
+    maintainers = with maintainers; [ mic92 vifino ];
+    mainProgram = "nvme";
   };
 }
diff --git a/pkgs/os-specific/linux/ocf-resource-agents/default.nix b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
new file mode 100644
index 00000000000..11f094f72c9
--- /dev/null
+++ b/pkgs/os-specific/linux/ocf-resource-agents/default.nix
@@ -0,0 +1,68 @@
+# This combines together OCF definitions from other derivations.
+# https://github.com/ClusterLabs/resource-agents/blob/master/doc/dev-guides/ra-dev-guide.asc
+{ stdenv
+, lib
+, runCommand
+, lndir
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, python3
+, glib
+, drbd
+, pacemaker
+}:
+
+let
+  drbdForOCF = drbd.override {
+    forOCF = true;
+  };
+  pacemakerForOCF = pacemaker.override {
+    forOCF = true;
+  };
+
+  resource-agentsForOCF = stdenv.mkDerivation rec {
+    pname = "resource-agents";
+    version = "4.10.0";
+
+    src = fetchFromGitHub {
+      owner = "ClusterLabs";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "0haryi3yrszdfpqnkfnppxj1yiy6ipah6m80snvayc7v0ss0wnir";
+    };
+
+    nativeBuildInputs = [
+      autoreconfHook
+      pkg-config
+    ];
+
+    buildInputs = [
+      glib
+      python3
+    ];
+
+    env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "12") [
+      # Needed with GCC 12 but breaks on darwin (with clang) or older gcc
+      "-Wno-error=maybe-uninitialized"
+    ]);
+
+    meta = with lib; {
+      homepage = "https://github.com/ClusterLabs/resource-agents";
+      description = "Combined repository of OCF agents from the RHCS and Linux-HA projects";
+      license = licenses.gpl2Plus;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ ryantm astro ];
+    };
+  };
+
+in
+
+# This combines together OCF definitions from other derivations.
+# https://github.com/ClusterLabs/resource-agents/blob/master/doc/dev-guides/ra-dev-guide.asc
+runCommand "ocf-resource-agents" {} ''
+  mkdir -p $out/usr/lib/ocf
+  ${lndir}/bin/lndir -silent "${resource-agentsForOCF}/lib/ocf/" $out/usr/lib/ocf
+  ${lndir}/bin/lndir -silent "${drbdForOCF}/usr/lib/ocf/" $out/usr/lib/ocf
+  ${lndir}/bin/lndir -silent "${pacemakerForOCF}/usr/lib/ocf/" $out/usr/lib/ocf
+''
diff --git a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
index 511dd162785..61a27bd51f0 100644
--- a/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
+++ b/pkgs/os-specific/linux/oci-seccomp-bpf-hook/default.nix
@@ -10,14 +10,14 @@
 
 buildGoModule rec {
   pname = "oci-seccomp-bpf-hook";
-  version = "1.2.3";
+  version = "1.2.10";
   src = fetchFromGitHub {
     owner = "containers";
     repo = "oci-seccomp-bpf-hook";
     rev = "v${version}";
-    sha256 = "sha256-EKD6tkdQCPlVlb9ScvRwDxYAtbbv9PIqBHH6SvtPDsE=";
+    sha256 = "sha256-bWlm+JYNf7+faKSQfW5fhxoH/D2I8ujjakswH+1r49o=";
   };
-  vendorSha256 = null;
+  vendorHash = null;
 
   outputs = [ "out" "man" ];
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/oddjob/default.nix b/pkgs/os-specific/linux/oddjob/default.nix
new file mode 100644
index 00000000000..bcbea908648
--- /dev/null
+++ b/pkgs/os-specific/linux/oddjob/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchurl
+, stdenv
+, autoreconfHook
+, dbus
+, libxml2
+, pam
+, pkg-config
+, systemd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "oddjob";
+  version = "0.34.7";
+
+  src = fetchurl {
+     url = "https://pagure.io/oddjob/archive/${pname}-${version}/oddjob-${pname}-${version}.tar.gz";
+     hash = "sha256-SUOsMH55HtEsk5rX0CXK0apDObTj738FGOaL5xZRnIM=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs =[
+    libxml2
+    dbus
+    pam
+    systemd
+  ];
+
+  postPatch = ''
+    substituteInPlace configure.ac \
+      --replace 'SYSTEMDSYSTEMUNITDIR=`pkg-config --variable=systemdsystemunitdir systemd 2> /dev/null`' "SYSTEMDSYSTEMUNITDIR=${placeholder "out"}" \
+      --replace 'SYSTEMDSYSTEMUNITDIR=`pkg-config --variable=systemdsystemunitdir systemd`' "SYSTEMDSYSTEMUNITDIR=${placeholder "out"}"
+  '';
+
+  configureFlags = [
+    "--prefix=${placeholder "out"}"
+    "--sysconfdir=${placeholder "out"}/etc"
+    "--with-selinux-acls=no"
+    "--with-selinux-labels=no"
+    "--disable-systemd"
+  ];
+
+  postConfigure = ''
+    substituteInPlace src/oddjobd.c \
+      --replace "globals.selinux_enabled" "FALSE"
+  '';
+
+  meta = with lib; {
+    description = "Odd Job Daemon";
+    homepage = "https://pagure.io/oddjob";
+    changelog = "https://pagure.io/oddjob/blob/oddjob-${version}/f/ChangeLog";
+    license = licenses.bsd0;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ SohamG ];
+  };
+}
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index 66b39b2c89e..7ac560824db 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -1,32 +1,37 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config
-, dpdk, libbpf, libconfig, libpcap, numactl, openssl, zlib, libbsd, libelf, jansson
-}: let
-  dpdk_19_11 = dpdk.overrideAttrs (old: rec {
-    version = "19.11";
-    src = fetchurl {
-      url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
-      sha256 = "sha256-RnEzlohDZ3uxwna7dKNFiqfAAswh4pXFHjvWVJexEqs=";
-    };
-    mesonFlags = old.mesonFlags ++ [
-      "-Denable_docs=false"
-    ];
-  });
-
-in stdenv.mkDerivation rec {
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, pkg-config
+, dpdk
+, libbpf
+, libconfig
+, libpcap
+, numactl
+, openssl
+, zlib
+, libbsd
+, libelf
+, jansson
+, libnl
+}:
+
+stdenv.mkDerivation rec {
   pname = "odp-dpdk";
-  version = "1.30.1.0_DPDK_19.11";
+  version = "1.42.0.0_DPDK_22.11";
 
   src = fetchurl {
     url = "https://git.linaro.org/lng/odp-dpdk.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-R3PsqQiHlHPzIYYWTVEC7Ikg3KR5I0jWGgftDA9Jj1o=";
+    hash = "sha256-qtdqYE4+ab6/9Z0YXXCItcfj+3+gyprcNMAnAZkl4GA=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
-    dpdk_19_11
+    dpdk
     libconfig
     libpcap
     numactl
@@ -36,6 +41,13 @@ in stdenv.mkDerivation rec {
     libelf
     jansson
     libbpf
+    libnl
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    # Needed with GCC 12
+    "-Wno-error=maybe-uninitialized"
+    "-Wno-error=uninitialized"
   ];
 
   # binaries will segfault otherwise
@@ -47,7 +59,7 @@ in stdenv.mkDerivation rec {
     description = "Open Data Plane optimized for DPDK";
     homepage = "https://www.opendataplane.org";
     license = licenses.bsd3;
-    platforms =  platforms.linux;
+    platforms = platforms.linux;
     maintainers = [ maintainers.abuibrahim ];
   };
 }
diff --git a/pkgs/os-specific/linux/open-iscsi/default.nix b/pkgs/os-specific/linux/open-iscsi/default.nix
index 0640316b627..9306099213a 100644
--- a/pkgs/os-specific/linux/open-iscsi/default.nix
+++ b/pkgs/os-specific/linux/open-iscsi/default.nix
@@ -1,46 +1,61 @@
-{ lib, stdenv, fetchFromGitHub, automake, autoconf, libtool, gettext
-, util-linux, open-isns, openssl, kmod, perl, systemd, pkgconf
-}:
+{ stdenv
+, lib
+, fetchFromGitHub
+, meson
+, pkg-config
+, ninja
+, perl
+, util-linux
+, open-isns
+, openssl
+, kmod
+, systemd
+, runtimeShell
+, nixosTests }:
 
 stdenv.mkDerivation rec {
   pname = "open-iscsi";
-  version = "2.1.4";
-
-  nativeBuildInputs = [ autoconf automake gettext libtool perl pkgconf ];
-  buildInputs = [ kmod open-isns.lib openssl systemd util-linux ];
+  version = "2.1.9";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "open-iscsi";
     rev = version;
-    sha256 = "sha256-HnvLLwxOnu7Oiige6A6zk9NmAI2ImcILp9eCfbdGiyI=";
+    hash = "sha256-y0NIb/KsKpCd8byr/SXI7nwTKXP2/bSSoW8QgeL5xdc=";
   };
 
-  DESTDIR = "$(out)";
-
-  NIX_LDFLAGS = "-lkmod -lsystemd";
-  NIX_CFLAGS_COMPILE = "-DUSE_KMOD";
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+    perl
+  ];
+  buildInputs = [
+    kmod
+    (lib.getLib open-isns)
+    openssl
+    systemd
+    util-linux
+  ];
 
   preConfigure = ''
-    sed -i 's|/usr|/|' Makefile
+    patchShebangs .
   '';
 
-  installFlags = [
-    "install"
-    "install_systemd"
-  ];
-
-  postInstall = ''
-    cp usr/iscsistart $out/sbin/
-    for f in $out/lib/systemd/system/*; do
-      substituteInPlace $f --replace /sbin $out/bin
-    done
-    $out/sbin/iscsistart -v
+  prePatch = ''
+    substituteInPlace etc/systemd/iscsi-init.service.template \
+      --replace /usr/bin/sh ${runtimeShell}
+    sed -i '/install_dir: db_root/d' meson.build
   '';
 
-  postFixup = ''
-    sed -i "s|/sbin/iscsiadm|$out/bin/iscsiadm|" $out/bin/iscsi_fw_login
-  '';
+  mesonFlags = [
+    "-Discsi_sbindir=${placeholder "out"}/sbin"
+    "-Drulesdir=${placeholder "out"}/etc/udev/rules.d"
+    "-Dsystemddir=${placeholder "out"}/lib/systemd"
+    "-Ddbroot=/etc/iscsi"
+  ];
+
+  passthru.tests = { inherit (nixosTests) iscsi-root; };
 
   meta = with lib; {
     description = "A high performance, transport independent, multi-platform implementation of RFC3720";
diff --git a/pkgs/os-specific/linux/open-isns/default.nix b/pkgs/os-specific/linux/open-isns/default.nix
index 3f939024a48..7afe13eea86 100644
--- a/pkgs/os-specific/linux/open-isns/default.nix
+++ b/pkgs/os-specific/linux/open-isns/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "open-isns";
-  version = "0.101";
+  version = "0.102";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "open-isns";
     rev = "v${version}";
-    sha256 = "1g7kp1j2f8afsach6sbl4k05ybz1yz2s8yg073bv4gnv48gyxb2p";
+    sha256 = "sha256-Vz6VqqvEr0f8AdN9NcVnruapswmoOgvAXxXSfrM3yRA=";
   };
 
   propagatedBuildInputs = [ openssl ];
diff --git a/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh b/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
index cd21899e60e..ed2c60da261 100644
--- a/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
+++ b/pkgs/os-specific/linux/opengl/xorg-sys/builder.sh
@@ -1,3 +1,4 @@
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
 source $stdenv/setup
 
 mkdir -p $out/lib
diff --git a/pkgs/os-specific/linux/opengl/xorg-sys/default.nix b/pkgs/os-specific/linux/opengl/xorg-sys/default.nix
index 33df8c0cc34..b7f1b657440 100644
--- a/pkgs/os-specific/linux/opengl/xorg-sys/default.nix
+++ b/pkgs/os-specific/linux/opengl/xorg-sys/default.nix
@@ -9,7 +9,8 @@
 {lib, stdenv, xorg, expat, libdrm}:
 
 stdenv.mkDerivation {
-  name = "xorg-sys-opengl-3";
+  pname = "xorg-sys-opengl";
+  version = "3";
   builder = ./builder.sh;
   neededLibs = map (p: p.out)
     [xorg.libXxf86vm xorg.libXext expat libdrm stdenv.cc.cc];
diff --git a/pkgs/os-specific/linux/openrazer/driver.nix b/pkgs/os-specific/linux/openrazer/driver.nix
index 07113e62862..f98fe5cfc74 100644
--- a/pkgs/os-specific/linux/openrazer/driver.nix
+++ b/pkgs/os-specific/linux/openrazer/driver.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation (common // {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  buildFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
 
@@ -30,15 +30,19 @@ stdenv.mkDerivation (common // {
     install -m 644 -v -D install_files/udev/99-razer.rules $RAZER_RULES_OUT
     install -m 755 -v -D install_files/udev/razer_mount $RAZER_MOUNT_OUT
     substituteInPlace $RAZER_RULES_OUT \
-      --replace razer_mount $RAZER_MOUNT_OUT
+      --replace razer_mount $RAZER_MOUNT_OUT \
+      --replace plugdev openrazer
     substituteInPlace $RAZER_MOUNT_OUT \
       --replace /usr/bin/logger ${util-linux}/bin/logger \
       --replace chgrp ${coreutils}/bin/chgrp \
-      --replace "PATH='/sbin:/bin:/usr/sbin:/usr/bin'" ""
+      --replace "PATH='/sbin:/bin:/usr/sbin:/usr/bin'" "" \
+      --replace plugdev openrazer
 
     runHook postInstall
   '';
 
+  enableParallelBuilding = true;
+
   meta = common.meta // {
     description = "An entirely open source Linux driver that allows you to manage your Razer peripherals on GNU/Linux";
     broken = kernel.kernelOlder "4.19";
diff --git a/pkgs/os-specific/linux/opensnitch-ebpf/default.nix b/pkgs/os-specific/linux/opensnitch-ebpf/default.nix
new file mode 100644
index 00000000000..70332abbe6e
--- /dev/null
+++ b/pkgs/os-specific/linux/opensnitch-ebpf/default.nix
@@ -0,0 +1,58 @@
+{ lib
+, kernel
+, stdenv
+, clang-tools
+, llvmPackages
+, elfutils
+, flex
+, bison
+, bc
+, opensnitch
+}:
+
+stdenv.mkDerivation rec {
+  pname = "opensnitch_ebpf";
+  version = "${opensnitch.version}-${kernel.version}";
+
+  inherit (opensnitch) src;
+
+  sourceRoot = "source/ebpf_prog";
+
+  nativeBuildInputs = with llvmPackages; [
+    bc
+    bison
+    clang
+    clang-tools
+    elfutils
+    flex
+    libllvm
+  ];
+
+  # We set -fno-stack-protector here to work around a clang regression.
+  # This is fine - bpf programs do not use stack protectors
+  # https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=opensnitch-ebpf-module&id=984b952a784eb701f691dd9f2d45dfeb8d15053b
+  env.NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+
+  env.KERNEL_DIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/source";
+  env.KERNEL_HEADERS="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+  extraConfig =''
+    CONFIG_UPROBE_EVENTS=y
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    for file in opensnitch*.o; do
+      install -Dm644 "$file" "$out/etc/opensnitchd/$file"
+    done
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "eBPF process monitor module for OpenSnitch";
+    homepage = "https://github.com/evilsocket/opensnitch";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ onny ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/openvswitch/default.nix b/pkgs/os-specific/linux/openvswitch/default.nix
index 5faccc14ce7..664adfdc164 100644
--- a/pkgs/os-specific/linux/openvswitch/default.nix
+++ b/pkgs/os-specific/linux/openvswitch/default.nix
@@ -1,65 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, pkg-config, util-linux, which
-, procps, libcap_ng, openssl, python3 , perl
-, kernel ? null }:
-
-with lib;
-
-let
-  _kernel = kernel;
-  pythonEnv = python3.withPackages (ps: with ps; [ six ]);
-in stdenv.mkDerivation rec {
-  version = "2.14.2";
-  pname = "openvswitch";
-
-  src = fetchurl {
-    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ZfQg+VTiUNiV+y2yKhMuHLVgvF4rkFHoNFETSBCOWXo=";
-  };
-
-  kernel = optional (_kernel != null) _kernel.dev;
-
-  nativeBuildInputs = [ pkg-config makeWrapper ];
-  buildInputs = [ util-linux openssl libcap_ng pythonEnv
-                  perl procps which ];
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--sharedstatedir=/var"
-    "--sbindir=$(out)/bin"
-  ] ++ (optionals (_kernel != null) ["--with-linux"]);
-
-  # Leave /var out of this!
-  installFlags = [
-    "LOGDIR=$(TMPDIR)/dummy"
-    "RUNDIR=$(TMPDIR)/dummy"
-    "PKIDIR=$(TMPDIR)/dummy"
-  ];
-
-  postBuild = ''
-    # fix tests
-    substituteInPlace xenserver/opt_xensource_libexec_interface-reconfigure --replace '/usr/bin/env python' '${pythonEnv.interpreter}'
-    substituteInPlace vtep/ovs-vtep --replace '/usr/bin/env python' '${pythonEnv.interpreter}'
-  '';
-
-  enableParallelBuilding = true;
-  doCheck = false; # bash-completion test fails with "compgen: command not found"
-
-  meta = with lib; {
-    platforms = platforms.linux;
-    description = "A multilayer virtual switch";
-    longDescription =
-      ''
-      Open vSwitch is a production quality, multilayer virtual switch
-      licensed under the open source Apache 2.0 license. It is
-      designed to enable massive network automation through
-      programmatic extension, while still supporting standard
-      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
-      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
-      support distribution across multiple physical servers similar
-      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
-      '';
-    homepage = "https://www.openvswitch.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ netixx kmcopper ];
-  };
+import ./generic.nix {
+  version = "3.1.1";
+  hash = "sha256-YEiRg6RNO5WlUiQHIhfF9tN6oRvhKnV2JRDO25Ok4gQ=";
 }
diff --git a/pkgs/os-specific/linux/openvswitch/generic.nix b/pkgs/os-specific/linux/openvswitch/generic.nix
new file mode 100644
index 00000000000..be4bc90fe42
--- /dev/null
+++ b/pkgs/os-specific/linux/openvswitch/generic.nix
@@ -0,0 +1,126 @@
+{ version
+, hash
+}:
+
+{ lib
+, stdenv
+, fetchurl
+, autoconf
+, automake
+, installShellFiles
+, iproute2
+, kernel ? null
+, libcap_ng
+, libtool
+, openssl
+, perl
+, pkg-config
+, procps
+, python3
+, sphinxHook
+, util-linux
+, which
+}:
+
+let
+  _kernel = kernel;
+in stdenv.mkDerivation rec {
+  pname = "openvswitch";
+  inherit version;
+
+  kernel = lib.optional (_kernel != null) _kernel.dev;
+
+  src = fetchurl {
+    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
+    inherit hash;
+  };
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  patches = [
+    # 8: vsctl-bashcomp - argument completion FAILED (completion.at:664)
+    ./patches/disable-bash-arg-completion-test.patch
+  ];
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    installShellFiles
+    libtool
+    pkg-config
+    sphinxHook
+  ];
+
+  sphinxBuilders = [
+    "man"
+  ];
+
+  sphinxRoot = "./Documentation";
+
+  buildInputs = [
+    libcap_ng
+    openssl
+    perl
+    procps
+    python3
+    util-linux
+    which
+  ];
+
+  preConfigure = "./boot.sh";
+
+  configureFlags = [
+    "--localstatedir=/var"
+    "--sharedstatedir=/var"
+    "--sbindir=$(out)/bin"
+  ] ++ (lib.optionals (_kernel != null) ["--with-linux"]);
+
+  # Leave /var out of this!
+  installFlags = [
+    "LOGDIR=$(TMPDIR)/dummy"
+    "RUNDIR=$(TMPDIR)/dummy"
+    "PKIDIR=$(TMPDIR)/dummy"
+  ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    installShellCompletion --bash utilities/ovs-appctl-bashcomp.bash
+    installShellCompletion --bash utilities/ovs-vsctl-bashcomp.bash
+  '';
+
+  doCheck = true;
+  preCheck = ''
+    patchShebangs tests/
+  '';
+
+  nativeCheckInputs = [
+    iproute2
+  ] ++ (with python3.pkgs; [
+    netaddr
+    pyparsing
+    pytest
+  ]);
+
+  meta = with lib; {
+    changelog = "https://www.openvswitch.org/releases/NEWS-${version}.txt";
+    description = "A multilayer virtual switch";
+    longDescription = ''
+      Open vSwitch is a production quality, multilayer virtual switch
+      licensed under the open source Apache 2.0 license. It is
+      designed to enable massive network automation through
+      programmatic extension, while still supporting standard
+      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
+      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
+      support distribution across multiple physical servers similar
+      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
+    '';
+    homepage = "https://www.openvswitch.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ netixx kmcopper ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/openvswitch/lts.nix b/pkgs/os-specific/linux/openvswitch/lts.nix
index 15c6c05b061..9fb9977c201 100644
--- a/pkgs/os-specific/linux/openvswitch/lts.nix
+++ b/pkgs/os-specific/linux/openvswitch/lts.nix
@@ -1,81 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, pkg-config, util-linux, which
-, procps, libcap_ng, openssl, python2, perl
-, automake, autoconf, libtool, kernel ? null }:
-
-with lib;
-
-let
-  _kernel = kernel;
-in stdenv.mkDerivation rec {
-  version = "2.5.12";
-  pname = "openvswitch";
-
-  src = fetchurl {
-    url = "https://www.openvswitch.org/releases/${pname}-${version}.tar.gz";
-    sha256 = "0a8wa1lj5p28x3vq0yaxjhqmppp4hvds6hhm0j3czpp8mc09fsfq";
-  };
-
-  patches = [ ./patches/lts-ssl.patch ];
-
-  kernel = optional (_kernel != null) _kernel.dev;
-
-  nativeBuildInputs = [ autoconf libtool automake pkg-config makeWrapper ];
-  buildInputs = [ util-linux openssl libcap_ng python2 perl procps which ];
-
-  preConfigure = "./boot.sh";
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--sharedstatedir=/var"
-    "--sbindir=$(out)/bin"
-  ] ++ (optionals (_kernel != null) ["--with-linux"]);
-
-  # Leave /var out of this!
-  installFlags = [
-    "LOGDIR=$(TMPDIR)/dummy"
-    "RUNDIR=$(TMPDIR)/dummy"
-    "PKIDIR=$(TMPDIR)/dummy"
-  ];
-
-  postBuild = ''
-    # fix tests
-    substituteInPlace xenserver/opt_xensource_libexec_interface-reconfigure --replace '/usr/bin/env python' '${python2.interpreter}'
-    substituteInPlace vtep/ovs-vtep --replace '/usr/bin/env python' '${python2.interpreter}'
-  '';
-
-  enableParallelBuilding = true;
-  doCheck = false; # bash-completion test fails with "compgen: command not found"
-
-  postInstall = ''
-    cp debian/ovs-monitor-ipsec $out/share/openvswitch/scripts
-    makeWrapper \
-      $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      $out/bin/ovs-monitor-ipsec \
-      --prefix PYTHONPATH : "$out/share/openvswitch/python"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "UnixctlServer.create(None)" "UnixctlServer.create(os.environ['UNIXCTLPATH'])"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "self.psk_file" "root_prefix + self.psk_file"
-    substituteInPlace $out/share/openvswitch/scripts/ovs-monitor-ipsec \
-      --replace "self.cert_dir" "root_prefix + self.cert_dir"
-  '';
-
-  meta = with lib; {
-    platforms = platforms.linux;
-    description = "A multilayer virtual switch";
-    longDescription =
-      ''
-      Open vSwitch is a production quality, multilayer virtual switch
-      licensed under the open source Apache 2.0 license. It is
-      designed to enable massive network automation through
-      programmatic extension, while still supporting standard
-      management interfaces and protocols (e.g. NetFlow, sFlow, SPAN,
-      RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to
-      support distribution across multiple physical servers similar
-      to VMware's vNetwork distributed vswitch or Cisco's Nexus 1000V.
-      '';
-    homepage = "https://www.openvswitch.org/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ netixx kmcopper ];
-  };
+import ./generic.nix {
+  version = "2.17.6";
+  hash = "sha256-dNqvK+c0iuXdQBe6RbjaxlNB8Vn0+0paecVC/tQQENk=";
 }
diff --git a/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch b/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch
new file mode 100644
index 00000000000..2b454274176
--- /dev/null
+++ b/pkgs/os-specific/linux/openvswitch/patches/disable-bash-arg-completion-test.patch
@@ -0,0 +1,12 @@
+diff --git a/tests/completion.at b/tests/completion.at
+index b6155af25..6367cb545 100644
+--- a/tests/completion.at
++++ b/tests/completion.at
+@@ -425,6 +425,7 @@ AT_CLEANUP
+ 
+ 
+ AT_SETUP([vsctl-bashcomp - argument completion])
++AT_SKIP_IF([true])
+ AT_SKIP_IF([test -z ${BASH_VERSION+x}])
+ AT_SKIP_IF([eval 'test ${BASH_VERSINFO[[0]]} -lt 4'])
+ OVS_VSWITCHD_START(
diff --git a/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch b/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch
deleted file mode 100644
index 0d8ff5b0d52..00000000000
--- a/pkgs/os-specific/linux/openvswitch/patches/lts-ssl.patch
+++ /dev/null
@@ -1,274 +0,0 @@
-diff --git a/build-aux/automake.mk b/build-aux/automake.mk
-new file mode 100644
-index 000000000..5d2657fd6
---- /dev/null
-+++ b/build-aux/automake.mk
-@@ -0,0 +1,2 @@
-+EXTRA_DIST += \
-+	build-aux/generate-dhparams-c 
-diff --git a/build-aux/generate-dhparams-c b/build-aux/generate-dhparams-c
-new file mode 100755
-index 000000000..bcd25e2d8
---- /dev/null
-+++ b/build-aux/generate-dhparams-c
-@@ -0,0 +1,33 @@
-+#! /bin/sh -e
-+
-+cat <<'EOF'
-+/* Generated automatically; do not modify!     -*- buffer-read-only: t -*-
-+ *
-+ * If you do need to regenerate this file, run "make generate-dhparams-c". */
-+
-+#include <config.h>
-+#include "lib/dhparams.h"
-+#include "lib/util.h"
-+
-+static int
-+my_DH_set0_pqg(DH *dh, BIGNUM *p, const BIGNUM **q OVS_UNUSED, BIGNUM *g)
-+{
-+    ovs_assert(q == NULL);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
-+    dh->p = p;
-+    dh->g = g;
-+    return 1;
-+#else
-+    return DH_set0_pqg(dh, p, NULL, g);
-+#endif
-+}
-+EOF
-+(openssl dhparam -C -in lib/dh1024.pem -noout &&
-+openssl dhparam -C -in lib/dh2048.pem -noout &&
-+openssl dhparam -C -in lib/dh4096.pem -noout) | sed '
-+    s/^static DH/DH/
-+    s/\(get_dh[0-9]*\)()/\1(void)/
-+    s/\(DH_set0_pqg\)/my_\1/
-+    s/[ 	]*$//
-+    s/	/        /g
-+'
-diff --git a/lib/automake.mk b/lib/automake.mk
-index 5387d519a..804a8b7d7 100644
---- a/lib/automake.mk
-+++ b/lib/automake.mk
-@@ -399,15 +399,16 @@ lib_libopenvswitch_la_SOURCES += \
- 	lib/route-table-bsd.c
- endif
- 
-+.PHONY: generate-dhparams-c
- if HAVE_OPENSSL
--lib_libopenvswitch_la_SOURCES += lib/stream-ssl.c
--nodist_lib_libopenvswitch_la_SOURCES += lib/dhparams.c
--lib/dhparams.c: lib/dh1024.pem lib/dh2048.pem lib/dh4096.pem
--	$(AM_V_GEN)(echo '#include "lib/dhparams.h"' &&                 \
--	 openssl dhparam -C -in $(srcdir)/lib/dh1024.pem -noout &&	\
--	 openssl dhparam -C -in $(srcdir)/lib/dh2048.pem -noout &&	\
--	 openssl dhparam -C -in $(srcdir)/lib/dh4096.pem -noout)	\
--	| sed 's/\(get_dh[0-9]*\)()/\1(void)/' > lib/dhparams.c.tmp &&  \
-+lib_libopenvswitch_la_SOURCES += lib/stream-ssl.c lib/dhparams.c
-+
-+# Manually regenerates lib/dhparams.c.  Not normally necessary since
-+# lib/dhparams.c is part of the repository and doesn't normally need
-+# updates.
-+generate-dhparams-c:
-+	$(AM_V_GEN)cd $(srcdir) && \
-+	build-aux/generate-dhparams-c > lib/dhparams.c.tmp && \
- 	mv lib/dhparams.c.tmp lib/dhparams.c
- else
- lib_libopenvswitch_la_SOURCES += lib/stream-nossl.c
-diff --git a/lib/dhparams.c b/lib/dhparams.c
-new file mode 100644
-index 000000000..4e42efad2
---- /dev/null
-+++ b/lib/dhparams.c
-@@ -0,0 +1,192 @@
-+/* Generated automatically; do not modify!     -*- buffer-read-only: t -*-
-+ *
-+ * If you do need to regenerate this file, run "make generate-dhparams-c". */
-+
-+#include <config.h>
-+#include "lib/dhparams.h"
-+#include "lib/util.h"
-+
-+static int
-+my_DH_set0_pqg(DH *dh, BIGNUM *p, const BIGNUM **q OVS_UNUSED, BIGNUM *g)
-+{
-+    ovs_assert(q == NULL);
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
-+    dh->p = p;
-+    dh->g = g;
-+    return 1;
-+#else
-+    return DH_set0_pqg(dh, p, NULL, g);
-+#endif
-+}
-+#ifndef HEADER_DH_H
-+# include <openssl/dh.h>
-+#endif
-+
-+DH *get_dh1024(void)
-+{
-+    static unsigned char dhp_1024[] = {
-+        0xF4, 0x88, 0xFD, 0x58, 0x4E, 0x49, 0xDB, 0xCD, 0x20, 0xB4,
-+        0x9D, 0xE4, 0x91, 0x07, 0x36, 0x6B, 0x33, 0x6C, 0x38, 0x0D,
-+        0x45, 0x1D, 0x0F, 0x7C, 0x88, 0xB3, 0x1C, 0x7C, 0x5B, 0x2D,
-+        0x8E, 0xF6, 0xF3, 0xC9, 0x23, 0xC0, 0x43, 0xF0, 0xA5, 0x5B,
-+        0x18, 0x8D, 0x8E, 0xBB, 0x55, 0x8C, 0xB8, 0x5D, 0x38, 0xD3,
-+        0x34, 0xFD, 0x7C, 0x17, 0x57, 0x43, 0xA3, 0x1D, 0x18, 0x6C,
-+        0xDE, 0x33, 0x21, 0x2C, 0xB5, 0x2A, 0xFF, 0x3C, 0xE1, 0xB1,
-+        0x29, 0x40, 0x18, 0x11, 0x8D, 0x7C, 0x84, 0xA7, 0x0A, 0x72,
-+        0xD6, 0x86, 0xC4, 0x03, 0x19, 0xC8, 0x07, 0x29, 0x7A, 0xCA,
-+        0x95, 0x0C, 0xD9, 0x96, 0x9F, 0xAB, 0xD0, 0x0A, 0x50, 0x9B,
-+        0x02, 0x46, 0xD3, 0x08, 0x3D, 0x66, 0xA4, 0x5D, 0x41, 0x9F,
-+        0x9C, 0x7C, 0xBD, 0x89, 0x4B, 0x22, 0x19, 0x26, 0xBA, 0xAB,
-+        0xA2, 0x5E, 0xC3, 0x55, 0xE9, 0x2F, 0x78, 0xC7
-+    };
-+    static unsigned char dhg_1024[] = {
-+        0x02
-+    };
-+    DH *dh = DH_new();
-+    BIGNUM *dhp_bn, *dhg_bn;
-+
-+    if (dh == NULL)
-+        return NULL;
-+    dhp_bn = BN_bin2bn(dhp_1024, sizeof (dhp_1024), NULL);
-+    dhg_bn = BN_bin2bn(dhg_1024, sizeof (dhg_1024), NULL);
-+    if (dhp_bn == NULL || dhg_bn == NULL
-+            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
-+        DH_free(dh);
-+        BN_free(dhp_bn);
-+        BN_free(dhg_bn);
-+        return NULL;
-+    }
-+    return dh;
-+}
-+#ifndef HEADER_DH_H
-+# include <openssl/dh.h>
-+#endif
-+
-+DH *get_dh2048(void)
-+{
-+    static unsigned char dhp_2048[] = {
-+        0xF6, 0x42, 0x57, 0xB7, 0x08, 0x7F, 0x08, 0x17, 0x72, 0xA2,
-+        0xBA, 0xD6, 0xA9, 0x42, 0xF3, 0x05, 0xE8, 0xF9, 0x53, 0x11,
-+        0x39, 0x4F, 0xB6, 0xF1, 0x6E, 0xB9, 0x4B, 0x38, 0x20, 0xDA,
-+        0x01, 0xA7, 0x56, 0xA3, 0x14, 0xE9, 0x8F, 0x40, 0x55, 0xF3,
-+        0xD0, 0x07, 0xC6, 0xCB, 0x43, 0xA9, 0x94, 0xAD, 0xF7, 0x4C,
-+        0x64, 0x86, 0x49, 0xF8, 0x0C, 0x83, 0xBD, 0x65, 0xE9, 0x17,
-+        0xD4, 0xA1, 0xD3, 0x50, 0xF8, 0xF5, 0x59, 0x5F, 0xDC, 0x76,
-+        0x52, 0x4F, 0x3D, 0x3D, 0x8D, 0xDB, 0xCE, 0x99, 0xE1, 0x57,
-+        0x92, 0x59, 0xCD, 0xFD, 0xB8, 0xAE, 0x74, 0x4F, 0xC5, 0xFC,
-+        0x76, 0xBC, 0x83, 0xC5, 0x47, 0x30, 0x61, 0xCE, 0x7C, 0xC9,
-+        0x66, 0xFF, 0x15, 0xF9, 0xBB, 0xFD, 0x91, 0x5E, 0xC7, 0x01,
-+        0xAA, 0xD3, 0x5B, 0x9E, 0x8D, 0xA0, 0xA5, 0x72, 0x3A, 0xD4,
-+        0x1A, 0xF0, 0xBF, 0x46, 0x00, 0x58, 0x2B, 0xE5, 0xF4, 0x88,
-+        0xFD, 0x58, 0x4E, 0x49, 0xDB, 0xCD, 0x20, 0xB4, 0x9D, 0xE4,
-+        0x91, 0x07, 0x36, 0x6B, 0x33, 0x6C, 0x38, 0x0D, 0x45, 0x1D,
-+        0x0F, 0x7C, 0x88, 0xB3, 0x1C, 0x7C, 0x5B, 0x2D, 0x8E, 0xF6,
-+        0xF3, 0xC9, 0x23, 0xC0, 0x43, 0xF0, 0xA5, 0x5B, 0x18, 0x8D,
-+        0x8E, 0xBB, 0x55, 0x8C, 0xB8, 0x5D, 0x38, 0xD3, 0x34, 0xFD,
-+        0x7C, 0x17, 0x57, 0x43, 0xA3, 0x1D, 0x18, 0x6C, 0xDE, 0x33,
-+        0x21, 0x2C, 0xB5, 0x2A, 0xFF, 0x3C, 0xE1, 0xB1, 0x29, 0x40,
-+        0x18, 0x11, 0x8D, 0x7C, 0x84, 0xA7, 0x0A, 0x72, 0xD6, 0x86,
-+        0xC4, 0x03, 0x19, 0xC8, 0x07, 0x29, 0x7A, 0xCA, 0x95, 0x0C,
-+        0xD9, 0x96, 0x9F, 0xAB, 0xD0, 0x0A, 0x50, 0x9B, 0x02, 0x46,
-+        0xD3, 0x08, 0x3D, 0x66, 0xA4, 0x5D, 0x41, 0x9F, 0x9C, 0x7C,
-+        0xBD, 0x89, 0x4B, 0x22, 0x19, 0x26, 0xBA, 0xAB, 0xA2, 0x5E,
-+        0xC3, 0x55, 0xE9, 0x32, 0x0B, 0x3B
-+    };
-+    static unsigned char dhg_2048[] = {
-+        0x02
-+    };
-+    DH *dh = DH_new();
-+    BIGNUM *dhp_bn, *dhg_bn;
-+
-+    if (dh == NULL)
-+        return NULL;
-+    dhp_bn = BN_bin2bn(dhp_2048, sizeof (dhp_2048), NULL);
-+    dhg_bn = BN_bin2bn(dhg_2048, sizeof (dhg_2048), NULL);
-+    if (dhp_bn == NULL || dhg_bn == NULL
-+            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
-+        DH_free(dh);
-+        BN_free(dhp_bn);
-+        BN_free(dhg_bn);
-+        return NULL;
-+    }
-+    return dh;
-+}
-+#ifndef HEADER_DH_H
-+# include <openssl/dh.h>
-+#endif
-+
-+DH *get_dh4096(void)
-+{
-+    static unsigned char dhp_4096[] = {
-+        0xFA, 0x14, 0x72, 0x52, 0xC1, 0x4D, 0xE1, 0x5A, 0x49, 0xD4,
-+        0xEF, 0x09, 0x2D, 0xC0, 0xA8, 0xFD, 0x55, 0xAB, 0xD7, 0xD9,
-+        0x37, 0x04, 0x28, 0x09, 0xE2, 0xE9, 0x3E, 0x77, 0xE2, 0xA1,
-+        0x7A, 0x18, 0xDD, 0x46, 0xA3, 0x43, 0x37, 0x23, 0x90, 0x97,
-+        0xF3, 0x0E, 0xC9, 0x03, 0x50, 0x7D, 0x65, 0xCF, 0x78, 0x62,
-+        0xA6, 0x3A, 0x62, 0x22, 0x83, 0xA1, 0x2F, 0xFE, 0x79, 0xBA,
-+        0x35, 0xFF, 0x59, 0xD8, 0x1D, 0x61, 0xDD, 0x1E, 0x21, 0x13,
-+        0x17, 0xFE, 0xCD, 0x38, 0x87, 0x9E, 0xF5, 0x4F, 0x79, 0x10,
-+        0x61, 0x8D, 0xD4, 0x22, 0xF3, 0x5A, 0xED, 0x5D, 0xEA, 0x21,
-+        0xE9, 0x33, 0x6B, 0x48, 0x12, 0x0A, 0x20, 0x77, 0xD4, 0x25,
-+        0x60, 0x61, 0xDE, 0xF6, 0xB4, 0x4F, 0x1C, 0x63, 0x40, 0x8B,
-+        0x3A, 0x21, 0x93, 0x8B, 0x79, 0x53, 0x51, 0x2C, 0xCA, 0xB3,
-+        0x7B, 0x29, 0x56, 0xA8, 0xC7, 0xF8, 0xF4, 0x7B, 0x08, 0x5E,
-+        0xA6, 0xDC, 0xA2, 0x45, 0x12, 0x56, 0xDD, 0x41, 0x92, 0xF2,
-+        0xDD, 0x5B, 0x8F, 0x23, 0xF0, 0xF3, 0xEF, 0xE4, 0x3B, 0x0A,
-+        0x44, 0xDD, 0xED, 0x96, 0x84, 0xF1, 0xA8, 0x32, 0x46, 0xA3,
-+        0xDB, 0x4A, 0xBE, 0x3D, 0x45, 0xBA, 0x4E, 0xF8, 0x03, 0xE5,
-+        0xDD, 0x6B, 0x59, 0x0D, 0x84, 0x1E, 0xCA, 0x16, 0x5A, 0x8C,
-+        0xC8, 0xDF, 0x7C, 0x54, 0x44, 0xC4, 0x27, 0xA7, 0x3B, 0x2A,
-+        0x97, 0xCE, 0xA3, 0x7D, 0x26, 0x9C, 0xAD, 0xF4, 0xC2, 0xAC,
-+        0x37, 0x4B, 0xC3, 0xAD, 0x68, 0x84, 0x7F, 0x99, 0xA6, 0x17,
-+        0xEF, 0x6B, 0x46, 0x3A, 0x7A, 0x36, 0x7A, 0x11, 0x43, 0x92,
-+        0xAD, 0xE9, 0x9C, 0xFB, 0x44, 0x6C, 0x3D, 0x82, 0x49, 0xCC,
-+        0x5C, 0x6A, 0x52, 0x42, 0xF8, 0x42, 0xFB, 0x44, 0xF9, 0x39,
-+        0x73, 0xFB, 0x60, 0x79, 0x3B, 0xC2, 0x9E, 0x0B, 0xDC, 0xD4,
-+        0xA6, 0x67, 0xF7, 0x66, 0x3F, 0xFC, 0x42, 0x3B, 0x1B, 0xDB,
-+        0x4F, 0x66, 0xDC, 0xA5, 0x8F, 0x66, 0xF9, 0xEA, 0xC1, 0xED,
-+        0x31, 0xFB, 0x48, 0xA1, 0x82, 0x7D, 0xF8, 0xE0, 0xCC, 0xB1,
-+        0xC7, 0x03, 0xE4, 0xF8, 0xB3, 0xFE, 0xB7, 0xA3, 0x13, 0x73,
-+        0xA6, 0x7B, 0xC1, 0x0E, 0x39, 0xC7, 0x94, 0x48, 0x26, 0x00,
-+        0x85, 0x79, 0xFC, 0x6F, 0x7A, 0xAF, 0xC5, 0x52, 0x35, 0x75,
-+        0xD7, 0x75, 0xA4, 0x40, 0xFA, 0x14, 0x74, 0x61, 0x16, 0xF2,
-+        0xEB, 0x67, 0x11, 0x6F, 0x04, 0x43, 0x3D, 0x11, 0x14, 0x4C,
-+        0xA7, 0x94, 0x2A, 0x39, 0xA1, 0xC9, 0x90, 0xCF, 0x83, 0xC6,
-+        0xFF, 0x02, 0x8F, 0xA3, 0x2A, 0xAC, 0x26, 0xDF, 0x0B, 0x8B,
-+        0xBE, 0x64, 0x4A, 0xF1, 0xA1, 0xDC, 0xEE, 0xBA, 0xC8, 0x03,
-+        0x82, 0xF6, 0x62, 0x2C, 0x5D, 0xB6, 0xBB, 0x13, 0x19, 0x6E,
-+        0x86, 0xC5, 0x5B, 0x2B, 0x5E, 0x3A, 0xF3, 0xB3, 0x28, 0x6B,
-+        0x70, 0x71, 0x3A, 0x8E, 0xFF, 0x5C, 0x15, 0xE6, 0x02, 0xA4,
-+        0xCE, 0xED, 0x59, 0x56, 0xCC, 0x15, 0x51, 0x07, 0x79, 0x1A,
-+        0x0F, 0x25, 0x26, 0x27, 0x30, 0xA9, 0x15, 0xB2, 0xC8, 0xD4,
-+        0x5C, 0xCC, 0x30, 0xE8, 0x1B, 0xD8, 0xD5, 0x0F, 0x19, 0xA8,
-+        0x80, 0xA4, 0xC7, 0x01, 0xAA, 0x8B, 0xBA, 0x53, 0xBB, 0x47,
-+        0xC2, 0x1F, 0x6B, 0x54, 0xB0, 0x17, 0x60, 0xED, 0x79, 0x21,
-+        0x95, 0xB6, 0x05, 0x84, 0x37, 0xC8, 0x03, 0xA4, 0xDD, 0xD1,
-+        0x06, 0x69, 0x8F, 0x4C, 0x39, 0xE0, 0xC8, 0x5D, 0x83, 0x1D,
-+        0xBE, 0x6A, 0x9A, 0x99, 0xF3, 0x9F, 0x0B, 0x45, 0x29, 0xD4,
-+        0xCB, 0x29, 0x66, 0xEE, 0x1E, 0x7E, 0x3D, 0xD7, 0x13, 0x4E,
-+        0xDB, 0x90, 0x90, 0x58, 0xCB, 0x5E, 0x9B, 0xCD, 0x2E, 0x2B,
-+        0x0F, 0xA9, 0x4E, 0x78, 0xAC, 0x05, 0x11, 0x7F, 0xE3, 0x9E,
-+        0x27, 0xD4, 0x99, 0xE1, 0xB9, 0xBD, 0x78, 0xE1, 0x84, 0x41,
-+        0xA0, 0xDF
-+    };
-+    static unsigned char dhg_4096[] = {
-+        0x02
-+    };
-+    DH *dh = DH_new();
-+    BIGNUM *dhp_bn, *dhg_bn;
-+
-+    if (dh == NULL)
-+        return NULL;
-+    dhp_bn = BN_bin2bn(dhp_4096, sizeof (dhp_4096), NULL);
-+    dhg_bn = BN_bin2bn(dhg_4096, sizeof (dhg_4096), NULL);
-+    if (dhp_bn == NULL || dhg_bn == NULL
-+            || !my_DH_set0_pqg(dh, dhp_bn, NULL, dhg_bn)) {
-+        DH_free(dh);
-+        BN_free(dhp_bn);
-+        BN_free(dhg_bn);
-+        return NULL;
-+    }
-+    return dh;
-+}
diff --git a/pkgs/os-specific/linux/otpw/default.nix b/pkgs/os-specific/linux/otpw/default.nix
index fed7930bf14..6c53bf16efc 100644
--- a/pkgs/os-specific/linux/otpw/default.nix
+++ b/pkgs/os-specific/linux/otpw/default.nix
@@ -1,10 +1,11 @@
-{ lib, stdenv, fetchurl, pam }:
+{ lib, stdenv, fetchurl, pam, libxcrypt }:
 
 stdenv.mkDerivation rec {
-  name = "otpw-1.3";
+  pname = "otpw";
+  version = "1.3";
 
   src = fetchurl {
-    url = "https://www.cl.cam.ac.uk/~mgk25/download/${name}.tar.gz";
+    url = "https://www.cl.cam.ac.uk/~mgk25/download/otpw-${version}.tar.gz";
     sha256 = "1k3hc7xbxz6hkc55kvddi3cibafwf93ivn58sy1l888d3l5dwmrk";
   };
 
@@ -22,7 +23,7 @@ stdenv.mkDerivation rec {
     cp *.8 $out/share/man/man8
   '';
 
-  buildInputs = [ pam ];
+  buildInputs = [ pam libxcrypt ];
 
   hardeningDisable = [ "stackprotector" ];
 
diff --git a/pkgs/os-specific/linux/oxtools/default.nix b/pkgs/os-specific/linux/oxtools/default.nix
new file mode 100644
index 00000000000..c16e12ab5e1
--- /dev/null
+++ b/pkgs/os-specific/linux/oxtools/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchFromGitHub
+, glibc, python3
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "0xtools";
+  version = "1.2.4";
+
+  src = fetchFromGitHub {
+    owner = "tanelpoder";
+    repo = "0xtools";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-h0/HIbwb1CvFUh/NpozDUCjYGCH647lC7JhbpDCvaLk=";
+  };
+
+  postPatch = ''
+    substituteInPlace lib/0xtools/psnproc.py \
+      --replace /usr/include/asm/unistd_64.h ${glibc.dev}/include/asm/unistd_64.h
+  '';
+
+  buildInputs = [ python3 ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  meta = with lib; {
+    description = "Utilities for analyzing application performance";
+    homepage = "https://0x.tools";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ astro ];
+    platforms = [ "x86_64-linux" ];
+  };
+})
diff --git a/pkgs/os-specific/linux/pam/default.nix b/pkgs/os-specific/linux/pam/default.nix
index fb993699494..a35f40be595 100644
--- a/pkgs/os-specific/linux/pam/default.nix
+++ b/pkgs/os-specific/linux/pam/default.nix
@@ -1,40 +1,45 @@
-{ lib, stdenv, buildPackages, fetchurl, flex, cracklib, db4, gettext
+{ lib, stdenv, buildPackages, fetchurl
+, fetchpatch
+, flex, cracklib, db4, gettext, audit, libxcrypt
 , nixosTests
-, withLibxcrypt ? false, libxcrypt
+, autoreconfHook269, pkg-config-unwrapped
 }:
 
 stdenv.mkDerivation rec {
   pname = "linux-pam";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchurl {
     url    = "https://github.com/linux-pam/linux-pam/releases/download/v${version}/Linux-PAM-${version}.tar.xz";
-    sha256 = "sha256-IB1AcwsRNbGzzeoJ8sKKxjTXMYHM0Bcs7d7jZJxXkvw=";
+    sha256 = "sha256-5OxxMakdpEUSV0Jo9JPG2MoQXIcJFpG46bVspoXU+U0=";
   };
 
+  patches = [
+    ./suid-wrapper-path.patch
+    # Pull support for localization on non-default --prefix:
+    #   https://github.com/NixOS/nixpkgs/issues/249010
+    #   https://github.com/linux-pam/linux-pam/pull/604
+    (fetchpatch {
+      name = "bind-locales.patch";
+      url = "https://github.com/linux-pam/linux-pam/commit/77bd338125cde583ecdfb9fd69619bcd2baf15c2.patch";
+      hash = "sha256-tlc9RcLZpEH315NFD4sdN9yOco8qhC6+bszl4OHm+AI=";
+    })
+  ];
+
   outputs = [ "out" "doc" "man" /* "modules" */ ];
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ flex ]
+  # autoreconfHook269 is needed for `suid-wrapper-path.patch` and
+  # `bind-locales.patch` above.
+  # pkg-config-unwrapped is needed for `AC_CHECK_LIB` and `AC_SEARCH_LIBS`
+  nativeBuildInputs = [ flex autoreconfHook269 pkg-config-unwrapped ]
     ++ lib.optional stdenv.buildPlatform.isDarwin gettext;
 
-  buildInputs = [ cracklib db4 ]
-    ++ lib.optional withLibxcrypt libxcrypt;
+  buildInputs = [ cracklib db4 libxcrypt ]
+    ++ lib.optional stdenv.buildPlatform.isLinux audit;
 
   enableParallelBuilding = true;
 
-  postInstall = ''
-    mv -v $out/sbin/unix_chkpwd{,.orig}
-    ln -sv /run/wrappers/bin/unix_chkpwd $out/sbin/unix_chkpwd
-  ''; /*
-    rm -rf $out/etc
-    mkdir -p $modules/lib
-    mv $out/lib/security $modules/lib/
-  '';*/
-  # don't move modules, because libpam needs to (be able to) find them,
-  # which is done by dlopening $out/lib/security/pam_foo.so
-  # $out/etc was also missed: pam_env(login:session): Unable to open config file
-
   preConfigure = lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
       # export ac_cv_search_crypt=no
       # (taken from Alpine linux, apparently insecure but also doesn't build O:))
@@ -55,7 +60,7 @@ stdenv.mkDerivation rec {
   doCheck = false; # fails
 
   passthru.tests = {
-    inherit (nixosTests) pam-oath-login pam-u2f shadow;
+    inherit (nixosTests) pam-oath-login pam-u2f shadow sssd-ldap;
   };
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/pam/suid-wrapper-path.patch b/pkgs/os-specific/linux/pam/suid-wrapper-path.patch
new file mode 100644
index 00000000000..a427ccf3881
--- /dev/null
+++ b/pkgs/os-specific/linux/pam/suid-wrapper-path.patch
@@ -0,0 +1,6 @@
+It needs the SUID version during runtime, and that can't be in /nix/store/**
+--- a/modules/pam_unix/Makefile.am
++++ b/modules/pam_unix/Makefile.am
+@@ -21 +21 @@
+-	-DCHKPWD_HELPER=\"$(sbindir)/unix_chkpwd\" \
++	-DCHKPWD_HELPER=\"/run/wrappers/bin/unix_chkpwd\" \
diff --git a/pkgs/os-specific/linux/pam_ccreds/default.nix b/pkgs/os-specific/linux/pam_ccreds/default.nix
index bfe9ac7c830..4b2cc7a3822 100644
--- a/pkgs/os-specific/linux/pam_ccreds/default.nix
+++ b/pkgs/os-specific/linux/pam_ccreds/default.nix
@@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl, pam, openssl, db}:
 
 stdenv.mkDerivation rec {
-  name = "pam_ccreds-10";
+  pname = "pam_ccreds";
+  version = "10";
 
   src = fetchurl {
-    url = "https://www.padl.com/download/${name}.tar.gz";
+    url = "https://www.padl.com/download/pam_ccreds-${version}.tar.gz";
     sha256 = "1h7zyg1b1h69civyvrj95w22dg0y7lgw3hq4gqkdcg35w1y76fhz";
   };
   patchPhase = ''
diff --git a/pkgs/os-specific/linux/pam_dp9ik/default.nix b/pkgs/os-specific/linux/pam_dp9ik/default.nix
new file mode 100644
index 00000000000..bd097caee49
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_dp9ik/default.nix
@@ -0,0 +1,29 @@
+{ lib
+, tlsclient
+, stdenv
+, pkg-config
+, pam
+}:
+
+stdenv.mkDerivation {
+  inherit (tlsclient) src version enableParallelBuilding;
+
+  pname = "pam_dp9ik";
+
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pam ];
+
+  buildFlags = [ "pam_p9.so" ];
+  installFlags = [ "PREFIX=$(out)" ];
+  installTargets = "pam.install";
+
+  meta = with lib; {
+    description = "dp9ik pam module";
+    longDescription = "Uses tlsclient to authenticate users against a 9front auth server";
+    homepage = "https://git.sr.ht/~moody/tlsclient";
+    license = licenses.mit;
+    maintainers = with maintainers; [ moody ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/pam_gnupg/default.nix b/pkgs/os-specific/linux/pam_gnupg/default.nix
index ffb397334c1..1c54c42120a 100644
--- a/pkgs/os-specific/linux/pam_gnupg/default.nix
+++ b/pkgs/os-specific/linux/pam_gnupg/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pam_gnupg";
-  version = "0.3";
+  version = "0.4";
 
   src = fetchFromGitHub {
     owner = "cruegge";
     repo = "pam-gnupg";
     rev = "v${version}";
-    sha256 = "sha256-NDl6MsvIDAXkaLqXt7Wa0T7aulT31P5Z/d/Vb+ILya0=";
+    sha256 = "sha256-6I9a841qohA42lhOgZf/hharnjkthuB8lRptPDxUgMI=";
   };
 
   configureFlags = [
diff --git a/pkgs/os-specific/linux/pam_krb5/default.nix b/pkgs/os-specific/linux/pam_krb5/default.nix
index cb04fa5b424..157226373db 100644
--- a/pkgs/os-specific/linux/pam_krb5/default.nix
+++ b/pkgs/os-specific/linux/pam_krb5/default.nix
@@ -1,11 +1,12 @@
 { lib, stdenv, fetchurl, pam, libkrb5 }:
 
 stdenv.mkDerivation rec {
-  name = "pam-krb5-4.10";
+  pname = "pam-krb5";
+  version = "4.11";
 
   src = fetchurl {
-    url = "https://archives.eyrie.org/software/kerberos/${name}.tar.gz";
-    sha256 = "09wzxd5zrj5bzqpb01qf148npj5k8hmd2bx2ij1qsy40hdxqyq79";
+    url = "https://archives.eyrie.org/software/kerberos/pam-krb5-${version}.tar.gz";
+    sha256 = "sha256-UDy+LLGv9L39o7z3+T+U+2ulLCbXCJNOcDmyGC/hCyA=";
   };
 
   buildInputs = [ pam libkrb5 ];
diff --git a/pkgs/os-specific/linux/pam_ldap/default.nix b/pkgs/os-specific/linux/pam_ldap/default.nix
index e327a551b23..988256808db 100644
--- a/pkgs/os-specific/linux/pam_ldap/default.nix
+++ b/pkgs/os-specific/linux/pam_ldap/default.nix
@@ -1,10 +1,11 @@
 { stdenv, fetchurl, pam, openldap, perl }:
 
 stdenv.mkDerivation rec {
-  name = "pam_ldap-186";
+  pname = "pam_ldap";
+  version = "186";
 
   src = fetchurl {
-    url = "https://www.padl.com/download/${name}.tar.gz";
+    url = "https://www.padl.com/download/pam_ldap-${version}.tar.gz";
     sha256 = "0lv4f7hc02jrd2l3gqxd247qq62z11sp3fafn8lgb8ymb7aj5zn8";
   };
 
diff --git a/pkgs/os-specific/linux/pam_mktemp/default.nix b/pkgs/os-specific/linux/pam_mktemp/default.nix
new file mode 100644
index 00000000000..04ba58785ef
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_mktemp/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, pam
+, e2fsprogs
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pam_mktemp";
+  version = "1.1.1";
+
+  src = fetchurl {
+    url = "https://openwall.com/pam/modules/${pname}/${pname}-${version}.tar.gz";
+    hash = "sha256-Zs+AwYQ5yjRW25ZALy7qwUsaBQPMHRvn8rFtXwefPz0=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "inherit_private_prefix_from_home.patch";
+      url = "https://git.altlinux.org/gears/p/pam_mktemp.git?p=pam_mktemp.git;a=commitdiff_plain;h=3d2e8ad6da6a44c047bf7a8afa1e1bb2a6e36a55";
+      hash = "sha256-xe44fi2xH9jqlStlIR4QPB0KS7spflRdOsvNPEmxJpU";
+     })
+    (fetchpatch {
+      name = "allow_private_prefix_to_be_stricter.patch";
+      url = "https://git.altlinux.org/gears/p/pam_mktemp.git?p=pam_mktemp.git;a=commitdiff_plain;h=bb2cee0c695d22310e5364c30d74bccb0dbf3205";
+      hash = "sha256-TouysUVlNnl+m7lJ2VKPxUTYD2om1Jh5FEJ6NHMAI4U=";
+    })
+  ];
+
+  patchFlags = "-p2";
+
+  dontConfigure = true;
+
+  buildInputs = [ pam e2fsprogs ];
+
+  makeFlags = [ "DESTDIR=$(out)" ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://www.openwall.com/pam/";
+    description = "PAM for login service to provide per-user private directories";
+    license = licenses.bsd0;
+    maintainers = with maintainers; [ wladmis ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/pam_mount/default.nix b/pkgs/os-specific/linux/pam_mount/default.nix
index 5e4e15c364b..2ed6829f361 100644
--- a/pkgs/os-specific/linux/pam_mount/default.nix
+++ b/pkgs/os-specific/linux/pam_mount/default.nix
@@ -1,12 +1,12 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libtool, pam, libHX, libxml2, pcre, perl, openssl, cryptsetup, util-linux }:
+{ lib, stdenv, fetchurl, autoreconfHook, pkg-config, libtool, pam, libHX, libxml2, pcre2, perl, openssl, cryptsetup, util-linux }:
 
 stdenv.mkDerivation rec {
   pname = "pam_mount";
-  version = "2.17";
+  version = "2.20";
 
   src = fetchurl {
-    url = "mirror://sourceforge/pam-mount/pam_mount/${pname}-${version}.tar.xz";
-    sha256 = "1q2n6a2ah6nghdn8i6ad2wj247njwb5nx48cggxknaa6lqxylidy";
+    url = "https://inai.de/files/pam_mount/${pname}-${version}.tar.xz";
+    hash = "sha256-VCYgekhWgPjhdkukBbs4w5pODIMGvIJxkQ8bgZozbO0=";
   };
 
   patches = [
@@ -18,9 +18,22 @@ stdenv.mkDerivation rec {
       --replace @@NIX_UTILLINUX@@ ${util-linux}/bin
   '';
 
-  nativeBuildInputs = [ autoreconfHook libtool pkg-config ];
+  nativeBuildInputs = [
+    autoreconfHook
+    libtool
+    perl
+    pkg-config
+  ];
 
-  buildInputs = [ pam libHX util-linux libxml2 pcre perl openssl cryptsetup ];
+  buildInputs = [
+    cryptsetup
+    libHX
+    libxml2
+    openssl
+    pam
+    pcre2
+    util-linux
+  ];
 
   enableParallelBuilding = true;
 
@@ -40,7 +53,7 @@ stdenv.mkDerivation rec {
     description = "PAM module to mount volumes for a user session";
     homepage = "https://pam-mount.sourceforge.net/";
     license = with licenses; [ gpl2 gpl3 lgpl21 lgpl3 ];
-    maintainers = with maintainers; [ tstrobel ];
+    maintainers = with maintainers; [ netali ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/pam_mysql/default.nix b/pkgs/os-specific/linux/pam_mysql/default.nix
new file mode 100644
index 00000000000..036d4b20cb4
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_mysql/default.nix
@@ -0,0 +1,24 @@
+{ lib, stdenv, fetchFromGitHub, meson, ninja, pam, pkg-config, libmysqlclient, mariadb, libxcrypt }:
+
+stdenv.mkDerivation rec {
+  pname = "pam_mysql";
+  version = "1.0.0-beta2";
+
+  src = fetchFromGitHub {
+    owner = "NigelCunningham";
+    repo = "pam-MySQL";
+    rev = version;
+    sha256 = "07acf0hbhkd0kg49gnj4nb5ilnv3v4xx3dsggvzvjg8gi3cjmsap";
+  };
+
+  nativeBuildInputs = [ meson pkg-config ninja ];
+  buildInputs = [ pam libmysqlclient mariadb libxcrypt ];
+
+  meta = with lib; {
+    description = "PAM authentication module against a MySQL database";
+    homepage = "https://github.com/NigelCunningham/pam-MySQL";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ netali ];
+  };
+}
diff --git a/pkgs/os-specific/linux/pam_p11/default.nix b/pkgs/os-specific/linux/pam_p11/default.nix
index 1ed47ba53c2..0a7e02f4ad8 100644
--- a/pkgs/os-specific/linux/pam_p11/default.nix
+++ b/pkgs/os-specific/linux/pam_p11/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, openssl, libp11, pam }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libp11, pam, libintl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "pam_p11";
@@ -11,8 +11,20 @@ stdenv.mkDerivation rec {
     sha256 = "1caidy18rq5zk82d51x8vwidmkhwmanf3qm25x1yrdlbhxv6m7lk";
   };
 
+  patches = [
+    # fix with openssl 3.x
+    # https://github.com/OpenSC/pam_p11/pull/22
+    (fetchpatch {
+      name = "OpenSC-pam_p11-pull-22.patch";
+      url = "https://github.com/OpenSC/pam_p11/compare/cd4eba2e921e1c2f93cde71922a76af99376246c...debd4f7acfaf998cfe4002e0be5c35ad9a9591b5.patch";
+      excludes = [ ".github/build.sh" ];
+      hash = "sha256-bm/agnBgvrr8L8yoGK4gzBqOGgsNWf9NIgcNJG7proE=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ pam openssl libp11 ];
+  buildInputs = [ pam libp11.passthru.openssl libp11 ]
+    ++ lib.optionals stdenv.isDarwin [ libintl ];
 
   meta = with lib; {
     homepage = "https://github.com/OpenSC/pam_p11";
diff --git a/pkgs/os-specific/linux/pam_pgsql/default.nix b/pkgs/os-specific/linux/pam_pgsql/default.nix
index bca02c17066..2eabcefe584 100644
--- a/pkgs/os-specific/linux/pam_pgsql/default.nix
+++ b/pkgs/os-specific/linux/pam_pgsql/default.nix
@@ -1,18 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, postgresql, libgcrypt, pam }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, postgresql, libgcrypt, pam, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "pam_pgsql";
-  version = "0.7.3.2";
+  version = "unstable-2020-05-05";
 
   src = fetchFromGitHub {
     owner = "pam-pgsql";
     repo = "pam-pgsql";
-    rev = "release-${version}";
-    sha256 = "1a68krq5m07zspdxwl1wmkr5j98zr9bdg4776kvplrsdcg97h4jk";
+    rev = "f9fd1e1a0daf754e6764a31db5cbec6f9fc02b3d";
+    sha256 = "1bvddrwyk1479wibyayzc24h62qzfnlbk9qvdhb31yw9yn17gp6k";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libgcrypt pam postgresql ];
+  buildInputs = [ libgcrypt pam postgresql libxcrypt ];
 
   meta = with lib; {
     description = "Support to authenticate against PostgreSQL for PAM-enabled appliations";
diff --git a/pkgs/os-specific/linux/pam_rssh/default.nix b/pkgs/os-specific/linux/pam_rssh/default.nix
new file mode 100644
index 00000000000..2da53d46279
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_rssh/default.nix
@@ -0,0 +1,78 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, coreutils
+, pkg-config
+, openssl
+, pam
+, openssh
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pam_rssh";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "z4yx";
+    repo = "pam_rssh";
+    rev = "v${version}";
+    hash = "sha256-SDtMqGy2zhq9jEQVwSEl4EwRp2jgXfTVLrCX7k/kBeU=";
+    fetchSubmodules = true;
+  };
+
+  cargoHash = "sha256-gNy1tcHDUOG1XduGAIMapvx5dlq+U1LitUQkccGfb9o=";
+
+  postPatch = ''
+    substituteInPlace src/auth_keys.rs \
+      --replace '/bin/echo' '${coreutils}/bin/echo' \
+      --replace '/bin/false' '${coreutils}/bin/false'
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    pam
+  ];
+
+  checkFlags = [
+    # Fails because it tries finding authorized_keys in /home/$USER.
+    "--skip=tests::parse_user_authorized_keys"
+  ];
+
+  nativeCheckInputs = [
+    openssh
+  ];
+
+  env.USER = "nixbld";
+
+  # Copied from https://github.com/z4yx/pam_rssh/blob/main/.github/workflows/rust.yml.
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    mkdir $HOME/.ssh
+    ssh-keygen -q -N "" -t ecdsa -b 521 -f $HOME/.ssh/id_ecdsa521
+    ssh-keygen -q -N "" -t ecdsa -b 384 -f $HOME/.ssh/id_ecdsa384
+    ssh-keygen -q -N "" -t ecdsa -b 256 -f $HOME/.ssh/id_ecdsa256
+    ssh-keygen -q -N "" -t ed25519 -f $HOME/.ssh/id_ed25519
+    ssh-keygen -q -N "" -t rsa -f $HOME/.ssh/id_rsa
+    ssh-keygen -q -N "" -t dsa -f $HOME/.ssh/id_dsa
+    export SSH_AUTH_SOCK=$HOME/ssh-agent.sock
+    eval $(ssh-agent -a $SSH_AUTH_SOCK)
+    ssh-add $HOME/.ssh/id_ecdsa521
+    ssh-add $HOME/.ssh/id_ecdsa384
+    ssh-add $HOME/.ssh/id_ecdsa256
+    ssh-add $HOME/.ssh/id_ed25519
+    ssh-add $HOME/.ssh/id_rsa
+    ssh-add $HOME/.ssh/id_dsa
+  '';
+
+  meta = with lib; {
+    description = "PAM module for authenticating via ssh-agent, written in Rust";
+    homepage = "https://github.com/z4yx/pam_rssh";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kranzes ];
+  };
+}
diff --git a/pkgs/os-specific/linux/pam_tmpdir/default.nix b/pkgs/os-specific/linux/pam_tmpdir/default.nix
new file mode 100644
index 00000000000..859ebedc334
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_tmpdir/default.nix
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchurl, autoreconfHook, pam }:
+
+stdenv.mkDerivation rec {
+  pname = "pam_tmpdir";
+  version = "0.09";
+
+  src = fetchurl {
+    url = "http://deb.debian.org/debian/pool/main/p/pam-tmpdir/pam-tmpdir_${version}.tar.gz";
+    hash = "sha256-MXa1CY6alD83E/Q+MJmsv8NaImWd0pPJKZd/7nbe4J8=";
+  };
+
+  postPatch = ''
+    substituteInPlace pam_tmpdir.c \
+      --replace /sbin/pam-tmpdir-helper $out/sbin/pam-tmpdir-helper
+
+    # chmod/chown fails on files in /nix/store
+    sed -i -E -e '/^\s*(chmod|chown)/d' Makefile.{am,in}
+
+    # the symlinks in m4 assume FHS
+    rm -rf m4
+  '';
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [ pam ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://tracker.debian.org/pkg/pam-tmpdir";
+    description = "PAM module for creating safe per-user temporary directories";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/pam_u2f/default.nix b/pkgs/os-specific/linux/pam_u2f/default.nix
index 30a55f2b9c0..085ff43a793 100644
--- a/pkgs/os-specific/linux/pam_u2f/default.nix
+++ b/pkgs/os-specific/linux/pam_u2f/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pam_u2f";
-  version = "1.1.1";
+  version = "1.3.0";
 
   src     = fetchurl {
     url = "https://developers.yubico.com/pam-u2f/Releases/${pname}-${version}.tar.gz";
-    sha256 = "12p3pkrp32vzpg7707cgx8zgvgj8iqwhy39sm761k7plqi027mmp";
+    sha256 = "sha256-cjYMaHVIXrTfQJ2o+PUrF4k/BeTZmFKcI4gUSA4RUiA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -27,8 +27,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://developers.yubico.com/pam-u2f/";
     description = "A PAM module for allowing authentication with a U2F device";
+    changelog = "https://github.com/Yubico/pam-u2f/raw/pam_u2f-${version}/NEWS";
     license = licenses.bsd2;
     platforms = platforms.unix;
     maintainers = with maintainers; [ philandstuff ];
+    mainProgram = "pamu2fcfg";
   };
 }
diff --git a/pkgs/os-specific/linux/pam_usb/default.nix b/pkgs/os-specific/linux/pam_usb/default.nix
index 1a66e986d8b..1264894ad0c 100644
--- a/pkgs/os-specific/linux/pam_usb/default.nix
+++ b/pkgs/os-specific/linux/pam_usb/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, dbus, libxml2, pam, pkg-config, pmount, pythonPackages, writeScript, runtimeShell }:
+{ lib, stdenv, fetchurl, makeWrapper, dbus, libxml2, pam, pkg-config, pmount, python2Packages, writeScript, runtimeShell }:
 
 let
 
@@ -29,21 +29,26 @@ let
 
   pmountBin = useSetUID pmount "/bin/pmount";
   pumountBin = useSetUID pmount "/bin/pumount";
-  inherit (pythonPackages) python dbus-python;
+  inherit (python2Packages) python dbus-python;
 in
 
 stdenv.mkDerivation rec {
-  name = "pam_usb-0.5.0";
+  pname = "pam_usb";
+  version = "0.5.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/pamusb/${name}.tar.gz";
+    url = "mirror://sourceforge/pamusb/pam_usb-${version}.tar.gz";
     sha256 = "1g1w0s9d8mfld8abrn405ll5grv3xgs0b0hsganrz6qafdq9j7q1";
   };
 
-  buildInputs = [
+  nativeBuildInputs = [
     makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
     # pam_usb dependencies
-    dbus libxml2 pam pmount pkg-config
+    dbus libxml2 pam pmount
     # pam_usb's tools dependencies
     python
     # cElementTree is included with python 2.5 and later.
diff --git a/pkgs/os-specific/linux/pam_ussh/default.nix b/pkgs/os-specific/linux/pam_ussh/default.nix
new file mode 100644
index 00000000000..028b33bc931
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_ussh/default.nix
@@ -0,0 +1,65 @@
+{ buildGoModule
+, fetchFromGitHub
+, pam
+, lib
+, nixosTests
+}:
+
+buildGoModule rec {
+  pname = "pam_ussh";
+  version = "unstable-20210615";
+
+  src = fetchFromGitHub {
+    owner = "uber";
+    repo = "pam-ussh";
+    rev = "e9524bda90ba19d3b9eb24f49cb63a6a56a19193";  # HEAD as of 2022-03-13
+    sha256 = "0nb9hpqbghgi3zvq41kabydzyc6ffaaw9b4jkc5jrwn1klpw1xk8";
+  };
+
+  preBuild = ''
+    cp ${./go.mod} go.mod
+    cp ${./go.sum} go.sum
+  '';
+
+  vendorHash = "sha256-fOIzJuTXiDNJak5ilgI2KnPOCogbFWTlPL3yNQdzUUI=";
+
+  buildInputs = [
+    pam
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    if [ -z "$enableParallelBuilding" ]; then
+      export NIX_BUILD_CORES=1
+    fi
+    go build -buildmode=c-shared -o pam_ussh.so -v -p $NIX_BUILD_CORES .
+
+    runHook postBuild
+  '';
+  checkPhase = ''
+    runHook preCheck
+
+    go test -v -p $NIX_BUILD_CORES .
+
+    runHook postCheck
+  '';
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/security
+    cp pam_ussh.so $out/lib/security
+
+    runHook postInstall
+  '';
+
+  passthru.tests = { inherit (nixosTests) pam-ussh; };
+
+  meta = with lib; {
+    homepage = "https://github.com/uber/pam-ussh";
+    description = "PAM module to authenticate using SSH certificates";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ lukegb ];
+  };
+}
diff --git a/pkgs/os-specific/linux/pam_ussh/go.mod b/pkgs/os-specific/linux/pam_ussh/go.mod
new file mode 100644
index 00000000000..9adc453560a
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_ussh/go.mod
@@ -0,0 +1,15 @@
+module github.com/uber/pam-ussh
+
+go 1.17
+
+require (
+	github.com/stretchr/testify v1.7.0
+	golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 // indirect
+	gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
+)
diff --git a/pkgs/os-specific/linux/pam_ussh/go.sum b/pkgs/os-specific/linux/pam_ussh/go.sum
new file mode 100644
index 00000000000..0df3145edbd
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_ussh/go.sum
@@ -0,0 +1,22 @@
+github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000 h1:SL+8VVnkqyshUSz5iNnXtrBQzvFF2SkROm6t5RczFAE=
+golang.org/x/crypto v0.0.0-20220313003712-b769efc7c000/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
+golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/pkgs/os-specific/linux/pax-utils/default.nix b/pkgs/os-specific/linux/pax-utils/default.nix
index 40159cd2acd..dcecfa4c13b 100644
--- a/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/pkgs/os-specific/linux/pax-utils/default.nix
@@ -1,15 +1,45 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv
+, lib
+, fetchgit
+, buildPackages
+, docbook_xml_dtd_44
+, docbook_xsl
+, withLibcap ? stdenv.isLinux, libcap
+, pkg-config
+, meson
+, ninja
+, xmlto
+, python3
+
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "pax-utils";
-  version = "1.2.8";
+  version = "1.3.7";
 
-  src = fetchurl {
-    url = "http://distfiles.gentoo.org/distfiles/${pname}-${version}.tar.xz";
-    sha256 = "sha256-urTIhG4dLMNmnPqSMdIdszWEHX1Y+eGc0Jn+bOYmsVc=";
+  src = fetchgit {
+    url = "https://anongit.gentoo.org/git/proj/pax-utils.git";
+    rev = "v${version}";
+    hash = "sha256-WyNng+UtfRz1+Eu4gwXLxUvBAg+m3mdrc8GdEPYRKVE=";
   };
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  strictDeps = true;
+
+  mesonFlags = [
+    (lib.mesonEnable "use_libcap" withLibcap)
+  ];
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ docbook_xml_dtd_44 docbook_xsl meson ninja pkg-config xmlto ];
+  buildInputs = lib.optionals withLibcap [ libcap ];
+  # Needed for lddtree
+  propagatedBuildInputs = [ (python3.withPackages (p: with p; [ pyelftools ])) ];
+
+  passthru.updateScript = gitUpdater {
+    url = "https://anongit.gentoo.org/git/proj/pax-utils.git";
+    rev-prefix = "v";
+  };
 
   meta = with lib; {
     description = "ELF utils that can check files for security relevant properties";
@@ -20,7 +50,7 @@ stdenv.mkDerivation rec {
       binary files.
     '';
     homepage = "https://wiki.gentoo.org/wiki/Hardened/PaX_Utilities";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.unix;
     maintainers = with maintainers; [ thoughtpolice joachifm ];
   };
diff --git a/pkgs/os-specific/linux/pcm/default.nix b/pkgs/os-specific/linux/pcm/default.nix
index c0b8b59ebb5..fc5902e719b 100644
--- a/pkgs/os-specific/linux/pcm/default.nix
+++ b/pkgs/os-specific/linux/pcm/default.nix
@@ -1,20 +1,18 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ cmake, fetchFromGitHub, lib, stdenv }:
 
 stdenv.mkDerivation rec {
-  version = "202101";
   pname = "pcm";
+  version = "202307";
 
   src = fetchFromGitHub {
     owner = "opcm";
     repo = "pcm";
     rev = version;
-    sha256 = "sha256-xiC9XDuFcAzD2lVuzBWUvHy1Z1shEXM2KPFabKvgh1Y=";
+    hash = "sha256-GeLiJT5AwsMWw0ErdwD6C1jtUZjUxGw5GRSvenu3W18=";
   };
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp pcm*.x $out/bin
-  '';
+  nativeBuildInputs = [ cmake ];
+  enableParallelBuilding = true;
 
   meta = with lib; {
     description = "Processor counter monitor";
diff --git a/pkgs/os-specific/linux/pcmciautils/default.nix b/pkgs/os-specific/linux/pcmciautils/default.nix
index a4da6be691e..b5f9d8a0a2c 100644
--- a/pkgs/os-specific/linux/pcmciautils/default.nix
+++ b/pkgs/os-specific/linux/pcmciautils/default.nix
@@ -7,10 +7,11 @@
 
 # FIXME: should add an option to choose between hotplug and udev.
 stdenv.mkDerivation rec {
-  name = "pcmciautils-018";
+  pname = "pcmciautils";
+  version = "018";
 
   src = fetchurl {
-    url = "https://kernel.org/pub/linux/utils/kernel/pcmcia/${name}.tar.gz";
+    url = "https://kernel.org/pub/linux/utils/kernel/pcmcia/pcmciautils-${version}.tar.gz";
     sha256 = "0sfm3w2n73kl5w7gb1m6q8gy5k4rgwvzz79n6yhs9w3sag3ix8sk";
   };
 
@@ -26,8 +27,8 @@ stdenv.mkDerivation rec {
       s,/etc/pcmcia,$out&,;
     " src/{startup.c,pcmcia-check-broken-cis.c} # fix-color */
   ''
-  + (if firmware == [] then ''sed -i "s,STARTUP = true,STARTUP = false," Makefile'' else "")
-  + (if configOpts == null then "" else "ln -sf ${configOpts} ./config/config.opts")
+  + (lib.optionalString (firmware == []) ''sed -i "s,STARTUP = true,STARTUP = false," Makefile'')
+  + (lib.optionalString (configOpts != null) "ln -sf ${configOpts} ./config/config.opts")
   ;
 
   makeFlags = [ "LEX=flex" ];
diff --git a/pkgs/os-specific/linux/perf-tools/default.nix b/pkgs/os-specific/linux/perf-tools/default.nix
index 7d5d6d59ea8..8c3e31e4538 100644
--- a/pkgs/os-specific/linux/perf-tools/default.nix
+++ b/pkgs/os-specific/linux/perf-tools/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, fetchFromGitHub, perl }:
 
 stdenv.mkDerivation {
-  name = "perf-tools-20171219";
+  pname = "perf-tools";
+  version = "unstable-2017-12-19";
 
   src = fetchFromGitHub {
     owner = "brendangregg";
@@ -39,6 +40,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/brendangregg/perf-tools";
     description = "Performance analysis tools based on Linux perf_events (aka perf) and ftrace";
     maintainers = [ maintainers.eelco ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
   };
 }
diff --git a/pkgs/os-specific/linux/pflask/default.nix b/pkgs/os-specific/linux/pflask/default.nix
index f3e63133d1e..1270a9b9494 100644
--- a/pkgs/os-specific/linux/pflask/default.nix
+++ b/pkgs/os-specific/linux/pflask/default.nix
@@ -1,23 +1,38 @@
-{ lib, stdenv, fetchurl, python, wafHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, python3, wafHook }:
 
 stdenv.mkDerivation rec {
   pname = "pflask";
-  version = "git-2015-12-17";
-  rev = "599418bb6453eaa0ccab493f9411f13726c1a636";
+  version = "unstable-2018-01-23";
 
-  src = fetchurl {
-    url = "https://github.com/ghedo/pflask/archive/${rev}.tar.gz";
-    sha256 = "2545fca37f9da484b46b6fb5e3a9bbba6526a9725189fe4af5227ef6e6fca440";
+  src = fetchFromGitHub {
+    owner = "ghedo";
+    repo = pname;
+    rev = "9ac31ffe2ed29453218aac89ae992abbd6e7cc69";
+    hash = "sha256-bAKPUj/EipZ98kHbZiFZZI3hLVMoQpCrYKMmznpSDhg=";
   };
 
-  nativeBuildInputs = [ wafHook ];
-  buildInputs = [ python ];
+  patches = [
+    # Pull patch pending upstream inclusion for -fno-common toolchain support:
+    #  https://github.com/ghedo/pflask/pull/30
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/ghedo/pflask/commit/73ba32ec48e1e0e4a56b1bceed4635711526e079.patch";
+      hash = "sha256-KVuBS7LbYJQv6NXljpSiGGja7ar7W6A6SKzkEjB1B6U=";
+    })
+  ];
+
+  nativeBuildInputs = [ python3 wafHook ];
+
+  postInstall = ''
+    mkdir -p $out/bin
+    cp build/pflask $out/bin
+  '';
 
   meta = {
     description = "Lightweight process containers for Linux";
-    homepage    = "https://ghedo.github.io/pflask/";
-    license     = lib.licenses.bsd2;
-    platforms   = lib.platforms.linux;
+    homepage = "https://ghedo.github.io/pflask/";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/phc-intel/default.nix b/pkgs/os-specific/linux/phc-intel/default.nix
index 34693564e0a..a0d43b2e0e3 100644
--- a/pkgs/os-specific/linux/phc-intel/default.nix
+++ b/pkgs/os-specific/linux/phc-intel/default.nix
@@ -44,8 +44,7 @@ in stdenv.mkDerivation rec {
       while noticably reducing fan noise. This driver works only on supported
       Intel architectures.
     '';
-    homepage = "http://www.linux-phc.org/";
-    downloadPage = "http://www.linux-phc.org/forum/viewtopic.php?f=7&t=267";
+    homepage = "https://github.com/danielw86dev/phc-intel-dkms";
     license = licenses.gpl2;
     platforms = [ "x86_64-linux" "i686-linux" ];
     broken = lib.versionAtLeast kernel.version "4.18";
diff --git a/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix b/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix
new file mode 100644
index 00000000000..4a651bf473e
--- /dev/null
+++ b/pkgs/os-specific/linux/picoprobe-udev-rules/default.nix
@@ -0,0 +1,32 @@
+{ lib, stdenv, fetchurl }:
+
+## Usage
+# In NixOS, simply add this package to services.udev.packages:
+#   services.udev.packages = [ pkgs.picoprobe-udev-rules ];
+
+stdenv.mkDerivation rec {
+  pname = "picoprobe-udev-rules";
+  version = "unstable-2023-01-31";
+
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/probe-rs/webpage/1cba61acc6ecb5ff96f74641269844ad88ad8ad5/static/files/69-probe-rs.rules";
+    sha256 = "sha256-vQMPX3Amttja0u03KWGnPDAVTGM9ekJ+IBTjW+xlJS0=";
+  };
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -D $src $out/lib/udev/rules.d/69-probe-rs.rules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://probe.rs/docs/getting-started/probe-setup/#udev-rules";
+    description = "Picoprobe udev rules list";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ mglolenstine ];
+  };
+}
diff --git a/pkgs/os-specific/linux/piper/default.nix b/pkgs/os-specific/linux/piper/default.nix
index 5edcd263f0d..39b0eaf5325 100644
--- a/pkgs/os-specific/linux/piper/default.nix
+++ b/pkgs/os-specific/linux/piper/default.nix
@@ -1,10 +1,10 @@
 { lib, meson, ninja, pkg-config, gettext, fetchFromGitHub, python3
 , wrapGAppsHook, gtk3, glib, desktop-file-utils, appstream-glib, gnome
-, gobject-introspection }:
+, gobject-introspection, librsvg }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "piper";
-  version = "0.5.1";
+  version = "0.7";
 
   format = "other";
 
@@ -12,20 +12,23 @@ python3.pkgs.buildPythonApplication rec {
     owner  = "libratbag";
     repo   = "piper";
     rev    =  version;
-    sha256 = "1nfjnsiwg2rs6gkjsxzhr2708i6di149dgwq3cf6l12rxqpb8arj";
+    sha256 = "0jsvfy0ihdcgnqljfgs41lys1nlz18qvsa0a8ndx3pyr41f8w8wf";
   };
 
   nativeBuildInputs = [ meson ninja gettext pkg-config wrapGAppsHook desktop-file-utils appstream-glib gobject-introspection ];
   buildInputs = [
-    gtk3 glib gnome.adwaita-icon-theme python3
+    gtk3 glib gnome.adwaita-icon-theme python3 librsvg
   ];
-  propagatedBuildInputs = with python3.pkgs; [ lxml evdev pygobject3 ] ++ [
-    gobject-introspection # fixes https://github.com/NixOS/nixpkgs/issues/56943 for now
+  propagatedBuildInputs = with python3.pkgs; [ lxml evdev pygobject3 ];
+
+  mesonFlags = [
+    "-Druntime-dependency-checks=false"
+    "-Dtests=false"
   ];
 
   postPatch = ''
     chmod +x meson_install.sh # patchShebangs requires executable file
-    patchShebangs meson_install.sh
+    patchShebangs meson_install.sh data/generate-piper-gresource.xml.py
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/pipework/default.nix b/pkgs/os-specific/linux/pipework/default.nix
index 33192392888..3591303a8d0 100644
--- a/pkgs/os-specific/linux/pipework/default.nix
+++ b/pkgs/os-specific/linux/pipework/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper
-, bridge-utils, iproute2, lxc, openvswitch, docker, busybox, dhcpcd, dhcp
+, bridge-utils, iproute2, lxc, openvswitch, docker, busybox, dhcpcd
 }:
 
 stdenv.mkDerivation {
@@ -15,13 +15,13 @@ stdenv.mkDerivation {
   installPhase = ''
     install -D pipework $out/bin/pipework
     wrapProgram $out/bin/pipework --prefix PATH : \
-      ${lib.makeBinPath [ bridge-utils iproute2 lxc openvswitch docker busybox dhcpcd dhcp ]};
+      ${lib.makeBinPath [ bridge-utils iproute2 lxc openvswitch docker busybox dhcpcd ]};
   '';
   meta = with lib; {
     description = "Software-Defined Networking tools for LXC";
     homepage = "https://github.com/jpetazzo/pipework";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/pktgen/default.nix b/pkgs/os-specific/linux/pktgen/default.nix
index 5a1a56ab691..b81bf74a3d9 100644
--- a/pkgs/os-specific/linux/pktgen/default.nix
+++ b/pkgs/os-specific/linux/pktgen/default.nix
@@ -1,19 +1,40 @@
-{ stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config
-, dpdk, libbsd, libpcap, lua5_3, numactl, util-linux
-, gtk2, which, withGtk ? false
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, meson
+, ninja
+, pkg-config
+, dpdk
+, libbsd
+, libpcap
+, lua5_3
+, numactl
+, util-linux
+, gtk2
+, which
+, withGtk ? false
 }:
 
 stdenv.mkDerivation rec {
   pname = "pktgen";
-  version = "21.05.0";
+  version = "22.07.1";
 
   src = fetchFromGitHub {
     owner = "pktgen";
     repo = "Pktgen-DPDK";
     rev = "pktgen-${version}";
-    sha256 = "sha256-7lLDtbd14olEHO+1BuI6KTEUNRM/zAyRXau/OZbYbGA=";
+    sha256 = "sha256-wBLGwVdn3ymUTVv7J/kbQYz4WNIgV246PHg51+FStUo=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Ealier DPDK deprecated some macros, which were finally removed in >= 22.11
+      url = "https://github.com/pktgen/Pktgen-DPDK/commit/089ef94ac04629f7380f5e618443bcacb2cef5ab.patch";
+      sha256 = "sha256-ITU/dIfu7QPpdIVYuCuDhDG9rVF+n8i1YYn9bFmQUME=";
+    })
+  ];
+
   nativeBuildInputs = [ meson ninja pkg-config ];
 
   buildInputs = [
@@ -25,7 +46,12 @@ stdenv.mkDerivation rec {
   RTE_SDK = dpdk;
   GUI = lib.optionalString withGtk "true";
 
-  NIX_CFLAGS_COMPILE = "-msse3";
+  env.NIX_CFLAGS_COMPILE = toString [
+    # Needed with GCC 12
+    "-Wno-error=address"
+    "-Wno-error=use-after-free"
+  ];
+
   # requires symbols from this file
   NIX_LDFLAGS = "-lrte_net_bond";
 
@@ -43,7 +69,7 @@ stdenv.mkDerivation rec {
     description = "Traffic generator powered by DPDK";
     homepage = "http://dpdk.org/";
     license = licenses.bsdOriginal;
-    platforms =  [ "x86_64-linux" ];
+    platforms =  platforms.linux;
     maintainers = [ maintainers.abuibrahim ];
   };
 }
diff --git a/pkgs/os-specific/linux/ply/default.nix b/pkgs/os-specific/linux/ply/default.nix
index e62716e4796..dbd8925a5cb 100644
--- a/pkgs/os-specific/linux/ply/default.nix
+++ b/pkgs/os-specific/linux/ply/default.nix
@@ -1,19 +1,16 @@
 { lib, stdenv, kernel, fetchFromGitHub, autoreconfHook, bison, flex, p7zip, rsync }:
 
-assert kernel != null -> lib.versionAtLeast kernel.version "4.0";
-
-let
-  version = "1.0.beta1-9e810b1";
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "ply";
-  inherit version;
+  version = "2.1.1-${lib.substring 0 7 src.rev}";
+
   nativeBuildInputs = [ autoreconfHook flex bison p7zip rsync ];
 
   src = fetchFromGitHub {
     owner = "iovisor";
     repo = "ply";
-    rev = "9e810b157ba079c32c430a7d4c6034826982056e";
-    sha256 = "15cp6iczawaqlhsa0af6i37zn5iq53kh6ya8s2hzd018yd7mhg50";
+    rev = "e25c9134b856cc7ffe9f562ff95caf9487d16b59";
+    sha256 = "1178z7vvnjwnlxc98g2962v16878dy7bd0b2njsgn4vqgrnia7i5";
   };
 
   preAutoreconf = ''
@@ -34,9 +31,9 @@ in stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = "dynamic Tracing in Linux";
+    description = "Dynamic tracing in Linux";
     homepage = "https://wkz.github.io/ply/";
-    license = [ licenses.gpl2 ];
+    license = [ licenses.gpl2Only ];
     maintainers = with maintainers; [ mic92 mbbx6spp ];
   };
 }
diff --git a/pkgs/os-specific/linux/plymouth/add-runtime-plugin-path.patch b/pkgs/os-specific/linux/plymouth/add-runtime-plugin-path.patch
new file mode 100644
index 00000000000..e4bd095bfd8
--- /dev/null
+++ b/pkgs/os-specific/linux/plymouth/add-runtime-plugin-path.patch
@@ -0,0 +1,67 @@
+diff --git a/meson.build b/meson.build
+index 650ad189..1e1ebe1d 100644
+--- a/meson.build
++++ b/meson.build
+@@ -18,6 +18,11 @@ plymouth_time_dir = get_option('prefix') / get_option('localstatedir') / 'lib' /
+ 
+ plymouth_runtime_dir = get_option('runstatedir') / 'plymouth'
+ plymouth_runtime_theme_path = plymouth_runtime_dir / 'themes/'
++if get_option('runtime-plugins')
++  plymouth_runtime_plugin_path = plymouth_runtime_dir / 'plugins/'
++else
++  plymouth_runtime_plugin_path = plymouth_plugin_path
++endif
+ 
+ # Dependencies
+ cc = meson.get_compiler('c')
+@@ -76,7 +81,7 @@ conf.set('PLY_ENABLE_TRACING', get_option('tracing'))
+ conf.set_quoted('PLYMOUTH_RUNTIME_DIR', plymouth_runtime_dir)
+ conf.set_quoted('PLYMOUTH_THEME_PATH', plymouth_theme_path)
+ conf.set_quoted('PLYMOUTH_RUNTIME_THEME_PATH', plymouth_runtime_theme_path)
+-conf.set_quoted('PLYMOUTH_PLUGIN_PATH', plymouth_plugin_path)
++conf.set_quoted('PLYMOUTH_PLUGIN_PATH', plymouth_runtime_plugin_path)
+ conf.set_quoted('PLYMOUTH_POLICY_DIR', plymouth_policy_dir)
+ conf.set_quoted('PLYMOUTH_CONF_DIR', plymouth_conf_dir)
+ conf.set_quoted('PLYMOUTH_TIME_DIRECTORY', plymouth_time_dir)
+diff --git a/meson_options.txt b/meson_options.txt
+index 4f601bb0..61fccc12 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -28,6 +28,11 @@ option('runstatedir',
+   value: '/run',
+   description: 'runstatedir',
+ )
++option('runtime-plugins',
++  type: 'boolean',
++  value: false,
++  description: 'Use runstatedir for loading theme plugins',
++)
+ option('boot-tty',
+   type: 'string',
+   value: '/dev/tty1',
+diff --git a/src/libply-splash-core/meson.build b/src/libply-splash-core/meson.build
+index 69636b13..02bd5cbd 100644
+--- a/src/libply-splash-core/meson.build
++++ b/src/libply-splash-core/meson.build
+@@ -31,7 +31,7 @@ libply_splash_core_cflags = [
+   '-DPLYMOUTH_BACKGROUND_COLOR=@0@'.format(get_option('background-color')),
+   '-DPLYMOUTH_BACKGROUND_START_COLOR=@0@'.format(get_option('background-start-color-stop')),
+   '-DPLYMOUTH_BACKGROUND_END_COLOR=@0@'.format(get_option('background-end-color-stop')),
+-  '-DPLYMOUTH_PLUGIN_PATH="@0@"'.format(plymouth_plugin_path),
++  '-DPLYMOUTH_PLUGIN_PATH="@0@"'.format(plymouth_runtime_plugin_path),
+ ]
+ 
+ libply_splash_core = library('ply-splash-core',
+diff --git a/src/libply-splash-graphics/meson.build b/src/libply-splash-graphics/meson.build
+index 32fad963..02b8440b 100644
+--- a/src/libply-splash-graphics/meson.build
++++ b/src/libply-splash-graphics/meson.build
+@@ -20,7 +20,7 @@ libply_splash_graphics_cflags = [
+   '-DPLYMOUTH_BACKGROUND_COLOR=@0@'.format(get_option('background-color')),
+   '-DPLYMOUTH_BACKGROUND_START_COLOR=@0@'.format(get_option('background-start-color-stop')),
+   '-DPLYMOUTH_BACKGROUND_END_COLOR=@0@'.format(get_option('background-end-color-stop')),
+-  '-DPLYMOUTH_PLUGIN_PATH="@0@"'.format(plymouth_plugin_path),
++  '-DPLYMOUTH_PLUGIN_PATH="@0@"'.format(plymouth_runtime_plugin_path),
+ ]
+ 
+ libply_splash_graphics = library('ply-splash-graphics',
diff --git a/pkgs/os-specific/linux/plymouth/default.nix b/pkgs/os-specific/linux/plymouth/default.nix
index 8cb2a00987e..d5d46e5de7e 100644
--- a/pkgs/os-specific/linux/plymouth/default.nix
+++ b/pkgs/os-specific/linux/plymouth/default.nix
@@ -1,111 +1,120 @@
 { lib
 , stdenv
-, fetchpatch
 , fetchFromGitLab
+, writeText
+, meson
 , pkg-config
-, autoreconfHook
-, libxslt
+, ninja
 , docbook-xsl-nons
 , gettext
+, libxslt
 , gtk3
-, systemd
-, pango
-, cairo
 , libdrm
+, libevdev
+, libpng
+, libxkbcommon
+, pango
+, systemd
+, xorg
 }:
 
-stdenv.mkDerivation rec {
-  pname = "plymouth-unstable";
-  version = "2020-12-07";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "plymouth";
+  version = "unstable-2023-06-17";
 
-  outputs = [
-    "out"
-    "dev"
-  ];
+  outputs = [ "out" "dev" ];
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "plymouth";
     repo = "plymouth";
-    rev = "c4ced2a2d70edea7fbb95274aa1d01d95928df1b";
-    sha256 = "7CPuKMA0fTt8DBsaA4Td74kHT/O7PW8N3awP04nUnOI=";
+    rev = "b1d5aa9d2a6033bba52cf63643e5878f8a9b68a0";
+    hash = "sha256-8DXcwt8CZTni5Ma+I63LzNejlIB0Cr1ATA7Nl3z9z6I=";
   };
 
+  patches = [
+    # do not create unnecessary symlink to non-existent header-image.png
+    ./dont-create-broken-symlink.patch
+    # add support for loading plugins from /run to assist NixOS module
+    ./add-runtime-plugin-path.patch
+  ];
+
+  strictDeps = true;
+
   nativeBuildInputs = [
-    autoreconfHook
+    meson
+    pkg-config
+    ninja
     docbook-xsl-nons
     gettext
     libxslt
-    pkg-config
   ];
 
   buildInputs = [
-    cairo
     gtk3
     libdrm
+    libevdev
+    libpng
+    libxkbcommon
     pango
     systemd
+    xorg.xkeyboardconfig
   ];
 
-  patches = [
-    # KillMode=none is deprecated
-    # https://gitlab.freedesktop.org/plymouth/plymouth/-/issues/123
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/plymouth/plymouth/-/commit/b406b0895a95949db2adfedaeda451f36f2b51c3.patch";
-      sha256 = "/UBImNuFO0G/oxlttjGIXon8YXMXlc9XU8uVuR9QuxY=";
-    })
+  mesonFlags = let
+    # https://gitlab.freedesktop.org/plymouth/plymouth/-/blob/a5eda165689864cc9a25ec14fd8c6da458598f42/meson.build#L47
+    crossFile = writeText "cross-file.conf" ''
+      [binaries]
+      systemd-tty-ask-password-agent = '${lib.getBin systemd}/bin/systemd-tty-ask-password-agent'
+    '';
+  in [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "-Dlogo=/etc/plymouth/logo.png"
+    "-Dbackground-color=0x000000"
+    "-Dbackground-start-color-stop=0x000000"
+    "-Dbackground-end-color-stop=0x000000"
+    "-Drelease-file=/etc/os-release"
+    "-Dudev=enabled"
+    "-Drunstatedir=/run"
+    "-Druntime-plugins=true"
+    "--cross-file=${crossFile}"
   ];
 
   postPatch = ''
-    sed -i \
-      -e "s#plymouthplugindir=.*#plymouthplugindir=/etc/plymouth/plugins/#" \
-      -e "s#plymouththemedir=.*#plymouththemedir=/etc/plymouth/themes#" \
-      -e "s#plymouthpolicydir=.*#plymouthpolicydir=/etc/plymouth/#" \
-      -e "s#plymouthconfdir=.*#plymouthconfdir=/etc/plymouth/#" \
-      configure.ac
-  '';
-
-  configurePlatforms = [ "host" ];
-
-  configureFlags = [
-    "--enable-documentation"
-    "--enable-drm"
-    "--enable-gtk"
-    "--enable-pango"
-    "--enable-systemd-integration"
-    "--enable-tracing"
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-    "--with-background-color=0x000000"
-    "--with-background-end-color-stop=0x000000"
-    "--with-background-start-color-stop=0x000000"
-    "--with-logo=/etc/plymouth/logo.png"
-    "--with-release-file=/etc/os-release"
-    "--with-runtimedir=/run"
-    "--with-systemdunitdir=${placeholder "out"}/etc/systemd/system"
-    "--without-rhgb-compat-link"
-    "--without-system-root-install"
-    "ac_cv_path_SYSTEMD_ASK_PASSWORD_AGENT=${lib.getBin systemd}/bin/systemd-tty-ask-password-agent"
-  ];
+    substituteInPlace meson.build \
+      --replace "run_command(['scripts/generate-version.sh'], check: true).stdout().strip()" "'${finalAttrs.version}'"
 
-  installFlags = [
-    "localstatedir=\${TMPDIR}"
-    "plymouthd_confdir=${placeholder "out"}/etc/plymouth"
-    "plymouthd_defaultsdir=${placeholder "out"}/share/plymouth"
-    "sysconfdir=${placeholder "out"}/etc"
-  ];
+    # prevent installing unused non-$out dirs to DESTDIR
+    sed -i '/^install_emptydir/d' src/meson.build
+  '';
 
   postInstall = ''
-    # Makes a symlink to /usr/share/pixmaps/system-logo-white.png
-    # We'll handle it in the nixos module.
-    rm $out/share/plymouth/themes/spinfinity/header-image.png
+    # Move stuff from DESTDIR to proper location.
+    cp -a "$DESTDIR/etc" "$out"
+    rm -r "$DESTDIR/etc"
+    for o in $(getAllOutputNames); do
+        if [[ "$o" = "debug" ]]; then continue; fi
+        cp -a "$DESTDIR/''${!o}" "$(dirname "''${!o}")"
+        rm -r "$DESTDIR/''${!o}"
+    done
+    # Ensure the DESTDIR is removed.
+    rmdir "$DESTDIR/${builtins.storeDir}" "$DESTDIR/${builtins.dirOf builtins.storeDir}" "$DESTDIR"
   '';
 
+  # HACK: We want to install configuration files to $out/etc
+  # but Plymouth should read them from /etc on a NixOS system.
+  # With autotools, it was possible to override Make variables
+  # at install time but Meson does not support this
+  # so we need to convince it to install all files to a temporary
+  # location using DESTDIR and then move it to proper one in postInstall.
+  env.DESTDIR = "${placeholder "out"}/dest";
+
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/Plymouth/";
     description = "Boot splash and boot logger";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.goibhniu teams.gnome.members ];
+    maintainers = [ maintainers.goibhniu ] ++ teams.gnome.members;
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/plymouth/dont-create-broken-symlink.patch b/pkgs/os-specific/linux/plymouth/dont-create-broken-symlink.patch
new file mode 100644
index 00000000000..7accb7c9efc
--- /dev/null
+++ b/pkgs/os-specific/linux/plymouth/dont-create-broken-symlink.patch
@@ -0,0 +1,13 @@
+diff --git a/themes/spinfinity/meson.build b/themes/spinfinity/meson.build
+index f48e8e55..5a2050c8 100644
+--- a/themes/spinfinity/meson.build
++++ b/themes/spinfinity/meson.build
+@@ -53,8 +53,3 @@ install_data(
+   'throbber-33.png',
+   install_dir: plymouth_theme_path / 'spinfinity',
+ )
+-
+-install_symlink('header-image.png',
+-  install_dir: plymouth_theme_path / 'spinfinity',
+-  pointing_to: plymouth_logo_file,
+-)
diff --git a/pkgs/os-specific/linux/pm-utils/default.nix b/pkgs/os-specific/linux/pm-utils/default.nix
index 17723983c69..4076641717f 100644
--- a/pkgs/os-specific/linux/pm-utils/default.nix
+++ b/pkgs/os-specific/linux/pm-utils/default.nix
@@ -12,10 +12,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "pm-utils-1.4.1";
+  pname = "pm-utils";
+  version = "1.4.1";
 
   src = fetchurl {
-    url = "https://pm-utils.freedesktop.org/releases/${name}.tar.gz";
+    url = "https://pm-utils.freedesktop.org/releases/pm-utils-${version}.tar.gz";
     sha256 = "02qc6zaf7ams6qcc470fwb6jvr4abv3lrlx16clqpn36501rkn4f";
   };
 
diff --git a/pkgs/os-specific/linux/pmount/default.nix b/pkgs/os-specific/linux/pmount/default.nix
index 0f65e0278ca..8267a2d4a7f 100644
--- a/pkgs/os-specific/linux/pmount/default.nix
+++ b/pkgs/os-specific/linux/pmount/default.nix
@@ -16,7 +16,8 @@ stdenv.mkDerivation rec {
     sha256 = "db38fc290b710e8e9e9d442da2fb627d41e13b3ee80326c15cc2595ba00ea036";
   };
 
-  buildInputs = [ intltool util-linux ];
+  nativeBuildInputs = [ intltool util-linux ];
+  buildInputs = [ util-linux ];
 
   configureFlags = [
     "--with-media-dir=${mediaDir}"
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index 7e2ff29325a..33875049747 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -1,13 +1,13 @@
-{ lib, stdenv, fetchurl, gettext, libsepol, libselinux, libsemanage }:
+{ lib, stdenv, fetchurl, gettext, libsepol, libselinux, libsemanage, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "policycoreutils";
-  version = "2.9";
-  inherit (libsepol) se_release se_url;
+  version = "3.3";
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/policycoreutils-${version}.tar.gz";
-    sha256 = "0yqg5ws5gbl1cbn8msxdk1c3ilmmx58qg5dx883kqyq0517k8g65";
+    url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
+    sha256 = "0y0hl32b2ks7r0fhbx3k2j1gqqms5aplyasjs3fz50caxl6096a1";
   };
 
   postPatch = ''
@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [ gettext ];
-  buildInputs = [ libsepol libselinux libsemanage ];
+  buildInputs = [ libsepol libselinux libsemanage libxcrypt ];
 
   makeFlags = [
     "PREFIX=$(out)"
-    "SBINDIR=$(out)/sbin"
+    "SBINDIR=$(out)/bin"
     "ETCDIR=$(out)/etc"
     "BASHCOMPLETIONDIR=$out/share/bash-completion/completions"
     "LOCALEDIR=$(out)/share/locale"
diff --git a/pkgs/os-specific/linux/pommed-light/default.nix b/pkgs/os-specific/linux/pommed-light/default.nix
index 0797656f653..113cedfab2e 100644
--- a/pkgs/os-specific/linux/pommed-light/default.nix
+++ b/pkgs/os-specific/linux/pommed-light/default.nix
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , pciutils
 , libconfuse
 , alsa-lib
@@ -10,17 +11,26 @@
 }:
 
 stdenv.mkDerivation rec {
-  pkgname = "pommed-light";
+  pname = "pommed-light";
   version = "1.51lw";
-  name = "${pkgname}-${version}";
 
   src = fetchFromGitHub {
     owner = "bytbox";
-    repo = pkgname;
+    repo = "pommed-light";
     rev = "v${version}";
     sha256 = "18fvdwwhcl6s4bpf2f2i389s71c8k4g0yb81am9rdddqmzaw27iy";
   };
 
+  patches = [
+    # Pull fix pending upstream inclusion for -fno-common toolchain support:
+    #   https://github.com/bytbox/pommed-light/pull/38
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/bytbox/pommed-light/commit/5848b49b45a9c3ab047ebd17deb2162daab1e0b8.patch";
+      sha256 = "15rsq2i4rqp4ssab20486a1wgxi2cp87b7nxyk9h23gdwld713vf";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace pommed.conf.mactel --replace /usr $out
     substituteInPlace pommed.conf.pmac --replace /usr $out
diff --git a/pkgs/os-specific/linux/power-calibrate/default.nix b/pkgs/os-specific/linux/power-calibrate/default.nix
index d62990ed4ff..884b2d0e01c 100644
--- a/pkgs/os-specific/linux/power-calibrate/default.nix
+++ b/pkgs/os-specific/linux/power-calibrate/default.nix
@@ -1,22 +1,25 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "power-calibrate";
-  version = "0.01.29";
+  version = "0.01.34";
 
-  src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1v8wvhjqglkvk9cl2b48lkcwhbc6nsdi3hjd7sap4hyvd6703pgs";
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    hash = "sha256-T2fCTE+snNt1ylOpVR0JfT2x0lWrgItpfjtUx/zjaQw=";
   };
 
   installFlags = [
     "BINDIR=${placeholder "out"}/bin"
     "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
   meta = with lib; {
     description = "Tool to calibrate power consumption";
-    homepage = "https://kernel.ubuntu.com/~cking/power-calibrate/";
+    homepage = "https://github.com/ColinIanKing/power-calibrate";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ dtzWill ];
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index 03267b8e9ae..e81f42b65a2 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -2,10 +2,14 @@
 , lib
 , pkg-config
 , meson
+, mesonEmulatorHook
 , ninja
 , fetchFromGitLab
+, fetchpatch
 , libgudev
 , glib
+, polkit
+, dbus
 , gobject-introspection
 , gettext
 , gtk-doc
@@ -14,13 +18,16 @@
 , libxml2
 , libxslt
 , upower
+, umockdev
 , systemd
 , python3
+, wrapGAppsNoGuiHook
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
   pname = "power-profiles-daemon";
-  version = "0.8.1";
+  version = "0.13";
 
   outputs = [ "out" "devdoc" ];
 
@@ -29,7 +36,7 @@ stdenv.mkDerivation rec {
     owner = "hadess";
     repo = "power-profiles-daemon";
     rev = version;
-    sha256 = "sha256-OnCUr7KWVPpYGDseBUcJD/PdOobvFnyNA97NhnKbTKY=";
+    sha256 = "sha256-ErHy+shxZQ/aCryGhovmJ6KmAMt9OZeQGDbHIkC0vUE=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +50,16 @@ stdenv.mkDerivation rec {
     libxml2 # for xmllint for stripping GResources
     libxslt # for xsltproc for building docs
     gobject-introspection
+    wrapGAppsNoGuiHook
+    python3.pkgs.wrapPython
+    # checkInput but cheked for during the configuring
+    (python3.pythonOnBuildForHost.withPackages (ps: with ps; [
+      pygobject3
+      dbus-python
+      python-dbusmock
+    ]))
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
@@ -50,14 +67,62 @@ stdenv.mkDerivation rec {
     systemd
     upower
     glib
-    (python3.withPackages (ps: with ps; [ ps.pygobject3 ])) # for cli tool
+    polkit
+    python3 # for cli tool
+    # Duplicate from nativeCheckInputs until https://github.com/NixOS/nixpkgs/issues/161570 is solved
+    umockdev
+  ];
+
+  strictDeps = true;
+
+  # for cli tool
+  pythonPath = [
+    python3.pkgs.pygobject3
+  ];
+
+  nativeCheckInputs = [
+    umockdev
+    dbus
   ];
 
   mesonFlags = [
     "-Dsystemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
     "-Dgtk_doc=true"
+    "-Dtests=${lib.boolToString (stdenv.buildPlatform.canExecute stdenv.hostPlatform)}"
   ];
 
+  doCheck = true;
+
+  PKG_CONFIG_POLKIT_GOBJECT_1_POLICYDIR = "${placeholder "out"}/share/polkit-1/actions";
+
+  # Avoid double wrapping
+  dontWrapGApps = true;
+
+  postPatch = ''
+    patchShebangs --build \
+      tests/integration-test.py \
+      tests/unittest_inspector.py
+  '';
+
+  postCheck = ''
+    # Do not contaminate the wrapper with test dependencies.
+    unset GI_TYPELIB_PATH
+    unset XDG_DATA_DIRS
+  '';
+
+  postFixup = ''
+    # Avoid double wrapping
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    # Make Python libraries available
+    wrapPythonProgramsIn "$out/bin" "$pythonPath"
+  '';
+
+  passthru = {
+    tests = {
+      nixos = nixosTests.power-profiles-daemon;
+    };
+  };
+
   meta = with lib; {
     homepage = "https://gitlab.freedesktop.org/hadess/power-profiles-daemon";
     description = "Makes user-selected power profiles handling available over D-Bus";
diff --git a/pkgs/os-specific/linux/powercap/default.nix b/pkgs/os-specific/linux/powercap/default.nix
index ad9de9f75d5..e705b6a3485 100644
--- a/pkgs/os-specific/linux/powercap/default.nix
+++ b/pkgs/os-specific/linux/powercap/default.nix
@@ -1,16 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "powercap";
-  version = "0.3.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "powercap";
     repo = "powercap";
     rev = "v${version}";
-    sha256 = "0f1sg1zsskcfralg9khwq7lmz25gvnyknza3bb0hmh1a9lw0jhdn";
+    sha256 = "sha256-l+IpFqBnCYUU825++sUPySD/Ku0TEIX2kt+S0Wml6iA=";
   };
 
+  # in master post 0.6.0, see https://github.com/powercap/powercap/issues/8
+  patches = [
+    (fetchpatch {
+      name = "fix-pkg-config.patch";
+      url = "https://github.com/powercap/powercap/commit/278dceb51635686e343edfc357b6020533fff299.patch";
+      sha256 = "0h62j63xdn0iqyx4xbia6hlmdjn45camb82z4vv6sb37x9sph7rg";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
diff --git a/pkgs/os-specific/linux/powerstat/default.nix b/pkgs/os-specific/linux/powerstat/default.nix
index f80b7425cd4..901a522fe8f 100644
--- a/pkgs/os-specific/linux/powerstat/default.nix
+++ b/pkgs/os-specific/linux/powerstat/default.nix
@@ -1,24 +1,25 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "powerstat";
-  version = "0.02.25";
+  version = "0.03.03";
 
-  src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-C6MCOXnElDI69QkLKd2X2SLved8cRCN0Q6BhUvvqsTY=";
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    hash = "sha256-D8VwczXHUHQ8p03IgYW3t8hOIGHKp0n1c7FpAUWua74=";
   };
 
-  installFlags = [ "DESTDIR=${placeholder "out"}" ];
-
-  postInstall = ''
-    mv $out/usr/* $out
-    rm -r $out/usr
-  '';
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
+  ];
 
   meta = with lib; {
     description = "Laptop power measuring tool";
-    homepage = "https://kernel.ubuntu.com/~cking/powerstat/";
+    homepage = "https://github.com/ColinIanKing/powerstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ womfoo ];
diff --git a/pkgs/os-specific/linux/powertop/default.nix b/pkgs/os-specific/linux/powertop/default.nix
index 79594a87c51..481cf1cd3bb 100644
--- a/pkgs/os-specific/linux/powertop/default.nix
+++ b/pkgs/os-specific/linux/powertop/default.nix
@@ -1,43 +1,57 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, gettext, libnl, ncurses, pciutils
-, pkg-config, zlib, autoreconfHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gettext
+, libnl
+, ncurses
+, pciutils
+, pkg-config
+, zlib
+, autoreconfHook
+, autoconf-archive
+, nix-update-script
+, testers
+, powertop
+, xorg
+}:
 
 stdenv.mkDerivation rec {
   pname = "powertop";
-  version = "2.14";
+  version = "2.15";
 
   src = fetchFromGitHub {
     owner = "fenrus75";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1zkr2y5nb1nr22nq8a3zli87iyfasfq6489p7h1k428pv8k45w4f";
+    hash = "sha256-53jfqt0dtMqMj3W3m6ravUTzApLQcljDHfdXejeZa4M=";
   };
 
   outputs = [ "out" "man" ];
 
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  nativeBuildInputs = [ pkg-config autoreconfHook autoconf-archive ];
   buildInputs = [ gettext libnl ncurses pciutils zlib ];
 
-  patches = lib.optional stdenv.hostPlatform.isMusl (
-    fetchpatch {
-      name = "strerror_r.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/powertop/strerror_r.patch?id=3b9214d436f1611f297b01f72469d66bfe729d6e";
-      sha256 = "1kzddhcrb0n2iah4lhgxwwy4mkhq09ch25jjngyq6pdj6pmfkpfw";
-    }
-  );
-
-  NIX_LDFLAGS = [ "-lpthread" ];
-
   postPatch = ''
     substituteInPlace src/main.cpp --replace "/sbin/modprobe" "modprobe"
-    substituteInPlace src/calibrate/calibrate.cpp --replace "/usr/bin/xset" "xset"
+    substituteInPlace src/calibrate/calibrate.cpp --replace "/usr/bin/xset" "${lib.getExe xorg.xset}"
     substituteInPlace src/tuning/bluetooth.cpp --replace "/usr/bin/hcitool" "hcitool"
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = powertop;
+      command = "powertop --version";
+      inherit version;
+    };
+  };
+
   meta = with lib; {
+    inherit (src.meta) homepage;
+    changelog = "https://github.com/fenrus75/powertop/releases/tag/v${version}";
     description = "Analyze power consumption on Intel-based laptops";
-    homepage = "https://01.org/powertop";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ fpletz ];
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ fpletz anthonyroussel ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/pps-tools/default.nix b/pkgs/os-specific/linux/pps-tools/default.nix
index 146c9457ed3..66754e5148e 100644
--- a/pkgs/os-specific/linux/pps-tools/default.nix
+++ b/pkgs/os-specific/linux/pps-tools/default.nix
@@ -1,15 +1,14 @@
 { lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  baseName = "pps-tools";
-  version = "1.0.2";
-  name = "${baseName}-${version}";
+  pname = "pps-tools";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "redlab-i";
-    repo = baseName;
+    repo = pname;
     rev = "v${version}";
-    sha256 = "1yh9g0l59dkq4ci0wbb03qin3c3cizfngmn9jy1vwm5zm6axlxhf";
+    sha256 = "sha256-eLLFHrCgOQzOtVxlAsZ5X91KK+vZiKMGL7zbQFiIZtI=";
   };
 
   outputs = [ "out" "dev" ];
@@ -24,7 +23,7 @@ stdenv.mkDerivation rec {
     rm -rf $out/usr/
   '';
 
-  meta = with lib;{
+  meta = with lib; {
     description = "User-space tools for LinuxPPS";
     homepage = "http://linuxpps.org/";
     license = licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 431e0ed58b1..314a95bd554 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -1,168 +1,176 @@
-{ stdenv, lib, makeWrapper, p7zip
-, gawk, util-linux, xorg, glib, dbus-glib, zlib
-, kernel ? null, libsOnly ? false
-, undmg, fetchurl
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, bbe
+, makeWrapper
+, p7zip
+, perl
+, undmg
+, dbus-glib
+, glib
+, xorg
+, zlib
+, kernel
+, bash
+, cups
+, gawk
+, netcat
+, timetrap
+, util-linux
 }:
 
-assert (!libsOnly) -> kernel != null;
-
-let xorgFullVer = lib.getVersion xorg.xorgserver;
-    xorgVer = lib.versions.majorMinor xorgFullVer;
-    x64 = if stdenv.hostPlatform.system == "x86_64-linux" then true
-          else if stdenv.hostPlatform.system == "i686-linux" then false
-          else throw "Parallels Tools for Linux only support {x86-64,i686}-linux targets";
+let
+  kernelVersion = kernel.modDirVersion;
+  kernelDir = "${kernel.dev}/lib/modules/${kernelVersion}";
+
+  libPath = lib.concatStringsSep ":" [ "${glib.out}/lib" "${xorg.libXrandr}/lib" ];
+  scriptPath = lib.concatStringsSep ":" [
+    "${bash}/bin"
+    "${cups}/sbin"
+    "${gawk}/bin"
+    "${netcat}/bin"
+    "${timetrap}/bin"
+    "${util-linux}/bin"
+  ];
 in
-stdenv.mkDerivation rec {
-  version = "${prl_major}.2.1-41615";
-  prl_major = "12";
+stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
+  version = "19.1.1-54734";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
-    url =  "https://download.parallels.com/desktop/v${prl_major}/${version}/ParallelsDesktop-${version}.dmg";
-    sha256 = "1jwzwif69qlhmfky9kigjaxpxfj0lyrl1iyrpqy4iwqvajdgbbym";
+    url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
+    hash = "sha256-02YxBkV9pZGfXuK6GvUDTgE9U5H2MOMk24h9qGJdFTM=";
   };
 
   hardeningDisable = [ "pic" "format" ];
 
-  # also maybe python2 to generate xorg.conf
-  nativeBuildInputs = [ p7zip undmg ] ++ lib.optionals (!libsOnly) [ makeWrapper ] ++ kernel.moduleBuildDependencies;
-
-  inherit libsOnly;
+  nativeBuildInputs = [
+    autoPatchelfHook
+    bbe
+    makeWrapper
+    p7zip
+    perl
+    undmg
+  ] ++ kernel.moduleBuildDependencies;
+
+  buildInputs = [
+    dbus-glib
+    glib
+    xorg.libX11
+    xorg.libXcomposite
+    xorg.libXext
+    xorg.libXrandr
+    xorg.libXi
+    xorg.libXinerama
+    zlib
+  ];
+
+  runtimeDependencies = [
+    glib
+    xorg.libXrandr
+  ];
 
   unpackPhase = ''
-    undmg < "${src}"
+    runHook preUnpack
 
+    undmg $src
     export sourceRoot=prl-tools-build
-    7z x "Parallels Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso" -o$sourceRoot
-    if test -z "$libsOnly"; then
-      ( cd $sourceRoot/kmods; tar -xaf prl_mod.tar.gz )
-    fi
-    ( cd $sourceRoot/tools; tar -xaf prltools${if x64 then ".x64" else ""}.tar.gz )
-  '';
+    7z x "Parallels Desktop.app/Contents/Resources/Tools/prl-tools-lin${lib.optionalString stdenv.isAarch64 "-arm"}.iso" -o$sourceRoot
+    ( cd $sourceRoot/kmods; tar -xaf prl_mod.tar.gz )
 
-  kernelVersion = if libsOnly then "" else lib.getName kernel.name;
-  kernelDir = if libsOnly then "" else "${kernel.dev}/lib/modules/${kernelVersion}";
-  scriptPath = lib.concatStringsSep ":" (lib.optionals (!libsOnly) [ "${util-linux}/bin" "${gawk}/bin" ]);
-
-  buildPhase = ''
-    if test -z "$libsOnly"; then
-      ( # kernel modules
-        cd kmods
-        make -f Makefile.kmods \
-          KSRC=$kernelDir/source \
-          HEADERS_CHECK_DIR=$kernelDir/source \
-          KERNEL_DIR=$kernelDir/build \
-          SRC=$kernelDir/build \
-          KVER=$kernelVersion
-      )
-
-      # Xorg config (maybe would be useful for other versions)
-      #python2 installer/xserver-config.py xorg ${xorgVer} /dev/null parallels.conf
-    fi
+    runHook postUnpack
   '';
 
-  libPath = with xorg;
-            lib.makeLibraryPath ([ stdenv.cc.cc libXrandr libXext libX11 libXcomposite libXinerama ]
-            ++ lib.optionals (!libsOnly) [ libXi glib dbus-glib zlib ]);
+  buildPhase = ''
+    runHook preBuild
+
+    ( # kernel modules
+      cd kmods
+      make -f Makefile.kmods \
+        KSRC=${kernelDir}/source \
+        HEADERS_CHECK_DIR=${kernelDir}/source \
+        KERNEL_DIR=${kernelDir}/build \
+        SRC=${kernelDir}/build \
+        KVER=${kernelVersion}
+    )
 
+    runHook postBuild
+  '';
 
   installPhase = ''
-    if test -z "$libsOnly"; then
-      ( # kernel modules
-        cd kmods
-        mkdir -p $out/lib/modules/${kernelVersion}/extra
-        cp prl_eth/pvmnet/prl_eth.ko $out/lib/modules/${kernelVersion}/extra
-        cp prl_tg/Toolgate/Guest/Linux/prl_tg/prl_tg.ko $out/lib/modules/${kernelVersion}/extra
-        cp prl_fs/SharedFolders/Guest/Linux/prl_fs/prl_fs.ko $out/lib/modules/${kernelVersion}/extra
-        cp prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.ko $out/lib/modules/${kernelVersion}/extra
-      )
-    fi
+    runHook preInstall
+
+    ( # kernel modules
+      cd kmods
+      mkdir -p $out/lib/modules/${kernelVersion}/extra
+      cp prl_fs/SharedFolders/Guest/Linux/prl_fs/prl_fs.ko $out/lib/modules/${kernelVersion}/extra
+      cp prl_fs_freeze/Snapshot/Guest/Linux/prl_freeze/prl_fs_freeze.ko $out/lib/modules/${kernelVersion}/extra
+      cp prl_tg/Toolgate/Guest/Linux/prl_tg/prl_tg.ko $out/lib/modules/${kernelVersion}/extra
+      ${lib.optionalString stdenv.isAarch64
+      "cp prl_notifier/Installation/lnx/prl_notifier/prl_notifier.ko $out/lib/modules/${kernelVersion}/extra"}
+    )
 
     ( # tools
-      cd tools
+      cd tools/tools${if stdenv.isAarch64 then "-arm64" else if stdenv.isx86_64 then "64" else "32"}
       mkdir -p $out/lib
 
-      if test -z "$libsOnly"; then
-        # install binaries
-        for i in bin/* sbin/prl_nettool sbin/prl_snapshot; do
-          install -Dm755 $i $out/$i
-        done
-        # other binaries
-        for i in xorg.7.1/usr/bin/*; do
-          cp $i $out/bin
-        done
-
-        for i in $out/bin/* $out/sbin/*; do
-          patchelf \
-            --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-            --set-rpath "$out/lib:$libPath" \
-            $i || true
-        done
-
-        mkdir -p $out/bin
-        install -Dm755 ../installer/prlfsmountd.sh $out/sbin/prlfsmountd
-        wrapProgram $out/sbin/prlfsmountd \
-          --prefix PATH ':' "$scriptPath"
-
-        for i in lib/*.a; do
-          cp $i $out/lib
+      # prltoolsd contains hardcoded /bin/bash path
+      # we're lucky because it uses only -c command
+      # => replace to /bin/sh
+      bbe -e "s:/bin/bash:/bin/sh\x00\x00:" -o bin/prltoolsd.tmp bin/prltoolsd
+      rm -f bin/prltoolsd
+      mv bin/prltoolsd.tmp bin/prltoolsd
+
+      # install binaries
+      for i in bin/* sbin/prl_nettool sbin/prl_snapshot; do
+        # also patch binaries to replace /usr/bin/XXX to XXX
+        # here a two possible cases:
+        # 1. it is uses as null terminated string and should be truncated by null;
+        # 2. it is uses inside shell script and should be truncated by space.
+        for p in bin/* sbin/prl_nettool sbin/prl_snapshot sbin/prlfsmountd; do
+          p=$(basename $p)
+          bbe -e "s:/usr/bin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00:" -o $i.tmp $i
+          bbe -e "s:/usr/sbin/$p\x00:./$p\x00\x00\x00\x00\x00\x00\x00\x00 :" -o $i $i.tmp
+          bbe -e "s:/usr/bin/$p:$p         :" -o $i.tmp $i
+          bbe -e "s:/usr/sbin/$p:$p          :" -o $i $i.tmp
         done
 
-        for i in xorg.7.1/usr/lib/libprl_wmouse_watcher.*; do
-          cp $i $out/lib
-        done
+        install -Dm755 $i $out/$i
+      done
 
-        mkdir -p $out/lib/udev/rules.d
-        for i in *.rules; do
-          sed 's,/bin/bash,${stdenv.shell},g' $i > $out/lib/udev/rules.d/$i
-        done
+      install -Dm755 ../../tools/prlfsmountd.sh $out/sbin/prlfsmountd
+      for f in $out/bin/* $out/sbin/*; do
+        wrapProgram $f \
+          --prefix LD_LIBRARY_PATH ':' "${libPath}" \
+          --prefix PATH ':' "${scriptPath}"
+      done
 
-        (
-          cd xorg.${xorgVer}
-          # Install the X modules.
-          (
-            cd x-server/modules
-            for i in */*; do
-              install -Dm755 $i $out/lib/xorg/modules/$i
-            done
-          )
-          (
-            cd usr/lib
-            libGLXname=$(echo libglx.so*)
-            install -Dm755 $libGLXname $out/lib/xorg/modules/extensions/$libGLXname
-            ln -s $libGLXname $out/lib/xorg/modules/extensions/libglx.so
-            ln -s $libGLXname $out/lib/xorg/modules/extensions/libglx.so.1
-          )
-        )
-      fi
-
-      for i in xorg.7.1/usr/lib/libGL.*; do
+      for i in lib/libPrl*.0.0; do
         cp $i $out/lib
+        ln -s $out/$i $out/''${i%.0.0}
       done
 
-      cd $out
-      find -name \*.so\* -type f -exec \
-        patchelf --set-rpath "$out/lib:$libPath" {} \;
+      mkdir -p $out/share/man/man8
+      install -Dm644 ../mount.prl_fs.8 $out/share/man/man8
+
+      substituteInPlace ../99prltoolsd-hibernate \
+        --replace "/bin/bash" "${bash}/bin/bash"
 
-      cd lib
-      libGLname=$(echo libGL.so*)
-      ln -s $libGLname libGL.so
-      ln -s $libGLname libGL.so.1
+      mkdir -p $out/etc/pm/sleep.d
+      install -Dm644 ../99prltoolsd-hibernate $out/etc/pm/sleep.d
     )
-  '';
 
-  dontStrip = true;
-  dontPatchELF = true;
+    runHook postInstall
+  '';
 
   meta = with lib; {
     description = "Parallels Tools for Linux guests";
     homepage = "https://parallels.com";
-    platforms = [ "i686-linux" "x86_64-linux" ];
     license = licenses.unfree;
-    # I was making this package blindly and requesting testing from the real user,
-    # so I can't even test it by myself and won't provide future updates.
-    maintainers = with maintainers; [ abbradar ];
+    maintainers = with maintainers; [ catap wegank ];
+    platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/procdump/default.nix b/pkgs/os-specific/linux/procdump/default.nix
index 75ca2cb165e..05ec4b90ed7 100644
--- a/pkgs/os-specific/linux/procdump/default.nix
+++ b/pkgs/os-specific/linux/procdump/default.nix
@@ -1,16 +1,26 @@
-{ lib, stdenv, fetchFromGitHub, bash, coreutils, gdb, zlib }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, bash, coreutils, gdb, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "procdump";
-  version = "1.1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "ProcDump-for-Linux";
     rev = version;
-    sha256 = "0h5fhk39d10kjbinzw1yp6nr8w8l300mn9qxrkpivdkyfn6bpq2f";
+    sha256 = "sha256-gVswAezHl7E2cBTJEQhPFXhHkzhWVHSpPF8m0s8+ekc=";
   };
 
+  patches = [
+    # Pull upstream patch to fix parallel builds:
+    #  https://github.com/Sysinternals/ProcDump-for-Linux/pull/133
+    (fetchpatch {
+      name = "parallel.patch";
+      url = "https://github.com/Sysinternals/ProcDump-for-Linux/commit/0d735836f11281cc6134be93eac8acb302f2055e.patch";
+      sha256 = "sha256-zsqllPHF8ZuXAIDSAPvbzdKa43uSSx9ilUKM1vFVW90=";
+    })
+  ];
+
   nativeBuildInputs = [ zlib ];
   buildInputs = [ bash coreutils gdb ];
 
@@ -27,6 +37,8 @@ stdenv.mkDerivation rec {
     "MANDIR=/share/man/man1"
   ];
 
+  enableParallelBuilding = true;
+
   doCheck = false; # needs sudo root
 
   doInstallCheck = true;
diff --git a/pkgs/os-specific/linux/procps-ng/default.nix b/pkgs/os-specific/linux/procps-ng/default.nix
index 1d19d915117..56a92ffa44e 100644
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@@ -1,13 +1,13 @@
 { lib
 , stdenv
 , fetchurl
-, fetchpatch
 , ncurses
 , pkg-config
+, fetchpatch
 
   # `ps` with systemd support is able to properly report different
   # attributes like unit name, so we want to have it on linux.
-, withSystemd ? stdenv.isLinux
+, withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd
 , systemd
 
   # procps is mostly Linux-only. Most commands require a running Linux
@@ -19,19 +19,23 @@
 
 stdenv.mkDerivation rec {
   pname = "procps";
-  version = "3.3.16";
+  version = "3.3.17";
 
   # The project's releases are on SF, but git repo on gitlab.
   src = fetchurl {
     url = "mirror://sourceforge/procps-ng/procps-ng-${version}.tar.xz";
-    sha256 = "1br0g93ysqhlv13i1k4lfbimsgxnpy5rgs4lxfc9rkzdbpbaqplj";
+    sha256 = "sha256-RRiz56r9NOwH0AY9JQ/UdJmbILIAIYw65W9dIRPxQbQ=";
   };
 
   patches = [
+    ./v3-CVE-2023-4016.patch
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    # NOTE: Starting from 4.x we will not need a patch anymore, but need to add
+    # "--disable-w" to configureFlags instead to prevent the utmp errors
     (fetchpatch {
-      url = "https://gitlab.com/procps-ng/procps/-/commit/bb96fc42956c9ed926a1b958ab715f8b4a663dec.diff";
-      sha256 = "0fzsb6ns3fvrszyzsz28qvbmcn135ilr4nwh2z1a0vlpl2fw961z";
-      name = "sysconf-argmax-sanity.patch";
+      name = "musl-fix-includes.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/procps/musl-fixes.patch?id=37cb5b6ef194db66d9ed07c8ecab59bca3b91215";
+      sha256 = "sha256-DphAvESmVg1U3bJABU95R++QD34odStCl82EF0vmht0=";
     })
   ];
 
diff --git a/pkgs/os-specific/linux/procps-ng/v3-CVE-2023-4016.patch b/pkgs/os-specific/linux/procps-ng/v3-CVE-2023-4016.patch
new file mode 100644
index 00000000000..2e260eaf738
--- /dev/null
+++ b/pkgs/os-specific/linux/procps-ng/v3-CVE-2023-4016.patch
@@ -0,0 +1,63 @@
+This is https://gitlab.com/procps-ng/procps/-/commit/2c933ecba3bb1d3041a5a7a53a7b4078a6003413.diff
+back-ported to procps 3.3.17.  That commit changes xmalloc to xcalloc.  This patch differs in two ways:
+
+* We modify it to change malloc (no x-) to xcalloc instead
+* We pull in procps-4's definition of xcalloc
+
+Alternative considered: Also pull in commits that changed malloc to xmalloc and defined xcalloc.
+This alternative is rejected because those commits contain many other unrelated changes.
+
+diff --git a/ps/parser.c b/ps/parser.c
+index 4263a1fb..ee9a57d9 100644
+--- a/ps/parser.c
++++ b/ps/parser.c
+@@ -36,6 +36,14 @@
+ #include "common.h"
+ #include "c.h"
+ 
++static void *xxcalloc(const size_t nelems, const size_t size)
++{
++  void *ret = calloc(nelems, size);
++  if (!ret && size && nelems)
++    xerrx(EXIT_FAILURE, "cannot allocate %zu bytes", nelems*size);
++  return ret;
++}
++
+ #define ARG_GNU  0
+ #define ARG_END  1
+ #define ARG_PGRP 2
+@@ -184,7 +192,6 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s
+   const char *err;       /* error code that could or did happen */
+   /*** prepare to operate ***/
+   node = malloc(sizeof(selection_node));
+-  node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */
+   node->n = 0;
+   buf = strdup(arg);
+   /*** sanity check and count items ***/
+@@ -205,6 +212,7 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s
+   } while (*++walk);
+   if(need_item) goto parse_error;
+   node->n = items;
++  node->u = xxcalloc(items, sizeof(sel_union));
+   /*** actually parse the list ***/
+   walk = buf;
+   while(items--){
+@@ -1031,15 +1039,15 @@ static const char *parse_trailing_pids(void){
+   thisarg = ps_argc - 1;   /* we must be at the end now */
+ 
+   pidnode = malloc(sizeof(selection_node));
+-  pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
++  pidnode->u = xxcalloc(i, sizeof(sel_union)); /* waste is insignificant */
+   pidnode->n = 0;
+ 
+   grpnode = malloc(sizeof(selection_node));
+-  grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
++  grpnode->u = xxcalloc(i, sizeof(sel_union)); /* waste is insignificant */
+   grpnode->n = 0;
+ 
+   sidnode = malloc(sizeof(selection_node));
+-  sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
++  sidnode->u = xxcalloc(i, sizeof(sel_union)); /* waste is insignificant */
+   sidnode->n = 0;
+ 
+   while(i--){
diff --git a/pkgs/os-specific/linux/projecteur/default.nix b/pkgs/os-specific/linux/projecteur/default.nix
new file mode 100644
index 00000000000..0477985cc19
--- /dev/null
+++ b/pkgs/os-specific/linux/projecteur/default.nix
@@ -0,0 +1,52 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, pkg-config
+, qtbase
+, qtgraphicaleffects
+, wrapQtAppsHook
+}:
+
+mkDerivation rec {
+  pname = "projecteur";
+  version = "0.10";
+
+  src = fetchFromGitHub {
+    owner = "jahnf";
+    repo = "Projecteur";
+    rev = "v${version}";
+    fetchSubmodules = false;
+    hash = "sha256-F7o93rBjrDTmArTIz8RB/uGBOYE6ny/U7ppk+jEhM5A=";
+  };
+
+  postPatch = ''
+    sed '1i#include <array>' -i src/device.h # gcc12
+  '';
+
+  buildInputs = [
+    qtbase
+    qtgraphicaleffects
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_PREFIX:PATH=${placeholder "out"}"
+    "-DPACKAGE_TARGETS=OFF"
+    "-DCMAKE_INSTALL_UDEVRULESDIR=${placeholder "out"}/lib/udev/rules.d"
+  ];
+
+  meta = {
+    description = "Linux/X11 application for the Logitech Spotlight device (and similar devices).";
+    homepage = "https://github.com/jahnf/Projecteur";
+    license = lib.licenses.mit;
+    mainProgram = "projecteur";
+    maintainers = with lib.maintainers; [ benneti drupol ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/pscircle/default.nix b/pkgs/os-specific/linux/pscircle/default.nix
index ef7dbc55a9a..a7ee92beb52 100644
--- a/pkgs/os-specific/linux/pscircle/default.nix
+++ b/pkgs/os-specific/linux/pscircle/default.nix
@@ -2,20 +2,23 @@
 
 stdenv.mkDerivation rec {
   pname = "pscircle";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     owner = "mildlyparallel";
     repo = "pscircle";
     rev = "v${version}";
-    sha256 = "1sm99423hh90kr4wdjqi9sdrrpk65j2vz2hzj65zcxfxyr6khjci";
+    sha256 = "sha256-bqbQBNscNfoqXprhoFUnUQO88YQs9xDhD4d3KHamtG0=";
   };
 
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    ninja
+  ];
+
   buildInputs = [
-      meson
-      pkg-config
-      cairo
-      ninja
+    cairo
   ];
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/psftools/default.nix b/pkgs/os-specific/linux/psftools/default.nix
index f7bcc2fd6ad..5d8c39bb145 100644
--- a/pkgs/os-specific/linux/psftools/default.nix
+++ b/pkgs/os-specific/linux/psftools/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl }:
 stdenv.mkDerivation rec {
   pname = "psftools";
-  version = "1.0.14";
+  version = "1.1.1";
   src = fetchurl {
     url = "https://www.seasip.info/Unix/PSF/${pname}-${version}.tar.gz";
-    sha256 = "17nia5n5rabbh42gz51c8y53rjwddria4j3wvzk8dd0llj7k1y6w";
+    sha256 = "sha256-MecY4JsIXTgHdkrFkQ+C3fC6OEFRUgjUgf7qxfKeZtM=";
   };
   outputs = ["out" "man" "dev" "lib"];
 
diff --git a/pkgs/os-specific/linux/psmisc/default.nix b/pkgs/os-specific/linux/psmisc/default.nix
index 4cf3e1f7dd1..f269c9146df 100644
--- a/pkgs/os-specific/linux/psmisc/default.nix
+++ b/pkgs/os-specific/linux/psmisc/default.nix
@@ -1,14 +1,21 @@
-{lib, stdenv, fetchFromGitLab, autoconf, automake, gettext, ncurses}:
+{ lib
+, stdenv
+, fetchFromGitLab
+, autoconf
+, automake
+, gettext
+, ncurses
+}:
 
 stdenv.mkDerivation rec {
   pname = "psmisc";
-  version = "23.4";
+  version = "23.6";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-s7omgtsNooYqhr4JUTZ6WCtPaZVC1ujJGz6KxUBWIs8=";
+    hash = "sha256-TjnOn8a7HAgt11zcM0i5DM5ERmsvLJHvo1e5FOsl6IA=";
   };
 
   nativeBuildInputs = [ autoconf automake gettext ];
diff --git a/pkgs/os-specific/linux/qc71_laptop/default.nix b/pkgs/os-specific/linux/qc71_laptop/default.nix
new file mode 100644
index 00000000000..bb4bf20ad0f
--- /dev/null
+++ b/pkgs/os-specific/linux/qc71_laptop/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "qc71_laptop";
+  version = "unstable-2023-03-02";
+
+  src = fetchFromGitHub {
+    owner = "pobrn";
+    repo = "qc71_laptop";
+    rev = "8805dc5639f6659addf153a295ad4bbaa2483fa3";
+    hash = "sha256-wg7APGArjrl9DEAHTG6BknOBx+UbtNrzziwmLueKPfA=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernel.makeFlags ++ [
+    "VERSION=${version}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D qc71_laptop.ko -t $out/lib/modules/${kernel.modDirVersion}/extra
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Linux driver for QC71 laptop";
+    homepage = "https://github.com/pobrn/qc71_laptop/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ aacebedo ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/qmk-udev-rules/default.nix b/pkgs/os-specific/linux/qmk-udev-rules/default.nix
new file mode 100644
index 00000000000..5b627ea9033
--- /dev/null
+++ b/pkgs/os-specific/linux/qmk-udev-rules/default.nix
@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+## Usage
+# In NixOS, simply add this package to services.udev.packages:
+#   services.udev.packages = [ pkgs.qmk-udev-rules ];
+
+stdenv.mkDerivation rec {
+  pname = "qmk-udev-rules";
+  version = "0.22.3";
+
+  src = fetchFromGitHub {
+    owner = "qmk";
+    repo = "qmk_firmware";
+    rev = version;
+    hash = "sha256-HLQxmBlzTdsOAMqfc4taoMM+V2G5novMsbc1drZlNGg=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -D util/udev/50-qmk.rules $out/lib/udev/rules.d/50-qmk.rules
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/qmk/qmk_firmware";
+    description = "Official QMK udev rules list";
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ ekleog ];
+  };
+}
diff --git a/pkgs/os-specific/linux/qperf/default.nix b/pkgs/os-specific/linux/qperf/default.nix
new file mode 100644
index 00000000000..a074cde448d
--- /dev/null
+++ b/pkgs/os-specific/linux/qperf/default.nix
@@ -0,0 +1,43 @@
+{ stdenv, lib
+, fetchFromGitHub, fetchpatch
+, autoconf, automake, perl, rdma-core }:
+
+stdenv.mkDerivation rec {
+  pname = "qperf";
+  version = "0.4.11";
+
+  src = fetchFromGitHub {
+    owner = "linux-rdma";
+    repo = "qperf";
+    rev = "v${version}";
+    hash = "sha256-x9l8xqwMDHlXRZpWt3XiqN5xyCTV5rk8jp/ClRPPECI=";
+  };
+
+  patches = [ (fetchpatch {
+    name = "version-bump.patch";
+    url = "https://github.com/linux-rdma/qperf/commit/34ec57ddb7e5ae1adfcfc8093065dff90b69a275.patch";
+    hash = "sha256-+7ckhUUB+7BG6qRKv0wgyIxkyvll2xjf3Wk1hpRsDo0=";
+  }) ];
+
+  nativeBuildInputs = [ autoconf automake perl rdma-core ];
+  buildInputs = [ rdma-core ];
+
+  postUnpack =  ''
+    patchShebangs .
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+    ./autogen.sh
+    ./configure --prefix=$out
+    runHook postConfigure
+  '';
+
+  meta = with lib; {
+    description = "Measure RDMA and IP performance";
+    homepage = "https://github.com/linux-rdma/qperf";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ edwtjo ];
+  };
+}
diff --git a/pkgs/os-specific/linux/r8125/default.nix b/pkgs/os-specific/linux/r8125/default.nix
index 30f8da7d5f4..4517cb29e75 100644
--- a/pkgs/os-specific/linux/r8125/default.nix
+++ b/pkgs/os-specific/linux/r8125/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   pname = "r8125";
   # On update please verify (using `diff -r`) that the source matches the
   # realtek version.
-  version = "9.004.01";
+  version = "9.011.01";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     owner = "louistakepillz";
     repo = "r8125";
     rev = version;
-    sha256 = "0h2y4mzydhc7var5281bk2jj1knig6i64k11ii4b94az3g9dbq24";
+    sha256 = "sha256-QV1DKkWVtqcnuqgAdJnPpj6Z6ch+lw61zpouXKlyfqQ=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/r8168/default.nix b/pkgs/os-specific/linux/r8168/default.nix
index 91e15db2eeb..69e779dfaa6 100644
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -10,7 +10,7 @@ in stdenv.mkDerivation rec {
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
-  # [1] http://www.realtek.com.tw/downloads/downloadsView.aspx?PFid=5&Level=5&Conn=4&DownTypeID=3
+  # [1] https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-pci-express-software
   # I've verified manually (`diff -r`) that the source code for version 8.046.00
   # is the same as the one available on the realtek website.
   src = fetchFromGitHub {
@@ -27,11 +27,13 @@ in stdenv.mkDerivation rec {
   # avoid using the Makefile directly -- it doesn't understand
   # any kernel but the current.
   # based on the ArchLinux pkgbuild: https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/r8168
+  makeFlags = kernel.makeFlags ++ [
+    "-C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(PWD)/src"
+    "modules"
+  ];
   preBuild = ''
-    makeFlagsArray+=("-C${kernel.dev}/lib/modules/${kernel.modDirVersion}/build")
-    makeFlagsArray+=("M=$PWD/src")
     makeFlagsArray+=("EXTRA_CFLAGS=-DCONFIG_R8168_NAPI -DCONFIG_R8168_VLAN -DCONFIG_ASPM -DENABLE_S5WOL -DENABLE_EEE")
-    makeFlagsArray+=("modules")
   '';
 
   enableParallelBuilding = true;
@@ -52,5 +54,6 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ timokau ];
+    broken = (lib.versions.majorMinor kernel.modDirVersion) != "5.15";
   };
 }
diff --git a/pkgs/os-specific/linux/radeontop/default.nix b/pkgs/os-specific/linux/radeontop/default.nix
index b172fad6adc..9e9cb5845e4 100644
--- a/pkgs/os-specific/linux/radeontop/default.nix
+++ b/pkgs/os-specific/linux/radeontop/default.nix
@@ -3,10 +3,10 @@
 
 stdenv.mkDerivation rec {
   pname = "radeontop";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
-    sha256 = "sha256-tnIxM0+RfOIt714fEUWRP/4rEPHaOuCZFit9/RPdxis=";
+    sha256 = "0kwqddidr45s1blp0h8r8h1dd1p50l516yb6mb4s6zsc827xzgg3";
     rev = "v${version}";
     repo = "radeontop";
     owner = "clbr";
@@ -19,12 +19,13 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''
     substituteInPlace getver.sh --replace ver=unknown ver=${version}
+    substituteInPlace Makefile --replace pkg-config "$PKG_CONFIG"
   '';
 
   makeFlags = [ "PREFIX=$(out)" ];
 
   postInstall = ''
-    wrapProgram $out/sbin/radeontop \
+    wrapProgram $out/bin/radeontop \
       --prefix LD_LIBRARY_PATH : $out/lib
   '';
 
diff --git a/pkgs/os-specific/linux/rasdaemon/default.nix b/pkgs/os-specific/linux/rasdaemon/default.nix
new file mode 100644
index 00000000000..35201d49b7f
--- /dev/null
+++ b/pkgs/os-specific/linux/rasdaemon/default.nix
@@ -0,0 +1,111 @@
+{ lib, stdenv, fetchFromGitHub
+, autoreconfHook
+, glibcLocales, kmod, coreutils, perl
+, dmidecode, hwdata, sqlite
+, nixosTests
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rasdaemon";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "mchehab";
+    repo = "rasdaemon";
+    rev = "v${version}";
+    sha256 = "sha256-oLwR+bNgKceVgLTOLYiKHNUkRmLouaQshdp/8UJnfqg=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [
+    coreutils
+    glibcLocales
+    hwdata
+    kmod
+    sqlite
+    (perl.withPackages (ps: with ps; [ DBI DBDSQLite ]))
+  ]
+  ++ lib.optionals (!stdenv.isAarch64) [ dmidecode ];
+
+  configureFlags = [
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--with-sysconfdefdir=${placeholder "out"}/etc/sysconfig"
+    "--enable-sqlite3"
+    "--enable-aer"
+    "--enable-mce"
+    "--enable-extlog"
+    "--enable-non-standard"
+    "--enable-abrt-report"
+    "--enable-hisi-ns-decode"
+    "--enable-devlink"
+    "--enable-diskerror"
+    "--enable-memory-failure"
+    "--enable-memory-ce-pfa"
+    "--enable-amp-ns-decode"
+  ]
+  ++ lib.optionals (stdenv.isAarch64) [ "--enable-arm" ];
+
+  # The installation attempts to create the following directories:
+  # /var/lib/rasdaemon
+  #   location of the RAS event log generated by rasdaemon -r
+  # /etc/ras/dimm_labels.d
+  #   location of the DIMM labels generated by ras-mc-ctl
+  # /etc/sysconfig/rasdaemon
+  #   location of rasdaemon config file, currently only used for CE PFA config
+
+  # these are optional (for logging, DIMM label storage and user config)
+  # /var/lib/rasdaemon should be created by the NixOS module
+  # /etc/ras/dimm_labels.d should probably be generated,
+  # from user supplied content, in the NixOS module
+  # /etc/sysconfig/rasdaemon should be generated if there is user supplied content
+  # and default to $out/etc/sysconfig/rasdaemon which should hold the supplied default
+
+  # therefore, stripping these from the generated Makefile
+  # (needed in the config flags because those set where the tools look for these)
+
+# easy way out, ends up installing /nix/store/...rasdaemon/bin in $out
+
+  postConfigure = ''
+    substituteInPlace Makefile \
+      --replace '"$(DESTDIR)/etc/ras/dimm_labels.d"' '"$(prefix)/etc/ras/dimm_labels.d"'
+  '';
+
+  outputs = [ "out" "dev" "man" "inject" ];
+
+  postInstall = ''
+    install -Dm 0755 contrib/edac-fake-inject $inject/bin/edac-fake-inject
+    install -Dm 0755 contrib/edac-tests $inject/bin/edac-tests
+  '';
+
+  postFixup = ''
+    # Fix dmidecode and modprobe paths
+    substituteInPlace $out/bin/ras-mc-ctl \
+      --replace 'find_prog ("modprobe")  or exit (1)' '"${kmod}/bin/modprobe"'
+  ''
+  + lib.optionalString (!stdenv.isAarch64) ''
+    substituteInPlace $out/bin/ras-mc-ctl \
+      --replace 'find_prog ("dmidecode")' '"${dmidecode}/bin/dmidecode"'
+  '';
+
+  passthru.tests = nixosTests.rasdaemon;
+
+  meta = with lib; {
+    description = ''
+      A Reliability, Availability and Serviceability (RAS) logging tool using EDAC kernel tracing events
+    '';
+    longDescription = ''
+      Rasdaemon is a RAS (Reliability, Availability and Serviceability) logging
+      tool. It records memory errors, using the EDAC tracing events. EDAC is a
+      Linux kernel subsystem with handles detection of ECC errors from memory
+      controllers for most chipsets on i386 and x86_64 architectures. EDAC
+      drivers for other architectures like arm also exists.
+    '';
+    homepage = "https://github.com/mchehab/rasdaemon";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    changelog = "https://github.com/mchehab/rasdaemon/blob/v${version}/ChangeLog";
+    maintainers = with maintainers; [ evils ];
+  };
+}
diff --git a/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix b/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
index 5113d3c1070..6a429a77c57 100644
--- a/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
+++ b/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
@@ -1,15 +1,15 @@
 { stdenvNoCC, lib, fetchFromGitHub, makeWrapper
-, python3, binutils-unwrapped, findutils, kmod, pciutils, libraspberrypi
+, python3, binutils-unwrapped, findutils, gawk, kmod, pciutils, libraspberrypi
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "raspberrypi-eeprom";
-  version = "2021.04.29-138a1";
+  version = "2023.01.11-138c0";
 
   src = fetchFromGitHub {
     owner = "raspberrypi";
     repo = "rpi-eeprom";
     rev = "v${version}";
-    sha256 = "sha256-nzAMPa4gqCAcROFa7z34IoMA3aoMHX9fYCsPFde9dac=";
+    hash = "sha256-z3VyqdSkvxAgVmtMI/Is9qYrOeDXlyVLwHSSC2+AxcA=";
   };
 
   buildInputs = [ python3 ];
@@ -26,24 +26,28 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin $out/share/rpi-eeprom
 
-    cp rpi-eeprom-config rpi-eeprom-update $out/bin
+    cp rpi-eeprom-config rpi-eeprom-update rpi-eeprom-digest $out/bin
     cp -r firmware/{beta,critical,old,stable} $out/share/rpi-eeprom
+    cp -P firmware/default firmware/latest $out/share/rpi-eeprom
   '';
 
   fixupPhase = ''
     patchShebangs $out/bin
-    wrapProgram $out/bin/rpi-eeprom-update \
-      --set FIRMWARE_ROOT $out/share/rpi-eeprom \
-      ${lib.optionalString stdenvNoCC.isAarch64 "--set VCMAILBOX ${libraspberrypi}/bin/vcmailbox"} \
-      --prefix PATH : "${lib.makeBinPath ([
-        binutils-unwrapped
-        findutils
-        kmod
-        pciutils
-        (placeholder "out")
-      ] ++ lib.optionals stdenvNoCC.isAarch64 [
-        libraspberrypi
-      ])}"
+    for i in rpi-eeprom-update rpi-eeprom-config; do
+      wrapProgram $out/bin/$i \
+        --set FIRMWARE_ROOT $out/share/rpi-eeprom \
+        ${lib.optionalString stdenvNoCC.isAarch64 "--set VCMAILBOX ${libraspberrypi}/bin/vcmailbox"} \
+        --prefix PATH : "${lib.makeBinPath ([
+          binutils-unwrapped
+          findutils
+          gawk
+          kmod
+          pciutils
+          (placeholder "out")
+        ] ++ lib.optionals stdenvNoCC.isAarch64 [
+          libraspberrypi
+        ])}"
+    done
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 242a4d03811..e400e5eba7d 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -1,23 +1,48 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, docutils
-, pandoc, ethtool, iproute2, libnl, udev, python3, perl
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, docutils
+, pandoc
+, ethtool
+, iproute2
+, libnl
+, udev
+, python3
+, perl
 } :
 
-let
-  version = "36.0";
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  inherit version;
+  version = "48.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
-    rev = "v${version}";
-    sha256 = "0x3mpwmhln6brwrwix9abdq1bs9zi4qnr3r64vwqk7l6f43mqd30";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-/ltuZ9OiwJJ6CuAd6hqJwo+wETOgZ4UcW50BrjudF+k=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config pandoc docutils ];
-  buildInputs = [ libnl ethtool iproute2 udev python3 perl ];
+  strictDeps = true;
+
+  outputs = [ "out" "man" "dev" ];
+
+  nativeBuildInputs = [
+    cmake
+    docutils
+    pandoc
+    pkg-config
+    python3
+  ];
+
+  buildInputs = [
+    ethtool
+    iproute2
+    libnl
+    perl
+    udev
+  ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_RUNDIR=/run"
@@ -43,11 +68,11 @@ in stdenv.mkDerivation {
     done
   '';
 
-  meta = with lib; {
+  meta = {
     description = "RDMA Core Userspace Libraries and Daemons";
     homepage = "https://github.com/linux-rdma/rdma-core";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ markuskowa ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.markuskowa ];
   };
-}
+})
diff --git a/pkgs/os-specific/linux/read-edid/default.nix b/pkgs/os-specific/linux/read-edid/default.nix
index 24ad0674976..6e040d3cbff 100644
--- a/pkgs/os-specific/linux/read-edid/default.nix
+++ b/pkgs/os-specific/linux/read-edid/default.nix
@@ -9,15 +9,18 @@ stdenv.mkDerivation rec {
     sha256 = "0vqqmwsgh2gchw7qmpqk6idgzcm5rqf2fab84y7gk42v1x2diin7";
   };
 
-  nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optional (stdenv.isi686 || stdenv.isx86_64) libx86;
-
-  cmakeFlags = [ "-DCLASSICBUILD=${if stdenv.isi686 || stdenv.isx86_64 then "ON" else "OFF"}" ];
+  patches = [ ./fno-common.patch ];
 
-  patchPhase = ''
+  postPatch = ''
     substituteInPlace CMakeLists.txt --replace 'COPYING' 'LICENSE'
   '';
 
+  nativeBuildInputs = [ cmake ];
+  buildInputs = lib.optional stdenv.hostPlatform.isx86 libx86;
+
+  cmakeFlags = [ "-DCLASSICBUILD=${if stdenv.hostPlatform.isx86 then "ON" else "OFF"}" ];
+
+
   meta = with lib; {
     description = "Tool for reading and parsing EDID data from monitors";
     homepage = "http://www.polypux.org/projects/read-edid/";
diff --git a/pkgs/os-specific/linux/read-edid/fno-common.patch b/pkgs/os-specific/linux/read-edid/fno-common.patch
new file mode 100644
index 00000000000..336b48b66ad
--- /dev/null
+++ b/pkgs/os-specific/linux/read-edid/fno-common.patch
@@ -0,0 +1,22 @@
+--- a/get-edid/classic.c
++++ b/get-edid/classic.c
+@@ -26,7 +26,7 @@ typedef byte* real_ptr;
+ #define dosmemput(buffer,length,offset) memcpy(offset,buffer,length)
+ 
+ #define display(...) if (quiet == 0) { fprintf(stderr, __VA_ARGS__); }
+-int quiet;
++extern int quiet;
+ 
+ real_ptr far_ptr_to_real_ptr( uint32 farptr )
+ {
+--- a/get-edid/i2c.c
++++ b/get-edid/i2c.c
+@@ -15,7 +15,7 @@
+ 
+ //Ideas (but not too much actual code) taken from i2c-tools. Thanks guys.
+ 
+-int quiet;
++extern int quiet;
+ 
+ #define display(...) if (quiet == 0) { fprintf(stderr, __VA_ARGS__); }
+ 
diff --git a/pkgs/os-specific/linux/reap/default.nix b/pkgs/os-specific/linux/reap/default.nix
new file mode 100644
index 00000000000..fbbabc96c78
--- /dev/null
+++ b/pkgs/os-specific/linux/reap/default.nix
@@ -0,0 +1,27 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "reap";
+  version = "0.3-unreleased";
+
+  src = fetchFromGitHub {
+    owner = "leahneukirchen";
+    repo = "reap";
+    rev = "0e68d09804fb9ec82af37045fb37c2ceefa391d5";
+    hash = "sha256-4Bv7stW5PKcODQanup37YbiUWrEGR6BuSFXibAHmwn0=";
+  };
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  postInstall = ''
+    install -dm755 "$out/share/licenses/reap/"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/leahneukirchen/reap";
+    description = "run process until all its spawned processes are dead ";
+    license = with licenses; [ publicDomain ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.leahneukirchen ];
+  };
+}
diff --git a/pkgs/os-specific/linux/reptyr/default.nix b/pkgs/os-specific/linux/reptyr/default.nix
index 0e635583d64..35516fdf0e6 100644
--- a/pkgs/os-specific/linux/reptyr/default.nix
+++ b/pkgs/os-specific/linux/reptyr/default.nix
@@ -1,29 +1,28 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, python2 }:
+{ stdenv, lib, fetchFromGitHub, python3 }:
 
-stdenv.mkDerivation rec {
-  version = "0.7.0";
+let
+  python = python3.withPackages (p: [ p.pexpect ]);
+in stdenv.mkDerivation rec {
+  version = "0.10.0";
   pname = "reptyr";
 
   src = fetchFromGitHub {
     owner = "nelhage";
     repo = "reptyr";
     rev = "reptyr-${version}";
-    sha256 = "1hnijfz1ab34j2h2cxc3f43rmbclyihgn9x9wxa7jqqgb2xm71hj";
+    sha256 = "sha256-jlO/ykrwGJkgKiPxfRQEX4TSksrbPQhkQs+QddwqaQ4=";
   };
 
-  patches = [
-    # Fix tests hanging
-    (fetchpatch {
-      url = "https://github.com/nelhage/reptyr/commit/bca3070ac0f3888b5d37ee162505be81b3b496ff.patch";
-      sha256 = "0w6rpv9k4a80q0ijzdq5hlpr37ncr284piqjv5agy8diniwlilab";
-    })
-  ];
-
   makeFlags = [ "PREFIX=" "DESTDIR=$(out)" ];
 
-  checkInputs = [ (python2.withPackages (p: [ p.pexpect ])) ];
+  nativeCheckInputs = [ python ];
+
   doCheck = true;
 
+  checkFlags = [
+    "PYTHON_CMD=${python.interpreter}"
+  ];
+
   meta = {
     platforms = [
       "i686-linux"
@@ -34,6 +33,7 @@ stdenv.mkDerivation rec {
       "armv6l-linux"
       "armv7l-linux"
       "aarch64-linux"
+      "riscv64-linux"
     ];
     maintainers = with lib.maintainers; [raskin];
     license = lib.licenses.mit;
diff --git a/pkgs/os-specific/linux/restool/default.nix b/pkgs/os-specific/linux/restool/default.nix
new file mode 100644
index 00000000000..853d9eeb7f3
--- /dev/null
+++ b/pkgs/os-specific/linux/restool/default.nix
@@ -0,0 +1,52 @@
+{ stdenv, lib, fetchFromGitHub, bash, coreutils, dtc, file, gawk, gnugrep, gnused, pandoc, which }:
+
+stdenv.mkDerivation rec {
+  pname = "restool";
+  version = "2.4";
+
+  src = fetchFromGitHub {
+    owner = "nxp-qoriq";
+    repo = "restool";
+    rev = "abd2f5b7181db9d03db9e6ccda0194923b73e9a2";
+    sha256 = "sha256-ryTDyqSy39e8Omf7l8lK4mLWr8jccDhMVPldkVGSQVo=";
+  };
+
+  nativeBuildInputs = [ file pandoc ];
+  buildInputs = [ bash coreutils dtc gawk gnugrep gnused which ];
+
+  enableParallelBuilding = true;
+  makeFlags = [
+    "prefix="
+    "bindir_completion=/share/bash-completion/completions"
+    "DESTDIR=$(out)"
+    "VERSION=${version}"
+  ];
+
+  postPatch = ''
+    # -Werror makes this derivation fragile on compiler version upgrades, patch
+    # it out.
+    sed -i /-Werror/d Makefile
+  '';
+
+  preFixup = ''
+    # wrapProgram interacts badly with the ls-main tool, which relies on the
+    # shell's $0 argument to figure out which operation to run (busybox-style
+    # symlinks). Instead, inject the environment directly into the shell
+    # scripts we need to wrap.
+    for tool in ls-append-dpl ls-debug ls-main; do
+      sed -i "1 a export PATH=\"$out/bin:${lib.makeBinPath buildInputs}:\$PATH\"" $out/bin/$tool
+    done
+  '';
+
+  meta = with lib; {
+    description = "DPAA2 Resource Management Tool";
+    longDescription = ''
+      restool is a user space application providing the ability to dynamically
+      create and manage DPAA2 containers and objects from Linux.
+    '';
+    homepage = "https://github.com/nxp-qoriq/restool";
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ delroth ];
+  };
+}
diff --git a/pkgs/os-specific/linux/rewritefs/default.nix b/pkgs/os-specific/linux/rewritefs/default.nix
index 161db99114b..e78d5f2d164 100644
--- a/pkgs/os-specific/linux/rewritefs/default.nix
+++ b/pkgs/os-specific/linux/rewritefs/default.nix
@@ -1,18 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, fuse, pcre }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, fuse3, pcre }:
 
 stdenv.mkDerivation {
   pname = "rewritefs";
-  version = "2017-08-14";
+  version = "unstable-2021-10-03";
 
   src = fetchFromGitHub {
     owner  = "sloonz";
     repo   = "rewritefs";
-    rev    = "33fb844d8e8ff441a3fc80d2715e8c64f8563d81";
-    sha256 = "15bcxprkxf0xqxljsqhb0jpi7p1vwqcb00sjs7nzrj7vh2p7mqla";
+    rev    = "3a56de8b5a2d44968b8bc3885c7d661d46367306";
+    sha256 = "1w2rik0lhqm3wr68x51zs45gqfx79l7fi4p0sqznlfq7sz5s8xxn";
   };
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ fuse pcre ];
+  buildInputs = [ fuse3 pcre ];
 
   prePatch = ''
     # do not set sticky bit in nix store
diff --git a/pkgs/os-specific/linux/roccat-tools/default.nix b/pkgs/os-specific/linux/roccat-tools/default.nix
index 1eba2511b98..389d5036b75 100644
--- a/pkgs/os-specific/linux/roccat-tools/default.nix
+++ b/pkgs/os-specific/linux/roccat-tools/default.nix
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, cmake, pkg-config, gettext
 , dbus, dbus-glib, libgaminggear, libgudev, lua
-, harfbuzz
+, harfbuzz, runtimeShell, coreutils, kmod
 }:
 
 stdenv.mkDerivation rec {
@@ -19,6 +19,11 @@ stdenv.mkDerivation rec {
       /return/c \
         return g_build_path("/", g_get_user_data_dir(), "roccat", NULL);
     }' libroccat/roccat_helper.c
+
+    substituteInPlace udev/90-roccat-kone.rules \
+      --replace "/bin/sh" "${runtimeShell}" \
+      --replace "/sbin/modprobe" "${kmod}/bin/modprobe" \
+      --replace "/bin/echo" "${coreutils}/bin/echo"
   '';
 
   nativeBuildInputs = [ cmake pkg-config gettext ];
@@ -31,11 +36,18 @@ stdenv.mkDerivation rec {
     "-DLIBDIR=lib"
   ];
 
-  NIX_CFLAGS_COMPILE = [ "-I${harfbuzz.dev}/include/harfbuzz" ];
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-I${harfbuzz.dev}/include/harfbuzz"
+
+    # Workaround build failure on -fno-common toolchains:
+    #   ld: ryos_talk.c.o:(.bss+0x0): multiple definition of `RyosWriteCheckWait';
+    #     ryos_custom_lights.c.o:(.bss+0x0): first defined here
+    "-fcommon"
+  ];
 
   meta = {
     description = "Tools to configure ROCCAT devices";
-    homepage = "http://roccat.sourceforge.net/";
+    homepage = "https://roccat.sourceforge.net/";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2Plus;
   };
diff --git a/pkgs/os-specific/linux/rt-tests/default.nix b/pkgs/os-specific/linux/rt-tests/default.nix
new file mode 100644
index 00000000000..8e3a9b0ceb0
--- /dev/null
+++ b/pkgs/os-specific/linux/rt-tests/default.nix
@@ -0,0 +1,34 @@
+{ stdenv
+, lib
+, makeWrapper
+, fetchurl
+, numactl
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "rt-tests";
+  version = "2.6";
+
+  src = fetchurl {
+    url = "https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git/snapshot/${pname}-${version}.tar.gz";
+    sha256 = "sha256-apRJwRqcyzfmyGCCv5BDN92pKP3Nafa9SkxlZ+Bxrm0=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ numactl python3 ];
+
+  makeFlags = [ "prefix=$(out)" "DESTDIR=" "PYLIB=$(out)/${python3.sitePackages}" ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/determine_maximum_mpps.sh" --prefix PATH : $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = "https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git";
+    description = "Suite of real-time tests - cyclictest, hwlatdetect, pip_stress, pi_stress, pmqtest, ptsematest, rt-migrate-test, sendme, signaltest, sigwaittest, svsematest";
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ poelzi ];
+    license = licenses.gpl2;
+  };
+}
diff --git a/pkgs/os-specific/linux/rtkit/default.nix b/pkgs/os-specific/linux/rtkit/default.nix
index fb41863c431..69d32079d5c 100644
--- a/pkgs/os-specific/linux/rtkit/default.nix
+++ b/pkgs/os-specific/linux/rtkit/default.nix
@@ -16,14 +16,22 @@ stdenv.mkDerivation rec {
 
   patches = [
     (fetchpatch {
-      url = "https://github.com/heftig/rtkit/commit/7d62095b94f8df3891c984a1535026d2658bb177.patch";
+      name = "meson-actual-use-systemd_systemunitdir.patch";
+      url = "https://github.com/heftig/rtkit/pull/19/commits/7d62095b94f8df3891c984a1535026d2658bb177.patch";
       sha256 = "17acv549zqcgh7sgprfagbf6drqsr0zdwvf1dsqda7wlqc2h9zn7";
     })
 
     (fetchpatch {
-      url = "https://github.com/heftig/rtkit/commit/98f70edd8f534c371cb4308b9720739c5178918d.patch";
+      name = "meson-fix-librt-find_library-check.patch";
+      url = "https://github.com/heftig/rtkit/pull/18/commits/98f70edd8f534c371cb4308b9720739c5178918d.patch";
       sha256 = "18mnjjsdjfr184nkzi01xyphpdngi31ry4bmkv9ysjxf9wilv4nl";
     })
+
+    (fetchpatch {
+      name = "rtkit-daemon-dont-log-debug-messages-by-default.patch";
+      url = "https://github.com/heftig/rtkit/pull/33/commits/ad649ee491ed1a41537774ad11564a208e598a09.patch";
+      sha256 = "sha256-p+MdJVMv58rFd1uc1UFKtq83RquDSFZ3M6YfaBU12UU=";
+    })
   ];
 
   nativeBuildInputs = [ meson ninja pkg-config unixtools.xxd ];
diff --git a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
index 93a91f0447a..50793167a34 100644
--- a/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl8188eus-aircrack/default.nix
@@ -2,29 +2,28 @@
 
 stdenv.mkDerivation {
   pname = "rtl8188eus-aircrack";
-  version = "${kernel.version}-unstable-2021-05-04";
+  version = "${kernel.version}-unstable-2023-09-21";
 
   src = fetchFromGitHub {
     owner = "aircrack-ng";
     repo = "rtl8188eus";
-    rev = "6146193406b62e942d13d4d43580ed94ac70c218";
-    sha256 = "sha256-85STELbFB7QmTaM8GvJNlWvAg6KPAXeYRiMb4cGA6RY=";
+    rev = "3fae7237ba121f1169e9a2ea55040dc123697d3b";
+    sha256 = "sha256-ILSMEt9nMdg1ZbFeatWm8Yxf6a/E7Vm7KtKhN933KTc=";
   };
 
-  nativeBuildInputs = [ bc ];
-
-  buildInputs = kernel.moduleBuildDependencies;
-
-  hardeningDisable = [ "pic" ];
-
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
+  hardeningDisable = [ "pic" ];
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+
   preInstall = ''
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -33,7 +32,7 @@ stdenv.mkDerivation {
     description = "RealTek RTL8188eus WiFi driver with monitor mode & frame injection support";
     homepage = "https://github.com/aircrack-ng/rtl8188eus";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ fortuneteller2k ];
-    broken = kernel.isHardened;
+    maintainers = with maintainers; [ moni ];
+    broken = (lib.versionAtLeast kernel.version "6.6") || ((lib.versions.majorMinor kernel.version) == "5.4" && kernel.isHardened);
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
new file mode 100644
index 00000000000..e31a54f56c3
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -0,0 +1,45 @@
+{ stdenv, lib, fetchFromGitHub, kernel, bc, nukeReferences }:
+
+stdenv.mkDerivation rec {
+  name = "rtl8189es-${kernel.version}-${version}";
+  version = "2023-03-14";
+
+  src = fetchFromGitHub {
+    owner = "jwrdegoede";
+    repo = "rtl8189ES_linux";
+    rev = "ae7b31e55526ca0e01d2a3310118530bff4f1055";
+    sha256 = "sha256-l/xUxs63Y5LVT6ZafuRc+iaCXCSt2HwysYJLJ5hg3RM=";
+  };
+
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
+
+  hardeningDisable = [ "pic" "format" ];
+
+  prePatch = ''
+    substituteInPlace ./Makefile --replace /lib/modules/ "${kernel.dev}/lib/modules/"
+    substituteInPlace ./Makefile --replace /sbin/depmod \#
+    substituteInPlace ./Makefile --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  makeFlags = kernel.makeFlags ++ [
+    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    ("CONFIG_PLATFORM_I386_PC=" + (if (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) then "y" else "n"))
+    ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
+  ];
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  postInstall = ''
+    nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
+  '';
+
+  meta = with lib; {
+    description = "Driver for Realtek rtl8189es";
+    homepage = "https://github.com/jwrdegoede/rtl8189ES_linux";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ danielfullmer lheckemann ];
+  };
+}
diff --git a/pkgs/os-specific/linux/rtl8189fs/default.nix b/pkgs/os-specific/linux/rtl8189fs/default.nix
new file mode 100644
index 00000000000..67642f11d32
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8189fs/default.nix
@@ -0,0 +1,22 @@
+{ lib, kernel, rtl8189es, fetchFromGitHub, fetchpatch }:
+
+# rtl8189fs is a branch of the rtl8189es driver
+rtl8189es.overrideAttrs (drv: rec {
+  name = "rtl8189fs-${kernel.version}-${version}";
+  version = "2023-03-27";
+
+  src = fetchFromGitHub {
+    owner = "jwrdegoede";
+    repo = "rtl8189ES_linux";
+    rev = "c223a25b1000d64432eca4201a8f012414dfc7ce";
+    sha256 = "sha256-5b5IshLbWxvmzcKy/xLsqKa3kZpwDQXTQtjqZLHyOCo=";
+  };
+
+  meta = with lib; {
+    description = "Driver for Realtek rtl8189fs";
+    homepage = "https://github.com/jwrdegoede/rtl8189ES_linux/tree/rtl8189fs";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ puffnfresh ];
+  };
+})
diff --git a/pkgs/os-specific/linux/rtl8192eu/default.nix b/pkgs/os-specific/linux/rtl8192eu/default.nix
index b66a56a8f8b..32b97b59c52 100644
--- a/pkgs/os-specific/linux/rtl8192eu/default.nix
+++ b/pkgs/os-specific/linux/rtl8192eu/default.nix
@@ -6,20 +6,20 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 
 in stdenv.mkDerivation rec {
   pname = "rtl8192eu";
-  version = "${kernel.version}-4.4.1.20210403";
+  version = "${kernel.version}-4.4.1.20230613";
 
   src = fetchFromGitHub {
     owner = "Mange";
     repo = "rtl8192eu-linux-driver";
-    rev = "ab35c7e9672f37d75b7559758c99f6d027607687";
-    sha256 = "sha256-sTIaye4oWNYEnNuXlrTLobaFKXzBLsfJXdJuc10EdJI=";
+    rev = "f2fc8af7ab58d2123eed1aa4428e713cdfc27976";
+    sha256 = "sha256-OgsxBcXoIP8h9Z0bLsG91/s/+r89Tdn2dPOt4p3sx8k=";
   };
 
   hardeningDisable = [ "pic" ];
 
   nativeBuildInputs = kernel.moduleBuildDependencies ++ [ bc ];
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/rtl8723bs/default.nix b/pkgs/os-specific/linux/rtl8723bs/default.nix
deleted file mode 100644
index a862b351716..00000000000
--- a/pkgs/os-specific/linux/rtl8723bs/default.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, nukeReferences, kernel }:
-with lib;
-stdenv.mkDerivation rec {
-  name = "rtl8723bs-${kernel.version}-${version}";
-  version = "2017-04-06";
-
-  src = fetchFromGitHub {
-    owner = "hadess";
-    repo = "rtl8723bs";
-    rev = "db2c4f61d48fe3b47c167c8bcd722ce83c24aca5";
-    sha256 = "0pxqya14a61vv2v5ky1ldybc0mjfin9mpvmajlmv0lls904rph7g";
-  };
-
-  hardeningDisable = [ "pic" ];
-
-  buildInputs = [ nukeReferences ];
-
-  makeFlags = [
-    "ARCH=${stdenv.hostPlatform.linuxArch}" # Normally not needed, but the Makefile sets ARCH in a broken way.
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" # Makefile uses $(uname -r); breaks us.
-  ];
-
-  enableParallelBuilding = true;
-
-  # The Makefile doesn't use env-vars well, so install manually:
-  installPhase = ''
-    mkdir -p      $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless
-    cp r8723bs.ko $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wireless
-
-    nuke-refs $(find $out -name "*.ko")
-  '';
-
-  meta = {
-    description = "Realtek SDIO Wi-Fi driver";
-    homepage = "https://github.com/hadess/rtl8723bs";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
-    broken = (! versionOlder kernel.version "4.12"); # Now in kernel staging drivers
-    maintainers = with maintainers; [ elitak ];
-  };
-}
diff --git a/pkgs/os-specific/linux/rtl8723ds/default.nix b/pkgs/os-specific/linux/rtl8723ds/default.nix
new file mode 100644
index 00000000000..be4b954c1b6
--- /dev/null
+++ b/pkgs/os-specific/linux/rtl8723ds/default.nix
@@ -0,0 +1,44 @@
+{ lib, stdenv, fetchFromGitHub, kernel, bc }:
+
+stdenv.mkDerivation {
+  pname = "rtl8723ds";
+  version = "${kernel.version}-unstable-2022-12-01";
+
+  src = fetchFromGitHub {
+    owner = "lwfinger";
+    repo = "rtl8723ds";
+    rev = "a638cc8639015b8b9390af3350fab0366b6c87e7";
+    sha256 = "sha256-qfVE7k71NPzw3FwoOaUxH66PnDjbpMAF6CyOyUVdSMA=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
+
+  postPatch = ''
+    substituteInPlace ./Makefile \
+      --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
+      --replace "/sbin/depmod" "#" \
+      --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Linux driver for RTL8723DS.";
+    homepage = "https://github.com/lwfinger/rtl8723ds";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ chuangzhu ];
+  };
+}
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index 43396a99b96..adc197a1166 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -1,36 +1,31 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl8812au";
-  version = "${kernel.version}-5.9.3.2.20210427";
+  version = "${kernel.version}-unstable-2023-07-22";
 
   src = fetchFromGitHub {
-    owner = "gordboy";
-    repo = "rtl8812au-5.9.3.2";
-    rev = "6ef5d8fcdb0b94b7490a9a38353877708fca2cd4";
-    sha256 = "sha256-czExf4z0nf7XEJ1YnRSB3CrGV6NTmUKDiZjLmrh6Hwo=";
+    owner = "morrownr";
+    repo = "8812au-20210629";
+    rev = "b5f4e6e894eca8fea38661e2fc22a2570e0274ad";
+    hash = "sha256-3uPowesJVh/cnagMz/Uadb+U5rDUAWfU39tZaDNCoqg=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-
-  buildInputs = kernel.moduleBuildDependencies;
-
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
   hardeningDisable = [ "pic" "format" ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
   makeFlags = [
     "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    ("CONFIG_PLATFORM_I386_PC=" + (if (stdenv.hostPlatform.isi686 || stdenv.hostPlatform.isx86_64) then "y" else "n"))
-    ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
-  ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+    ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
+    ("CONFIG_PLATFORM_ARM_RPI=" + (if stdenv.hostPlatform.isAarch then "y" else "n"))
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
   ];
 
@@ -42,12 +37,13 @@ stdenv.mkDerivation rec {
     nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Driver for Realtek 802.11ac, rtl8812au, provides the 8812au mod";
-    homepage = "https://github.com/gordboy/rtl8812au-5.9.3.2";
+    homepage = "https://github.com/morrownr/8812au-20210629";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ fortuneteller2k ];
-    broken = kernel.kernelOlder "4.10" || kernel.isHardened;
+    maintainers = with maintainers; [ moni ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index 2b0fb9622a4..0b1522c9697 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -2,25 +2,25 @@
 
 stdenv.mkDerivation {
   pname = "rtl8814au";
-  version = "${kernel.version}-unstable-2021-05-18";
+  version = "${kernel.version}-unstable-2023-03-21";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8814au";
-    rev = "388786c864f9b1437fc4d934b1eccf6d7f1e1355";
-    sha256 = "sha256-2EnheODPFWTGN/fz45LWRSOGeV6pTENEUrehahj+PJ4=";
+    rev = "6f80699e68fd2a9f2bba3f1a56ca06d1b7992bd8";
+    hash = "sha256-7dv+8vNI1OLLA4SdZQPL87pTS9HR6mGijzWo9WL7vc0=";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -29,6 +29,8 @@ stdenv.mkDerivation {
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Realtek 8814AU USB WiFi driver";
     homepage = "https://github.com/morrownr/8814au";
diff --git a/pkgs/os-specific/linux/rtl8821au/default.nix b/pkgs/os-specific/linux/rtl8821au/default.nix
index 08e097b0d5f..b89cddbfc73 100644
--- a/pkgs/os-specific/linux/rtl8821au/default.nix
+++ b/pkgs/os-specific/linux/rtl8821au/default.nix
@@ -1,27 +1,33 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl8821au";
-  version = "${kernel.version}-unstable-2021-05-18";
+  version = "${kernel.version}-unstable-2023-07-23";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "8821au";
-    rev = "6f6a9d5772bb2b75f18374c01c82c6b3e8e3244d";
-    sha256 = "sha256-RqtLR3sNcLXhUrNloSTRKubL1SVwzbVe73AsBYYSXNE=";
+    repo = "8821au-20210708";
+    rev = "0dc022287b0ab534efa885881eaa65c5503291be";
+    hash = "sha256-pLRBWdqlv9A39VbCS8dymTCJHcwJooqD8v6mTbOsBz0=";
   };
 
-  nativeBuildInputs = [ bc nukeReferences ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" "format" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+    ("CONFIG_PLATFORM_I386_PC=" + (if stdenv.hostPlatform.isx86 then "y" else "n"))
+    ("CONFIG_PLATFORM_ARM_RPI=" + (if (stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64) then "y" else "n"))
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -34,11 +40,13 @@ stdenv.mkDerivation rec {
     nuke-refs $out/lib/modules/*/kernel/net/wireless/*.ko
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "rtl8821AU and rtl8812AU chipset driver with firmware";
     homepage = "https://github.com/morrownr/8821au";
     license = licenses.gpl2Only;
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = lib.platforms.linux;
     maintainers = with maintainers; [ plchldr ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
index b4def6f001c..87670105b10 100644
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -1,25 +1,29 @@
-{ lib, stdenv, fetchFromGitHub, kernel, bc }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+, bc
+}:
 
 stdenv.mkDerivation rec {
   pname = "rtl8821ce";
-  version = "${kernel.version}-unstable-2021-05-28";
+  version = "${kernel.version}-unstable-2023-05-04";
 
   src = fetchFromGitHub {
     owner = "tomaspinho";
     repo = "rtl8821ce";
-    rev = "f93db734666f75ebf65e44ceb943c19b598b1647";
-    sha256 = "sha256-cqXV52U+6Jl9Jje1nEOYDvmH4rgA1QdrwNCfYeul3hU=";
+    rev = "a478095a45d8aa957b45be4f9173c414efcacc6f";
+    hash = "sha256-xqVxylKhL7vbC7m5Av6ven5i7OBkS2RHxrKzLOVBlgE=";
   };
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -28,12 +32,14 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Realtek rtl8821ce driver";
     homepage = "https://github.com/tomaspinho/rtl8821ce";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = stdenv.isAarch64;
-    maintainers = with maintainers; [ hhm ];
+    maintainers = with maintainers; [ hhm ivar ];
+    broken = stdenv.isAarch64 || ((lib.versions.majorMinor kernel.version) == "5.4" && kernel.isHardened);
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8821cu/default.nix b/pkgs/os-specific/linux/rtl8821cu/default.nix
index 556fd793915..806df9f6dd4 100644
--- a/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -2,24 +2,23 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2021-05-19";
+  version = "${kernel.version}-unstable-2023-09-10";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "8821cu";
-    rev = "2430c354c9b15fa6193a263c99ce57211d50c66f";
-    sha256 = "sha256-PkrpwebZYh/hBukqDQf6pxfbkVyA+CpYtte5pmzgLtw=";
+    repo = "8821cu-20210916";
+    rev = "f6d4598290c5e9c8e545130e8a31d130f6d135f4";
+    hash = "sha256-jpMf8K9diJ3mbEkP9Cp+VwairK+pwiEGU/AtUIouCqM=";
   };
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -28,6 +27,8 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Realtek rtl8821cu driver";
     homepage = "https://github.com/morrownr/8821cu";
diff --git a/pkgs/os-specific/linux/rtl88x2bu/default.nix b/pkgs/os-specific/linux/rtl88x2bu/default.nix
index 4b194bb2f33..73b098894b9 100644
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -1,25 +1,24 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "rtl88x2bu";
-  version = "${kernel.version}-unstable-2021-05-18";
+  version = "${kernel.version}-unstable-2023-09-24";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "88x2bu";
-    rev = "80b03962e33f86f99e898305d8d597140503de03";
-    sha256 = "sha256-C7XOpKgwxM9UbfW3wHteInTmAUM3FFqN1MHMKxP8gBA=";
+    repo = "88x2bu-20210702";
+    rev = "888ba1b309e6258a736ef5c37a68836cd0ea5517";
+    sha256 = "sha256-oLRGRKUNTmIw+Zn23TArGumo24AIH2YEMpnStyXBNw8=";
   };
 
   hardeningDisable = [ "pic" ];
 
-  nativeBuildInputs = [ bc ];
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ bc ] ++ kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags;
 
- prePatch = ''
+  prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -28,11 +27,13 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Realtek rtl88x2bu driver";
-    homepage = "https://github.com/morrownr/88x2bu";
+    homepage = "https://github.com/morrownr/88x2bu-20210702";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    maintainers = [ maintainers.ralith ];
+    maintainers = with maintainers; [ otavio ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
index d65a601fd9e..78409b7bd14 100644
--- a/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
+++ b/pkgs/os-specific/linux/rtl88xxau-aircrack/default.nix
@@ -1,37 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel }:
+{ lib, stdenv, fetchFromGitHub, kernel }:
 
-let
-  rev = "3a64331a1c809bbbc21eca63b825970f213ec5ac";
-in
 stdenv.mkDerivation rec {
   pname = "rtl88xxau-aircrack";
-  version = "${kernel.version}-${builtins.substring 0 6 rev}";
+  version = "${kernel.version}-unstable-02-05-2023";
 
   src = fetchFromGitHub {
     owner = "aircrack-ng";
     repo = "rtl8812au";
-    inherit rev;
-    sha256 = "sha256-goaN80imfCeUwiHokJd10CFKskE3iL5BO/xOQk6PtHE=";
+    rev = "35308f4dd73e77fa572c48867cce737449dd8548";
+    hash = "sha256-0kHrNsTKRl/xTQpDkIOYqTtcHlytXhXX8h+6guvLmLI=";
   };
 
-  buildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
-  NIX_CFLAGS_COMPILE="-Wno-error=incompatible-pointer-types";
-
-  # Fix build for 5.12 kernels
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/aircrack-ng/rtl8812au/commit/9b4c60a89c2a55f36454b950a86246b6b86a9681.patch";
-      sha256 = "sha256-HPhTLstqAePF3H6WeM9Fu4/8UjNL+9xl4L8xq3NOWuM=";
-    })
-  ];
-
   prePatch = ''
     substituteInPlace ./Makefile \
       --replace /lib/modules/ "${kernel.dev}/lib/modules/" \
-      --replace '$(shell uname -r)' "${kernel.modDirVersion}" \
       --replace /sbin/depmod \# \
       --replace '$(MODDESTDIR)' "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
@@ -40,11 +26,13 @@ stdenv.mkDerivation rec {
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Aircrack-ng kernel module for Realtek 88XXau network cards\n(8811au, 8812au, 8814au and 8821au chipsets) with monitor mode and injection support.";
     homepage = "https://github.com/aircrack-ng/rtl8812au";
     license = licenses.gpl2Only;
     maintainers = [ maintainers.jethro ];
-    platforms = [ "x86_64-linux" "i686-linux" ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/rtw88/default.nix b/pkgs/os-specific/linux/rtw88/default.nix
index 42302351240..a28a9f3d19e 100644
--- a/pkgs/os-specific/linux/rtw88/default.nix
+++ b/pkgs/os-specific/linux/rtw88/default.nix
@@ -5,16 +5,17 @@ let
 in
 stdenv.mkDerivation {
   pname = "rtw88";
-  version = "unstable-2021-04-19";
+  version = "unstable-2023-07-23";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtw88";
-    rev = "0f3cc6a5973bc386d9cb542fc85a6ba027edff5d";
-    hash = "sha256-PRzWXC1lre8gt1GfVdnaG836f5YK57P9a8tG20yef0w=";
+    rev = "9b6fe04a741a6b0a1edc5ca134927784bff033a5";
+    hash = "sha256-OzaIy+WTrljwAhC73wEIRUXrkz1NrGNJAS3zofQyV6E=";
   };
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 
@@ -29,12 +30,12 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = "The newest Realtek rtlwifi codes";
+    description = "Backport of the latest Realtek RTW88 driver from wireless-next for older kernels";
     homepage = "https://github.com/lwfinger/rtw88";
     license = with licenses; [ bsd3 gpl2Only ];
-    maintainers = with maintainers; [ tvorog ];
+    maintainers = with maintainers; [ tvorog atila ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.14";
+    broken = kernel.kernelOlder "4.20";
     priority = -1;
   };
 }
diff --git a/pkgs/os-specific/linux/rtw89/default.nix b/pkgs/os-specific/linux/rtw89/default.nix
index 86ca72c537c..1bb42860a8c 100644
--- a/pkgs/os-specific/linux/rtw89/default.nix
+++ b/pkgs/os-specific/linux/rtw89/default.nix
@@ -5,16 +5,17 @@ let
 in
 stdenv.mkDerivation {
   pname = "rtw89";
-  version = "unstable-2021-07-03";
+  version = "unstable-2022-12-18";
 
   src = fetchFromGitHub {
     owner = "lwfinger";
     repo = "rtw89";
-    rev = "cebafc6dc839e66c725b92c0fabf131bc908f607";
-    sha256 = "1vw67a423gajpzd5d51bxnja1qpppx9x5ii2vcfkj6cbnqwr83af";
+    rev = "e834edfe8bee6e27e31c2f783817a9c13ff45665";
+    sha256 = "19ApYiEvA0E6qgf5XQc03paZ+ghjZL8JoC3vSYYw3xU=";
   };
 
-  makeFlags = [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernel.makeFlags ++ [ "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   enableParallelBuilding = true;
 
@@ -29,12 +30,12 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    description = " Driver for Realtek 8852AE, an 802.11ax device";
+    description = " Driver for Realtek 8852AE, 8852BE, and 8853CE, 802.11ax devices";
     homepage = "https://github.com/lwfinger/rtw89";
     license = with licenses; [ gpl2Only ];
     maintainers = with maintainers; [ tvorog ];
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.4";
+    broken = kernel.kernelOlder "5.7";
     priority = -1;
   };
 }
diff --git a/pkgs/os-specific/linux/ryzenadj/default.nix b/pkgs/os-specific/linux/ryzenadj/default.nix
index e50cb7e8d53..0744ed2896f 100644
--- a/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/pkgs/os-specific/linux/ryzenadj/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pciutils, cmake }:
 stdenv.mkDerivation rec {
   pname = "ryzenadj";
-  version = "0.8.2";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "FlyGoat";
     repo = "RyzenAdj";
     rev = "v${version}";
-    sha256 = "182l9nchlpl4yr568n86086glkr607rif92wnwc7v3aym62ch6ld";
+    sha256 = "sha256-Lqq4LNRmqQyeIJfr/+tYdKMEk+P54VnwZAQZcE0ev8Y=";
   };
 
   nativeBuildInputs = [ pciutils cmake ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = "Adjust power management settings for Ryzen Mobile Processors.";
     homepage = "https://github.com/FlyGoat/RyzenAdj";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ asbachb ];
+    maintainers = with maintainers; [ rhendric ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/os-specific/linux/s6-linux-init/default.nix b/pkgs/os-specific/linux/s6-linux-init/default.nix
deleted file mode 100644
index 5d6941259e1..00000000000
--- a/pkgs/os-specific/linux/s6-linux-init/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ lib, skawarePackages }:
-
-with skawarePackages;
-
-buildPackage {
-  pname = "s6-linux-init";
-  version = "1.0.6.2";
-  sha256 = "06xcmn2a89fvng056lcnnyrl2ak0y7cblkc90lj9a2liyhawy9dr";
-
-  description = "A set of minimalistic tools used to create a s6-based init system, including a /sbin/init binary, on a Linux kernel";
-  platforms = lib.platforms.linux;
-
-  outputs = [ "bin" "dev" "doc" "out" ];
-
-  configureFlags = [
-    "--bindir=\${bin}/bin"
-    "--includedir=\${dev}/include"
-    "--with-sysdeps=${skalibs.lib}/lib/skalibs/sysdeps"
-    "--with-include=${skalibs.dev}/include"
-    "--with-include=${execline.dev}/include"
-    "--with-include=${s6.dev}/include"
-    "--with-lib=${skalibs.lib}/lib"
-    "--with-lib=${s6.out}/lib"
-    "--with-lib=${execline.lib}/lib"
-    "--with-dynlib=${skalibs.lib}/lib"
-    "--with-dynlib=${execline.lib}/lib"
-    "--with-dynlib=${s6.out}/lib"
-  ];
-
-  postInstall = ''
-    # remove all s6 executables from build directory
-    rm $(find -name "s6-*" -type f -mindepth 1 -maxdepth 1 -executable)
-    rm libs6_linux_init.* libhpr.*
-    rm -rf skel
-
-    mv doc $doc/share/doc/s6-linux-init/html
-  '';
-
-}
diff --git a/pkgs/os-specific/linux/s6-linux-utils/default.nix b/pkgs/os-specific/linux/s6-linux-utils/default.nix
deleted file mode 100644
index 3596ab23e72..00000000000
--- a/pkgs/os-specific/linux/s6-linux-utils/default.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{ lib, skawarePackages }:
-
-with skawarePackages;
-
-buildPackage {
-  pname = "s6-linux-utils";
-  version = "2.5.1.5";
-  sha256 = "1fj5ldlrc6bx40pphg29rp3byd6fal6869v85kw86c2kdgrxn063";
-
-  description = "A set of minimalistic Linux-specific system utilities";
-  platforms = lib.platforms.linux;
-
-  outputs = [ "bin" "dev" "doc" "out" ];
-
-  # TODO: nsss support
-  configureFlags = [
-    "--bindir=\${bin}/bin"
-    "--includedir=\${dev}/include"
-    "--with-sysdeps=${skalibs.lib}/lib/skalibs/sysdeps"
-    "--with-include=${skalibs.dev}/include"
-    "--with-lib=${skalibs.lib}/lib"
-    "--with-dynlib=${skalibs.lib}/lib"
-  ];
-
-  postInstall = ''
-    # remove all s6 executables from build directory
-    rm $(find -name "s6-*" -type f -mindepth 1 -maxdepth 1 -executable)
-
-    mv doc $doc/share/doc/s6-linux-utils/html
-  '';
-
-}
diff --git a/pkgs/os-specific/linux/sasutils/default.nix b/pkgs/os-specific/linux/sasutils/default.nix
new file mode 100644
index 00000000000..d30e7f608c7
--- /dev/null
+++ b/pkgs/os-specific/linux/sasutils/default.nix
@@ -0,0 +1,28 @@
+{ lib, python3Packages, fetchFromGitHub, installShellFiles, sg3_utils }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "sasutils";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "stanford-rc";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-9JRw+UoxU0I5RHuimzYrM/3j8UWHuicVpoOdRRrj2Wc=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  propagatedBuildInputs = [ sg3_utils ];
+
+  postInstall = ''
+    installManPage doc/man/man1/*.1
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/stanford-rc/sasutils";
+    description = "A set of command-line tools to ease the administration of Serial Attached SCSI (SAS) fabrics";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ aij ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sch_cake/default.nix b/pkgs/os-specific/linux/sch_cake/default.nix
deleted file mode 100644
index 851a903cf07..00000000000
--- a/pkgs/os-specific/linux/sch_cake/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ stdenv, lib, fetchFromGitHub, kernel }:
-
-assert lib.versionAtLeast kernel.version "4.4";
-
-stdenv.mkDerivation {
-  name = "sch_cake-2017-07-16";
-
-  src = fetchFromGitHub {
-    owner = "dtaht";
-    repo = "sch_cake";
-    rev = "e641a56f27b6848736028f87eda65ac3df9f99f7";
-    sha256 = "08582jy01j32b3mj8hf6m8687qrcz64zv2m236j24inlkmd94q21";
-  };
-
-  hardeningDisable = [ "pic" ];
-
-  makeFlags = [
-    "KERNEL_VERSION=${kernel.version}"
-    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-  ];
-
-  installPhase = ''
-    install -v -m 644 -D sch_cake.ko \
-      $out/lib/modules/${kernel.modDirVersion}/kernel/net/sched/sch_cake.ko
-  '';
-
-  meta = with lib; {
-    description = "The cake qdisc scheduler";
-    homepage = "https://www.bufferbloat.net/projects/codel/wiki/Cake/";
-    license = with licenses; [ bsd3 gpl2 ];
-    maintainers = with maintainers; [ fpletz ];
-    platforms = platforms.linux;
-    broken = !lib.versionOlder kernel.version "4.13";
-  };
-}
diff --git a/pkgs/os-specific/linux/sd-switch/default.nix b/pkgs/os-specific/linux/sd-switch/default.nix
index 987f32664c1..b231f32d42a 100644
--- a/pkgs/os-specific/linux/sd-switch/default.nix
+++ b/pkgs/os-specific/linux/sd-switch/default.nix
@@ -1,17 +1,18 @@
-{ lib, fetchFromGitLab, rustPlatform, pkg-config, dbus }:
+{ lib, fetchFromSourcehut, rustPlatform, pkg-config, dbus }:
 
-rustPlatform.buildRustPackage rec {
+let version = "0.3.0";
+in rustPlatform.buildRustPackage {
   pname = "sd-switch";
-  version = "0.2.3";
+  inherit version;
 
-  src = fetchFromGitLab {
-    owner = "rycee";
-    repo = pname;
+  src = fetchFromSourcehut {
+    owner = "~rycee";
+    repo = "sd-switch";
     rev = version;
-    sha256 = "12h2d7v7pdz7b0hrna64561kf35nbpwb2kzxa791xk8raxc2b72k";
+    hash = "sha256-mWrLbCUnoJ3hVtpSU/7dw91U5TLyw5kNchX5nmP9asA=";
   };
 
-  cargoSha256 = "12ny3cir2nxzrmf4vwq6sgc35dbpq88hav53xqdp44rigdf4vzbs";
+  cargoHash = "sha256-VK+kPX1pGhowbWKkUs1PL0DXIhDXJOFVoIHTtWQcWEs=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus ];
diff --git a/pkgs/os-specific/linux/sdnotify-wrapper/default.nix b/pkgs/os-specific/linux/sdnotify-wrapper/default.nix
deleted file mode 100644
index cf09f047676..00000000000
--- a/pkgs/os-specific/linux/sdnotify-wrapper/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ lib, runCommandCC, skawarePackages }:
-
-with skawarePackages;
-
-let
-  # From https://skarnet.org/software/misc/sdnotify-wrapper.c,
-  # which is unversioned.
-  src = ./sdnotify-wrapper.c;
-
-in runCommandCC "sdnotify-wrapper" {
-
-   outputs = [ "bin" "doc" "out" ];
-
-   meta = {
-     homepage = "https://skarnet.org/software/misc/sdnotify-wrapper.c";
-     description = "Use systemd sd_notify without having to link against libsystemd";
-     platforms = lib.platforms.all;
-     license = lib.licenses.isc;
-     maintainers = with lib.maintainers; [ Profpatsch ];
-   };
-
-} ''
-  mkdir -p $bin/bin
-  mkdir $out
-
-  # the -lskarnet has to come at the end to support static builds
-  $CC \
-    -o $bin/bin/sdnotify-wrapper \
-    -I${skalibs.dev}/include \
-    -L${skalibs.lib}/lib \
-    ${src} \
-    -lskarnet
-
-  mkdir -p $doc/share/doc/sdnotify-wrapper
-  # copy the documentation comment
-  sed -ne '/Usage:/,/*\//p' ${src} > $doc/share/doc/sdnotify-wrapper/README
-''
diff --git a/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c b/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c
deleted file mode 100644
index bb71a732bf9..00000000000
--- a/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c
+++ /dev/null
@@ -1,176 +0,0 @@
-/*
-   Copyright: (C)2015-2020 Laurent Bercot.  http://skarnet.org/
-   ISC license. See http://opensource.org/licenses/ISC
-
-   Build-time requirements: skalibs.  http://skarnet.org/software/skalibs/
-   Run-time requirements: none, if you link skalibs statically.
- 
-   Compilation:
-     gcc -o sdnotify-wrapper -L/usr/lib/skalibs sdnotify-wrapper.c -lskarnet
-   Use /usr/lib/skalibs/libskarnet.a instead of -lskarnet to link statically.
-   Adapt gcc's -I and -L options to your skalibs installation paths.
-
-   Usage: if a daemon would be launched by systemd as "foobard args...",
-   launch it as "sdnotify-wrapper foobard args..." instead, and you can now
-   tell systemd that this daemon supports readiness notification.
-
-   Instead of using sd_notify() and having to link against the systemd
-   library, the daemon notifies readiness by writing whatever it wants
-   to a file descriptor (by default: stdout), then a newline. (Then it
-   should close that file descriptor.) The simplest way is something like
-   int notify_readiness() { write(1, "\n", 1) ; close(1) ; }
-   This mechanism is understandable by any notification readiness framework.
-
-   Readiness notification occurs when the newline is written, not when
-   the descriptor is closed; but since sdnotify-wrapper stops reading
-   after the first newline and will exit, any subsequent writes will
-   fail and it's best to simply close the descriptor right away.
-
-   sdnotify-wrapper sees the notification when it occurs and sends it
-   to systemd using the sd_notify format.
-
-   Options:
-     -d fd: the daemon will write its notification on descriptor fd.
-     Default is 1.
-     -f: do not doublefork. Use if the daemon waits for children it does
-     not know it has (for instance, superservers do this). When in doubt,
-     do not use that option, or you may have a zombie hanging around.
-     -t timeout: if the daemon has not sent a notification after timeout
-     milliseconds, give up and exit; systemd will not be notified.
-     -k: keep the NOTIFY_SOCKET environment variable when execing into the
-     daemon. By default, the variable is unset: the daemon should not need it.
-
-   Notes:
-     sdnotify-wrapper does not change the daemon's pid. It runs as a
-     (grand)child of the daemon.
-     If the NOTIFY_SOCKET environment variable is not set, sdnotify-wrapper
-     does nothing - it only execs into the daemon.
-     sdnotify-wrapper is more liberal than sd_notify(). It will accept
-     a relative path in NOTIFY_SOCKET.
-*/
-
-
-#include <sys/types.h>
-#include <string.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-
-#include <skalibs/uint64.h>
-#include <skalibs/types.h>
-#include <skalibs/bytestr.h>
-#include <skalibs/sgetopt.h>
-#include <skalibs/strerr2.h>
-#include <skalibs/allreadwrite.h>
-#include <skalibs/tai.h>
-#include <skalibs/iopause.h>
-#include <skalibs/djbunix.h>
-//#include <skalibs/webipc.h>
-// svanderburg: This header no longer exists, but socket.h provides the functions this module needs
-#include <skalibs/socket.h>
-#include <skalibs/exec.h>
-
-#define USAGE "sdnotify-wrapper [ -d fd ] [ -f ] [ -t timeout ] [ -k ] prog..."
-#define dieusage() strerr_dieusage(100, USAGE)
-
-#define VAR "NOTIFY_SOCKET"
-
-static inline int ipc_sendto (int fd, char const *s, size_t len, char const *path)
-{
-  struct sockaddr_un sa ;
-  size_t l = strlen(path) ;
-  if (l > IPCPATH_MAX) return (errno = ENAMETOOLONG, 0) ;
-  memset(&sa, 0, sizeof sa) ;
-  sa.sun_family = AF_UNIX ;
-  memcpy(sa.sun_path, path, l+1) ;
-  if (path[0] == '@') sa.sun_path[0] = 0 ;
-  return sendto(fd, s, len, MSG_NOSIGNAL, (struct sockaddr *)&sa, sizeof sa) >= 0 ;
-}
-
-static inline void notify_systemd (pid_t pid, char const *socketpath)
-{
-  size_t n = 16 ;
-  char fmt[16 + PID_FMT] = "READY=1\nMAINPID=" ;
-  int fd = ipc_datagram_b() ;
-  if (fd < 0) strerr_diefu1sys(111, "create socket") ;
-  n += pid_fmt(fmt + n, pid) ;
-  fmt[n++] = '\n' ;
-  if (!ipc_sendto(fd, fmt, n, socketpath))
-    strerr_diefu2sys(111, "send notification message to ", socketpath) ;
-  close(fd) ;
-}
-
-static inline int run_child (int fd, unsigned int timeout, pid_t pid, char const *s)
-{
-  char dummy[4096] ;
-  iopause_fd x = { .fd = fd, .events = IOPAUSE_READ } ;
-  tain_t deadline ;
-  tain_now_g() ;
-  if (timeout) tain_from_millisecs(&deadline, timeout) ;
-  else deadline = tain_infinite_relative ;
-  tain_add_g(&deadline, &deadline) ;
-  for (;;)
-  {
-    int r = iopause_g(&x, 1, &deadline) ;
-    if (r < 0) strerr_diefu1sys(111, "iopause") ;
-    if (!r) return 99 ;
-    r = sanitize_read(fd_read(fd, dummy, 4096)) ;
-    if (r < 0)
-      if (errno == EPIPE) return 1 ;
-      else strerr_diefu1sys(111, "read from parent") ;
-    else if (r && memchr(dummy, '\n', r)) break ;
-  }
-  close(fd) ;
-  notify_systemd(pid, s) ;
-  return 0 ;
-}
-
-int main (int argc, char const *const *argv)
-{
-  char const *s = getenv(VAR) ;
-  unsigned int fd = 1 ;
-  unsigned int timeout = 0 ;
-  int df = 1, keep = 0 ;
-  PROG = "sdnotify-wrapper" ;
-  {
-    subgetopt_t l = SUBGETOPT_ZERO ;
-    for (;;)
-    {
-      int opt = subgetopt_r(argc, argv, "d:ft:k", &l) ;
-      if (opt == -1) break ;
-      switch (opt)
-      {
-        case 'd' : if (!uint0_scan(l.arg, &fd)) dieusage() ; break ;
-        case 'f' : df = 0 ; break ;
-        case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ;
-        case 'k' : keep = 1 ; break ;
-        default : dieusage() ;
-      }
-    }
-    argc -= l.ind ; argv += l.ind ;
-  }
-  if (!argc) dieusage() ;
-
-  if (!s) xexec(argv) ;
-  else
-  {
-    pid_t parent = getpid() ;
-    pid_t child ;
-    int p[2] ;
-    if (pipe(p) < 0) strerr_diefu1sys(111, "pipe") ;
-    child = df ? doublefork() : fork() ;
-    if (child < 0) strerr_diefu1sys(111, df ? "doublefork" : "fork") ;
-    else if (!child)
-    {
-      PROG = "sdnotify-wrapper (child)" ;
-      close(p[1]) ;
-      return run_child(p[0], timeout, parent, s) ;
-    }
-    close(p[0]) ;
-    if (fd_move((int)fd, p[1]) < 0) strerr_diefu1sys(111, "move descriptor") ;
-    if (keep) xexec(argv) ;
-    else xmexec_m(argv, VAR, sizeof(VAR)) ;
-  }
-}
diff --git a/pkgs/os-specific/linux/sdparm/default.nix b/pkgs/os-specific/linux/sdparm/default.nix
index 08e61a98f6b..a9137b18f39 100644
--- a/pkgs/os-specific/linux/sdparm/default.nix
+++ b/pkgs/os-specific/linux/sdparm/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sdparm";
-  version = "1.11";
+  version = "1.12";
 
   src = fetchurl {
     url = "http://sg.danny.cz/sg/p/${pname}-${version}.tar.xz";
-    sha256 = "1nqjc4w2w47zavcbf5xmm53x1zbwgljaw1lpajcdi537cgy32fa8";
+    sha256 = "sha256-xMnvr9vrZi4vlxJwfsSQkyvU0BC7ESmueplSZUburb4=";
   };
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/selinux-python/default.nix b/pkgs/os-specific/linux/selinux-python/default.nix
index 32ed5bc2e7d..c50f4ffccd0 100644
--- a/pkgs/os-specific/linux/selinux-python/default.nix
+++ b/pkgs/os-specific/linux/selinux-python/default.nix
@@ -4,22 +4,23 @@
 # this is python3 only because setools only supports python3
 
 with lib;
-with python3.pkgs;
 
 stdenv.mkDerivation rec {
   pname = "selinux-python";
-  version = "2.9";
+  version = "3.3";
 
-  inherit (libsepol) se_release se_url;
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/selinux-python-${version}.tar.gz";
-    sha256 = "1pjzsyay5535cxcjag7y7k193ajry0s0xc3dqv5905qd7cwval1n";
+    url = "${se_url}/${version}/selinux-python-${version}.tar.gz";
+    sha256 = "1v244hpb45my303793xa4kcn7qnxjgxn4ja7rdn9k1q361hi1nca";
   };
 
-  nativeBuildInputs = [ wrapPython ];
-  buildInputs = [ libsepol python3 ];
-  propagatedBuildInputs = [ libselinux libsemanage setools ipy ];
+  strictDeps = true;
+
+  nativeBuildInputs = [ python3 python3.pkgs.wrapPython ];
+  buildInputs = [ libsepol ];
+  propagatedBuildInputs = [ libselinux libsemanage setools python3.pkgs.ipy ];
 
   postPatch = ''
     substituteInPlace sepolicy/Makefile --replace "echo --root" "echo --prefix"
@@ -32,7 +33,7 @@ stdenv.mkDerivation rec {
     "LOCALEDIR=$(out)/share/locale"
     "BASHCOMPLETIONDIR=$(out)/share/bash-completion/completions"
     "PYTHON=python"
-    "PYTHONLIBDIR=$(out)/${python.sitePackages}"
+    "PYTHONLIBDIR=$(out)/${python3.sitePackages}"
     "LIBSEPOLA=${lib.getLib libsepol}/lib/libsepol.a"
   ];
 
@@ -48,4 +49,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
   };
 }
-
diff --git a/pkgs/os-specific/linux/selinux-sandbox/default.nix b/pkgs/os-specific/linux/selinux-sandbox/default.nix
index a10588bacf1..0d2843d216a 100644
--- a/pkgs/os-specific/linux/selinux-sandbox/default.nix
+++ b/pkgs/os-specific/linux/selinux-sandbox/default.nix
@@ -9,12 +9,12 @@ with python3.pkgs;
 
 stdenv.mkDerivation rec {
   pname = "selinux-sandbox";
-  version = "2.9";
-  inherit (policycoreutils) se_release se_url;
+  version = "3.3";
+  inherit (policycoreutils) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/selinux-sandbox-${version}.tar.gz";
-    sha256 = "0qj20jyi8v1653xdqj5yak3wwbvg5bw8f2jmx8fpahl6y1bmz481";
+    url = "${se_url}/${version}/selinux-sandbox-${version}.tar.gz";
+    sha256 = "0rw8pxfqhl6ww4w31fbf4hi3zilh1n3b1rfjm7ra76mm78wfyylj";
   };
 
   nativeBuildInputs = [ wrapPython ];
diff --git a/pkgs/os-specific/linux/semodule-utils/default.nix b/pkgs/os-specific/linux/semodule-utils/default.nix
index b76e715dbc2..e6b8e778a77 100644
--- a/pkgs/os-specific/linux/semodule-utils/default.nix
+++ b/pkgs/os-specific/linux/semodule-utils/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "semodule-utils";
-  version = "2.9";
+  version = "3.5";
 
-  inherit (libsepol) se_release se_url;
+  inherit (libsepol) se_url;
 
   src = fetchurl {
-    url = "${se_url}/${se_release}/${pname}-${version}.tar.gz";
-    sha256 = "01yrwnd3calmw6r8kdh8ld7i7fb250n2yqqqk9p0ymrlwsg6g0w0";
+    url = "${se_url}/${version}/${pname}-${version}.tar.gz";
+    sha256 = "sha256-yaVQpzcFHrrywQL2ZcfsL4XnIyhwmAqgBnmYRZtBQoM=";
   };
 
   buildInputs = [ libsepol ];
@@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
     description = "SELinux policy core utilities (packaging additions)";
     license = licenses.gpl2;
     inherit (libsepol.meta) homepage platforms;
-    maintainers = [ maintainers.e-user ];
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/sepolgen/default.nix b/pkgs/os-specific/linux/sepolgen/default.nix
deleted file mode 100644
index f7ef1cb9c3a..00000000000
--- a/pkgs/os-specific/linux/sepolgen/default.nix
+++ /dev/null
@@ -1,24 +0,0 @@
-{ lib, stdenv, fetchurl, libsepol, python }:
-
-stdenv.mkDerivation rec {
-  pname = "sepolgen";
-  version = "1.2.2";
-  inherit (libsepol) se_release se_url;
-
-  src = fetchurl {
-    url = "${se_url}/${se_release}/sepolgen-${version}.tar.gz";
-    sha256 = "09139kspr41zgksayi4dh982p8080lrfl96p4dld51nknbpaigdy";
-  };
-
-  preBuild = ''
-    makeFlagsArray+=("PREFIX=$out")
-    makeFlagsArray+=("DESTDIR=$out")
-    makeFlagsArray+=("PYTHONLIBDIR=lib/${python.libPrefix}/site-packages")
-  '';
-
-  meta = with lib; {
-    inherit (libsepol.meta) homepage platforms maintainers;
-    description = "SELinux policy generation library";
-    license = licenses.gpl2;
-  };
-}
diff --git a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
index a7c3bc9758b..2889adc1868 100755
--- a/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
+++ b/pkgs/os-specific/linux/service-wrapper/service-wrapper.sh
@@ -33,12 +33,12 @@
 
 
 is_ignored_file() {
-	case "$1" in
-		skeleton | README | *.dpkg-dist | *.dpkg-old | rc | rcS | single | reboot | bootclean.sh)
-			return 0
-		;;
-	esac
-	return 1
+    case "$1" in
+        skeleton | README | *.dpkg-dist | *.dpkg-old | rc | rcS | single | reboot | bootclean.sh)
+            return 0
+        ;;
+    esac
+    return 1
 }
 
 VERSION=$(@coreutils@/bin/basename $0)" ver. 19-04"
@@ -75,35 +75,35 @@ while [ $# -gt 0 ]; do
        if [ -z "${SERVICE}" -a $# -eq 1 -a "${1}" = "--status-all" ]; then
           if [ -d "${SERVICEDIR}" ]; then
              cd ${SERVICEDIR}
-	     for SERVICE in * ; do
-	       case "${SERVICE}" in
-	         functions | halt | killall | single| linuxconf| kudzu)
-	             ;;
-	         *)
-	           if ! is_ignored_file "${SERVICE}" \
-	   	    && [ -x "${SERVICEDIR}/${SERVICE}" ]; then
-	                   out=$(env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status 2>&1)
-	                   retval=$?
-	                   if echo "$out" | egrep -iq "usage:"; then
-	                     #printf " %s %-60s %s\n" "[?]" "$SERVICE:" "unknown" 1>&2
-	                     echo " [ ? ]  $SERVICE" 1>&2
-	                     continue
-	                   else
-	                     if [ "$retval" = "0" -a -n "$out" ]; then
-	                       #printf " %s %-60s %s\n" "[+]" "$SERVICE:" "running"
-	                       echo " [ + ]  $SERVICE"
-	                       continue
-	                     else
-	                       #printf " %s %-60s %s\n" "[-]" "$SERVICE:" "NOT running"
-	                       echo " [ - ]  $SERVICE"
-	                       continue
-	                     fi
-	                   fi
-	             #env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status
-	           fi
-	           ;;
-	       esac
-	     done
+         for SERVICE in * ; do
+           case "${SERVICE}" in
+             functions | halt | killall | single| linuxconf| kudzu)
+                 ;;
+             *)
+               if ! is_ignored_file "${SERVICE}" \
+               && [ -x "${SERVICEDIR}/${SERVICE}" ]; then
+                       out=$(env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status 2>&1)
+                       retval=$?
+                       if echo "$out" | egrep -iq "usage:"; then
+                         #printf " %s %-60s %s\n" "[?]" "$SERVICE:" "unknown" 1>&2
+                         echo " [ ? ]  $SERVICE" 1>&2
+                         continue
+                       else
+                         if [ "$retval" = "0" -a -n "$out" ]; then
+                           #printf " %s %-60s %s\n" "[+]" "$SERVICE:" "running"
+                           echo " [ + ]  $SERVICE"
+                           continue
+                         else
+                           #printf " %s %-60s %s\n" "[-]" "$SERVICE:" "NOT running"
+                           echo " [ - ]  $SERVICE"
+                           continue
+                         fi
+                       fi
+                 #env -i LANG="$LANG" LANGUAGE="$LANGUAGE" LC_CTYPE="$LC_CTYPE" LC_NUMERIC="$LC_NUMERIC" LC_TIME="$LC_TIME" LC_COLLATE="$LC_COLLATE" LC_MONETARY="$LC_MONETARY" LC_MESSAGES="$LC_MESSAGES" LC_PAPER="$LC_PAPER" LC_NAME="$LC_NAME" LC_ADDRESS="$LC_ADDRESS" LC_TELEPHONE="$LC_TELEPHONE" LC_MEASUREMENT="$LC_MEASUREMENT" LC_IDENTIFICATION="$LC_IDENTIFICATION" LC_ALL="$LC_ALL" PATH="$PATH" TERM="$TERM" "$SERVICEDIR/$SERVICE" status
+               fi
+               ;;
+           esac
+         done
           else
              systemctl $sctl_args list-units
           fi
diff --git a/pkgs/os-specific/linux/setools/default.nix b/pkgs/os-specific/linux/setools/default.nix
index 842a525353d..2e554a0241b 100644
--- a/pkgs/os-specific/linux/setools/default.nix
+++ b/pkgs/os-specific/linux/setools/default.nix
@@ -1,6 +1,5 @@
 { lib, fetchFromGitHub, python3
 , libsepol, libselinux, checkpolicy
-, fetchpatch
 , withGraphics ? false
 }:
 
@@ -9,28 +8,21 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "setools";
-  version = "4.3.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = pname;
-    rev = version;
-    sha256 = "0vr20bi8w147z5lclqz1l0j1b34137zg2r04pkafkgqqk7qbyjk6";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-4T5FIdnKi35JSm+IoYA2gIBBRV0nN0YLEw9xvDqNcgo=";
   };
 
-  patches = [
-    (fetchpatch { # included in 4.4.0
-      url = "https://github.com/SELinuxProject/setools/commit/f1b4a5d375be05fbccedb258c940d771bff8e524.diff";
-      sha256 = "1r38s6i4i6bdr2zdp5wcg1yifpf3pd018c73a511mgynyg7d11xy";
-    })
-  ];
-
   nativeBuildInputs = [ cython ];
   buildInputs = [ libsepol ];
   propagatedBuildInputs = [ enum34 libselinux networkx ]
     ++ optionals withGraphics [ pyqt5 ];
 
-  checkInputs = [ tox checkpolicy ];
+  nativeCheckInputs = [ tox checkpolicy ];
   preCheck = ''
     export CHECKPOLICY=${checkpolicy}/bin/checkpolicy
   '';
diff --git a/pkgs/os-specific/linux/seturgent/default.nix b/pkgs/os-specific/linux/seturgent/default.nix
index 2e9e445eddc..6d83e322ce8 100644
--- a/pkgs/os-specific/linux/seturgent/default.nix
+++ b/pkgs/os-specific/linux/seturgent/default.nix
@@ -1,16 +1,18 @@
-{ lib, stdenv, fetchurl, libX11, xorgproto, unzip }:
+{ lib, stdenv, fetchgit, libX11, xorgproto }:
 
-stdenv.mkDerivation {
-  name = "seturgent-2012-08-17";
+stdenv.mkDerivation rec {
+  pname = "seturgent";
+  version = "1.5";
 
-  src = fetchurl {
-    url = "https://github.com/hiltjo/seturgent/archive/ada70dcb15865391e5cdcab27a0739a304a17e03.zip";
-    sha256 = "0q1sr6aljkw2jr9b4xxzbc01qvnd5vk3pxrypif9yd8xjw4wqwri";
+  src = fetchgit {
+    url = "git://git.codemadness.org/seturgent";
+    rev = version;
+    sha256 = "sha256-XW7ms0BVCf1/fuL3PJ970t6sHkmMY1iLYXfS9R60JX0=";
   };
 
-  nativeBuildInputs = [ unzip ];
   buildInputs = [
-    libX11 xorgproto
+    libX11
+    xorgproto
   ];
 
   installPhase = ''
@@ -18,11 +20,11 @@ stdenv.mkDerivation {
     mv seturgent $out/bin
   '';
 
-  meta = {
-      platforms = lib.platforms.linux;
-      description = "Set an application's urgency hint (or not)";
-      maintainers = [ lib.maintainers.yarr ];
-      homepage = "https://github.com/hiltjo/seturgent";
-      license = lib.licenses.mit;
+  meta = with lib; {
+    platforms = platforms.linux;
+    description = "Set an application's urgency hint (or not)";
+    maintainers = with maintainers; [ yarr ];
+    homepage = "https://codemadness.org/seturgent-set-urgency-hints-for-x-applications.html";
+    license = licenses.mit;
   };
 }
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
new file mode 100644
index 00000000000..eed99122cd6
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -0,0 +1,93 @@
+{ stdenv
+, fetchFromGitHub
+, fetchurl
+, lib
+, curl
+, nlohmann_json
+, openssl
+, pkg-config
+, linkFarmFromDrvs
+, callPackage
+}:
+
+let
+  # Although those headers are also included in the source of `sgx-psw`, the `azure-dcap-client` build needs specific versions
+  filterSparse = list: ''
+    cp -r "$out"/. .
+    find "$out" -mindepth 1 -delete
+    cp ${lib.concatStringsSep " " list} "$out/"
+  '';
+  headers = linkFarmFromDrvs "azure-dcpa-client-intel-headers" [
+    (fetchFromGitHub rec {
+      name = "${repo}-headers";
+      owner = "intel";
+      repo = "SGXDataCenterAttestationPrimitives";
+      rev = "0436284f12f1bd5da7e7a06f6274d36b4c8d39f9";
+      sparseCheckout = [ "QuoteGeneration/quote_wrapper/common/inc/sgx_ql_lib_common.h" ];
+      hash = "sha256-ipKpYHbiwjCUXF/pCArJZy5ko1YX2wqMMdSnMUzhkgY=";
+      postFetch = filterSparse sparseCheckout;
+    })
+    (fetchFromGitHub rec {
+      name = "${repo}-headers";
+      owner = "intel";
+      repo = "linux-sgx";
+      rev = "1ccf25b64abd1c2eff05ead9d14b410b3c9ae7be";
+      hash = "sha256-WJRoS6+NBVJrFmHABEEDpDhW+zbWFUl65AycCkRavfs=";
+      sparseCheckout = [
+        "common/inc/sgx_report.h"
+        "common/inc/sgx_key.h"
+        "common/inc/sgx_attributes.h"
+      ];
+      postFetch = filterSparse sparseCheckout;
+    })
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "azure-dcap-client";
+  version = "1.11.2";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = pname;
+    rev = version;
+    hash = "sha256-EYj3jnzTyJRl6N7avNf9VrB8r9U6zIE6wBNeVsMtWCA=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    nlohmann_json
+    openssl
+  ];
+
+  postPatch = ''
+    mkdir -p src/Linux/ext/intel
+    find -L '${headers}' -type f -exec ln -s {} src/Linux/ext/intel \;
+
+    substitute src/Linux/Makefile{.in,} \
+      --replace '##CURLINC##' '${curl.dev}/include/curl/' \
+      --replace '$(TEST_SUITE): $(PROVIDER_LIB) $(TEST_SUITE_OBJ)' '$(TEST_SUITE): $(TEST_SUITE_OBJ)'
+  '';
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
+
+  makeFlags = [
+    "-C src/Linux"
+    "prefix=$(out)"
+  ];
+
+  # Online test suite; run with
+  # $(nix-build -A sgx-azure-dcap-client.tests.suite)/bin/tests
+  passthru.tests.suite = callPackage ./test-suite.nix { };
+
+  meta = with lib; {
+    description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
+    homepage = "https://github.com/microsoft/azure-dcap-client";
+    maintainers = with maintainers; [ trundle veehaitch ];
+    platforms = [ "x86_64-linux" ];
+    license = [ licenses.mit ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix
new file mode 100644
index 00000000000..71fdb2bab39
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix
@@ -0,0 +1,27 @@
+{ lib
+, sgx-azure-dcap-client
+, gtest
+, makeWrapper
+}:
+sgx-azure-dcap-client.overrideAttrs (oldAttrs: {
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [
+    makeWrapper
+    gtest
+  ];
+
+  buildFlags = [
+    "tests"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ./src/Linux/tests "$out/bin/tests"
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/tests" --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-azure-dcap-client ]}"
+  '';
+})
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
new file mode 100644
index 00000000000..fa4a7be01cf
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -0,0 +1,172 @@
+{ stdenv
+, lib
+, fetchurl
+, cmake
+, coreutils
+, curl
+, file
+, glibc
+, makeWrapper
+, nixosTests
+, protobuf
+, python3
+, sgx-sdk
+, shadow
+, systemd
+, util-linux
+, which
+, debug ? false
+}:
+stdenv.mkDerivation rec {
+  inherit (sgx-sdk) version versionTag src;
+  pname = "sgx-psw";
+
+  postUnpack =
+    let
+      ae.prebuilt = fetchurl {
+        url = "https://download.01.org/intel-sgx/sgx-linux/${versionTag}/prebuilt_ae_${versionTag}.tar.gz";
+        hash = "sha256-JriA9UGYFkAPuCtRizk8RMM1YOYGR/eO9ILnx47A40s=";
+      };
+      dcap = rec {
+        version = "1.13";
+        filename = "prebuilt_dcap_${version}.tar.gz";
+        prebuilt = fetchurl {
+          url = "https://download.01.org/intel-sgx/sgx-dcap/${version}/linux/${filename}";
+          hash = "sha256-0kD6hxN8qZ/7/H99aboQx7Qg7ewmYPEexoU6nqczAik=";
+        };
+      };
+    in
+    sgx-sdk.postUnpack + ''
+      # Make sure we use the correct version of prebuilt DCAP
+      grep -q 'ae_file_name=${dcap.filename}' "$src/external/dcap_source/QuoteGeneration/download_prebuilt.sh" \
+        || (echo "Could not find expected prebuilt DCAP ${dcap.filename} in linux-sgx source" >&2 && exit 1)
+
+      tar -zxf ${ae.prebuilt}   -C $sourceRoot/
+      tar -zxf ${dcap.prebuilt} -C $sourceRoot/external/dcap_source/QuoteGeneration/
+    '';
+
+  nativeBuildInputs = [
+    cmake
+    file
+    makeWrapper
+    python3
+    sgx-sdk
+    which
+  ];
+
+  buildInputs = [
+    curl
+    protobuf
+  ];
+
+  hardeningDisable = [
+    # causes redefinition of _FORTIFY_SOURCE
+    "fortify3"
+  ] ++ lib.optionals debug [
+    "fortify"
+  ];
+
+  postPatch = ''
+    patchShebangs \
+      linux/installer/bin/build-installpkg.sh \
+      linux/installer/common/psw/createTarball.sh \
+      linux/installer/common/psw/install.sh
+  '';
+
+  dontUseCmakeConfigure = true;
+
+  # Randomly fails if enabled
+  enableParallelBuilding = false;
+
+  buildFlags = [
+    "psw_install_pkg"
+  ] ++ lib.optionals debug [
+    "DEBUG=1"
+  ];
+
+  installFlags = [
+    "-C linux/installer/common/psw/output"
+    "DESTDIR=$(TMPDIR)/install"
+  ];
+
+  postInstall = ''
+    installDir=$TMPDIR/install
+    sgxPswDir=$installDir/opt/intel/sgxpsw
+
+    mv $installDir/usr/lib64/ $out/lib/
+    ln -sr $out/lib $out/lib64
+
+    # Install udev rules to lib/udev/rules.d
+    mv $sgxPswDir/udev/ $out/lib/
+
+    # Install example AESM config
+    mkdir $out/etc/
+    mv $sgxPswDir/aesm/conf/aesmd.conf $out/etc/
+    rmdir $sgxPswDir/aesm/conf/
+
+    # Delete init service
+    rm $sgxPswDir/aesm/aesmd.conf
+
+    # Move systemd services
+    mkdir -p $out/lib/systemd/system/
+    mv $sgxPswDir/aesm/aesmd.service $out/lib/systemd/system/
+    mv $sgxPswDir/remount-dev-exec.service $out/lib/systemd/system/
+
+    # Move misc files
+    mkdir $out/share/
+    mv $sgxPswDir/licenses $out/share/
+
+    # Remove unnecessary files
+    rm $sgxPswDir/{cleanup.sh,startup.sh}
+    rm -r $sgxPswDir/scripts
+
+    mv $sgxPswDir/aesm/ $out/
+
+    mkdir $out/bin
+    makeWrapper $out/aesm/aesm_service $out/bin/aesm_service \
+      --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
+      --chdir "$out/aesm"
+
+    # Make sure we didn't forget to handle any files
+    rmdir $sgxPswDir || (echo "Error: The directory $installDir still contains unhandled files: $(ls -A $installDir)" >&2 && exit 1)
+  '';
+
+  # Most—if not all—of those fixups are not relevant for NixOS as we have our own
+  # NixOS module which is based on those files without relying on them. Still, it
+  # is helpful to have properly patched versions for non-NixOS distributions.
+  postFixup = ''
+    echo "Fixing aesmd.service"
+    substituteInPlace $out/lib/systemd/system/aesmd.service \
+      --replace '@aesm_folder@' \
+                "$out/aesm" \
+      --replace 'Type=forking' \
+                'Type=simple' \
+      --replace "ExecStart=$out/aesm/aesm_service" \
+                "ExecStart=$out/bin/aesm_service --no-daemon"\
+      --replace "/bin/mkdir" \
+                "${coreutils}/bin/mkdir" \
+      --replace "/bin/chown" \
+                "${coreutils}/bin/chown" \
+      --replace "/bin/chmod" \
+                "${coreutils}/bin/chmod" \
+      --replace "/bin/kill" \
+                "${coreutils}/bin/kill"
+
+    echo "Fixing remount-dev-exec.service"
+    substituteInPlace $out/lib/systemd/system/remount-dev-exec.service \
+      --replace '/bin/mount' \
+                "${util-linux}/bin/mount"
+  '';
+
+  passthru.tests = {
+    service = nixosTests.aesmd;
+  };
+
+  meta = with lib; {
+    description = "Intel SGX Architectural Enclave Service Manager";
+    homepage = "https://github.com/intel/linux-sgx";
+    maintainers = with maintainers; [ veehaitch citadelcore ];
+    platforms = [ "x86_64-linux" ];
+    license = with licenses; [ bsd3 ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sgx/samples/default.nix b/pkgs/os-specific/linux/sgx/samples/default.nix
new file mode 100644
index 00000000000..2afd62de75d
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/samples/default.nix
@@ -0,0 +1,109 @@
+{ stdenv
+, lib
+, makeWrapper
+, sgx-sdk
+, sgx-psw
+, which
+  # "SIM" or "HW"
+, sgxMode
+}:
+let
+  isSimulation = sgxMode == "SIM";
+  buildSample = name: stdenv.mkDerivation {
+    pname = name;
+    version = sgxMode;
+
+    src = sgx-sdk.out;
+    sourceRoot = "${sgx-sdk.name}/share/SampleCode/${name}";
+
+    nativeBuildInputs = [
+      makeWrapper
+      which
+    ];
+
+    buildInputs = [
+      sgx-sdk
+    ];
+
+    # The samples don't have proper support for parallel building
+    # causing them to fail randomly.
+    enableParallelBuilding = false;
+
+    buildFlags = [
+      "SGX_MODE=${sgxMode}"
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib}
+      install -m 755 app $out/bin
+      install *.so $out/lib
+
+      wrapProgram "$out/bin/app" \
+        --chdir "$out/lib" \
+        ${lib.optionalString (!isSimulation)
+        ''--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"''}
+
+      runHook postInstall
+    '';
+
+    # Breaks the signature of the enclaves
+    dontFixup = true;
+
+    # We don't have access to real SGX hardware during the build
+    doInstallCheck = isSimulation;
+    installCheckPhase = ''
+      runHook preInstallCheck
+
+      pushd /
+      echo a | $out/bin/app
+      popd
+
+      runHook preInstallCheck
+    '';
+  };
+in
+{
+  cxx11SGXDemo = buildSample "Cxx11SGXDemo";
+  localAttestation = (buildSample "LocalAttestation").overrideAttrs (oldAttrs: {
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib}
+      install -m 755 bin/app* $out/bin
+      install bin/*.so $out/lib
+
+      for bin in $out/bin/*; do
+        wrapProgram $bin \
+          --chdir "$out/lib" \
+          ${lib.optionalString (!isSimulation)
+          ''--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-psw ]}"''}
+      done
+
+      runHook postInstall
+    '';
+  });
+  powerTransition = buildSample "PowerTransition";
+  protobufSGXDemo = buildSample "ProtobufSGXDemo";
+  remoteAttestation = (buildSample "RemoteAttestation").overrideAttrs (oldAttrs: {
+    # Makefile sets rpath to point to $TMPDIR
+    preFixup = ''
+      patchelf --remove-rpath $out/bin/app
+    '';
+
+    postInstall = ''
+      install sample_libcrypto/*.so $out/lib
+    '';
+  });
+  sampleEnclave = buildSample "SampleEnclave";
+  sampleEnclavePCL = buildSample "SampleEnclavePCL";
+  sampleEnclaveGMIPP = buildSample "SampleEnclaveGMIPP";
+  sealUnseal = (buildSample "SealUnseal").overrideAttrs (oldAttrs: {
+    prePatch = ''
+      substituteInPlace App/App.cpp \
+        --replace '"sealed_data_blob.txt"' '"/tmp/sealed_data_blob.txt"'
+    '';
+  });
+  switchless = buildSample "Switchless";
+}
diff --git a/pkgs/os-specific/linux/sgx/sdk/default.nix b/pkgs/os-specific/linux/sgx/sdk/default.nix
new file mode 100644
index 00000000000..053aaecbcbb
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/sdk/default.nix
@@ -0,0 +1,285 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, fetchzip
+, autoconf
+, automake
+, binutils
+, callPackage
+, cmake
+, file
+, gdb
+, git
+, libtool
+, linkFarmFromDrvs
+, nasm
+, ocaml
+, ocamlPackages
+, openssl_1_1
+, perl
+, python3
+, texinfo
+, validatePkgConfig
+, writeShellApplication
+, writeShellScript
+, writeText
+, debug ? false
+}:
+stdenv.mkDerivation rec {
+  pname = "sgx-sdk";
+  # Version as given in se_version.h
+  version = "2.16.100.4";
+  # Version as used in the Git tag
+  versionTag = "2.16";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "linux-sgx";
+    rev = "sgx_${versionTag}";
+    hash = "sha256-qgXuJJWiqmcU11umCsE3DnlK4VryuTDAsNf53YPw6UY=";
+    fetchSubmodules = true;
+  };
+
+  postUnpack = ''
+    # Make sure this is the right version of linux-sgx
+    grep -q '"${version}"' "$src/common/inc/internal/se_version.h" \
+      || (echo "Could not find expected version ${version} in linux-sgx source" >&2 && exit 1)
+  '';
+
+  patches = [
+    # Fix missing pthread_compat.h, see https://github.com/intel/linux-sgx/pull/784
+    (fetchpatch {
+      url = "https://github.com/intel/linux-sgx/commit/254b58f922a6bd49c308a4f47f05f525305bd760.patch";
+      sha256 = "sha256-sHU++K7NJ+PdITx3y0PwstA9MVh10rj2vrLn01N9F4w=";
+    })
+  ];
+
+  postPatch = ''
+    patchShebangs linux/installer/bin/build-installpkg.sh \
+      linux/installer/common/sdk/createTarball.sh \
+      linux/installer/common/sdk/install.sh
+  '';
+
+  # We need `cmake` as a build input but don't use it to kick off the build phase
+  dontUseCmakeConfigure = true;
+
+  # SDK built with stackprotector produces broken enclaves which crash at runtime.
+  # Disable all to be safe, SDK build configures compiler mitigations manually.
+  hardeningDisable = [ "all" ];
+
+  nativeBuildInputs = [
+    autoconf
+    automake
+    cmake
+    file
+    git
+    ocaml
+    ocamlPackages.ocamlbuild
+    perl
+    python3
+    texinfo
+    validatePkgConfig
+  ];
+
+  buildInputs = [
+    libtool
+    openssl_1_1
+  ];
+
+  BINUTILS_DIR = "${binutils}/bin";
+
+  # Build external/ippcp_internal first. The Makefile is rewritten to make the
+  # build faster by splitting different versions of ipp-crypto builds and to
+  # avoid patching the Makefile for reproducibility issues.
+  preBuild =
+    let
+      ipp-crypto-no_mitigation = callPackage ./ipp-crypto.nix { };
+
+      sgx-asm-pp = "python ${src}/build-scripts/sgx-asm-pp.py --assembler=nasm";
+
+      nasm-load = writeShellScript "nasm-load" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=LOAD $@";
+      ipp-crypto-cve_2020_0551_load = callPackage ./ipp-crypto.nix {
+        extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-load}" ];
+      };
+
+      nasm-cf = writeShellScript "nasm-cf" "${sgx-asm-pp} --MITIGATION-CVE-2020-0551=CF $@";
+      ipp-crypto-cve_2020_0551_cf = callPackage ./ipp-crypto.nix {
+        extraCmakeFlags = [ "-DCMAKE_ASM_NASM_COMPILER=${nasm-cf}" ];
+      };
+    in
+    ''
+      echo "Setting up IPP crypto build artifacts"
+
+      pushd 'external/ippcp_internal'
+
+      cp -r ${ipp-crypto-no_mitigation}/include/. inc/
+
+      install -D -m a+rw ${ipp-crypto-no_mitigation}/lib/intel64/libippcp.a \
+        lib/linux/intel64/no_mitigation/libippcp.a
+      install -D -m a+rw ${ipp-crypto-cve_2020_0551_load}/lib/intel64/libippcp.a \
+        lib/linux/intel64/cve_2020_0551_load/libippcp.a
+      install -D -m a+rw ${ipp-crypto-cve_2020_0551_cf}/lib/intel64/libippcp.a \
+        lib/linux/intel64/cve_2020_0551_cf/libippcp.a
+
+      rm inc/ippcp.h
+      patch ${ipp-crypto-no_mitigation}/include/ippcp.h -i inc/ippcp21u3.patch -o inc/ippcp.h
+
+      install -D ${ipp-crypto-no_mitigation.src}/LICENSE license/LICENSE
+
+      popd
+    '';
+
+  buildFlags = [
+    "sdk_install_pkg"
+  ] ++ lib.optionals debug [
+    "DEBUG=1"
+  ];
+
+  enableParallelBuilding = true;
+
+  postBuild = ''
+    patchShebangs linux/installer/bin/sgx_linux_x64_sdk_${version}.bin
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    installDir=$TMPDIR
+    ./linux/installer/bin/sgx_linux_x64_sdk_${version}.bin -prefix $installDir
+    installDir=$installDir/sgxsdk
+
+    echo "Move files created by installer"
+
+    mkdir -p $out/bin
+    pushd $out
+
+    mv $installDir/bin/sgx-gdb $out/bin
+    mkdir $out/bin/x64
+    for file in $installDir/bin/x64/*; do
+      mv $file bin/
+      ln -sr bin/$(basename $file) bin/x64/
+    done
+    rmdir $installDir/bin/{x64,}
+
+    # Move `lib64` to `lib` and symlink `lib64`
+    mv $installDir/lib64 lib
+    ln -s lib/ lib64
+
+    mv $installDir/include/ .
+
+    mkdir -p share/
+    mv $installDir/{SampleCode,licenses} share/
+
+    mkdir -p share/bin
+    mv $installDir/{environment,buildenv.mk} share/bin/
+    ln -s share/bin/{environment,buildenv.mk} .
+
+    # pkgconfig should go to lib/
+    mv $installDir/pkgconfig lib/
+    ln -s lib/pkgconfig/ .
+
+    # Also create the `sdk_libs` for compat. All the files
+    # link to libraries in `lib64/`, we shouldn't link the entire
+    # directory, however, as there seems to be some ambiguity between
+    # SDK and PSW libraries.
+    mkdir sdk_libs/
+    for file in $installDir/sdk_libs/*; do
+      ln -sr lib/$(basename $file) sdk_libs/
+      rm $file
+    done
+    rmdir $installDir/sdk_libs
+
+    # No uninstall script required
+    rm $installDir/uninstall.sh
+
+    # Create an `sgxsdk` symlink which points to `$out` for compat
+    ln -sr . sgxsdk
+
+    # Make sure we didn't forget any files
+    rmdir $installDir || (echo "Error: The directory $installDir still contains unhandled files: $(ls -A $installDir)" >&2 && exit 1)
+
+    popd
+
+    runHook postInstall
+  '';
+
+
+  preFixup = ''
+    echo "Strip sgxsdk prefix"
+    for path in "$out/share/bin/environment" "$out/bin/sgx-gdb"; do
+      substituteInPlace $path --replace "$TMPDIR/sgxsdk" "$out"
+    done
+
+    echo "Fixing pkg-config files"
+    sed -i "s|prefix=.*|prefix=$out|g" $out/lib/pkgconfig/*.pc
+
+    echo "Fixing SGX_SDK default in samples"
+    substituteInPlace $out/share/SampleCode/LocalAttestation/buildenv.mk \
+      --replace '/opt/intel/sgxsdk' "$out"
+    for file in $out/share/SampleCode/*/Makefile; do
+      substituteInPlace $file \
+        --replace '/opt/intel/sgxsdk' "$out"
+    done
+
+    echo "Fixing BINUTILS_DIR in buildenv.mk"
+    substituteInPlace $out/share/bin/buildenv.mk \
+      --replace 'BINUTILS_DIR ?= /usr/local/bin' \
+                'BINUTILS_DIR ?= ${BINUTILS_DIR}'
+
+    echo "Fixing GDB path in bin/sgx-gdb"
+    substituteInPlace $out/bin/sgx-gdb --replace '/usr/local/bin/gdb' '${gdb}/bin/gdb'
+  '';
+
+  doInstallCheck = true;
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # Make sure all symlinks are valid
+    output=$(find "$out" -type l -exec test ! -e {} \; -print)
+    if [[ -n "$output" ]]; then
+      echo "Broken symlinks:"
+      echo "$output"
+      exit 1
+    fi
+
+    runHook postInstallCheck
+  '';
+
+  setupHook = writeText "setup-hook.sh" ''
+    sgxsdk() {
+        export SGX_SDK=@out@
+    }
+
+    postHooks+=(sgxsdk)
+  '';
+
+  passthru.tests = callPackage ../samples { sgxMode = "SIM"; };
+
+  # Run tests in SGX hardware mode on an SGX-enabled machine
+  # $(nix-build -A sgx-sdk.runTestsHW)/bin/run-tests-hw
+  passthru.runTestsHW =
+    let
+      testsHW = lib.filterAttrs (_: v: v ? "name") (callPackage ../samples { sgxMode = "HW"; });
+      testsHWLinked = linkFarmFromDrvs "sgx-samples-hw-bundle" (lib.attrValues testsHW);
+    in
+    writeShellApplication {
+      name = "run-tests-hw";
+      text = ''
+        for test in ${testsHWLinked}/*; do
+          printf '*** Running test %s ***\n\n' "$(basename "$test")"
+          printf 'a\n' | "$test/bin/app"
+          printf '\n'
+        done
+      '';
+    };
+
+  meta = with lib; {
+    description = "Intel SGX SDK for Linux built with IPP Crypto Library";
+    homepage = "https://github.com/intel/linux-sgx";
+    maintainers = with maintainers; [ sbellem arturcygan veehaitch ];
+    platforms = [ "x86_64-linux" ];
+    license = with licenses; [ bsd3 ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
new file mode 100644
index 00000000000..b9f682f5319
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/sdk/ipp-crypto.nix
@@ -0,0 +1,36 @@
+{ lib
+, gcc11Stdenv
+, fetchFromGitHub
+, cmake
+, nasm
+, openssl_1_1
+, python3
+, extraCmakeFlags ? [ ]
+}:
+
+gcc11Stdenv.mkDerivation rec {
+  pname = "ipp-crypto";
+  version = "2021.3";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ipp-crypto";
+    rev = "ippcp_${version}";
+    hash = "sha256-QEJXvQ//zhQqibFxXwPMdS1MHewgyb24LRmkycVSGrM=";
+  };
+
+  # Fix typo: https://github.com/intel/ipp-crypto/pull/33
+  postPatch = ''
+    substituteInPlace sources/cmake/ippcp-gen-config.cmake \
+      --replace 'ippcpo-config.cmake' 'ippcp-config.cmake'
+  '';
+
+  cmakeFlags = [ "-DARCH=intel64" ] ++ extraCmakeFlags;
+
+  nativeBuildInputs = [
+    cmake
+    nasm
+    openssl_1_1
+    python3
+  ];
+}
diff --git a/pkgs/os-specific/linux/sgx/ssl/default.nix b/pkgs/os-specific/linux/sgx/ssl/default.nix
new file mode 100644
index 00000000000..f3f6ce48506
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/ssl/default.nix
@@ -0,0 +1,95 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, fetchurl
+, lib
+, perl
+, sgx-sdk
+, which
+, debug ? false
+}:
+let
+  sgxVersion = sgx-sdk.versionTag;
+  opensslVersion = "1.1.1l";
+in
+stdenv.mkDerivation rec {
+  pname = "sgx-ssl" + lib.optionalString debug "-debug";
+  version = "${sgxVersion}_${opensslVersion}";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "intel-sgx-ssl";
+    rev = "lin_${sgxVersion}_${opensslVersion}";
+    hash = "sha256-ibPXs90ni2fkxJ09fNO6wWVpfCFdko6MjBFkEsyIih8=";
+  };
+
+  postUnpack =
+    let
+      opensslSourceArchive = fetchurl {
+        url = "https://www.openssl.org/source/openssl-${opensslVersion}.tar.gz";
+        hash = "sha256-C3o+XlnDSCf+DDp0t+yLrvMCuY+oAIjX+RU6oW+na9E=";
+      };
+    in
+    ''
+      ln -s ${opensslSourceArchive} $sourceRoot/openssl_source/openssl-${opensslVersion}.tar.gz
+    '';
+
+  patches = [
+    # https://github.com/intel/intel-sgx-ssl/pull/111
+    ./intel-sgx-ssl-pr-111.patch
+  ];
+
+  postPatch = ''
+    patchShebangs Linux/build_openssl.sh
+
+    # Run the test in the `installCheckPhase`, not the `buildPhase`
+    substituteInPlace Linux/sgx/Makefile \
+      --replace '$(MAKE) -C $(TEST_DIR) all' \
+                'bash -c "true"'
+  '';
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [
+    perl
+    sgx-sdk
+    stdenv.cc.libc
+    which
+  ];
+
+  makeFlags = [
+    "-C Linux"
+  ] ++ lib.optionals debug [
+    "DEBUG=1"
+  ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+  ];
+
+  # Build the test app
+  #
+  # Running the test app is currently only supported on Intel CPUs
+  # and will fail on non-Intel CPUs even in SGX simulation mode.
+  # Therefore, we only build the test app without running it until
+  # upstream resolves the issue: https://github.com/intel/intel-sgx-ssl/issues/113
+  doInstallCheck = true;
+  installCheckTarget = "all";
+  installCheckFlags = [
+    "SGX_MODE=SIM"
+    "-C sgx/test_app"
+    "-j 1" # Makefile doesn't support multiple jobs
+  ];
+  preInstallCheck = ''
+    # Expects the enclave file in the current working dir
+    ln -s sgx/test_app/TestEnclave.signed.so .
+  '';
+
+  meta = with lib; {
+    description = "Cryptographic library for Intel SGX enclave applications based on OpenSSL";
+    homepage = "https://github.com/intel/intel-sgx-ssl";
+    maintainers = with maintainers; [ trundle veehaitch ];
+    platforms = [ "x86_64-linux" ];
+    license = with licenses; [ bsd3 openssl ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sgx/ssl/intel-sgx-ssl-pr-111.patch b/pkgs/os-specific/linux/sgx/ssl/intel-sgx-ssl-pr-111.patch
new file mode 100644
index 00000000000..6ef06d7e231
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/ssl/intel-sgx-ssl-pr-111.patch
@@ -0,0 +1,99 @@
+From 1683c336e11b3cbe2b48c1be1c9460a661523c71 Mon Sep 17 00:00:00 2001
+From: Vincent Haupert <mail@vincent-haupert.de>
+Date: Sat, 8 Jan 2022 17:22:31 +0100
+Subject: [PATCH 1/3] Linux: fix Nix detection
+
+Detect the `OS_ID` of Nix by probing for the presence of the `NIX_STORE`
+environment variable instead of `NIX_PATH`. The latter is only set in a
+`nix-shell` session but isn't when building a derivation through
+`nix-build`. In contrast, the `NIX_STORE` environment variable is set in
+both cases.
+
+Signed-off-by: Vincent Haupert <mail@vincent-haupert.de>
+---
+ Linux/sgx/buildenv.mk | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Linux/sgx/buildenv.mk b/Linux/sgx/buildenv.mk
+index cd8818e..dac23c7 100644
+--- a/Linux/sgx/buildenv.mk
++++ b/Linux/sgx/buildenv.mk
+@@ -65,7 +65,7 @@ $(shell mkdir -p $(PACKAGE_LIB))
+ UBUNTU_CONFNAME:=/usr/include/x86_64-linux-gnu/bits/confname.h
+ ifneq ("$(wildcard $(UBUNTU_CONFNAME))","")
+ 	OS_ID=1
+-else ifeq ($(origin NIX_PATH),environment)
++else ifeq ($(origin NIX_STORE),environment)
+ 	OS_ID=3
+ else
+ 	OS_ID=2
+
+From f493525face589d759223bfa45bb802c31ddce4f Mon Sep 17 00:00:00 2001
+From: Vincent Haupert <mail@vincent-haupert.de>
+Date: Sat, 8 Jan 2022 17:33:22 +0100
+Subject: [PATCH 2/3] Linux: call binaries relative to PATH
+
+Using an absolute path to call binaries is incompatible with
+distributions which do not follow the Filesystem Hierachy Standard;
+Nix is an example. Also, it is inconsistent with the rest of the code
+base, let alone superfluous.
+
+Signed-off-by: Vincent Haupert <mail@vincent-haupert.de>
+---
+ Linux/build_openssl.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Linux/build_openssl.sh b/Linux/build_openssl.sh
+index 7d77b79..e8b59a1 100755
+--- a/Linux/build_openssl.sh
++++ b/Linux/build_openssl.sh
+@@ -38,7 +38,7 @@ SGXSSL_ROOT="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+ echo $SGXSSL_ROOT
+ 
+ OPENSSL_INSTALL_DIR="$SGXSSL_ROOT/../openssl_source/OpenSSL_install_dir_tmp"
+-OPENSSL_VERSION=`/bin/ls $SGXSSL_ROOT/../openssl_source/*1.1.1*.tar.gz | /usr/bin/head -1 | /bin/grep -o '[^/]*$' | /bin/sed -s -- 's/\.tar\.gz//'`
++OPENSSL_VERSION=`ls $SGXSSL_ROOT/../openssl_source/*1.1.1*.tar.gz | head -1 | grep -o '[^/]*$' | sed -s -- 's/\.tar\.gz//'`
+ if [ "$OPENSSL_VERSION" == "" ] 
+ then
+ 	echo "In order to run this script, OpenSSL tar.gz package must be located in openssl_source/ directory."
+
+From fdb883d30fff72b5cfb8c61a2288d3d948f64224 Mon Sep 17 00:00:00 2001
+From: Vincent Haupert <mail@vincent-haupert.de>
+Date: Tue, 11 Jan 2022 10:56:39 +0100
+Subject: [PATCH 3/3] Linux: properly extract GCC major version
+
+Calling `gcc -dumpversion` yields the full version string, e.g.,
+`10.3.0`. The `build_openssl.sh` bash script uses the `-ge` number
+comparison operator to check if the returned version is at least
+8. This results in an error if the returned GCC version includes a patch
+version; "10.3.0" isn't a valid number.
+
+This commit fixes the version detection by only extracting the relevant
+major version of GCC.
+
+Signed-off-by: Vincent Haupert <mail@vincent-haupert.de>
+---
+ Linux/build_openssl.sh | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/Linux/build_openssl.sh b/Linux/build_openssl.sh
+index e8b59a1..6e4046f 100755
+--- a/Linux/build_openssl.sh
++++ b/Linux/build_openssl.sh
+@@ -82,6 +82,7 @@ fi
+ MITIGATION_OPT=""
+ MITIGATION_FLAGS=""
+ CC_VERSION=`gcc -dumpversion`
++CC_VERSION_MAJOR=`echo "$CC_VERSION" | cut -f1 -d.`
+ for arg in "$@"
+ do
+     case $arg in
+@@ -99,7 +100,7 @@ do
+         ;;
+     -mfunction-return=thunk-extern)
+         MITIGATION_FLAGS+=" $arg"
+-        if [[ $CC_VERSION -ge 8 ]] ; then
++        if [[ "$CC_VERSION_MAJOR" -ge 8 ]] ; then
+             MITIGATION_FLAGS+=" -fcf-protection=none"
+         fi
+         shift
diff --git a/pkgs/os-specific/linux/shadow/default.nix b/pkgs/os-specific/linux/shadow/default.nix
index e20023b2b6e..38fec65b333 100644
--- a/pkgs/os-specific/linux/shadow/default.nix
+++ b/pkgs/os-specific/linux/shadow/default.nix
@@ -1,56 +1,58 @@
-{ lib, stdenv, nixosTests, fetchpatch, fetchFromGitHub, autoreconfHook, libxslt
-, libxml2 , docbook_xml_dtd_45, docbook_xsl, itstool, flex, bison, runtimeShell
-, pam ? null, glibcCross ? null
+{ lib, stdenv, fetchFromGitHub
+, runtimeShell, nixosTests
+, autoreconfHook, bison, flex
+, docbook_xml_dtd_45, docbook_xsl
+, itstool, libbsd, libxml2, libxslt
+, libxcrypt, pkg-config
+, glibcCross ? null
+, pam ? null
+, withTcb ? lib.meta.availableOn stdenv.hostPlatform tcb, tcb
 }:
-
 let
-
   glibc =
-    if stdenv.hostPlatform != stdenv.buildPlatform
-    then glibcCross
+    if stdenv.hostPlatform != stdenv.buildPlatform then glibcCross
     else assert stdenv.hostPlatform.libc == "glibc"; stdenv.cc.libc;
 
-  dots_in_usernames = fetchpatch {
-    url = "http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/sys-apps/shadow/files/shadow-4.1.3-dots-in-usernames.patch";
-    sha256 = "1fj3rg6x3jppm5jvi9y7fhd2djbi4nc5pgwisw00xlh4qapgz692";
-  };
-
 in
 
 stdenv.mkDerivation rec {
   pname = "shadow";
-  version = "4.8.1";
+  version = "4.14.1";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
-    repo = "shadow";
+    repo = pname;
     rev = version;
-    sha256 = "13407r6qwss00504qy740jghb2dzd561la7dhp47rg8w3g8jarpn";
+    hash = "sha256-DzPPnttnJSOMQwXWyFcz6fEtjwBC3p2PpZpBAQ/Ew18=";
   };
 
-  buildInputs = lib.optional (pam != null && stdenv.isLinux) pam;
-  nativeBuildInputs = [autoreconfHook libxslt libxml2
-    docbook_xml_dtd_45 docbook_xsl flex bison itstool
-    ];
-
-  patches =
-    [ ./keep-path.patch
-      # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
-      ./respect-xml-catalog-files-var.patch
-      dots_in_usernames
-      ./runtime-shell.patch
-    ];
+  outputs = [ "out" "su" "dev" "man" ];
 
   RUNTIME_SHELL = runtimeShell;
 
-  # The nix daemon often forbids even creating set[ug]id files.
-  postPatch =
-    ''sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
-    '';
-
-  outputs = [ "out" "su" "man" ];
+  nativeBuildInputs = [
+    autoreconfHook bison flex
+    docbook_xml_dtd_45 docbook_xsl
+    itstool libxml2 libxslt
+    pkg-config
+  ];
+
+  buildInputs = [ libbsd libxcrypt ]
+    ++ lib.optional (pam != null && stdenv.isLinux) pam
+    ++ lib.optional withTcb tcb;
+
+  patches = [
+    ./keep-path.patch
+    # Obtain XML resources from XML catalog (patch adapted from gtk-doc)
+    ./respect-xml-catalog-files-var.patch
+    ./runtime-shell.patch
+    ./fix-install-with-tcb.patch
+  ];
 
-  enableParallelBuilding = true;
+  # The nix daemon often forbids even creating set[ug]id files.
+  postPatch = ''
+    sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
+  '';
 
   # Assume System V `setpgrp (void)', which is the default on GNU variants
   # (`AC_FUNC_SETPGRP' is not cross-compilation capable.)
@@ -62,23 +64,26 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--enable-man"
     "--with-group-name-max-length=32"
-  ] ++ lib.optional (stdenv.hostPlatform.libc != "glibc") "--disable-nscd";
-
-  preBuild = lib.optionalString (stdenv.hostPlatform.libc == "glibc")
-    ''
-      substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc.bin}/bin/nscd
-    '';
-
-  postInstall =
-    ''
-      # Don't install ‘groups’, since coreutils already provides it.
-      rm $out/bin/groups
-      rm $man/share/man/man1/groups.*
-
-      # Move the su binary into the su package
-      mkdir -p $su/bin
-      mv $out/bin/su $su/bin
-    '';
+    "--with-bcrypt"
+    "--with-yescrypt"
+  ] ++ lib.optional (stdenv.hostPlatform.libc != "glibc") "--disable-nscd"
+    ++ lib.optional withTcb "--with-tcb";
+
+  preBuild = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''
+    substituteInPlace lib/nscd.c --replace /usr/sbin/nscd ${glibc.bin}/bin/nscd
+  '';
+
+  postInstall = ''
+    # Don't install ‘groups’, since coreutils already provides it.
+    rm $out/bin/groups
+    rm $man/share/man/man1/groups.*
+
+    # Move the su binary into the su package
+    mkdir -p $su/bin
+    mv $out/bin/su $su/bin
+  '';
+
+  enableParallelBuilding = true;
 
   disallowedReferences = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.shellPackage;
 
diff --git a/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch b/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch
new file mode 100644
index 00000000000..ff6166b92f1
--- /dev/null
+++ b/pkgs/os-specific/linux/shadow/fix-install-with-tcb.patch
@@ -0,0 +1,28 @@
+diff --git a/src/Makefile.am b/src/Makefile.am
+index a1a2e4e..fa17f9d 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -74,10 +74,6 @@ suidubins += newgidmap newuidmap
+ endif
+ endif
+ 
+-if WITH_TCB
+-shadowsgidubins = passwd
+-endif
+-
+ LDADD          = $(INTLLIBS) \
+ 		 $(top_builddir)/libmisc/libmisc.la \
+ 		 $(top_builddir)/lib/libshadow.la \
+@@ -146,12 +142,6 @@ install-am: all-am
+ 	set -e; for i in $(suidusbins); do \
+ 		chmod $(suidperms) $(DESTDIR)$(usbindir)/$$i; \
+ 	done
+-if WITH_TCB
+-	set -e; for i in $(shadowsgidubins); do \
+-		chown root:shadow $(DESTDIR)$(ubindir)/$$i; \
+-		chmod $(sgidperms) $(DESTDIR)$(ubindir)/$$i; \
+-	done
+-endif
+ if ENABLE_SUBIDS
+ if FCAPS
+ 	setcap cap_setuid+ep $(DESTDIR)$(ubindir)/newuidmap
diff --git a/pkgs/os-specific/linux/sinit/default.nix b/pkgs/os-specific/linux/sinit/default.nix
index 830087013fe..a412461bfd5 100644
--- a/pkgs/os-specific/linux/sinit/default.nix
+++ b/pkgs/os-specific/linux/sinit/default.nix
@@ -1,36 +1,29 @@
-{lib, stdenv, fetchgit, rcinit ? null, rcshutdown ? null, rcreboot ? null}:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="sinit";
-    version="1.0";
-    name="${baseName}-${version}";
-    url="https://git.suckless.org/sinit/";
-    sha256="0cf8yylgrrj1wxm5v6jdlbnxpx97m38yxrc9nmv1l8hldjqsj9pc";
+{ lib, stdenv, fetchgit, rcinit ? null, rcshutdown ? null, rcreboot ? null }:
+
+stdenv.mkDerivation rec {
+  pname = "sinit";
+  version = "1.1";
+
+  src = fetchgit {
+    url = "https://git.suckless.org/sinit/";
+    sha256 = "sha256-VtXkgixgElKKOT26uKN9feXDVjjtSgTWvcgk5o5MLmw=";
     rev = "refs/tags/v${version}";
   };
   buildInputs = [
     (lib.getOutput "static" stdenv.cc.libc)
   ];
-in
-stdenv.mkDerivation {
-  inherit (s) name version;
-  inherit buildInputs;
-  src = fetchgit {
-    inherit (s) url sha256 rev;
-  };
-  makeFlags = ["PREFIX=$(out)"];
+  makeFlags = [ "PREFIX=$(out)" ];
   preConfigure = ""
     + (lib.optionalString (rcinit != null) ''sed -re 's@(rcinitcmd[^"]*")[^"]*"@\1${rcinit}"@' -i config.def.h; '')
     + (lib.optionalString (rcshutdown != null) ''sed -re 's@(rc(reboot|poweroff)cmd[^"]*")[^"]*"@\1${rcshutdown}"@' -i config.def.h; '')
     + (lib.optionalString (rcreboot != null) ''sed -re 's@(rc(reboot)cmd[^"]*")[^"]*"@\1${rcreboot}"@' -i config.def.h; '')
-    ;
-  meta = {
-    inherit (s) version;
+  ;
+
+  meta = with lib; {
     description = "A very minimal Linux init implementation from suckless.org";
-    license = lib.licenses.mit ;
-    maintainers = [lib.maintainers.raskin];
-    platforms = lib.platforms.linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ raskin ];
+    platforms = platforms.linux;
     homepage = "https://tools.suckless.org/sinit";
     downloadPage = "https://git.suckless.org/sinit";
   };
diff --git a/pkgs/os-specific/linux/smem/default.nix b/pkgs/os-specific/linux/smem/default.nix
index cace3e22ae7..6308b83b600 100644
--- a/pkgs/os-specific/linux/smem/default.nix
+++ b/pkgs/os-specific/linux/smem/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, python }:
+{ lib, stdenv, fetchurl, python3 }:
 
 stdenv.mkDerivation rec {
   pname = "smem";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "19ibv1byxf2b68186ysrgrhy5shkc5mc69abark1h18yigp3j34m";
   };
 
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
 
   makeFlags = [ "smemcap" ];
 
diff --git a/pkgs/os-specific/linux/smemstat/default.nix b/pkgs/os-specific/linux/smemstat/default.nix
index 64525052af2..d8f8c1bc025 100644
--- a/pkgs/os-specific/linux/smemstat/default.nix
+++ b/pkgs/os-specific/linux/smemstat/default.nix
@@ -1,21 +1,26 @@
-{ stdenv, lib, fetchurl, ncurses }:
+{ stdenv, lib, fetchFromGitHub, ncurses }:
 
 stdenv.mkDerivation rec {
   pname = "smemstat";
-  version = "0.02.08";
-  src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/smemstat/smemstat-${version}.tar.xz";
-    sha256 = "1agigvkv1868cskivzrwyiixl658x5bv7xpz4xjc8mlii4maivpp";
+  version = "0.02.12";
+
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    hash = "sha256-5gO26F80nZvZ6RIqX8o7bDSNo38EL8XywR8wMPFqHA8=";
   };
+
   buildInputs = [ ncurses ];
-  installFlags = [ "DESTDIR=$(out)" ];
-  postInstall = ''
-    mv $out/usr/* $out
-    rm -r $out/usr
-  '';
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
+  ];
+
   meta = with lib; {
     description = "Memory usage monitoring tool";
-    homepage = "https://kernel.ubuntu.com/~cking/smemstat/";
+    homepage = "https://github.com/ColinIanKing/smemstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ womfoo ];
diff --git a/pkgs/os-specific/linux/spectrum/default.nix b/pkgs/os-specific/linux/spectrum/default.nix
deleted file mode 100644
index c4cccab3787..00000000000
--- a/pkgs/os-specific/linux/spectrum/default.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ newScope, linux_cros }:
-
-let
-  self = with self; {
-    callPackage = newScope self;
-
-    sys-vms = callPackage ./vm { };
-
-    spectrum-vm = callPackage ./spectrum-vm { linux = linux_vm; };
-
-    spectrum-testhost = callPackage ./testhost { };
-
-    linux_vm = callPackage ./linux/vm.nix { linux = linux_cros; };
-
-    makeRootfs = callPackage ./rootfs { };
-  };
-in
-self
diff --git a/pkgs/os-specific/linux/spectrum/linux/vm.nix b/pkgs/os-specific/linux/spectrum/linux/vm.nix
deleted file mode 100644
index c657cb443e8..00000000000
--- a/pkgs/os-specific/linux/spectrum/linux/vm.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, linux, kernelPatches, structuredExtraConfig ? {} }:
-
-with lib.kernel;
-
-linux.override {
-  structuredExtraConfig = {
-    VIRTIO_PCI = yes;
-    VIRTIO_BLK = yes;
-    VIRTIO_WL = yes;
-    VIRTIO_NET = yes;
-    DEVTMPFS_MOUNT = yes;
-    SQUASHFS = yes;
-
-    # VOP is needed to work around a Kconfig bug:
-    # https://lore.kernel.org/lkml/87wob4tf9b.fsf@alyssa.is/
-    VOP = yes;
-    VOP_BUS = yes;
-    HW_RANDOM = yes;
-    HW_RANDOM_VIRTIO = yes;
-
-    NET_9P = yes;
-    NET_9P_VIRTIO = yes;
-    "9P_FS" = yes;
-  } // structuredExtraConfig;
-}
diff --git a/pkgs/os-specific/linux/spectrum/rootfs/default.nix b/pkgs/os-specific/linux/spectrum/rootfs/default.nix
deleted file mode 100644
index 56f2d15b103..00000000000
--- a/pkgs/os-specific/linux/spectrum/rootfs/default.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{ runCommandNoCC, writeScript, writeReferencesToFile, makeFontsConf, lib
-, dash, execline, s6, s6-rc, s6-portable-utils, s6-linux-utils, s6-linux-init, busybox
-, mesa, squashfs-tools-ng, makeDBusConf, connman
-}:
-
-{ services, rcServices ? {}, fonts ? [], path ? [] }:
-
-let
-  stage1 = import ./stage1.nix {
-    inherit writeScript lib
-      execline s6 s6-rc s6-portable-utils s6-linux-utils s6-linux-init busybox mesa
-      path;
-  };
-
-  makeServicesDir = import ./services.nix {
-    inherit runCommandNoCC writeScript lib execline;
-  };
-
-  makeRcServicesDir = import ./rc-services.nix {
-    inherit runCommandNoCC lib s6-rc;
-  };
-
-  fontsConf = makeFontsConf { fontDirectories = fonts; };
-
-  squashfs = runCommandNoCC "root-squashfs" {} ''
-    cd ${rootfs}
-    (
-        grep -v ^${rootfs} ${writeReferencesToFile rootfs}
-        printf "%s\n" *
-    ) \
-        | xargs tar -cP --owner root:0 --group root:0 --hard-dereference \
-        | ${squashfs-tools-ng}/bin/tar2sqfs -c gzip -X level=1 $out
-  '';
-
-  rootfs = runCommandNoCC "rootfs" { passthru = { inherit squashfs; }; } ''
-    mkdir $out
-    cd $out
-
-    mkdir -p bin sbin dev proc run sys tmp var/lib
-    ln -s /run var/run
-    ln -s ${dash}/bin/dash bin/sh
-    ln -s ${stage1} sbin/init
-    cp -r ${./etc} etc
-    chmod u+w etc
-    ln -s ${makeDBusConf {
-      suidHelper = "/run/dbus-daemon-launch-helper";
-      serviceDirectories = [ connman ];
-    }} etc/dbus-1
-
-    mkdir etc/fonts
-    ln -s ${fontsConf} etc/fonts/fonts.conf
-
-    touch etc/login.defs
-    cp -r ${makeServicesDir { inherit services; }} etc/service
-    cp -r ${makeRcServicesDir { services = rcServices; }} etc/s6-rc
-  '';
-in
-rootfs
diff --git a/pkgs/os-specific/linux/spectrum/rootfs/etc/group b/pkgs/os-specific/linux/spectrum/rootfs/etc/group
deleted file mode 100644
index df4940a5516..00000000000
--- a/pkgs/os-specific/linux/spectrum/rootfs/etc/group
+++ /dev/null
@@ -1,3 +0,0 @@
-root:x:0:root
-messagebus:x:4:messagebus
-user:x:1000:user
diff --git a/pkgs/os-specific/linux/spectrum/rootfs/etc/passwd b/pkgs/os-specific/linux/spectrum/rootfs/etc/passwd
deleted file mode 100644
index ddb1f854a6e..00000000000
--- a/pkgs/os-specific/linux/spectrum/rootfs/etc/passwd
+++ /dev/null
@@ -1,3 +0,0 @@
-root:x:0:0:System administrator:/:/bin/sh
-messagebus:x:4:4:D-Bus system message bus daemon user:/run/dbus:/bin/sh
-user:x:1000:1000:User:/:/bin/sh
diff --git a/pkgs/os-specific/linux/spectrum/rootfs/etc/wayfire/wf-shell-defaults.ini b/pkgs/os-specific/linux/spectrum/rootfs/etc/wayfire/wf-shell-defaults.ini
deleted file mode 100644
index 7ba621225aa..00000000000
--- a/pkgs/os-specific/linux/spectrum/rootfs/etc/wayfire/wf-shell-defaults.ini
+++ /dev/null
@@ -1,2 +0,0 @@
-[panel]
-widgets_right =
diff --git a/pkgs/os-specific/linux/spectrum/rootfs/rc-services.nix b/pkgs/os-specific/linux/spectrum/rootfs/rc-services.nix
deleted file mode 100644
index 4c942189c5e..00000000000
--- a/pkgs/os-specific/linux/spectrum/rootfs/rc-services.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ runCommandNoCC, lib, s6-rc }:
-
-{ services ? [] }:
-
-let
-  inherit (lib) concatStrings escapeShellArg mapAttrsToList optionalString;
-
-  source = runCommandNoCC "s6-services-source" {} ''
-    mkdir $out
-    ${concatStrings (mapAttrsToList (name: attrs: ''
-      mkdir $out/${name}
-      ${concatStrings (mapAttrsToList (key: value: ''
-        cp ${value} $out/${name}/${key}
-      '') attrs)}
-    '') services)}
-  '';
-
-  s6RcCompile = { fdhuser ? null }: source:
-    runCommandNoCC "s6-rc-compile" {} ''
-      ${s6-rc}/bin/s6-rc-compile \
-        ${optionalString (fdhuser != null) "-h ${escapeShellArg fdhuser}"} \
-        $out ${source}
-    '';
-in
-
-s6RcCompile {} source
diff --git a/pkgs/os-specific/linux/spectrum/rootfs/services.nix b/pkgs/os-specific/linux/spectrum/rootfs/services.nix
deleted file mode 100644
index b2b09faa06e..00000000000
--- a/pkgs/os-specific/linux/spectrum/rootfs/services.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ runCommandNoCC, writeScript, lib, execline }:
-
-{ services ? [] }:
-
-let
-  services' = {
-    ".s6-svscan" = {
-      finish = writeScript "init-stage3" ''
-        #! ${execline}/bin/execlineb -P
-        foreground { s6-nuke -th }
-        s6-sleep -m -- 2000
-        foreground { s6-nuke -k }
-        wait { }
-        s6-linux-init-hpr -fr
-      '';
-    } // services.".s6-svscan" or {};
-  } // services;
-in
-
-runCommandNoCC "services" {} ''
-  mkdir $out
-  ${lib.concatStrings (lib.mapAttrsToList (name: attrs: ''
-    mkdir $out/${name}
-    ${lib.concatStrings (lib.mapAttrsToList (key: value: ''
-      cp ${value} $out/${name}/${key}
-    '') attrs)}
-  '') services')}
-''
diff --git a/pkgs/os-specific/linux/spectrum/rootfs/stage1.nix b/pkgs/os-specific/linux/spectrum/rootfs/stage1.nix
deleted file mode 100644
index de10d60ffb6..00000000000
--- a/pkgs/os-specific/linux/spectrum/rootfs/stage1.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ writeScript, lib
-, execline, s6, s6-rc, s6-portable-utils, s6-linux-utils, s6-linux-init, busybox, mesa
-, path ? []
-}:
-
-let
-  path' = path ++ [
-    s6 s6-rc s6-portable-utils s6-linux-utils s6-linux-init busybox execline
-  ];
-in
-
-writeScript "init-stage1" ''
-  #! ${execline}/bin/execlineb -P
-  export PATH ${lib.makeBinPath path'}
-  ${s6}/bin/s6-setsid -qb --
-
-  umask 022
-  if { s6-mount -t tmpfs -o mode=0755 tmpfs /run }
-  if { s6-hiercopy /etc/service /run/service }
-  emptyenv -p
-
-  background {
-    s6-setsid --
-
-    if { s6-rc-init -c /etc/s6-rc /run/service }
-
-    if { s6-mkdir -p /run/user/0 /dev/pts /dev/shm }
-    if { install -o user -g user -d /run/user/1000 }
-
-    if { s6-mount -t devpts -o gid=4,mode=620 none /dev/pts }
-    if { s6-mount -t tmpfs none /dev/shm }
-    if { s6-mount -t tmpfs none /var/lib }
-    if { s6-mount -t proc none /proc }
-    if { s6-mount -t sysfs none /sys }
-
-    if { s6-ln -s ${mesa.drivers} /run/opengl-driver }
-
-    s6-rc change ok-all
-  }
-
-  unexport !
-  cd /run/service
-  s6-svscan
-''
diff --git a/pkgs/os-specific/linux/spectrum/spectrum-vm/default.nix b/pkgs/os-specific/linux/spectrum/spectrum-vm/default.nix
deleted file mode 100644
index c56d2537c63..00000000000
--- a/pkgs/os-specific/linux/spectrum/spectrum-vm/default.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{ stdenv, lib, makeWrapper, utillinux, crosvm, linux, sys-vms }:
-
-stdenv.mkDerivation {
-  name = "spectrum-vm";
-
-  src = ./spectrum-vm.in;
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  unpackPhase = ''
-    cp $src spectrum-vm.in
-  '';
-
-  configurePhase = ''
-    substituteAll spectrum-vm.in spectrum-vm
-    chmod +x spectrum-vm
-  '';
-
-  getopt = "${lib.getBin utillinux}/bin/getopt";
-  crosvm = "${lib.getBin crosvm}/bin/crosvm";
-  kernel = "${sys-vms.comp.linux}/bzImage";
-  rootfs = sys-vms.comp.rootfs.squashfs;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp spectrum-vm $out/bin
-  '';
-
-  meta = with lib; {
-    description = "Utility for testing Spectrum VM components";
-    maintainers = with maintainers; [ qyliss ];
-    license = licenses.gpl3Plus;
-    inherit (crosvm.meta) platforms;
-  };
-}
diff --git a/pkgs/os-specific/linux/spectrum/spectrum-vm/spectrum-vm.in b/pkgs/os-specific/linux/spectrum/spectrum-vm/spectrum-vm.in
deleted file mode 100755
index a72c3896141..00000000000
--- a/pkgs/os-specific/linux/spectrum/spectrum-vm/spectrum-vm.in
+++ /dev/null
@@ -1,71 +0,0 @@
-#!@shell@
-set -ue
-
-ex_usage() {
-    cat <<EOF
-Usage: $(basename "$0") [OPTION]... [-- CROSVM_OPTIONS]
-
-  -c COMMAND         shell command to run inside VM
-  -C, --crosvm PATH  path to custom crosvm executable
-  -k, --kernel PATH  path to custom kernel image
-  -f, --rootfs PATH  path to custom root file system image
-  -- CROSVM_OPTIONS  extra arguments to pass to crosvm
-EOF
-    exit "$1"
-}
-
-args="$(@getopt@ -s sh -l crosvm:,help,kernel:,rootfs: -o c:C:hk:f: -- "$@" || exit 1)"
-eval set -- "$args"
-
-command=
-crosvm=@crosvm@
-kernel=@kernel@
-rootfs=@rootfs@
-
-while :
-do
-    case "$1" in
-	-c)
-	    shift
-	    command="$1"
-	    shift
-	    ;;
-        -C|--crosvm)
-            shift
-            crosvm="$1"
-	    shift
-            ;;
-	-h|--help)
-	    ex_usage 0
-	    ;;
-        -k|--kernel)
-            shift
-            kernel="$1"
-	    shift
-            ;;
-        -f|--rootfs)
-            shift
-            rootfs="$1"
-	    shift
-            ;;
-        --)
-            shift
-            break
-            ;;
-    esac
-done
-
-if [ -n "${XDG_RUNTIME_DIR-}" ]
-then
-    set -- -s "$XDG_RUNTIME_DIR" "$@"
-    if [ -n "${WAYLAND_DISPLAY-}" ]
-    then set -- --wayland-sock "$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY" "$@"
-    fi
-fi
-
-exec "$crosvm" run \
-    -p init=/sbin/init \
-    -p "spectrumcmd=$(printf %s "$command" | base64 -w0)" \
-    --root "$rootfs" \
-    "$@" \
-    "$kernel"
diff --git a/pkgs/os-specific/linux/spectrum/testhost/default.nix b/pkgs/os-specific/linux/spectrum/testhost/default.nix
deleted file mode 100644
index d81ff8b826e..00000000000
--- a/pkgs/os-specific/linux/spectrum/testhost/default.nix
+++ /dev/null
@@ -1,212 +0,0 @@
-{ lib, runCommandNoCC, writeScript, writeScriptBin, writeShellScript, writeText
-, coreutils, cloud-hypervisor, crosvm, curl, execline, gnutar, gnused, iproute
-, iptables, jq, kmod, mktuntap, rsync, s6, s6-rc, sys-vms, utillinux
-}:
-
-let
-  inherit (lib) concatStrings escapeShellArg makeBinPath mapAttrsToList
-    optionalString;
-
-  compose2 = f: g: a: b: f (g a b);
-
-  concatMapAttrs = compose2 concatStrings mapAttrsToList;
-
-  makeServicesDir = { services }:
-    runCommandNoCC "services" {} ''
-      mkdir $out
-      ${concatMapAttrs (name: attrs: ''
-        mkdir $out/${name}
-        ${concatMapAttrs (key: value: ''
-          cp -r ${value} $out/${name}/${key}
-        '') attrs}
-      '') services}
-    '';
-
-  s6RcCompile = { fdhuser ? null }: source:
-    runCommandNoCC "s6-rc-compile" {} ''
-      ${s6-rc}/bin/s6-rc-compile \
-        ${optionalString (fdhuser != null) "-h ${escapeShellArg fdhuser}"} \
-        dest ${source}
-      tar -C dest -cf $out .
-    '';
-
-  compiledRcServicesDir = s6RcCompile {} (makeServicesDir {
-    services = {
-      vm-app = {
-        run = writeScript "app-run" ''
-          #! ${execline}/bin/execlineb -S0
-          # fdclose 0
-
-          # Checking the return value of the bridge creation is
-          # important, because if it fails due to the bridge already
-          # existing that means something else could already be using
-          # this bridge.
-          if { ip link add name br0 type bridge }
-          if { ip link set br0 up }
-
-          # Calculate the MACs for our TAP and the router's TAP.
-          # MAC address format, by octet:
-          #
-          #  0-3  Static OUI for Spectrum
-          #    4  Most significant bit is used to differentiate
-          #       routers from clients.  Other bits are reserved.
-          #  5-6  Last two octets of client's IP (in 100.64.0.0/16).
-          #
-          backtick -E router_mac {
-            pipeline { printf %.4x ${toString sys-vms.app.vmID} }
-            sed s/^\\(..\\)\\(..\\)$/0A:B3:EC:80:\\1:\\2/
-          }
-          backtick -E client_mac {
-            pipeline { printf %.4x ${toString sys-vms.app.vmID} }
-            sed s/^\\(..\\)\\(..\\)$/0A:B3:EC:00:\\1:\\2/
-          }
-
-          # Create the net VM end, and attach it to the net VM.
-          #
-          # Use a hardcoded name for now because if we use a dynamic
-          # one iproute2 has no way of telling us the name that was
-          # chosen:
-          # https://lore.kernel.org/netdev/20210406134240.wwumpnrzfjbttnmd@eve.qyliss.net/
-          define other_tap_name vmtapnet
-          # Try to delete the device in case the VM was powered off
-          # (as the finish script wouldn't have been run in that
-          # case.)  Since we check the return value of ip tuntap add,
-          # in the case of a race condition between deleting the
-          # device and creating it again, we'll just fail and try
-          # again.
-          foreground { ip link delete $other_tap_name }
-          if { ip tuntap add name $other_tap_name mode tap }
-          if { ip link set $other_tap_name master br0 }
-          if { ip link set $other_tap_name up }
-          if {
-            pipeline {
-              jq -n "$ARGS.named"
-                --arg tap $other_tap_name
-                --arg mac $router_mac
-            }
-            curl -iX PUT
-              -H "Accept: application/json"
-              -H "Content-Type: application/json"
-              --data-binary @-
-              --unix-socket ../vm-net/env/cloud-hypervisor.sock
-              http://localhost/api/v1/vm.add-net
-          }
-
-          mktuntap -pvBi vmtap%d 6
-          importas -iu tap_name TUNTAP_NAME
-          if { ip link set $tap_name master br0 }
-          if { ip link set $tap_name up }
-          if { iptables -t nat -A POSTROUTING -o $tap_name -j MASQUERADE }
-
-          ${crosvm}/bin/crosvm run -p init=/sbin/init -p notifyport=''${port}
-            # --serial type=file,path=/tmp/app.log
-            --cid 4
-            --tap-fd 6,mac=''${client_mac}
-            --root ${sys-vms.app.rootfs.squashfs} ${sys-vms.app.linux}/bzImage
-        '';
-        finish = writeScript "app-finish" ''
-          #! ${execline}/bin/execlineb -S0
-          # TODO: remove from vm-net
-          foreground { ip link delete vmtapnet }
-          ip link delete br0
-        '';
-        type = writeText "app-type" ''
-          longrun
-        '';
-        dependencies = writeText "app-dependencies" ''
-          vm-net
-        '';
-      };
-
-      vm-net = {
-        run = writeScript "net-run" ''
-          #! ${execline}/bin/execlineb -S0
-          # This is only necessary for when running s6 from a tty.
-          # (i.e. when debugging or running the demo).
-          redirfd -w 0 /dev/null
-
-          define PCI_LOCATION 0000:00:19.0
-          define PCI_PATH /sys/bus/pci/devices/''${PCI_LOCATION}
-
-          # Unbind the network device from the driver it's already
-          # attached to, if any.
-          foreground {
-            redirfd -w 1 ''${PCI_PATH}/driver/unbind
-            printf "%s" $PCI_LOCATION
-          }
-
-          # Tell the VFIO driver it should support our device.  This
-          # is allowed to fail because it might already know that, in
-          # which case it'll return EEXIST.
-          if { modprobe vfio-pci }
-          backtick -E device_id {
-            if { dd bs=2 skip=1 count=2 status=none if=''${PCI_PATH}/vendor }
-            if { printf " " }
-            dd bs=2 skip=1 count=2 status=none if=''${PCI_PATH}/device
-          }
-          foreground {
-            redirfd -w 1 /sys/bus/pci/drivers/vfio-pci/new_id
-            printf "%s" $device_id
-          }
-
-          # Bind the device to the VFIO driver.  This is allowed to
-          # fail because the new_id operation we just tried will have
-          # bound it automatically for us if it succeeded.  In such a
-          # case, the kernel will return ENODEV (conistency!).
-          foreground {
-            redirfd -w 1 /sys/bus/pci/drivers/vfio-pci/bind
-            printf "%s" $PCI_LOCATION
-          }
-
-          # Because we allow both new_id and bind to fail, we need to
-          # manually make sure now that at least one of them succeeded
-          # and the device is actually attached to the vfio-driver.
-          if { test -e /sys/bus/pci/drivers/vfio-pci/''${PCI_LOCATION} }
-
-          foreground { mkdir env }
-
-          ${cloud-hypervisor}/bin/cloud-hypervisor
-            --api-socket env/cloud-hypervisor.sock
-            --console off
-            # --serial tty
-            --cmdline "console=ttyS0 panic=30 root=/dev/vda"
-            --device path=''${PCI_PATH}
-            --disk path=${sys-vms.net.rootfs.squashfs},readonly=on
-            --kernel ${sys-vms.net.linux.dev}/vmlinux
-        '';
-        type = writeText "net-type" ''
-          longrun
-        '';
-      };
-    };
-  });
-
-  servicesDir = makeServicesDir {
-    services = {
-      ".s6-svscan" = {
-        finish = writeShellScript ".s6-svscan-finish" "";
-      };
-    };
-  };
-in
-
-writeScriptBin "spectrum-testhost" ''
-  #! ${execline}/bin/execlineb -S0
-  export PATH ${makeBinPath [
-    coreutils curl execline gnused gnutar iproute iptables jq kmod mktuntap rsync
-    s6 s6-rc
-  ]}
-
-  if { redirfd -w 1 /proc/sys/net/ipv4/ip_forward echo 1 }
-
-  importas -iu runtime_dir XDG_RUNTIME_DIR
-  backtick -E top { mktemp -dp $runtime_dir spectrum.XXXXXXXXXX }
-  if { echo $top }
-  if { rsync -r --chmod=Du+w ${servicesDir}/ ''${top}/service }
-  background {
-    if { mkdir -p ''${top}/s6-rc/compiled }
-    if { tar -C ''${top}/s6-rc/compiled -xf ${compiledRcServicesDir} }
-    s6-rc-init -c ''${top}/s6-rc/compiled -l ''${top}/s6-rc/live ''${top}/service
-  }
-  s6-svscan ''${top}/service
-''
diff --git a/pkgs/os-specific/linux/spectrum/vm/app/default.nix b/pkgs/os-specific/linux/spectrum/vm/app/default.nix
deleted file mode 100644
index 9ffed7e5b13..00000000000
--- a/pkgs/os-specific/linux/spectrum/vm/app/default.nix
+++ /dev/null
@@ -1,57 +0,0 @@
-{ runCommand, writeScript, writeText, makeRootfs
-, busybox, execline, linux_vm, jq, iproute
-}:
-
-runCommand "vm-app" rec {
-  linux = linux_vm;
-
-  login = writeScript "login" ''
-    #! ${execline}/bin/execlineb -s0
-    unexport !
-    ${busybox}/bin/login -p -f root $@
-  '';
-
-  rootfs = makeRootfs {
-    rcServices.ok-all = {
-      type = writeText "ok-all-type" ''
-        bundle
-      '';
-      contents = writeText "ok-all-contents" ''
-        net
-      '';
-    };
-
-    rcServices.net = {
-      type = writeText "net-type" ''
-        oneshot
-      '';
-      up = writeText "net-up" ''
-        backtick -E LOCAL_IP {
-          pipeline { ip -j link show eth0 }
-          pipeline { jq -r ".[0].address | split(\":\") | .[4:6] | \"0x\" + .[]" }
-          xargs printf "100.64.%d.%d"
-        }
-
-        if { ip address add ''${LOCAL_IP}/32 dev eth0 }
-        if { ip link set eth0 up }
-        if { ip route add 169.254.0.1 dev eth0 }
-        ip route add default via 169.254.0.1 dev eth0
-      '';
-    };
-
-    services.getty.run = writeScript "getty-run" ''
-      #! ${execline}/bin/execlineb -P
-      ${busybox}/bin/getty -i -n -l ${login} 38400 ttyS0
-    '';
-
-    path = [ iproute jq ];
-  };
-
-  inherit (rootfs) squashfs;
-  vmID = 0;
-} ''
-  mkdir $out
-  echo "$vmID" > $out/vm-id
-  ln -s $linux/bzImage $out/kernel
-  ln -s $squashfs $out/squashfs
-''
diff --git a/pkgs/os-specific/linux/spectrum/vm/comp/default.nix b/pkgs/os-specific/linux/spectrum/vm/comp/default.nix
deleted file mode 100644
index eb6317ed6f2..00000000000
--- a/pkgs/os-specific/linux/spectrum/vm/comp/default.nix
+++ /dev/null
@@ -1,73 +0,0 @@
-{ lib, makeRootfs, runCommand, writeScript, writeText
-, busybox, emacs-nox, execline, gcc, linux_vm, s6, sommelier, source-code-pro
-, tinywl, westonLite, zsh
-}:
-
-runCommand "vm-comp" rec {
-  linux = linux_vm;
-
-  path = [
-    busybox emacs-nox execline gcc s6 sommelier tinywl westonLite zsh
-  ];
-
-  login = writeScript "login" ''
-    #! ${execline}/bin/execlineb -s0
-    unexport !
-    ${busybox}/bin/login -p -f root $@
-  '';
-
-  rootfs = makeRootfs {
-    services.getty.run = writeScript "getty-run" ''
-      #! ${execline}/bin/execlineb -P
-      ${busybox}/bin/getty -i -n -l ${login} 38400 ttyS0
-    '';
-
-    rcServices.ok-all = {
-      type = writeText "ok-all-type" ''
-        bundle
-      '';
-      contents = writeText "ok-all-contents" ''
-        compositor
-      '';
-    };
-
-    rcServices.compositor = {
-      type = writeText "compositor-type" ''
-        longrun
-      '';
-      run = writeScript "compositor-run" ''
-        #! ${execline}/bin/execlineb -S0
-
-        s6-applyuidgid -u 1000 -g 1000
-
-        export HOME /
-        export PATH ${lib.makeBinPath path}
-        export XDG_RUNTIME_DIR /run/user/1000
-        export XKB_DEFAULT_LAYOUT dvorak
-
-        ${sommelier}/bin/sommelier
-        ${tinywl}/bin/tinywl -s "weston-terminal --shell $(command -v zsh)"
-      '';
-      dependencies = writeText "compositor-dependencies" ''
-        wl0
-      '';
-    };
-
-    rcServices.wl0 = {
-      type = writeText "wl0-type" ''
-        oneshot
-      '';
-      up = writeText "wl0-run" ''
-        chown user /dev/wl0
-      '';
-    };
-
-    fonts = [ source-code-pro ];
-  };
-
-  inherit (rootfs) squashfs;
-} ''
-  mkdir $out
-  ln -s $linux/bzImage $out/kernel
-  ln -s $squashfs $out/squashfs
-''
diff --git a/pkgs/os-specific/linux/spectrum/vm/default.nix b/pkgs/os-specific/linux/spectrum/vm/default.nix
deleted file mode 100644
index f5d591a960a..00000000000
--- a/pkgs/os-specific/linux/spectrum/vm/default.nix
+++ /dev/null
@@ -1,9 +0,0 @@
-{ callPackage }:
-
-{
-  app = callPackage ./app { };
-
-  comp = callPackage ./comp { };
-
-  net = callPackage ./net { };
-}
diff --git a/pkgs/os-specific/linux/spectrum/vm/net/default.nix b/pkgs/os-specific/linux/spectrum/vm/net/default.nix
deleted file mode 100644
index 75c86b8f92c..00000000000
--- a/pkgs/os-specific/linux/spectrum/vm/net/default.nix
+++ /dev/null
@@ -1,165 +0,0 @@
-{ lib, makeRootfs, runCommand, writeScript, writeText
-, busybox, connman, dbus, execline, iptables, iproute, jq, linux_vm, mdevd
-}:
-
-runCommand "vm-net" rec {
-  linux = linux_vm.override {
-    structuredExtraConfig = with lib.kernel; {
-      E1000E = yes;
-      IGB = yes;
-      PACKET = yes;
-
-      IP_NF_NAT = yes;
-      IP_NF_IPTABLES = yes;
-      IP_NF_TARGET_MASQUERADE = yes;
-      NF_CONNTRACK = yes;
-    };
-  };
-
-  login = writeScript "login" ''
-    #! ${execline}/bin/execlineb -s0
-    unexport !
-    ${busybox}/bin/login -p -f root $@
-  '';
-
-  rootfs = makeRootfs {
-    rcServices.ok-all = {
-      type = writeText "ok-all-type" ''
-        bundle
-      '';
-      contents = writeText "ok-all-contents" ''
-        mdevd-coldplug
-      '';
-    };
-
-    rcServices.mdevd = {
-      type = writeText "mdevd-type" ''
-        longrun
-      '';
-      run = writeScript "mdevd-run" ''
-        #! ${execline}/bin/execlineb -P
-        ${mdevd}/bin/mdevd -D3 -f ${writeText "mdevd.conf" ''
-          $INTERFACE=.* 0:0 660 ! @${writeScript "interface" ''
-            #! ${execline}/bin/execlineb -S0
-
-            multisubstitute {
-              importas -i DEVPATH DEVPATH
-              importas -i INTERFACE INTERFACE
-            }
-
-            ifte
-
-            {
-              # This interface is connected to another VM.
-
-              # Our IP is encoded in the NIC-specific portion of the
-              # interface's MAC address.
-              backtick -E CLIENT_IP {
-                pipeline { ip -j link show $INTERFACE }
-                pipeline { jq -r ".[0].address | split(\":\") | .[4:6] | \"0x\" + .[]" }
-                xargs printf "100.64.%d.%d"
-              }
-
-              if { ip address add 169.254.0.1/32 dev $INTERFACE }
-              if { ip link set $INTERFACE up }
-              ip route add $CLIENT_IP dev $INTERFACE
-            }
-
-            {
-              if { test $INTERFACE != lo }
-              # This is a physical connection to a network device.
-              if { iptables -t nat -A POSTROUTING -o $INTERFACE -j MASQUERADE }
-              s6-rc -u change connman
-            }
-
-            grep -iq ^0A:B3:EC: /sys/class/net/''${INTERFACE}/address
-          ''}
-        ''}
-      '';
-      notification-fd = writeText "mdevd-notification-fd" ''
-        3
-      '';
-      dependencies = writeText "mdevd-dependencies" ''
-        sysctl
-      '';
-    };
-
-    rcServices.mdevd-coldplug = {
-      type = writeText "mdevd-coldplug-type" ''
-        oneshot
-      '';
-      up = writeText "mdevd-run" ''
-        ${mdevd}/bin/mdevd-coldplug
-      '';
-      dependencies = writeText "mdevd-coldplug-dependencies" ''
-        mdevd
-      '';
-    };
-
-    rcServices.dbus = {
-      type = writeText "dbus-daemon" ''
-        longrun
-      '';
-      run = writeScript "dbus-daemon-run" ''
-        #! ${execline}/bin/execlineb -S0
-        foreground { mkdir /run/dbus }
-        # Busybox cp doesn't have -n to avoid copying to paths that
-        # already exist, but we can abuse -u for the same effect,
-        # since every file in the store is from Jan 1 1970.
-        foreground { cp -u ${dbus}/libexec/dbus-daemon-launch-helper /run }
-        foreground { chgrp messagebus /run/dbus-daemon-launch-helper }
-        foreground { chmod 4550 /run/dbus-daemon-launch-helper }
-        ${dbus}/bin/dbus-daemon
-          --nofork --nosyslog --nopidfile --config-file=/etc/dbus-1/system.conf
-      '';
-    };
-
-    rcServices.connman = {
-      type = writeText "connman-type" ''
-        longrun
-      '';
-      run = writeScript "connman-run" ''
-        #! ${execline}/bin/execlineb -S0
-        backtick -E HARDWARE_INTERFACES {
-          pipeline {
-            find -L /sys/class/net -mindepth 2 -maxdepth 2 -name address -print0
-          }
-
-          # Filter out other VMs and the loopback device.
-          pipeline { xargs -0 grep -iL ^\\(0A:B3:EC:\\|00:00:00:00:00:00$\\) }
-
-          # Extract the interface names from the address file paths.
-          awk -F/ "{if (NR > 1) printf \",\"; printf \"%s\", $5}"
-        }
-
-        ${connman}/bin/connmand -ni $HARDWARE_INTERFACES
-      '';
-      dependencies = writeText "connman-dependencies" ''
-        dbus
-      '';
-    };
-
-    rcServices.sysctl = {
-      type = writeText "sysctl-type" ''
-        oneshot
-      '';
-      up = writeText "sysctl-up" ''
-        redirfd -w 1 /proc/sys/net/ipv4/ip_forward
-        echo 1
-      '';
-    };
-
-    services.getty.run = writeScript "getty-run" ''
-      #! ${execline}/bin/execlineb -P
-      ${busybox}/bin/getty -i -n -l ${login} 38400 ttyS0
-    '';
-
-    path = [ iproute iptables jq ];
-  };
-
-  inherit (rootfs) squashfs;
-} ''
-  mkdir $out
-  ln -s $linux/bzImage $out/kernel
-  ln -s $squashfs $out/squashfs
-''
diff --git a/pkgs/os-specific/linux/speedometer/default.nix b/pkgs/os-specific/linux/speedometer/default.nix
deleted file mode 100644
index 2801334688b..00000000000
--- a/pkgs/os-specific/linux/speedometer/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, fetchurl, pythonPackages }:
-
-pythonPackages.buildPythonApplication rec {
-  pname = "speedometer";
-  version = "2.8";
-
-  src = fetchurl {
-    url = "https://excess.org/speedometer/speedometer-${version}.tar.gz";
-    sha256 = "060bikv3gwr203jbdmvawsfhc0yq0bg1m42dk8czx1nqvwvgv6fm";
-  };
-
-  propagatedBuildInputs = [ pythonPackages.urwid ];
-
-  postPatch = ''
-    sed -i "/'entry_points': {/d" setup.py
-    sed -i "/'console_scripts': \['speedometer = speedometer:console'\],},/d" setup.py
-  '';
-
-  meta = with lib; {
-    description = "Measure and display the rate of data across a network connection or data being stored in a file";
-    homepage = "https://excess.org/speedometer/";
-    license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ Baughn ];
-  };
-}
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index 94b1a6d799d..62db758c7aa 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -1,44 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, fetchpatch, glibc, augeas, dnsutils, c-ares, curl,
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, makeWrapper, glibc, augeas, dnsutils, c-ares, curl,
   cyrus_sasl, ding-libs, libnl, libunistring, nss, samba, nfs-utils, doxygen,
-  python, python3, pam, popt, talloc, tdb, tevent, pkg-config, ldb, openldap,
-  pcre, libkrb5, cifs-utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
-  libuuid, ldap, systemd, nspr, check, cmocka, uid_wrapper,
-  nss_wrapper, ncurses, Po4a, http-parser, jansson,
+  python3, pam, popt, talloc, tdb, tevent, pkg-config, ldb, openldap,
+  pcre2, libkrb5, cifs-utils, glib, keyutils, dbus, fakeroot, libxslt, libxml2,
+  libuuid, systemd, nspr, check, cmocka, uid_wrapper, p11-kit,
+  nss_wrapper, ncurses, Po4a, http-parser, jansson, jose,
   docbook_xsl, docbook_xml_dtd_44,
+  testers, nix-update-script, nixosTests,
   withSudo ? false }:
 
 let
   docbookFiles = "${docbook_xsl}/share/xml/docbook-xsl/catalog.xml:${docbook_xml_dtd_44}/xml/dtd/docbook/catalog.xml";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sssd";
-  version = "1.16.5";
+  version = "2.9.3";
 
   src = fetchFromGitHub {
     owner = "SSSD";
-    repo = pname;
-    rev = "${pname}-${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0zbs04lkjbp7y92anmafl7gzamcnq1f147p13hc4byyvjk9rg6f7";
+    repo = "sssd";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-WTVOt2TpTCyMmFYzWJMBQdwgmov7m1Sd8CwyL4ywPUY=";
   };
-  patches = [
-    # Fix build failure against samba 4.12.0rc1
-    (fetchpatch {
-      url = "https://github.com/SSSD/sssd/commit/bc56b10aea999284458dcc293b54cf65288e325d.patch";
-      sha256 = "0q74sx5n41srq3kdn55l5j1sq4xrjsnl5y4v8yh5mwsijj74yh4g";
-    })
-    # Fix collision with external nss symbol
-    (fetchpatch {
-      url = "https://github.com/SSSD/sssd/commit/fe9eeb51be06059721e873f77092b1e9ba08e6c1.patch";
-      sha256 = "0b83b2w0rnvm26pg03a4lpmkmi7n3gqxg7lk751q61q79gnzrpz4";
-    })
-  ];
+
+  postPatch = ''
+    patchShebangs ./sbus_generate.sh.in
+  '';
 
   # Something is looking for <libxml/foo.h> instead of <libxml2/libxml/foo.h>
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   preConfigure = ''
     export SGML_CATALOG_FILES="${docbookFiles}"
-    export PYTHONPATH=${ldap}/lib/python2.7/site-packages
+    export PYTHONPATH=$(find ${python3.pkgs.python-ldap} -type d -name site-packages)
     export PATH=$PATH:${openldap}/libexec
 
     configureFlagsArray=(
@@ -48,7 +41,6 @@ stdenv.mkDerivation rec {
       --enable-pammoddir=$out/lib/security
       --with-os=fedora
       --with-pid-path=/run
-      --with-python2-bindings
       --with-python3-bindings
       --with-syslog=journald
       --without-selinux
@@ -62,13 +54,16 @@ stdenv.mkDerivation rec {
   '';
 
   enableParallelBuilding = true;
-  nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];
+  # Disable parallel install due to missing depends:
+  #   libtool:   error: error: relink '_py3sss.la' with the above command before installing i
+  enableParallelInstalling = false;
+  nativeBuildInputs = [ autoreconfHook makeWrapper pkg-config doxygen ];
   buildInputs = [ augeas dnsutils c-ares curl cyrus_sasl ding-libs libnl libunistring nss
-                  samba nfs-utils python python3 popt
-                  talloc tdb tevent ldb pam openldap pcre libkrb5
+                  samba nfs-utils p11-kit python3 popt
+                  talloc tdb tevent ldb pam openldap pcre2 libkrb5
                   cifs-utils glib keyutils dbus fakeroot libxslt libxml2
-                  libuuid ldap systemd nspr check cmocka uid_wrapper
-                  nss_wrapper ncurses Po4a http-parser jansson ];
+                  libuuid python3.pkgs.python-ldap systemd nspr check cmocka uid_wrapper
+                  nss_wrapper ncurses Po4a http-parser jansson jose ];
 
   makeFlags = [
     "SGML_CATALOG_FILES=${docbookFiles}"
@@ -95,13 +90,29 @@ stdenv.mkDerivation rec {
     rm -f "$out"/modules/ldb/memberof.la
     find "$out" -depth -type d -exec rmdir --ignore-fail-on-non-empty {} \;
   '';
+  postFixup = ''
+    for f in $out/bin/sss{ctl,_cache,_debuglevel,_override,_seed}; do
+      wrapProgram $f --prefix LDB_MODULES_PATH : $out/modules/ldb
+    done
+  '';
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) sssd sssd-ldap;
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "sssd --version";
+      };
+    };
+    updateScript = nix-update-script { };
+  };
 
   meta = with lib; {
     description = "System Security Services Daemon";
     homepage = "https://sssd.io/";
-    changelog = "https://sssd.io/release-notes/sssd-${version}.html";
+    changelog = "https://sssd.io/release-notes/sssd-${finalAttrs.version}.html";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
-    maintainers = [ maintainers.e-user ];
+    maintainers = with maintainers; [ illustris ];
   };
-}
+})
diff --git a/pkgs/os-specific/linux/statifier/default.nix b/pkgs/os-specific/linux/statifier/default.nix
index 5afb399fc16..eefd95d1153 100644
--- a/pkgs/os-specific/linux/statifier/default.nix
+++ b/pkgs/os-specific/linux/statifier/default.nix
@@ -1,8 +1,8 @@
 { lib, multiStdenv, fetchurl }:
 
-let version = "1.7.4"; in
-multiStdenv.mkDerivation {
-  name = "statifier-${version}";
+multiStdenv.mkDerivation rec {
+  pname = "statifier";
+  version = "1.7.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/statifier/statifier-${version}.tar.gz";
diff --git a/pkgs/os-specific/linux/switcheroo-control/default.nix b/pkgs/os-specific/linux/switcheroo-control/default.nix
index 38945c70622..bb0f262a2b1 100644
--- a/pkgs/os-specific/linux/switcheroo-control/default.nix
+++ b/pkgs/os-specific/linux/switcheroo-control/default.nix
@@ -12,7 +12,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "switcheroo-control";
-  version = "2.3";
+  version = "2.6";
 
   format = "other";
 
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "hadess";
     repo = pname;
     rev = version;
-    hash = "sha256-1Pze2TJ9mggfcpiLFwJ7/9WhsdJx4G3GoA7+Z47shuc=";
+    hash = "sha256-F+5HhMxM8pcnAGmVBARKWNCL0rIEzHW/jsGHHqYZJug=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/sydbox/default.nix b/pkgs/os-specific/linux/sydbox/default.nix
new file mode 100644
index 00000000000..bdaf77147f2
--- /dev/null
+++ b/pkgs/os-specific/linux/sydbox/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, autoreconfHook
+, python3
+, perl
+, libxslt
+, docbook_xsl
+, docbook_xml_dtd_42
+, libseccomp
+, installTests ? true, gnumake, which
+, debugBuild ? false, libunwind
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sydbox-1";
+  version = "2.2.0";
+
+  outputs = [ "out" "dev" "man" "doc" ]
+    ++ lib.optional installTests "installedTests";
+
+  src = fetchurl {
+    url = "https://git.exherbo.org/${pname}.git/snapshot/${pname}-${version}.tar.xz";
+    sha256 = "0664myrrzbvsw73q5b7cqwgv4hl9a7vkm642s1r96gaxm16jk0z7";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+    python3
+    perl
+    libxslt.bin
+    docbook_xsl
+    docbook_xml_dtd_42
+  ];
+
+  buildInputs = [
+    libseccomp
+  ] ++ lib.optional debugBuild libunwind
+    ++ lib.optionals installTests [
+      gnumake
+      python3
+      perl
+      which
+    ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [ ]
+    ++ lib.optionals installTests [ "--enable-installed-tests"
+      "--libexecdir=${placeholder "installedTests"}/libexec" ]
+    ++ lib.optional debugBuild "--enable-debug";
+
+  makeFlags = [ "SYD_INCLUDEDIR=${stdenv.cc.libc.dev}/include" ];
+
+  doCheck = true;
+  checkPhase = ''
+    # Many of the regular test cases in t/ do not work inside the build sandbox
+    make -C syd check
+  '';
+
+  postInstall = if installTests then ''
+    moveToOutput bin/syd-test $installedTests
+  '' else ''
+    # Tests are installed despite --disable-installed-tests
+    rm -r $out/bin/syd-test $out/libexec
+  '';
+
+  meta = with lib; {
+    homepage = "https://sydbox.exherbo.org/";
+    description = "seccomp-based application sandbox";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mvs ];
+  };
+}
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 23e78dd848e..3e63a4a54d8 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -1,40 +1,112 @@
-{ lib, stdenv, fetchFromGitHub, cmake, kernel, installShellFiles
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, kernel, installShellFiles, pkg-config
 , luajit, ncurses, perl, jsoncpp, libb64, openssl, curl, jq, gcc, elfutils, tbb, protobuf, grpc
+, yaml-cpp, nlohmann_json, re2, zstd
 }:
 
-with lib;
+let
+  # Compare with https://github.com/draios/sysdig/blob/dev/cmake/modules/falcosecurity-libs.cmake
+  libsRev = "59fb313475b82f842e9e9bbc1e0e629428c0a4cf";
+  libsSha256 = "sha256-IjzLbCOpB6EgPDgkGIyg1dNxHfYgU10OLgXrDOPmoTs=";
+
+  # Compare with https://github.com/falcosecurity/libs/blob/master/cmake/modules/valijson.cmake#L17
+  valijson = fetchFromGitHub {
+    owner = "tristanpenman";
+    repo = "valijson";
+    rev = "v0.6";
+    sha256 = "sha256-ZD19Q2MxMQd3yEKbY90GFCrerie5/jzgO8do4JQDoKM=";
+  };
+
+  # https://github.com/draios/sysdig/blob/0.31.5/cmake/modules/driver.cmake
+  driver = fetchFromGitHub {
+    owner = "falcosecurity";
+    repo = "libs";
+    rev = libsRev;
+    sha256 = libsSha256;
+  };
+
+in
 stdenv.mkDerivation rec {
   pname = "sysdig";
-  version = "0.27.1";
+  version = "0.33.1";
 
   src = fetchFromGitHub {
     owner = "draios";
     repo = "sysdig";
     rev = version;
-    sha256 = "sha256-lYjMvxMIReANNwMr62u881Nugrs9piOaN3EmrvGzRns=";
+    sha256 = "sha256-qcJ9EcePrsKic+wgsck+pTrRdQic0xhzguH4EYVP0gk=";
   };
 
-  nativeBuildInputs = [ cmake perl installShellFiles ];
+  patches = [
+    # https://github.com/draios/sysdig/pull/2024
+    (fetchpatch {
+      url = "https://github.com/draios/sysdig/commit/d9515aad2be660b2ba7ec8c0b4fb2467a10434af.patch";
+      sha256 = "sha256-3m+Rn8BZS8U8QTBDJ6x7kQbH6BE3HKgt1iNnRjPEr8k=";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake perl installShellFiles pkg-config ];
   buildInputs = [
-    luajit ncurses jsoncpp libb64 openssl curl jq gcc elfutils tbb protobuf grpc
-  ] ++ optionals (kernel != null) kernel.moduleBuildDependencies;
+    luajit
+    ncurses
+    libb64
+    openssl
+    curl
+    jq
+    gcc
+    elfutils
+    tbb
+    libb64
+    re2
+    protobuf
+    grpc
+    yaml-cpp
+    jsoncpp
+    nlohmann_json
+    zstd
+  ] ++ lib.optionals (kernel != null) kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
 
+  postUnpack = ''
+    cp -r ${fetchFromGitHub {
+      owner = "falcosecurity";
+      repo = "libs";
+      rev = libsRev;
+      sha256 = libsSha256;
+    }} libs
+    chmod -R +w libs
+    cp -r ${driver} driver-src
+    chmod -R +w driver-src
+    cmakeFlagsArray+=(
+      "-DFALCOSECURITY_LIBS_SOURCE_DIR=$(pwd)/libs"
+      "-DVALIJSON_INCLUDE=${valijson}/include"
+      "-DDRIVER_SOURCE_DIR=$(pwd)/driver-src/driver"
+    )
+  '';
+
   cmakeFlags = [
     "-DUSE_BUNDLED_DEPS=OFF"
     "-DSYSDIG_VERSION=${version}"
+    "-DUSE_BUNDLED_B64=OFF"
+    "-DUSE_BUNDLED_TBB=OFF"
+    "-DUSE_BUNDLED_RE2=OFF"
     "-DCREATE_TEST_TARGETS=OFF"
-  ] ++ optional (kernel == null) "-DBUILD_DRIVER=OFF";
+  ] ++ lib.optional (kernel == null) "-DBUILD_DRIVER=OFF";
 
-  # needed since luajit-2.1.0-beta3
-  NIX_CFLAGS_COMPILE = "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i))";
+  env.NIX_CFLAGS_COMPILE =
+   # needed since luajit-2.1.0-beta3
+   "-DluaL_reg=luaL_Reg -DluaL_getn(L,i)=((int)lua_objlen(L,i)) " +
+   # fix compiler warnings been treated as errors
+   "-Wno-error";
 
   preConfigure = ''
-    cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl")
-
+    if ! grep -q "${libsRev}" cmake/modules/falcosecurity-libs.cmake; then
+      echo "falcosecurity-libs checksum needs to be updated!"
+      exit 1
+    fi
+    cmakeFlagsArray+=(-DCMAKE_EXE_LINKER_FLAGS="-ltbb -lcurl -lzstd -labsl_synchronization")
+  '' + lib.optionalString (kernel != null) ''
     export INSTALL_MOD_PATH="$out"
-  '' + optionalString (kernel != null) ''
     export KERNELDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   '';
 
@@ -46,22 +118,26 @@ stdenv.mkDerivation rec {
       rmdir $out/etc/bash_completion.d
       rmdir $out/etc
     ''
-    + optionalString (kernel != null) ''
+    + lib.optionalString (kernel != null) ''
       make install_driver
       kernel_dev=${kernel.dev}
-      kernel_dev=''${kernel_dev#/nix/store/}
+      kernel_dev=''${kernel_dev#${builtins.storeDir}/}
       kernel_dev=''${kernel_dev%%-linux*dev*}
-      if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko"; then
-          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko
+      if test -f "$out/lib/modules/${kernel.modDirVersion}/extra/scap.ko"; then
+          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/scap.ko
       else
-          xz -d $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko.xz
-          sed -i "s#$kernel_dev#................................#g" $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko
-          xz $out/lib/modules/${kernel.modDirVersion}/extra/sysdig-probe.ko
+          for i in $out/lib/modules/${kernel.modDirVersion}/{extra,updates}/scap.ko.xz; do
+            if test -f "$i"; then
+              xz -d $i
+              sed -i "s#$kernel_dev#................................#g" ''${i%.xz}
+              xz -9 ''${i%.xz}
+            fi
+          done
       fi
     '';
 
 
-  meta = {
+  meta = with lib; {
     description = "A tracepoint-based system tracing tool for Linux (with clients for other OSes)";
     license = with licenses; [ asl20 gpl2 mit ];
     maintainers = [maintainers.raskin];
diff --git a/pkgs/os-specific/linux/sysdig/default.upstream b/pkgs/os-specific/linux/sysdig/default.upstream
deleted file mode 100644
index 485de5741d7..00000000000
--- a/pkgs/os-specific/linux/sysdig/default.upstream
+++ /dev/null
@@ -1,8 +0,0 @@
-url https://github.com/draios/sysdig/releases
-ensure_choice
-version '.*/([0-9.]+)[.]tar[.].*' '\1'
-do_overwrite () {
-  ensure_hash
-  set_var_value sha256 $CURRENT_HASH
-  set_var_value version $CURRENT_VERSION
-}
diff --git a/pkgs/os-specific/linux/sysfsutils/default.nix b/pkgs/os-specific/linux/sysfsutils/default.nix
index 4daac076e58..113ba7939a6 100644
--- a/pkgs/os-specific/linux/sysfsutils/default.nix
+++ b/pkgs/os-specific/linux/sysfsutils/default.nix
@@ -1,15 +1,16 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "sysfsutils-2.1.0";
+  pname = "sysfsutils";
+  version = "2.1.0";
 
   src = fetchurl {
-    url = "mirror://sourceforge/linux-diag/${name}.tar.gz";
+    url = "mirror://sourceforge/linux-diag/sysfsutils-${version}.tar.gz";
     sha256 = "e865de2c1f559fff0d3fc936e660c0efaf7afe662064f2fb97ccad1ec28d208a";
   };
 
   meta = {
-    homepage = "http://linux-diag.sourceforge.net/Sysfsutils.html";
+    homepage = "https://linux-diag.sourceforge.net/Sysfsutils.html";
     longDescription =
       ''
         These are a set of utilites built upon sysfs, a new virtual
diff --git a/pkgs/os-specific/linux/sysklogd/default.nix b/pkgs/os-specific/linux/sysklogd/default.nix
index af180b5e524..048d82b5a53 100644
--- a/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/pkgs/os-specific/linux/sysklogd/default.nix
@@ -1,19 +1,31 @@
 {lib, stdenv, fetchurl}:
 
-stdenv.mkDerivation {
-  name = "sysklogd-1.5.1";
+stdenv.mkDerivation rec {
+  pname = "sysklogd";
+  version = "1.5.1";
 
   src = fetchurl {
-    url = "http://www.infodrom.org/projects/sysklogd/download/sysklogd-1.5.1.tar.gz";
+    url = "http://www.infodrom.org/projects/sysklogd/download/sysklogd-${version}.tar.gz";
     sha256 = "00f2wy6f0qng7qzga4iicyzl9j8b7mp6mrpfky5jxj93ms2w2rji";
   };
 
   patches = [ ./systemd.patch ./union-wait.patch ./fix-includes-for-musl.patch ];
 
-  NIX_CFLAGS_COMPILE = "-DSYSV";
+  env.NIX_CFLAGS_COMPILE = "-DSYSV";
 
   installFlags = [ "BINDIR=$(out)/sbin" "MANDIR=$(out)/share/man" "INSTALL=install" ];
 
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  postPatch = ''
+    # Disable stripping during installation, stripping will be done anyway.
+    # Fixes cross-compilation.
+    substituteInPlace Makefile \
+      --replace "-m 500 -s" "-m 500"
+  '';
+
   preConfigure =
     ''
       sed -e 's@-o \''${MAN_USER} -g \''${MAN_GROUP} -m \''${MAN_PERMS} @@' -i Makefile
diff --git a/pkgs/os-specific/linux/syslinux/default.nix b/pkgs/os-specific/linux/syslinux/default.nix
index 4ca7f50b7d1..f5153eb5abc 100644
--- a/pkgs/os-specific/linux/syslinux/default.nix
+++ b/pkgs/os-specific/linux/syslinux/default.nix
@@ -1,53 +1,70 @@
-{ lib, stdenv, fetchgit, fetchurl, fetchpatch, nasm, perl, python3, libuuid, mtools, makeWrapper }:
+{ lib
+, stdenv
+, fetchgit
+, fetchurl
+, libuuid
+, makeWrapper
+, mtools
+, nasm
+, perl
+, python3
+}:
 
 stdenv.mkDerivation {
   pname = "syslinux";
-  version = "unstable-20190207";
+  version = "unstable-2019-02-07";
 
   # This is syslinux-6.04-pre3^1; syslinux-6.04-pre3 fails to run.
   # Same issue here https://www.syslinux.org/archives/2019-February/026330.html
   src = fetchgit {
     url = "https://repo.or.cz/syslinux";
     rev = "b40487005223a78c3bb4c300ef6c436b3f6ec1f7";
-    sha256 = "1acf6byx7i6vz8hq6mra526g8mf7fmfhid211y8nq0v6px7d3aqs";
+    sha256 = "sha256-GqvRTr9mA2yRD0G0CF11x1X0jCgqV4Mh+tvE0/0yjqk=";
     fetchSubmodules = true;
   };
 
   patches = let
-    mkURL = commit: patchName:
-      "https://salsa.debian.org/images-team/syslinux/raw/${commit}/debian/patches/"
-      + patchName;
+    fetchDebianPatch = name: commit: hash:
+      fetchurl {
+        url = "https://salsa.debian.org/images-team/syslinux/raw/"
+              + commit + "/debian/patches/" + name;
+        inherit name hash;
+      };
+    fetchArchlinuxPatch = name: commit: hash:
+      fetchurl {
+        url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/"
+              + commit + "/trunk/" + name;
+        inherit name hash;
+      };
   in [
-    (fetchurl {
-      url = mkURL "fa1349f1" "0002-gfxboot-menu-label.patch";
-      sha256 = "06ifgzbpjj4picpj17zgprsfi501zf4pp85qjjgn29i5rs291zni";
-    })
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/821c3da473d1399d930d5b4a086e46a4179eaa45/trunk/0005-gnu-efi-version-compatibility.patch";
-      name = "0005-gnu-efi-version-compatibility.patch";
-      sha256 = "1mz2idg8cwn0mvd3jixxynhkn7rhmi5fp8cc8zznh5f0ysfra446";
-    })
-    (fetchurl {
-      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/821c3da473d1399d930d5b4a086e46a4179eaa45/trunk/0025-reproducible-build.patch";
-      name = "0025-reproducible-build.patch";
-      sha256 = "0qk6wc6z3648828y3961pn4pi7xhd20a6fqn6z1mnj22bbvzcxls";
-    })
-    (fetchurl {
+    ./gcc10.patch
+    (fetchDebianPatch
+      "0002-gfxboot-menu-label.patch"
+      "fa1349f1"
+      "sha256-0f6QhM4lJmGflLige4n7AZTodL7vnyAvi5dIedd/Lho=")
+    (fetchArchlinuxPatch
+      "0005-gnu-efi-version-compatibility.patch"
+      "821c3da473d1399d930d5b4a086e46a4179eaa45"
+      "sha256-hhCVnfbAFWj/R4yh60qsMB87ofW9RznarsByhl6L4tc=")
+    (fetchArchlinuxPatch
+      "0025-reproducible-build.patch"
+      "821c3da473d1399d930d5b4a086e46a4179eaa45"
+      "sha256-mnb291pCSFvDNxY7o4BosJ94ib3BpOGRQIiY8Q3jZmI=")
+    (fetchDebianPatch
       # mbr.bin: too big (452 > 440)
       # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906414
-      url = mkURL "7468ef0e38c43" "0016-strip-gnu-property.patch";
-      sha256 = "17n63b8wz6szv8npla1234g1ip7lqgzx2whrpv358ppf67lq8vwm";
-    })
-    (fetchurl {
+      "0016-strip-gnu-property.patch"
+      "7468ef0e38c43"
+      "sha256-lW+E6THuXlTGvhly0f/D9NwYHhkiKHot2l+bz9Eaxp4=")
+    (fetchDebianPatch
       # mbr.bin: too big (452 > 440)
-      url = mkURL "012e1dd312eb" "0017-single-load-segment.patch";
-      sha256 = "0azqzicsjw47b9ppyikhzaqmjl4lrvkxris1356bkmgcaiv6d98b";
-    })
-    (fetchurl {
-      url = mkURL "26f0e7b2" "0018-prevent-pow-optimization.patch";
-      sha256 = "1c8g0jz5yj9a0rsmryx9vdjsw4hw8mjfcg05c9pmyjg85w3dfp3m";
-    })
-    ./gcc10.patch
+      "0017-single-load-segment.patch"
+      "012e1dd312eb"
+      "sha256-C6VmdlTs1blMGUHH3OfOlFBZsfpwRn9vWodwqVn8+Cs=")
+    (fetchDebianPatch
+      "0018-prevent-pow-optimization.patch"
+      "26f0e7b2"
+      "sha256-dVzXBi/oSV9vYgU85mRFHBKuZdup+1x1BipJX74ED7E=")
   ];
 
   postPatch = ''
@@ -63,14 +80,30 @@ stdenv.mkDerivation {
     touch gnu-efi/inc/ia32/gnu/stubs-32.h
   '';
 
-  nativeBuildInputs = [ nasm perl python3 makeWrapper ];
-  buildInputs = [ libuuid ];
+  nativeBuildInputs = [
+    nasm
+    perl
+    python3
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libuuid
+  ];
+
+  # Fails very rarely with 'No rule to make target: ...'
+  enableParallelBuilding = false;
 
-  enableParallelBuilding = false; # Fails very rarely with 'No rule to make target: ...'
   hardeningDisable = [ "pic" "stackprotector" "fortify" ];
 
   stripDebugList = [ "bin" "sbin" "share/syslinux/com32" ];
 
+  # Workaround build failure on -fno-common toolchains like upstream
+  # gcc-10. Otherwise build fails as:
+  #   ld: acpi/xsdt.o:/build/syslinux-b404870/com32/gpllib/../gplinclude/memory.h:40: multiple definition of
+  #     `e820_types'; memory.o:/build/syslinux-b404870/com32/gpllib/../gplinclude/memory.h:40: first defined here
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
+
   makeFlags = [
     "BINDIR=$(out)/bin"
     "SBINDIR=$(out)/sbin"
@@ -79,9 +112,10 @@ stdenv.mkDerivation {
     "PERL=perl"
     "HEXDATE=0x00000000"
   ]
-    ++ lib.optionals stdenv.hostPlatform.isi686 [ "bios" "efi32" ];
+  ++ lib.optionals stdenv.hostPlatform.isi686 [ "bios" "efi32" ];
 
-  doCheck = false; # fails. some fail in a sandbox, others require qemu
+  # Some tests require qemu, some others fail in a sandboxed environment
+  doCheck = false;
 
   postInstall = ''
     wrapProgram $out/bin/syslinux \
@@ -94,7 +128,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     homepage = "http://www.syslinux.org/";
     description = "A lightweight bootloader";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = [ maintainers.samueldr ];
     platforms = [ "i686-linux" "x86_64-linux" ];
   };
diff --git a/pkgs/os-specific/linux/sysstat/default.nix b/pkgs/os-specific/linux/sysstat/default.nix
index 2eff999ac7c..303935d8adb 100644
--- a/pkgs/os-specific/linux/sysstat/default.nix
+++ b/pkgs/os-specific/linux/sysstat/default.nix
@@ -1,11 +1,19 @@
-{ lib, stdenv, fetchurl, gettext, bzip2 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gettext
+, bzip2
+}:
 
 stdenv.mkDerivation rec {
-  name = "sysstat-12.4.3";
+  pname = "sysstat";
+  version = "12.7.4";
 
-  src = fetchurl {
-    url = "http://pagesperso-orange.fr/sebastien.godard/${name}.tar.xz";
-    sha256 = "sha256-rkMkMfRarLyrrPu+Ep4lBeIVyvqc6ZbXVQxgkaRvC/0=";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ELmSzWnJ8vGwGPwY/5MFp/2gQhMXMjNG4bHtCplfQSc=";
   };
 
   buildInputs = [ gettext ];
@@ -15,6 +23,7 @@ stdenv.mkDerivation rec {
     export PATH_CHKCONFIG=/no-such-program
     export BZIP=${bzip2.bin}/bin/bzip2
     export SYSTEMCTL=systemctl
+    export COMPRESS_MANPG=n
   '';
 
   makeFlags = [ "SYSCONFIG_DIR=$(out)/etc" "IGNORE_FILE_ATTRIBUTES=y" "CHOWN=true" ];
diff --git a/pkgs/os-specific/linux/system76-acpi/default.nix b/pkgs/os-specific/linux/system76-acpi/default.nix
index f642fad6978..b384cf63948 100644
--- a/pkgs/os-specific/linux/system76-acpi/default.nix
+++ b/pkgs/os-specific/linux/system76-acpi/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 let
-  version = "1.0.1";
-  sha256 = "0jmm9h607f7k20yassm6af9mh5l00yih5248wwv4i05bd68yw3p5";
+  version = "1.0.2";
+  sha256 = "1i7zjn5cdv9h00fgjg46b8yrz4d3dqvfr25g3f13967ycy58m48h";
 in
 stdenv.mkDerivation {
   name = "system76-acpi-module-${version}-${kernel.version}";
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.khumba ];
     license = [ licenses.gpl2Only ];
     platforms = [ "i686-linux" "x86_64-linux" ];
-    broken = versionOlder kernel.version "4.14";
+    broken = kernel.kernelOlder "5.2";
     description = "System76 ACPI Driver (DKMS)";
     homepage = "https://github.com/pop-os/system76-acpi-dkms";
     longDescription = ''
diff --git a/pkgs/os-specific/linux/system76-io/default.nix b/pkgs/os-specific/linux/system76-io/default.nix
index fb697430f61..54af222bc7d 100644
--- a/pkgs/os-specific/linux/system76-io/default.nix
+++ b/pkgs/os-specific/linux/system76-io/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 let
-  version = "1.0.1";
-  sha256 = "0qkgkkjy1isv6ws6hrcal75dxjz98rpnvqbm7agdcc6yv0c17wwh";
+  version = "1.0.2";
+  sha256 = "sha256-DWUjQmoojkzFv1p4Xyt0kOwwqQ216ocO5yR/ujhhMPA=";
 in
 stdenv.mkDerivation {
   name = "system76-io-module-${version}-${kernel.version}";
diff --git a/pkgs/os-specific/linux/system76-power/default.nix b/pkgs/os-specific/linux/system76-power/default.nix
index fbc26ca8719..f1a4c9b7bb3 100644
--- a/pkgs/os-specific/linux/system76-power/default.nix
+++ b/pkgs/os-specific/linux/system76-power/default.nix
@@ -2,22 +2,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "system76-power";
-  version = "1.1.16";
+  version = "1.1.23";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "system76-power";
     rev = version;
-    sha256 = "sha256-OtrhvUkNNgg6KlrqjwiBKL4zuQZBWevb0xgtSlEW2rQ=";
+    sha256 = "sha256-RuYDG4eZE599oa04xUR+W5B3/IPOpQUss1x7hzoydUQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus libusb1 ];
 
-  cargoSha256 = "sha256-ImACDbnUbwc0ZXgF3xxzes8+vUjt76B1xxgqzhgAYX4=";
+  cargoSha256 = "sha256-Vps02ZRVmeOQ8jDFZJYAUb502MhqY+2YV2W1/9XGY+0=";
 
   postInstall = ''
-    install -D -m 0644 data/system76-power.conf $out/etc/dbus-1/system.d/system76-power.conf
+    install -D -m 0644 data/com.system76.PowerDaemon.conf $out/etc/dbus-1/system.d/com.system76.PowerDaemon.conf
+    install -D -m 0644 data/com.system76.PowerDaemon.policy $out/share/polkit-1/actions/com.system76.PowerDaemon.policy
+    install -D -m 0644 data/com.system76.PowerDaemon.xml $out/share/dbus-1/interfaces/com.system76.PowerDaemon.xml
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/system76-scheduler/01-fix-pipewire-paths.kdl b/pkgs/os-specific/linux/system76-scheduler/01-fix-pipewire-paths.kdl
new file mode 100644
index 00000000000..1ce08e2d343
--- /dev/null
+++ b/pkgs/os-specific/linux/system76-scheduler/01-fix-pipewire-paths.kdl
@@ -0,0 +1,8 @@
+assignments {
+  sound-server {
+    // original config matches on /usr/bin/..., but this is NixOS
+    pipewire
+    pipewire-pulse
+    jackd
+  }
+}
diff --git a/pkgs/os-specific/linux/system76-scheduler/default.nix b/pkgs/os-specific/linux/system76-scheduler/default.nix
new file mode 100644
index 00000000000..99c54900cf7
--- /dev/null
+++ b/pkgs/os-specific/linux/system76-scheduler/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+, pipewire
+, pkg-config
+, bcc
+, dbus }:
+
+let
+  version = "2.0.1";
+in rustPlatform.buildRustPackage {
+  pname = "system76-scheduler";
+  inherit version;
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "system76-scheduler";
+    rev = version;
+    hash = "sha256-o4noaLBXHDe7pMBHfQ85uzKJzwbBE5mkWq8h9l6iIZs=";
+  };
+  cargoSha256 = "sha256-hpFDAhOzm4v3lBWwAl/10pS5xvKCScdKsp5wpCeQ+FE=";
+
+  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
+  buildInputs = [ dbus pipewire ];
+
+  EXECSNOOP_PATH = "${bcc}/bin/execsnoop";
+
+  # tests don't build
+  doCheck = false;
+
+  postInstall = ''
+    mkdir -p $out/data
+    install -D -m 0644 data/com.system76.Scheduler.conf $out/etc/dbus-1/system.d/com.system76.Scheduler.conf
+    install -D -m 0644 data/*.kdl $out/data/
+  '';
+
+  meta = with lib; {
+    description = "System76 Scheduler";
+    homepage = "https://github.com/pop-os/system76-scheduler";
+    license = licenses.mpl20;
+    platforms = [ "x86_64-linux" "x86-linux" "aarch64-linux" ];
+    maintainers = [ maintainers.cmm ];
+  };
+}
diff --git a/pkgs/os-specific/linux/system76/default.nix b/pkgs/os-specific/linux/system76/default.nix
index 84c153c2f82..7d9cd9bde02 100644
--- a/pkgs/os-specific/linux/system76/default.nix
+++ b/pkgs/os-specific/linux/system76/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 let
-  version = "1.0.9";
-  sha256 = "0i4825y2vd679kdjv30ifzj1i1066d3x37z4lgk39hx16993k162";
+  version = "1.0.13";
+  sha256 = "162hhmnww8z9k0795ffs8v3f61hlfm375law156sk5l08if19a4r";
 in
 stdenv.mkDerivation {
   name = "system76-module-${version}-${kernel.version}";
diff --git a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
index ac2d0018160..104a9dad959 100644
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@@ -1,7 +1,7 @@
-From 2f4a5e9c9ef1cd57662e8bd4c24e1029a00d55b5 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Tue, 8 Jan 2013 15:46:30 +0100
-Subject: [PATCH 01/19] Start device units for uninitialised encrypted devices
+Subject: [PATCH] Start device units for uninitialised encrypted devices
 
 This is necessary because the NixOS service that initialises the
 filesystem depends on the appearance of the device unit.  Also, this
@@ -13,20 +13,17 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
  1 file changed, 4 deletions(-)
 
 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 7c22eefdb7..e3a55e00b5 100644
+index c0defc31de..8f80235731 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
-@@ -17,10 +17,6 @@ SUBSYSTEM=="ubi", TAG+="systemd"
- SUBSYSTEM=="block", TAG+="systemd"
+@@ -20,10 +20,6 @@ SUBSYSTEM=="block", TAG+="systemd"
+ SUBSYSTEM=="block", ENV{DM_SUSPENDED}=="1", IMPORT{db}="SYSTEMD_READY", GOTO="systemd_end"
  SUBSYSTEM=="block", ACTION=="add", ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="1", ENV{SYSTEMD_READY}="0"
  
 -# Ignore encrypted devices with no identified superblock on it, since
 -# we are probably still calling mke2fs or mkswap on it.
 -SUBSYSTEM=="block", ENV{DM_UUID}=="CRYPT-*", ENV{ID_PART_TABLE_TYPE}=="", ENV{ID_FS_USAGE}=="", ENV{SYSTEMD_READY}="0"
 -
- # add symlink to GPT root disk
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
- SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
--- 
-2.30.1
-
+ # Explicitly set SYSTEMD_READY=1 for DM devices that don't have it set yet, so that we always have something to import above
+ SUBSYSTEM=="block", ENV{DM_UUID}=="?*", ENV{SYSTEMD_READY}=="", ENV{SYSTEMD_READY}="1"
+ 
diff --git a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
index f54430f764e..dda8524c498 100644
--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@@ -1,21 +1,23 @@
-From 4e96b2e074c4a4f4ce900409872ce2f86704ee5b Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Fri, 12 Apr 2013 13:16:57 +0200
-Subject: [PATCH 02/19] Don't try to unmount /nix or /nix/store
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Raito Bezarius <masterancpp@gmail.com>
+Date: Mon, 19 Jun 2023 02:11:35 +0200
+Subject: [PATCH] Don't try to unmount /nix or /nix/store
 
 They'll still be remounted read-only.
 
 https://github.com/NixOS/nixos/issues/126
+
+Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
 ---
  src/shared/fstab-util.c | 2 ++
- src/shutdown/umount.c   | 2 ++
- 2 files changed, 4 insertions(+)
+ src/shutdown/umount.c   | 6 ++++--
+ 2 files changed, 6 insertions(+), 2 deletions(-)
 
 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index 292b97cd69..791b8e6b7e 100644
+index 4ffec25c75..b99031c54e 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
-@@ -40,6 +40,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
+@@ -43,6 +43,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
          /* Don't bother with the OS data itself */
          if (PATH_IN_SET(mount,
                          "/",
@@ -25,18 +27,19 @@ index 292b97cd69..791b8e6b7e 100644
                          "/etc"))
                  return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 3a72a13e1a..541320dc9d 100644
+index 1586c2e214..fcae95f824 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -500,6 +500,8 @@ static int delete_md(MountPoint *m) {
- 
+@@ -170,8 +170,10 @@ int mount_points_list_get(const char *mountinfo, MountPoint **head) {
  static bool nonunmountable_path(const char *path) {
-         return path_equal(path, "/")
+         assert(path);
+ 
+-        return PATH_IN_SET(path, "/", "/usr") ||
+-                path_startswith(path, "/run/initramfs");
++        return PATH_IN_SET(path, "/", "/usr")
 +                || path_equal(path, "/nix")
 +                || path_equal(path, "/nix/store")
- #if ! HAVE_SPLIT_USR
-                 || path_equal(path, "/usr")
- #endif
--- 
-2.30.1
-
++                || path_startswith(path, "/run/initramfs");
+ }
+ 
+ static void log_umount_blockers(const char *mnt) {
diff --git a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
index 37caffb97d7..2d86d1e6957 100644
--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@@ -1,7 +1,7 @@
-From 3d1b2e56a6ed6cc86a64f6f89765a2900e576402 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Wed, 16 Apr 2014 10:59:28 +0200
-Subject: [PATCH 03/19] Fix NixOS containers
+Subject: [PATCH] Fix NixOS containers
 
 In NixOS containers, the init script is bind-mounted into the
 container, so checking early whether it exists will fail.
@@ -10,25 +10,22 @@ container, so checking early whether it exists will fail.
  1 file changed, 2 insertions(+)
 
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 7515380fcd..14f8a82eb8 100644
+index e170958fc5..898a674631 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5323,6 +5323,7 @@ static int run(int argc, char *argv[]) {
+@@ -5648,6 +5648,7 @@ static int run(int argc, char *argv[]) {
                                  goto finish;
                          }
                  } else {
 +#if 0
-                         const char *p, *q;
+                         _cleanup_free_ char *p = NULL;
  
                          if (arg_pivot_root_new)
-@@ -5337,6 +5338,7 @@ static int run(int argc, char *argv[]) {
-                                 r = -EINVAL;
+@@ -5662,6 +5663,7 @@ static int run(int argc, char *argv[]) {
+                                                     "Directory %s doesn't look like it has an OS tree (/usr/ directory is missing). Refusing.", arg_directory);
                                  goto finish;
                          }
 +#endif
                  }
  
          } else {
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
index 0acccacd613..c905a4d812a 100644
--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Add-some-NixOS-specific-unit-directories.patch
@@ -1,23 +1,25 @@
-From 8b7f881cf22e98e907506f4c403b9e304e332bf9 Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Fri, 19 Dec 2014 14:46:17 +0100
-Subject: [PATCH 05/19] Add some NixOS-specific unit directories
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Raito Bezarius <masterancpp@gmail.com>
+Date: Mon, 19 Jun 2023 02:13:42 +0200
+Subject: [PATCH] Add some NixOS-specific unit directories
 
 Look in `/nix/var/nix/profiles/default/lib/systemd/{system,user}` for
 units provided by packages installed into the default profile via
 `nix-env -iA nixos.$package`.
 
 Also, remove /usr and /lib as these don't exist on NixOS.
+
+Original-Author: Eelco Dolstra <eelco.dolstra@logicblox.com>
 ---
  src/basic/path-lookup.c | 17 ++---------------
- src/core/systemd.pc.in  |  5 +++--
- 2 files changed, 5 insertions(+), 17 deletions(-)
+ src/core/systemd.pc.in  |  8 ++++----
+ 2 files changed, 6 insertions(+), 19 deletions(-)
 
 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 96b82170d0..bf66bd6b77 100644
+index 7d158a8295..f9bd62b631 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
-@@ -94,11 +94,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
+@@ -92,11 +92,7 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
  }
  
  static const char* const user_data_unit_paths[] = {
@@ -29,7 +31,7 @@ index 96b82170d0..bf66bd6b77 100644
          NULL
  };
  
-@@ -616,15 +612,13 @@ int lookup_paths_init(
+@@ -617,15 +613,13 @@ int lookup_paths_init(
                                          persistent_config,
                                          SYSTEM_CONFIG_UNIT_DIR,
                                          "/etc/systemd/system",
@@ -40,13 +42,13 @@ index 96b82170d0..bf66bd6b77 100644
                                          STRV_IFNOTNULL(runtime_attached),
                                          STRV_IFNOTNULL(generator),
 -                                        "/usr/local/lib/systemd/system",
-                                         SYSTEM_DATA_UNIT_PATH,
+                                         SYSTEM_DATA_UNIT_DIR,
 -                                        "/usr/lib/systemd/system",
 -                                        STRV_IFNOTNULL(flags & LOOKUP_PATHS_SPLIT_USR ? "/lib/systemd/system" : NULL),
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -640,14 +634,11 @@ int lookup_paths_init(
+@@ -641,14 +635,11 @@ int lookup_paths_init(
                                          persistent_config,
                                          USER_CONFIG_UNIT_DIR,
                                          "/etc/systemd/user",
@@ -62,40 +64,42 @@ index 96b82170d0..bf66bd6b77 100644
                                          STRV_IFNOTNULL(generator_late));
                          break;
  
-@@ -797,7 +788,6 @@ char **generator_binary_paths(UnitFileScope scope) {
-                 case UNIT_FILE_SYSTEM:
+@@ -808,7 +799,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+                 case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-generators",
                                         "/etc/systemd/system-generators",
 -                                       "/usr/local/lib/systemd/system-generators",
                                         SYSTEM_GENERATOR_DIR);
                          break;
  
-@@ -805,7 +795,6 @@ char **generator_binary_paths(UnitFileScope scope) {
-                 case UNIT_FILE_USER:
+@@ -816,7 +806,6 @@ char **generator_binary_paths(RuntimeScope scope) {
+                 case RUNTIME_SCOPE_USER:
                          add = strv_new("/run/systemd/user-generators",
                                         "/etc/systemd/user-generators",
 -                                       "/usr/local/lib/systemd/user-generators",
                                         USER_GENERATOR_DIR);
                          break;
  
-@@ -844,12 +833,10 @@ char **env_generator_binary_paths(bool is_system) {
-                 if (is_system)
+@@ -855,14 +844,12 @@ char **env_generator_binary_paths(RuntimeScope runtime_scope) {
+                 case RUNTIME_SCOPE_SYSTEM:
                          add = strv_new("/run/systemd/system-environment-generators",
                                          "/etc/systemd/system-environment-generators",
 -                                        "/usr/local/lib/systemd/system-environment-generators",
                                          SYSTEM_ENV_GENERATOR_DIR);
-                 else
+                         break;
+ 
+                 case RUNTIME_SCOPE_USER:
                          add = strv_new("/run/systemd/user-environment-generators",
                                         "/etc/systemd/user-environment-generators",
 -                                       "/usr/local/lib/systemd/user-environment-generators",
                                         USER_ENV_GENERATOR_DIR);
+                         break;
  
-                 if (!add)
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index b5cc8f94a5..a701cd05f8 100644
+index 693433b34b..5932a21b5b 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
-@@ -38,10 +38,11 @@ systemdsystemconfdir=${systemd_system_conf_dir}
+@@ -38,10 +38,10 @@ systemdsystemconfdir=${systemd_system_conf_dir}
  systemd_user_conf_dir=${sysconfdir}/systemd/user
  systemduserconfdir=${systemd_user_conf_dir}
  
@@ -105,10 +109,19 @@ index b5cc8f94a5..a701cd05f8 100644
  
 -systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/local/share/systemd/user:${systemd_user_unit_dir}:/usr/lib/systemd/user:/usr/share/systemd/user
 +systemd_user_unit_path=${systemd_user_conf_dir}:/etc/systemd/user:/nix/var/nix/profiles/default/lib/systemd/user:/run/systemd/user:${systemduserunitdir}
-+
  systemduserunitpath=${systemd_user_unit_path}
  
  systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
--- 
-2.30.1
-
+@@ -50,10 +50,10 @@ systemdsystemgeneratordir=${systemd_system_generator_dir}
+ systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
+ systemdusergeneratordir=${systemd_user_generator_dir}
+ 
+-systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemd_system_generator_dir}
++systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:${systemd_system_generator_dir}
+ systemdsystemgeneratorpath=${systemd_system_generator_path}
+ 
+-systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:/usr/local/lib/systemd/user-generators:${systemd_user_generator_dir}
++systemd_user_generator_path=/run/systemd/user-generators:/etc/systemd/user-generators:${systemd_user_generator_dir}
+ systemdusergeneratorpath=${systemd_user_generator_path}
+ 
+ systemd_sleep_dir=${root_prefix}/lib/systemd/system-sleep
diff --git a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
deleted file mode 100644
index 2f14a9d6a7e..00000000000
--- a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 3a721cf70e952e933ef5374006bbb11a3a0ad36a Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Thu, 1 May 2014 14:10:10 +0200
-Subject: [PATCH 04/19] Look for fsck in the right place
-
----
- src/fsck/fsck.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 510689f3b7..25cab5acae 100644
---- a/src/fsck/fsck.c
-+++ b/src/fsck/fsck.c
-@@ -368,7 +368,7 @@ static int run(int argc, char *argv[]) {
-                 } else
-                         dash_c[0] = 0;
- 
--                cmdline[i++] = "/sbin/fsck";
-+                cmdline[i++] = "/run/current-system/sw/bin/fsck";
-                 cmdline[i++] =  arg_repair;
-                 cmdline[i++] = "-T";
- 
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
new file mode 100644
index 00000000000..0a80d5ac4e8
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0005-Get-rid-of-a-useless-message-in-user-sessions.patch
@@ -0,0 +1,28 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Eelco Dolstra <eelco.dolstra@logicblox.com>
+Date: Mon, 11 May 2015 15:39:38 +0200
+Subject: [PATCH] Get rid of a useless message in user sessions
+
+Namely lots of variants of
+
+  Unit nix-var-nix-db.mount is bound to inactive unit dev-disk-by\x2dlabel-nixos.device. Stopping, too.
+
+in containers.
+---
+ src/core/manager.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 22ec6e79b1..771e8e7f16 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -1559,7 +1559,8 @@ static unsigned manager_dispatch_stop_when_bound_queue(Manager *m) {
+                 if (!unit_is_bound_by_inactive(u, &culprit))
+                         continue;
+ 
+-                log_unit_debug(u, "Unit is stopped because bound to inactive unit %s.", culprit->id);
++                if (u->type != UNIT_MOUNT || detect_container() <= 0)
++                        log_unit_debug(u, "Unit is stopped because bound to inactive unit %s.", culprit->id);
+ 
+                 /* If stopping a unit fails continuously we might enter a stop loop here, hence stop acting on the
+                  * service being unnecessary after a while. */
diff --git a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
deleted file mode 100644
index bda27ac1762..00000000000
--- a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 7a6529ee27028860b93bc539e8bbf3f2374d712f Mon Sep 17 00:00:00 2001
-From: Eelco Dolstra <eelco.dolstra@logicblox.com>
-Date: Mon, 11 May 2015 15:39:38 +0200
-Subject: [PATCH 06/19] Get rid of a useless message in user sessions
-
-Namely lots of variants of
-
-  Unit nix-var-nix-db.mount is bound to inactive unit dev-disk-by\x2dlabel-nixos.device. Stopping, too.
-
-in containers.
----
- src/core/unit.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/core/unit.c b/src/core/unit.c
-index 45a417a090..8af3cb08d6 100644
---- a/src/core/unit.c
-+++ b/src/core/unit.c
-@@ -2163,7 +2163,8 @@ static void unit_check_binds_to(Unit *u) {
-         }
- 
-         assert(other);
--        log_unit_info(u, "Unit is bound to inactive unit %s. Stopping, too.", other->id);
-+        if (u->type != UNIT_MOUNT || detect_container() <= 0)
-+                log_unit_info(u, "Unit is bound to inactive unit %s. Stopping, too.", other->id);
- 
-         /* A unit we need to run is gone. Sniff. Let's stop this. */
-         r = manager_add_job(u->manager, JOB_STOP, u, JOB_FAIL, NULL, &error, NULL);
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
index d51e1c0f566..abc6c24dbf5 100644
--- a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
@@ -1,8 +1,8 @@
-From 5580303956ca7d8eb431d23c2af0030c9cc0e6e9 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Gabriel Ebner <gebner@gebner.org>
 Date: Sun, 6 Dec 2015 14:26:36 +0100
-Subject: [PATCH 07/19] hostnamed, localed, timedated: disable methods that
- change system settings.
+Subject: [PATCH] hostnamed, localed, timedated: disable methods that change
+ system settings.
 
 ---
  src/hostname/hostnamed.c |  6 ++++++
@@ -11,10 +11,10 @@ Subject: [PATCH 07/19] hostnamed, localed, timedated: disable methods that
  3 files changed, 25 insertions(+)
 
 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index a1794bdab1..77134731e1 100644
+index 9ef45f8e75..99b1ec2e36 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -643,6 +643,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -1053,6 +1053,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
          if (r < 0)
                  return r;
  
@@ -24,7 +24,7 @@ index a1794bdab1..77134731e1 100644
          name = empty_to_null(name);
  
          context_read_etc_hostname(c);
-@@ -702,6 +705,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -1116,6 +1119,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
          if (r < 0)
                  return r;
  
@@ -35,12 +35,12 @@ index a1794bdab1..77134731e1 100644
  
          context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 736dacdee9..53e0ee935e 100644
+index f544a73580..ce00c262cc 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
-@@ -317,6 +317,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
-         if (r < 0)
-                 return r;
+@@ -229,6 +229,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
+ 
+         use_localegen = locale_gen_check_available();
  
 +        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
 +            "Changing system settings via systemd is not supported on NixOS.");
@@ -48,31 +48,31 @@ index 736dacdee9..53e0ee935e 100644
          /* If single locale without variable name is provided, then we assume it is LANG=. */
          if (strv_length(l) == 1 && !strchr(l[0], '=')) {
                  if (!locale_is_valid(l[0]))
-@@ -432,6 +435,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
+@@ -347,6 +350,9 @@ static int method_set_vc_keyboard(sd_bus_message *m, void *userdata, sd_bus_erro
          if (r < 0)
-                 return r;
+                 return bus_log_parse_error(r);
  
 +        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
 +            "Changing system settings via systemd is not supported on NixOS.");
 +
-         keymap = empty_to_null(keymap);
-         keymap_toggle = empty_to_null(keymap_toggle);
+         vc_context_empty_to_null(&in);
  
-@@ -606,6 +612,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
+         r = vc_context_verify_and_warn(&in, LOG_ERR, error);
+@@ -465,6 +471,9 @@ static int method_set_x11_keyboard(sd_bus_message *m, void *userdata, sd_bus_err
          if (r < 0)
-                 return r;
+                 return bus_log_parse_error(r);
  
 +        return sd_bus_error_setf(error, SD_BUS_ERROR_NOT_SUPPORTED,
 +            "Changing system settings via systemd is not supported on NixOS.");
 +
-         layout = empty_to_null(layout);
-         model = empty_to_null(model);
-         variant = empty_to_null(variant);
+         x11_context_empty_to_null(&in);
+ 
+         r = x11_context_verify_and_warn(&in, LOG_ERR, error);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 76fe04900d..e87c4c8919 100644
+index ad1d492d6b..331af34505 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -646,6 +646,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
+@@ -665,6 +665,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
          if (r < 0)
                  return r;
  
@@ -83,7 +83,7 @@ index 76fe04900d..e87c4c8919 100644
          if (!timezone_is_valid(z, LOG_DEBUG))
                  return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid or not installed time zone '%s'", z);
  
-@@ -725,6 +729,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
+@@ -743,6 +747,9 @@ static int method_set_local_rtc(sd_bus_message *m, void *userdata, sd_bus_error
          if (r < 0)
                  return r;
  
@@ -93,7 +93,7 @@ index 76fe04900d..e87c4c8919 100644
          if (lrtc == c->local_rtc && !fix_system)
                  return sd_bus_reply_method_return(m, NULL);
  
-@@ -907,6 +914,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -923,6 +930,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
          if (r < 0)
                  return r;
  
@@ -103,6 +103,3 @@ index 76fe04900d..e87c4c8919 100644
          r = context_update_ntp_status(c, bus, m);
          if (r < 0)
                  return r;
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
new file mode 100644
index 00000000000..7777ba7e425
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0007-Fix-hwdb-paths.patch
@@ -0,0 +1,24 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Thu, 7 Jul 2016 02:47:13 +0300
+Subject: [PATCH] Fix hwdb paths
+
+Patch by vcunat.
+---
+ src/libsystemd/sd-hwdb/hwdb-internal.h | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/src/libsystemd/sd-hwdb/hwdb-internal.h b/src/libsystemd/sd-hwdb/hwdb-internal.h
+index 5302679a62..39e59a527f 100644
+--- a/src/libsystemd/sd-hwdb/hwdb-internal.h
++++ b/src/libsystemd/sd-hwdb/hwdb-internal.h
+@@ -83,8 +83,4 @@ struct trie_value_entry2_f {
+ } _packed_;
+ 
+ #define hwdb_bin_paths                          \
+-        "/etc/systemd/hwdb/hwdb.bin\0"          \
+-        "/etc/udev/hwdb.bin\0"                  \
+-        "/usr/lib/systemd/hwdb/hwdb.bin\0"      \
+-        _CONF_PATHS_SPLIT_USR_NULSTR("systemd/hwdb/hwdb.bin") \
+-        UDEVLIBEXECDIR "/hwdb.bin\0"
++        "/etc/udev/hwdb.bin\0"
diff --git a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch b/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
index a1e8ec963c7..3150d97be2e 100644
--- a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@@ -1,16 +1,16 @@
-From 367d0dad3d1853048569e315931cb8a27e16a098 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Tue, 11 Oct 2016 13:12:08 +0300
-Subject: [PATCH 09/19] Change /usr/share/zoneinfo to /etc/zoneinfo
+Subject: [PATCH] Change /usr/share/zoneinfo to /etc/zoneinfo
 
 NixOS uses this path.
 ---
  man/localtime.xml         | 4 ++--
- src/basic/time-util.c     | 6 +++---
+ src/basic/time-util.c     | 8 ++++----
  src/firstboot/firstboot.c | 2 +-
  src/nspawn/nspawn.c       | 4 ++--
  src/timedate/timedated.c  | 8 ++++----
- 5 files changed, 12 insertions(+), 12 deletions(-)
+ 5 files changed, 13 insertions(+), 13 deletions(-)
 
 diff --git a/man/localtime.xml b/man/localtime.xml
 index e486474c44..5f373d0723 100644
@@ -35,28 +35,37 @@ index e486474c44..5f373d0723 100644
      <literal>Etc/UTC</literal>. The resulting link should lead to the
      corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 5318d6378d..04069dc27b 100644
+index 1db630003a..31744c3e68 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1277,7 +1277,7 @@ int get_timezones(char ***ret) {
-         n_allocated = 2;
-         n_zones = 1;
+@@ -1350,7 +1350,7 @@ static int get_timezones_from_zone1970_tab(char ***ret) {
+ 
+         assert(ret);
  
 -        f = fopen("/usr/share/zoneinfo/zone1970.tab", "re");
 +        f = fopen("/etc/zoneinfo/zone1970.tab", "re");
-         if (f) {
-                 for (;;) {
-                         _cleanup_free_ char *line = NULL;
-@@ -1372,7 +1372,7 @@ bool timezone_is_valid(const char *name, int log_level) {
+         if (!f)
+                 return -errno;
+ 
+@@ -1391,7 +1391,7 @@ static int get_timezones_from_tzdata_zi(char ***ret) {
+ 
+         assert(ret);
+ 
+-        f = fopen("/usr/share/zoneinfo/tzdata.zi", "re");
++        f = fopen("/etc/zoneinfo/tzdata.zi", "re");
+         if (!f)
+                 return -errno;
+ 
+@@ -1503,7 +1503,7 @@ int verify_timezone(const char *name, int log_level) {
          if (p - name >= PATH_MAX)
-                 return false;
+                 return -ENAMETOOLONG;
  
 -        t = strjoina("/usr/share/zoneinfo/", name);
 +        t = strjoina("/etc/zoneinfo/", name);
  
          fd = open(t, O_RDONLY|O_CLOEXEC);
-         if (fd < 0) {
-@@ -1470,7 +1470,7 @@ int get_timezone(char **ret) {
+         if (fd < 0)
+@@ -1563,7 +1563,7 @@ int get_timezone(char **ret) {
          if (r < 0)
                  return r; /* returns EINVAL if not a symlink */
  
@@ -66,23 +75,23 @@ index 5318d6378d..04069dc27b 100644
                  return -EINVAL;
  
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index 742b43f9fc..f2cb121816 100644
+index 1956ab3b13..9ef356f8af 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -459,7 +459,7 @@ static int process_timezone(void) {
+@@ -630,7 +630,7 @@ static int process_timezone(int rfd) {
          if (isempty(arg_timezone))
                  return 0;
  
 -        e = strjoina("../usr/share/zoneinfo/", arg_timezone);
 +        e = strjoina("zoneinfo/", arg_timezone);
  
-         (void) mkdir_parents(etc_localtime, 0755);
-         if (symlink(e, etc_localtime) < 0)
+         r = symlinkat_atomic_full(e, pfd, f, /* make_relative= */ false);
+         if (r < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 14f8a82eb8..8632dadec6 100644
+index 898a674631..c41a416e04 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1810,8 +1810,8 @@ static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t u
+@@ -1924,8 +1924,8 @@ int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t uid, gid
  static const char *timezone_from_path(const char *path) {
          return PATH_STARTSWITH_SET(
                          path,
@@ -94,10 +103,10 @@ index 14f8a82eb8..8632dadec6 100644
  
  static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index e87c4c8919..964a40ba81 100644
+index 331af34505..722c4b5b4f 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
-@@ -269,7 +269,7 @@ static int context_read_data(Context *c) {
+@@ -282,7 +282,7 @@ static int context_read_data(Context *c) {
  
          r = get_timezone(&t);
          if (r == -EINVAL)
@@ -106,7 +115,7 @@ index e87c4c8919..964a40ba81 100644
          else if (r < 0)
                  log_warning_errno(r, "Failed to get target of /etc/localtime: %m");
  
-@@ -293,7 +293,7 @@ static int context_write_data_timezone(Context *c) {
+@@ -306,7 +306,7 @@ static int context_write_data_timezone(Context *c) {
  
          if (isempty(c->zone) || streq(c->zone, "UTC")) {
  
@@ -115,7 +124,7 @@ index e87c4c8919..964a40ba81 100644
  
                          if (unlink("/etc/localtime") < 0 && errno != ENOENT)
                                  return -errno;
-@@ -301,9 +301,9 @@ static int context_write_data_timezone(Context *c) {
+@@ -314,9 +314,9 @@ static int context_write_data_timezone(Context *c) {
                          return 0;
                  }
  
@@ -127,6 +136,3 @@ index e87c4c8919..964a40ba81 100644
                  if (!p)
                          return -ENOMEM;
  
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch b/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
deleted file mode 100644
index 2b1c02b233c..00000000000
--- a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From 874698425f6d68fc0d662cb17c7c29e0af3e8c25 Mon Sep 17 00:00:00 2001
-From: Nikolay Amiantov <ab@fmap.me>
-Date: Thu, 7 Jul 2016 02:47:13 +0300
-Subject: [PATCH 08/19] Fix hwdb paths
-
-Patch by vcunat.
----
- src/libsystemd/sd-hwdb/sd-hwdb.c | 7 +------
- 1 file changed, 1 insertion(+), 6 deletions(-)
-
-diff --git a/src/libsystemd/sd-hwdb/sd-hwdb.c b/src/libsystemd/sd-hwdb/sd-hwdb.c
-index cb3c77ce96..7b8c80071f 100644
---- a/src/libsystemd/sd-hwdb/sd-hwdb.c
-+++ b/src/libsystemd/sd-hwdb/sd-hwdb.c
-@@ -297,13 +297,8 @@ static int trie_search_f(sd_hwdb *hwdb, const char *search) {
- }
- 
- static const char hwdb_bin_paths[] =
--        "/etc/systemd/hwdb/hwdb.bin\0"
-         "/etc/udev/hwdb.bin\0"
--        "/usr/lib/systemd/hwdb/hwdb.bin\0"
--#if HAVE_SPLIT_USR
--        "/lib/systemd/hwdb/hwdb.bin\0"
--#endif
--        UDEVLIBEXECDIR "/hwdb.bin\0";
-+        ;
- 
- _public_ int sd_hwdb_new(sd_hwdb **ret) {
-         _cleanup_(sd_hwdb_unrefp) sd_hwdb *hwdb = NULL;
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch b/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
index 334156495fc..c0f6afd7fc7 100644
--- a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0009-localectl-use-etc-X11-xkb-for-list-x11.patch
@@ -1,7 +1,7 @@
-From bf285fe7e12bd22f95c14bcefbb5008888c32bfa Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Imuli <i@imu.li>
 Date: Wed, 19 Oct 2016 08:46:47 -0400
-Subject: [PATCH 10/19] localectl: use /etc/X11/xkb for list-x11-*
+Subject: [PATCH] localectl: use /etc/X11/xkb for list-x11-*
 
 NixOS has an option to link the xkb data files to /etc/X11, but not to
 /usr/share/X11.
@@ -10,10 +10,10 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index 7d2e887660..91c5139eed 100644
+index d8db9d9d22..4601bb5431 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
-@@ -277,7 +277,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
+@@ -297,7 +297,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
          } state = NONE, look_for;
          int r;
  
@@ -22,6 +22,3 @@ index 7d2e887660..91c5139eed 100644
          if (!f)
                  return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
  
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
index 902018ee4b9..b8f97308acf 100644
--- a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/pkgs/os-specific/linux/systemd/0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@@ -1,26 +1,23 @@
-From 293b19c5fdbda1b4ee579a7e8ba12f024a6f34c9 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Franz Pletz <fpletz@fnordicwalking.de>
 Date: Sun, 11 Feb 2018 04:37:44 +0100
-Subject: [PATCH 11/19] build: don't create statedir and don't touch prefixdir
+Subject: [PATCH] build: don't create statedir and don't touch prefixdir
 
 ---
  meson.build | 3 ---
  1 file changed, 3 deletions(-)
 
 diff --git a/meson.build b/meson.build
-index 580964c3fa..f99d4f3ab5 100644
+index 395eca1943..082cd748bb 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3518,9 +3518,6 @@ install_data('LICENSE.GPL2',
-              'src/libsystemd/sd-bus/GVARIANT-SERIALIZATION',
-              install_dir : docdir)
+@@ -4707,9 +4707,6 @@ install_data('LICENSE.GPL2',
+ install_subdir('LICENSES',
+                install_dir : docdir)
  
 -meson.add_install_script('sh', '-c', mkdir_p.format(systemdstatedir))
 -meson.add_install_script('sh', '-c', 'touch $DESTDIR@0@'.format(prefixdir))
 -
  ############################################################
  
- check_help = find_program('tools/check-help.sh')
--- 
-2.30.1
-
+ # Ensure that changes to the docs/ directory do not break the
diff --git a/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch b/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
index b9bab2d387e..fa201126ae2 100644
--- a/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0011-add-rootprefix-to-lookup-dir-paths.patch
@@ -1,21 +1,21 @@
-From 561dc3b864d96753b5dc448e6e1a80460d5f0bc4 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Thu, 9 May 2019 11:15:22 +0200
-Subject: [PATCH 13/19] add rootprefix to lookup dir paths
+Subject: [PATCH] add rootprefix to lookup dir paths
 
 systemd does not longer use the UDEVLIBEXEC directory as root for
 discovery default udev rules. By adding `$out/lib` to the lookup paths
 we should again be able to discover the udev rules amongst other default
 files that I might have missed.
 ---
- src/basic/def.h | 6 ++++--
+ src/basic/constants.h | 6 ++++--
  1 file changed, 4 insertions(+), 2 deletions(-)
 
-diff --git a/src/basic/def.h b/src/basic/def.h
-index 2e60abb4f1..732ec51d36 100644
---- a/src/basic/def.h
-+++ b/src/basic/def.h
-@@ -39,13 +39,15 @@
+diff --git a/src/basic/constants.h b/src/basic/constants.h
+index 3f96786da9..6e8fb40c08 100644
+--- a/src/basic/constants.h
++++ b/src/basic/constants.h
+@@ -74,13 +74,15 @@
          "/run/" n "\0"                          \
          "/usr/local/lib/" n "\0"                \
          "/usr/lib/" n "\0"                      \
@@ -33,6 +33,3 @@ index 2e60abb4f1..732ec51d36 100644
  
  #define CONF_PATHS(n)                           \
          CONF_PATHS_USR(n)                       \
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
deleted file mode 100644
index 05fce10e856..00000000000
--- a/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 63777e7f690b67952bf4571f8e09e5d8e769d3c0 Mon Sep 17 00:00:00 2001
-From: Andreas Rammhold <andreas@rammhold.de>
-Date: Fri, 2 Nov 2018 21:15:42 +0100
-Subject: [PATCH 12/19] inherit systemd environment when calling generators.
-
-Systemd generators need access to the environment configured in
-stage-2-init.sh since it schedules fsck and mkfs executions based on
-being able to find an appropriate binary for the target filesystem.
-
-With this commit I am altering the systemd behaviour since upstream
-tries to gather environments with that they call
-"environment-generators" and then seems to pass that on to all the other
-executables that are being called from managers.
----
- src/core/manager.c | 11 ++++++++---
- 1 file changed, 8 insertions(+), 3 deletions(-)
-
-diff --git a/src/core/manager.c b/src/core/manager.c
-index 6858950107..07a599ede7 100644
---- a/src/core/manager.c
-+++ b/src/core/manager.c
-@@ -4142,9 +4142,14 @@ static int manager_run_generators(Manager *m) {
-         argv[4] = NULL;
- 
-         RUN_WITH_UMASK(0022)
--                (void) execute_directories((const char* const*) paths, DEFAULT_TIMEOUT_USEC, NULL, NULL,
--                                           (char**) argv, m->transient_environment, EXEC_DIR_PARALLEL | EXEC_DIR_IGNORE_ERRORS);
--
-+                (void) execute_directories((const char* const*) paths, DEFAULT_TIMEOUT_USEC,
-+                                    // On NixOS we must propagate PATH to generators so they are
-+                                    // able to find binaries such as `fsck.${fstype}` and
-+                                    // `mkfs.${fstype}`. That is why the last argument of the
-+                                    // function (envp) is set to NULL. This propagates systemd's
-+                                    // environment (e.g. PATH) that was setup
-+                                    // before calling systemd from stage-2-init.sh.
-+                                    NULL, NULL, (char**) argv, /* NixOS: use inherited env */ NULL, EXEC_DIR_PARALLEL | EXEC_DIR_IGNORE_ERRORS);
-         r = 0;
- 
- finish:
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
new file mode 100644
index 00000000000..fde1e2b276c
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@@ -0,0 +1,23 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nikolay Amiantov <ab@fmap.me>
+Date: Thu, 25 Jul 2019 20:45:55 +0300
+Subject: [PATCH] systemd-shutdown: execute scripts in
+ /etc/systemd/system-shutdown
+
+This is needed for NixOS to use such scripts as systemd directory is immutable.
+---
+ src/shutdown/shutdown.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
+index 8395bb429d..14fbc85bb4 100644
+--- a/src/shutdown/shutdown.c
++++ b/src/shutdown/shutdown.c
+@@ -334,6 +334,7 @@ static void init_watchdog(void) {
+ int main(int argc, char *argv[]) {
+         static const char* const dirs[] = {
+                 SYSTEM_SHUTDOWN_PATH,
++                "/etc/systemd/system-shutdown",
+                 NULL
+         };
+         _cleanup_free_ char *cgroup = NULL;
diff --git a/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch b/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
index 3059216f7c5..d91150cfc49 100644
--- a/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@@ -1,8 +1,7 @@
-From 577b11afe38fc185d785ca8f125f518a4eb21a00 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:46:58 +0300
-Subject: [PATCH 15/19] systemd-sleep: execute scripts in
- /etc/systemd/system-sleep
+Subject: [PATCH] systemd-sleep: execute scripts in /etc/systemd/system-sleep
 
 This is needed for NixOS to use such scripts as systemd directory is immutable.
 ---
@@ -10,10 +9,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
  1 file changed, 1 insertion(+)
 
 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 39ab554290..880ac7ccb0 100644
+index de1f6c7ec1..d0cdebd80a 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -178,6 +178,7 @@ static int execute(char **modes, char **states) {
+@@ -224,6 +224,7 @@ static int execute(
          };
          static const char* const dirs[] = {
                  SYSTEM_SLEEP_PATH,
@@ -21,6 +20,3 @@ index 39ab554290..880ac7ccb0 100644
                  NULL
          };
  
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 585a0aa112e..13dec1070ff 100644
--- a/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -1,7 +1,7 @@
-From c639f311bd27c2bff62a22c34bc92613aaf77587 Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sun, 8 Mar 2020 01:05:54 +0100
-Subject: [PATCH 17/19] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
+Subject: [PATCH] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
 
 This will be the $PATH used to lookup ExecStart= etc. options, which
 systemd itself uses extensively.
@@ -10,10 +10,10 @@ systemd itself uses extensively.
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index d613709f0b..5cced4c115 100644
+index 97175bee11..3839704901 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -24,11 +24,11 @@
+@@ -25,11 +25,11 @@
  #  define PATH_SBIN_BIN_NULSTR(x) PATH_NORMAL_SBIN_BIN_NULSTR(x)
  #endif
  
@@ -28,6 +28,3 @@ index d613709f0b..5cced4c115 100644
  
  #if HAVE_SPLIT_USR
  #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch b/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
deleted file mode 100644
index c737b61e749..00000000000
--- a/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 8f619304804b02f4e9d7a340ca90359f96adc6e8 Mon Sep 17 00:00:00 2001
-From: Nikolay Amiantov <ab@fmap.me>
-Date: Thu, 25 Jul 2019 20:45:55 +0300
-Subject: [PATCH 14/19] systemd-shutdown: execute scripts in
- /etc/systemd/system-shutdown
-
-This is needed for NixOS to use such scripts as systemd directory is immutable.
----
- src/shutdown/shutdown.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 0d07865542..26d974ef73 100644
---- a/src/shutdown/shutdown.c
-+++ b/src/shutdown/shutdown.c
-@@ -312,7 +312,7 @@ int main(int argc, char *argv[]) {
-         _cleanup_free_ char *cgroup = NULL;
-         char *arguments[3], *watchdog_device;
-         int cmd, r, umount_log_level = LOG_INFO;
--        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, NULL};
-+        static const char* const dirs[] = {SYSTEM_SHUTDOWN_PATH, "/etc/systemd/system-shutdown", NULL};
- 
-         /* The log target defaults to console, but the original systemd process will pass its log target in through a
-          * command line argument, which will override this default. Also, ensure we'll never log to the journal or
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0019-pkg-config-derive-prefix-from-prefix.patch b/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
index 2d93cdef9a3..3fbfd7f10ab 100644
--- a/pkgs/os-specific/linux/systemd/0019-pkg-config-derive-prefix-from-prefix.patch
+++ b/pkgs/os-specific/linux/systemd/0015-pkg-config-derive-prefix-from-prefix.patch
@@ -1,7 +1,7 @@
-From 5439a516995f9fd57fc91c2cdd016bb18f31aadf Mon Sep 17 00:00:00 2001
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
 Date: Sun, 6 Dec 2020 08:34:19 +0100
-Subject: [PATCH 19/19] pkg-config: derive prefix from --prefix
+Subject: [PATCH] pkg-config: derive prefix from --prefix
 
 Point prefix to the one configured, instead of `/usr` `systemd` has limited
 support for making the pkgconfig prefix overridable, and interpolates those
@@ -16,7 +16,7 @@ Co-Authored-By: Florian Klink <flokli@flokli.de>
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index a701cd05f8..85d6911bdf 100644
+index 5932a21b5b..20bf8e316d 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
 @@ -11,7 +11,7 @@
@@ -24,10 +24,7 @@ index a701cd05f8..85d6911bdf 100644
  # shall have underscores.
  
 -prefix=/usr
-+prefix=@prefix@
- root_prefix=@rootprefix_noslash@
++prefix={{PREFIX}}
+ root_prefix={{ROOTPREFIX_NOSLASH}}
  rootprefix=${root_prefix}
- sysconf_dir=@sysconfdir@
--- 
-2.30.1
-
+ sysconf_dir={{SYSCONF_DIR}}
diff --git a/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch b/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
new file mode 100644
index 00000000000..d6640c87454
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0016-inherit-systemd-environment-when-calling-generators.patch
@@ -0,0 +1,39 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Yuriy Taraday <yorik.sar@gmail.com>
+Date: Fri, 17 Jun 2022 12:45:10 +0000
+Subject: [PATCH] inherit systemd environment when calling generators.
+
+Systemd generators need access to the environment configured in
+stage-2-init.sh since it schedules fsck and mkfs executions based on
+being able to find an appropriate binary for the target filesystem.
+
+With this commit I am altering the systemd behaviour since upstream
+tries to gather environments with that they call
+"environment-generators" and then seems to pass that on to all the other
+executables that are being called from managers.
+---
+ src/core/manager.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index 771e8e7f16..acf3ead8d7 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -3899,9 +3899,17 @@ static int build_generator_environment(Manager *m, char ***ret) {
+          * adjust generated units to that. Let's pass down some bits of information that are easy for us to
+          * determine (but a bit harder for generator scripts to determine), as environment variables. */
+ 
++        // On NixOS we must propagate PATH to generators so they are
++        // able to find binaries such as `fsck.${fstype}` and
++        // `mkfs.${fstype}`. That is why we ignore transient_environment that
++        // overrides the PATH variable. This propagates systemd's
++        // environment (e.g. PATH) that was setup
++        // before calling systemd from stage-2-init.sh.
++#if 0
+         nl = strv_copy(m->transient_environment);
+         if (!nl)
+                 return -ENOMEM;
++#endif
+ 
+         r = strv_env_assign(&nl, "SYSTEMD_SCOPE", runtime_scope_to_string(m->runtime_scope));
+         if (r < 0)
diff --git a/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch b/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
deleted file mode 100644
index ad19d910e1e..00000000000
--- a/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From ba19f629c1806ca2d2ab58154e45bce4ae4a3f0c Mon Sep 17 00:00:00 2001
-From: Florian Klink <flokli@flokli.de>
-Date: Sat, 7 Mar 2020 22:40:27 +0100
-Subject: [PATCH 16/19] kmod-static-nodes.service: Update ConditionFileNotEmpty
-
-On NixOS, kernel modules of the currently booted systems are located at
-/run/booted-system/kernel-modules/lib/modules/%v/, not /lib/modules/%v/.
----
- units/kmod-static-nodes.service.in | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/units/kmod-static-nodes.service.in b/units/kmod-static-nodes.service.in
-index f4170d6a99..9a6a591bea 100644
---- a/units/kmod-static-nodes.service.in
-+++ b/units/kmod-static-nodes.service.in
-@@ -12,7 +12,7 @@ Description=Create list of static device nodes for the current kernel
- DefaultDependencies=no
- Before=sysinit.target systemd-tmpfiles-setup-dev.service
- ConditionCapability=CAP_SYS_MODULE
--ConditionFileNotEmpty=/lib/modules/%v/modules.devname
-+ConditionFileNotEmpty=/run/booted-system/kernel-modules/lib/modules/%v/modules.devname
- 
- [Service]
- Type=oneshot
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch b/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
new file mode 100644
index 00000000000..73b237a2960
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0017-core-don-t-taint-on-unmerged-usr.patch
@@ -0,0 +1,33 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: oxalica <oxalicc@pm.me>
+Date: Tue, 4 Oct 2022 09:18:07 +0800
+Subject: [PATCH] core: don't taint on unmerged /usr
+
+NixOS has very different approach towards /bin and /sbin - they don't
+really exist (except for /bin/sh and /usr/bin/env, because these are used
+heavily in shebangs around the world). The concept of merged or unmerged
+usr doesn't really apply here at all, it's neither of the two.
+Users don't execute things from /bin or /sbin, there's nothing else in
+there. In all cases, systemd doesn't look things up from /usr/bin or /bin,
+so showing the taint isn't really helpful.
+
+See also: https://github.com/systemd/systemd/issues/24191
+---
+ src/core/manager.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git a/src/core/manager.c b/src/core/manager.c
+index acf3ead8d7..bdbab16829 100644
+--- a/src/core/manager.c
++++ b/src/core/manager.c
+@@ -4754,10 +4754,6 @@ char* manager_taint_string(const Manager *m) {
+         if (m->taint_usr)
+                 stage[n++] = "split-usr";
+ 
+-        _cleanup_free_ char *usrbin = NULL;
+-        if (readlink_malloc("/bin", &usrbin) < 0 || !PATH_IN_SET(usrbin, "usr/bin", "/usr/bin"))
+-                stage[n++] = "unmerged-usr";
+-
+         if (access("/proc/cgroups", F_OK) < 0)
+                 stage[n++] = "cgroups-missing";
+ 
diff --git a/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch b/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
deleted file mode 100644
index f634e74e663..00000000000
--- a/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From ebb37f81c28aaa80acd9187a7d77dcb3cb3828db Mon Sep 17 00:00:00 2001
-From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Mon, 26 Oct 2020 21:21:38 +0100
-Subject: [PATCH 18/19] logind-seat-debus: show CanMultiSession again
-
-Fixes the "switch user" function in Plasma < 5.20.
----
- src/login/logind-seat-dbus.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/login/logind-seat-dbus.c b/src/login/logind-seat-dbus.c
-index a60ed2d3c2..69b6271075 100644
---- a/src/login/logind-seat-dbus.c
-+++ b/src/login/logind-seat-dbus.c
-@@ -450,7 +450,7 @@ static const sd_bus_vtable seat_vtable[] = {
- 
-         SD_BUS_PROPERTY("Id", "s", NULL, offsetof(Seat, id), SD_BUS_VTABLE_PROPERTY_CONST),
-         SD_BUS_PROPERTY("ActiveSession", "(so)", property_get_active_session, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
--        SD_BUS_PROPERTY("CanMultiSession", "b", property_get_const_true, 0, SD_BUS_VTABLE_PROPERTY_CONST|SD_BUS_VTABLE_HIDDEN),
-+        SD_BUS_PROPERTY("CanMultiSession", "b", property_get_const_true, 0, SD_BUS_VTABLE_PROPERTY_CONST),
-         SD_BUS_PROPERTY("CanTTY", "b", property_get_can_tty, 0, SD_BUS_VTABLE_PROPERTY_CONST),
-         SD_BUS_PROPERTY("CanGraphical", "b", property_get_can_graphical, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
-         SD_BUS_PROPERTY("Sessions", "a(so)", property_get_sessions, 0, 0),
--- 
-2.30.1
-
diff --git a/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch b/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
new file mode 100644
index 00000000000..6de01a0ae80
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0018-tpm2_context_init-fix-driver-name-checking.patch
@@ -0,0 +1,41 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Nick Cao <nickcao@nichi.co>
+Date: Sun, 15 Jan 2023 20:15:55 +0800
+Subject: [PATCH] tpm2_context_init: fix driver name checking
+
+https://github.com/systemd/systemd/commit/542dbc623e introduced
+additional checks for tpm2 driver names, namely ensuring the driver
+name, when concated with "libtss2-tcti-" and ".so.0", generates a valid
+filename (with no '/' inside).
+
+For example, if the driver is name "device", the line
+  fn = strjoina("libtss2-tcti-", driver, ".so.0")
+would yield "libtss2-tcti-device.so.0", passing the check. And the
+filename is then passed to dlopen for loading the driver.
+
+Our current approach for systemd to correctly locate these dynamically
+loaded libraries is to patch the filenames to include their absolute
+path. Thus the line mentioned above is patched into
+  fn = strjoina("/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-", driver, ".so.0")
+yielding "/nix/store/xxxxxxx-tpm2-tss-3.2.0/lib/libtss2-tcti-device.so.0",
+tripping the check.
+
+This patch relaxes the check to also accept absolute paths, by replacing
+filename_is_valid with path_is_valid.
+---
+ src/shared/tpm2-util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/shared/tpm2-util.c b/src/shared/tpm2-util.c
+index ae8a8bc073..c284b244f8 100644
+--- a/src/shared/tpm2-util.c
++++ b/src/shared/tpm2-util.c
+@@ -582,7 +582,7 @@ int tpm2_context_new(const char *device, Tpm2Context **ret_context) {
+                 fn = strjoina("libtss2-tcti-", driver, ".so.0");
+ 
+                 /* Better safe than sorry, let's refuse strings that cannot possibly be valid driver early, before going to disk. */
+-                if (!filename_is_valid(fn))
++                if (!path_is_valid(fn))
+                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "TPM2 driver name '%s' not valid, refusing.", driver);
+ 
+                 context->tcti_dl = dlopen(fn, RTLD_NOW);
diff --git a/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
new file mode 100644
index 00000000000..dd9af6738c4
--- /dev/null
+++ b/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Fri, 1 Sep 2023 09:57:02 +0200
+Subject: [PATCH] systemctl-edit: suggest `systemdctl edit --runtime` on system
+ scope
+
+This is a NixOS-specific change. When trying to modify a unit with
+`systemctl edit` on NixOS, it'll fail with "Read-only file system":
+
+    $ systemctl edit libvirtd
+    Failed to open "/etc/systemd/system/libvirtd.service.d/.#override.conffa9825a0c9a249eb": Read-only file system
+
+This is because `/etc/systemd/system` is a symlink into the store. In
+fact, I'd consider this a feature rather than a bug since this ensures I
+don't introduce state imperatively.
+
+However, people wrongly assume that it's not possible to edit units
+ad-hoc and re-deploy their system for quick&dirty debugging where this
+would be absolutely fine (and doable with `--runtime` which adds a
+transient and non-persistent unit override in `/run`).
+
+To make sure that people learn about it quicker, this patch
+throws an error which suggests using `--runtime` when running
+`systemctl edit` on the system scope.
+
+For the user scope this isn't needed because user-level unit overrides
+are written into `$XDG_CONFIG_HOME/systemd/user`.
+---
+ src/systemctl/systemctl-edit.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
+index e3f25d52d5..81c9c6f6b7 100644
+--- a/src/systemctl/systemctl-edit.c
++++ b/src/systemctl/systemctl-edit.c
+@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+         sd_bus *bus;
+         int r;
+ 
++        if (!arg_runtime && arg_runtime_scope == RUNTIME_SCOPE_SYSTEM)
++                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead.");
++
+         if (!on_tty())
+                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot edit units if not on a tty.");
+ 
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a33bb3c1a1d..0311d46d1fc 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -2,9 +2,13 @@
 
 { stdenv
 , lib
+, nixosTests
+, pkgsCross
 , fetchFromGitHub
 , fetchpatch
+, fetchzip
 , buildPackages
+, makeBinaryWrapper
 , ninja
 , meson
 , m4
@@ -12,8 +16,9 @@
 , coreutils
 , gperf
 , getent
-, patchelf
 , glibcLocales
+
+  # glib is only used during tests (test-bus-gvariant, test-bus-marshal)
 , glib
 , substituteAll
 , gettext
@@ -24,99 +29,146 @@
 , util-linux
 , kbd
 , kmod
+, libxcrypt
 
   # Optional dependencies
 , pam
 , cryptsetup
-, lvm2
 , audit
 , acl
 , lz4
 , libgcrypt
-, libgpgerror
+, libgpg-error
 , libidn2
 , curl
 , gnutar
 , gnupg
 , zlib
 , xz
+, zstd
+, tpm2-tss
 , libuuid
 , libapparmor
 , intltool
 , bzip2
 , pcre2
 , e2fsprogs
+, elfutils
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
-, gnu-efi
 , iptables
 , withSelinux ? false
 , libselinux
 , withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp
 , libseccomp
-, withKexectools ? lib.meta.availableOn stdenv.hostPlatform kexectools
-, kexectools
+, withKexectools ? lib.meta.availableOn stdenv.hostPlatform kexec-tools
+, kexec-tools
 , bashInteractive
+, bash
 , libmicrohttpd
+, libfido2
+, p11-kit
 
+  # the (optional) BPF feature requires bpftool, libbpf, clang and llvm-strip to be available during build time.
+  # Only libbpf should be a runtime dependency.
+  # Note: llvmPackages is explicitly taken from buildPackages instead of relying
+  # on splicing. Splicing will evaluate the adjacent (pkgsHostTarget) llvmPackages
+  # which is sometimes problematic: llvmPackages.clang looks at targetPackages.stdenv.cc
+  # which, in the unfortunate case of pkgsCross.ghcjs, `throw`s. If we explicitly
+  # take buildPackages.llvmPackages, this is no problem because
+  # `buildPackages.targetPackages.stdenv.cc == stdenv.cc` relative to us. Working
+  # around this is important, because systemd is in the dependency closure of
+  # GHC via emscripten and jdk.
+, bpftools
+, libbpf
+
+  # Needed to produce a ukify that works for cross compiling UKIs.
+, targetPackages
+
+, withAcl ? true
 , withAnalyze ? true
 , withApparmor ? true
-, withCompression ? true  # adds bzip2, lz4 and xz
+, withAudit ? true
+, withBootloader ? withEfi && !stdenv.hostPlatform.isMusl # compiles systemd-boot, assumes EFI is available.
+, withCompression ? true  # adds bzip2, lz4, xz and zstd
 , withCoredump ? true
 , withCryptsetup ? true
+, withRepart ? true
 , withDocumentation ? true
 , withEfi ? stdenv.hostPlatform.isEfi
-, withHomed ? false
+, withFido2 ? true
+, withFirstboot ? false # conflicts with the NixOS /etc management
+, withHomed ? !stdenv.hostPlatform.isMusl
 , withHostnamed ? true
 , withHwdb ? true
-, withImportd ? true
+, withImportd ? !stdenv.hostPlatform.isMusl
+, withKmod ? true
+, withLibBPF ? lib.versionAtLeast buildPackages.llvmPackages.clang.version "10.0"
+    && (stdenv.hostPlatform.isAarch -> lib.versionAtLeast stdenv.hostPlatform.parsed.cpu.version "6") # assumes hard floats
+    && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
+    # buildPackages.targetPackages.llvmPackages is the same as llvmPackages,
+    # but we do it this way to avoid taking llvmPackages as an input, and
+    # risking making it too easy to ignore the above comment about llvmPackages.
+    && lib.meta.availableOn stdenv.hostPlatform buildPackages.targetPackages.llvmPackages.compiler-rt
+, withLibidn2 ? true
 , withLocaled ? true
 , withLogind ? true
 , withMachined ? true
 , withNetworkd ? true
-, withNss ? true
-, withOomd ? false
+, withNss ? !stdenv.hostPlatform.isMusl
+, withOomd ? true
+, withPam ? true
+, withPasswordQuality ? false
 , withPCRE2 ? true
 , withPolkit ? true
-, withPortabled ? false
-, withRemote ? true
+, withPortabled ? !stdenv.hostPlatform.isMusl
+, withRemote ? !stdenv.hostPlatform.isMusl
 , withResolved ? true
 , withShellCompletions ? true
+, withSysusers ? true
+, withSysupdate ? true
 , withTimedated ? true
 , withTimesyncd ? true
+, withTpm2Tss ? true
+, withUkify ? false  # adds python to closure which is too much by default
 , withUserDb ? true
-, libfido2
-, p11-kit
+, withUtmp ? !stdenv.hostPlatform.isMusl
+  # tests assume too much system access for them to be feasible for us right now
+, withTests ? false
+  # build only libudev and libsystemd
+, buildLibsOnly ? false
 
   # name argument
 , pname ? "systemd"
 
-
 , libxslt
 , docbook_xsl
 , docbook_xml_dtd_42
 , docbook_xml_dtd_45
 }:
 
-assert withResolved -> (libgcrypt != null && libgpgerror != null);
-assert withImportd ->
-(curl.dev != null && zlib != null && xz != null && libgcrypt != null
-  && gnutar != null && gnupg != null && withCompression);
-
-assert withEfi -> (gnu-efi != null);
-assert withRemote -> lib.getDev curl != null;
+assert withImportd -> withCompression;
 assert withCoredump -> withCompression;
-
 assert withHomed -> withCryptsetup;
+assert withHomed -> withPam;
+assert withUkify -> withEfi;
+assert withRepart -> withCryptsetup;
+assert withBootloader -> withEfi;
+# passwdqc is not packaged in nixpkgs yet, if you want to fix this, please submit a PR.
+assert !withPasswordQuality;
 
-assert withCryptsetup ->
-(cryptsetup != null);
 let
   wantCurl = withRemote || withImportd;
-
-  version = "247.6";
+  wantGcrypt = withResolved || withImportd;
+  version = "254.3";
+
+  # Bump this variable on every (major) version change. See below (in the meson options list) for why.
+  # command:
+  #  $ curl -s https://api.github.com/repos/systemd/systemd/releases/latest | \
+  #     jq '.created_at|strptime("%Y-%m-%dT%H:%M:%SZ")|mktime'
+  releaseTimestamp = "1690536449";
 in
-stdenv.mkDerivation {
-  inherit version pname;
+stdenv.mkDerivation (finalAttrs: {
+  inherit pname version;
 
   # We use systemd/systemd-stable for src, and ship NixOS-specific patches inside nixpkgs directly
   # This has proven to be less error-prone than the previous systemd fork.
@@ -124,67 +176,94 @@ stdenv.mkDerivation {
     owner = "systemd";
     repo = "systemd-stable";
     rev = "v${version}";
-    sha256 = "sha256-7XYEq3Qw25suwjbtPzx9lVPHUu9ZY/1bADXl2wQbkJc=";
+    hash = "sha256-ObnsAiKwhwEb4ti611eS/wGpg3Sss/pUy/gANPAbXbs=";
   };
 
-  # If these need to be regenerated, `git am path/to/00*.patch` them into a
-  # systemd worktree, rebase to the more recent systemd version, and export the
-  # patches again via `git -c format.signoff=false format-patch v${version}`.
+  # On major changes, or when otherwise required, you *must* reformat the patches,
+  # `git am path/to/00*.patch` them into a systemd worktree, rebase to the more recent
+  # systemd version, and export the patches again via
+  # `git -c format.signoff=false format-patch v${version} --no-numbered --zero-commit --no-signature`.
   # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all patches
   patches = [
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch
-    ./0004-Look-for-fsck-in-the-right-place.patch
-    ./0005-Add-some-NixOS-specific-unit-directories.patch
-    ./0006-Get-rid-of-a-useless-message-in-user-sessions.patch
-    ./0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
-    ./0008-Fix-hwdb-paths.patch
-    ./0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
-    ./0010-localectl-use-etc-X11-xkb-for-list-x11.patch
-    ./0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0012-inherit-systemd-environment-when-calling-generators.patch
-    ./0013-add-rootprefix-to-lookup-dir-paths.patch
-    ./0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
-    ./0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0018-logind-seat-debus-show-CanMultiSession-again.patch
-    ./0019-pkg-config-derive-prefix-from-prefix.patch
-
-    # Fix -Werror=format.
-    (fetchpatch {
-      url = "https://github.com/systemd/systemd/commit/ab1aa6368a883bce88e3162fee2bea14aacedf23.patch";
-      sha256 = "1b280l5jrjsg8qhsang199mpqjhkpix4c8bm3blknjnq9iv43add";
-    })
-
-    # Fix CVE-2021-33910, disclosed 2021-07-20
+    ./0004-Add-some-NixOS-specific-unit-directories.patch
+    ./0005-Get-rid-of-a-useless-message-in-user-sessions.patch
+    ./0006-hostnamed-localed-timedated-disable-methods-that-cha.patch
+    ./0007-Fix-hwdb-paths.patch
+    ./0008-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+    ./0009-localectl-use-etc-X11-xkb-for-list-x11.patch
+    ./0010-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+    ./0011-add-rootprefix-to-lookup-dir-paths.patch
+    ./0012-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0013-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0014-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0015-pkg-config-derive-prefix-from-prefix.patch
+    ./0016-inherit-systemd-environment-when-calling-generators.patch
+    ./0017-core-don-t-taint-on-unmerged-usr.patch
+    ./0018-tpm2_context_init-fix-driver-name-checking.patch
+    ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
+
+    # Fix for `RuntimeError: ELF .dynamic section is missing.`
+    # https://github.com/systemd/systemd/issues/29381
+    # https://github.com/systemd/systemd/pull/29392
     (fetchpatch {
-      name = "CVE-2021-33910.patch";
-      url = "https://github.com/systemd/systemd/commit/441e0115646d54f080e5c3bb0ba477c892861ab9.patch";
-      sha256 = "1g1lk95igaadg67kah9bpi4zsc01rg398sd1247ghjsvl5hxn4v4";
+      url = "https://github.com/systemd/systemd/commit/cecbb162a3134b43d2ca160e13198c73ff34c3ef.patch";
+      hash = "sha256-hWpUosTDA18mYm5nIb9KnjwOlnzbEHgzha/WpyHoC54=";
     })
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isMusl (
+    let
+      oe-core = fetchzip {
+        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-eb8a86fee9eeae787cc0a58ef2ed087fd48d93eb.tar.gz";
+        sha256 = "tE2KpXLvOknIpEZFdOnNxvBmDvZrra3kvQp9tKxa51c=";
+      };
+      musl-patches = oe-core + "/meta/recipes-core/systemd/systemd";
+    in
+    [
+      (musl-patches + "/0001-Adjust-for-musl-headers.patch")
+      (musl-patches + "/0005-pass-correct-parameters-to-getdents64.patch")
+      (musl-patches + "/0006-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch")
+      (musl-patches + "/0009-missing_type.h-add-comparison_fn_t.patch")
+      (musl-patches + "/0010-add-fallback-parse_printf_format-implementation.patch")
+      (musl-patches + "/0011-src-basic-missing.h-check-for-missing-strndupa.patch")
+      (musl-patches + "/0012-don-t-fail-if-GLOB_BRACE-and-GLOB_ALTDIRFUNC-is-not-.patch")
+      (musl-patches + "/0013-add-missing-FTW_-macros-for-musl.patch")
+      (musl-patches + "/0014-Use-uintmax_t-for-handling-rlim_t.patch")
+      (musl-patches + "/0016-don-t-pass-AT_SYMLINK_NOFOLLOW-flag-to-faccessat.patch")
+      (musl-patches + "/0017-Define-glibc-compatible-basename-for-non-glibc-syste.patch")
+      (musl-patches + "/0018-Do-not-disable-buffering-when-writing-to-oom_score_a.patch")
+      (musl-patches + "/0019-distinguish-XSI-compliant-strerror_r-from-GNU-specif.patch")
+      (musl-patches + "/0020-avoid-redefinition-of-prctl_mm_map-structure.patch")
+      (musl-patches + "/0021-do-not-disable-buffer-in-writing-files.patch")
+      (musl-patches + "/0022-Handle-__cpu_mask-usage.patch")
+      (musl-patches + "/0023-Handle-missing-gshadow.patch")
+      (musl-patches + "/0024-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch")
+      (musl-patches + "/0028-sd-event-Make-malloc_trim-conditional-on-glibc.patch")
+      (musl-patches + "/0029-shared-Do-not-use-malloc_info-on-musl.patch")
+    ]
+  );
 
   postPatch = ''
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
-    substituteInPlace src/boot/efi/meson.build \
-      --replace \
-      "find_program('ld'" \
-      "find_program('${stdenv.cc.bintools.targetPrefix}ld'" \
+  '' + lib.optionalString withLibBPF ''
+    substituteInPlace meson.build \
+      --replace "find_program('clang'" "find_program('${stdenv.cc.targetPrefix}clang'"
+  '' + lib.optionalString withUkify ''
+    substituteInPlace src/ukify/ukify.py \
       --replace \
-      "find_program('objcopy'" \
-      "find_program('${stdenv.cc.bintools.targetPrefix}objcopy'"
+      "'readelf'" \
+      "'${targetPackages.stdenv.cc.bintools.targetPrefix}readelf'"
   '' + (
     let
-      # The folllowing dlopen patches ensure that all the features that are
-      # implemented via dlopen(3) are available (or explicitly deactivated) by
-      # pointing dlopen to the absolute store path instead of relying on the
-      # linkers runtime lookup code.
+      # The following patches references to dynamic libraries to ensure that
+      # all the features that are implemented via dlopen(3) are available (or
+      # explicitly deactivated) by pointing dlopen to the absolute store path
+      # instead of relying on the linkers runtime lookup code.
       #
-      # All of the dlopen calls have to be handled. When new ones are introduced
-      # by upstream (or one of our patches) they must be explicitly declared,
-      # otherwise the build will fail.
+      # All of the shared library references have to be handled. When new ones
+      # are introduced by upstream (or one of our patches) they must be
+      # explicitly declared, otherwise the build will fail.
       #
       # As of systemd version 247 we've seen a few errors like `libpcre2.… not
       # found` when using e.g. --grep with journalctl. Those errors should
@@ -203,32 +282,58 @@ stdenv.mkDerivation {
       # path location).
       #
       # To get a list of dynamically loaded libraries issue something like
-      # `grep -ri 'dlopen("lib' $src` and update the below list.
-      dlopenLibs = [
-        # We did never provide support for libxkbcommon & qrencode
-        { name = "libxkbcommon.so.0"; pkg = null; }
-        { name = "libqrencode.so.4"; pkg = null; }
-
-        # We did not provide libpwquality before so it is safe to disable it for
-        # now.
-        { name = "libpwquality.so.1"; pkg = null; }
-
-        # Only include cryptsetup if it is enabled. We might not be able to
-        # provide it during "bootstrap" in e.g. the minimal systemd build as
-        # cryptsetup has udev (aka systemd) in it's dependencies.
-        { name = "libcryptsetup.so.12"; pkg = if withCryptsetup then cryptsetup else null; }
-
-        # We are using libidn2 so we only provide that and ignore the others.
-        # Systemd does this decision during configure time and uses ifdef's to
-        # enable specific branches. We can safely ignore (nuke) the libidn "v1"
-        # libraries.
-        { name = "libidn2.so.0"; pkg = libidn2; }
-        { name = "libidn.so.12"; pkg = null; }
-        { name = "libidn.so.11"; pkg = null; }
-
-        # journalctl --grep requires libpcre so lets provide it
-        { name = "libpcre2-8.so.0"; pkg = pcre2; }
-      ];
+      # `grep -ri '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"'' $src` and update the below list.
+      dlopenLibs =
+        let
+          opt = condition: pkg: if condition then pkg else null;
+        in
+        [
+          # bpf compilation support. We use libbpf 1 now.
+          { name = "libbpf.so.1"; pkg = opt withLibBPF libbpf; }
+          { name = "libbpf.so.0"; pkg = null; }
+
+          # We did never provide support for libxkbcommon & qrencode
+          { name = "libxkbcommon.so.0"; pkg = null; }
+          { name = "libqrencode.so.4"; pkg = null; }
+          { name = "libqrencode.so.3"; pkg = null; }
+
+          # We did not provide libpwquality before so it is safe to disable it for
+          # now.
+          { name = "libpwquality.so.1"; pkg = null; }
+
+          # Only include cryptsetup if it is enabled. We might not be able to
+          # provide it during "bootstrap" in e.g. the minimal systemd build as
+          # cryptsetup has udev (aka systemd) in it's dependencies.
+          { name = "libcryptsetup.so.12"; pkg = opt withCryptsetup cryptsetup; }
+
+          # We are using libidn2 so we only provide that and ignore the others.
+          # Systemd does this decision during configure time and uses ifdef's to
+          # enable specific branches. We can safely ignore (nuke) the libidn "v1"
+          # libraries.
+          { name = "libidn2.so.0"; pkg = opt withLibidn2 libidn2; }
+          { name = "libidn.so.12"; pkg = null; }
+          { name = "libidn.so.11"; pkg = null; }
+
+          # journalctl --grep requires libpcre so let's provide it
+          { name = "libpcre2-8.so.0"; pkg = pcre2; }
+
+          # Support for TPM2 in systemd-cryptsetup, systemd-repart and systemd-cryptenroll
+          { name = "libtss2-esys.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
+          { name = "libtss2-rc.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
+          { name = "libtss2-mu.so.0"; pkg = opt withTpm2Tss tpm2-tss; }
+          { name = "libtss2-tcti-"; pkg = opt withTpm2Tss tpm2-tss; }
+          { name = "libfido2.so.1"; pkg = opt withFido2 libfido2; }
+
+          # inspect-elf support
+          { name = "libelf.so.1"; pkg = opt withCoredump elfutils; }
+          { name = "libdw.so.1"; pkg = opt withCoredump elfutils; }
+
+          # Support for PKCS#11 in systemd-cryptsetup, systemd-cryptenroll and systemd-homed
+          { name = "libp11-kit.so.0"; pkg = opt (withHomed || withCryptsetup) p11-kit; }
+
+          # Password quality support
+          { name = "libpasswdqc.so.1"; pkg = opt withPasswordQuality null; }
+        ];
 
       patchDlOpen = dl:
         let
@@ -236,46 +341,57 @@ stdenv.mkDerivation {
         in
         if dl.pkg == null then ''
           # remove the dependency on the library by replacing it with an invalid path
-          for file in $(grep -lr 'dlopen("${dl.name}"' src); do
-            echo "patching dlopen(\"${dl.name}\", …) in $file to an invalid store path ("/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}")…"
-            substituteInPlace "$file" --replace 'dlopen("${dl.name}"' 'dlopen("/nix/store/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}"'
+          for file in $(grep -lr '"${dl.name}"' src); do
+            echo "patching dlopen(\"${dl.name}\", …) in $file to an invalid store path ("${builtins.storeDir}/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}")…"
+            substituteInPlace "$file" --replace '"${dl.name}"' '"${builtins.storeDir}/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-not-implemented/${dl.name}"'
           done
         '' else ''
           # ensure that the library we provide actually exists
           if ! [ -e ${library} ]; then
-            echo 'The shared library `${library}` does not exist but was given as subtitute for `${dl.name}`'
-            exit 1
+            # exceptional case, details:
+            # https://github.com/systemd/systemd-stable/blob/v249-stable/src/shared/tpm2-util.c#L157
+            if ! [[ "${library}" =~ .*libtss2-tcti-$ ]]; then
+              echo 'The shared library `${library}` does not exist but was given as substitute for `${dl.name}`'
+              exit 1
+            fi
           fi
           # make the path to the dependency explicit
-          for file in $(grep -lr 'dlopen("${dl.name}"' src); do
+          for file in $(grep -lr '"${dl.name}"' src); do
             echo "patching dlopen(\"${dl.name}\", …) in $file to ${library}…"
-            substituteInPlace "$file" --replace 'dlopen("${dl.name}"' 'dlopen("${library}"'
+            substituteInPlace "$file" --replace '"${dl.name}"' '"${library}"'
           done
+
         '';
     in
     # patch all the dlopen calls to contain absolute paths to the libraries
     lib.concatMapStringsSep "\n" patchDlOpen dlopenLibs
   )
-  # finally ensure that there are no left-over dlopen calls that we didn't handle
+  # finally ensure that there are no left-over dlopen calls (or rather strings pointing to shared libraries) that we didn't handle
   + ''
-    if grep -qr 'dlopen("[^/]' src; then
-      echo "Found unhandled dlopen calls: "
-      grep -r 'dlopen("[^/]' src
+    if grep -qr '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"' src; then
+      echo "Found unhandled dynamic library calls: "
+      grep -r '"lib[a-zA-Z0-9-]*\.so[\.0-9a-zA-z]*"' src
       exit 1
     fi
+  ''
+  # Finally, patch shebangs in scripts used at build time. This must not patch
+  # scripts that will end up in the output, to avoid build platform references
+  # when cross-compiling.
+  + ''
+    shopt -s extglob
+    patchShebangs tools test src/!(rpm|kernel-install|ukify) src/kernel-install/test-kernel-install.sh
   '';
 
-  outputs = [ "out" "man" "dev" ];
+  outputs = [ "out" "dev" ] ++ (lib.optional (!buildLibsOnly) "man");
 
   nativeBuildInputs =
     [
       pkg-config
+      makeBinaryWrapper
       gperf
       ninja
       meson
-      coreutils # meson calls date, stat etc.
       glibcLocales
-      patchelf
       getent
       m4
 
@@ -286,44 +402,67 @@ stdenv.mkDerivation {
       docbook_xsl
       docbook_xml_dtd_42
       docbook_xml_dtd_45
-      (buildPackages.python3Packages.python.withPackages (ps: with ps; [ python3Packages.lxml ]))
-    ];
+      bash
+      (buildPackages.python3Packages.python.withPackages (ps: with ps; [ lxml jinja2 ] ++ lib.optional withEfi ps.pyelftools))
+    ]
+    ++ lib.optionals withLibBPF [
+      bpftools
+      buildPackages.llvmPackages.clang
+      buildPackages.llvmPackages.libllvm
+    ]
+  ;
 
   buildInputs =
     [
-      acl
-      audit
-      glib
-      kmod
+      libxcrypt
       libcap
-      libgcrypt
-      libidn2
       libuuid
       linuxHeaders
-      pam
+      bashInteractive # for patch shebangs
     ]
 
+    ++ lib.optionals wantGcrypt [ libgcrypt libgpg-error ]
+    ++ lib.optional withTests glib
+    ++ lib.optional withAcl acl
     ++ lib.optional withApparmor libapparmor
+    ++ lib.optional withAudit audit
     ++ lib.optional wantCurl (lib.getDev curl)
-    ++ lib.optionals withCompression [ bzip2 lz4 xz ]
+    ++ lib.optionals withCompression [ bzip2 lz4 xz zstd ]
+    ++ lib.optional withCoredump elfutils
     ++ lib.optional withCryptsetup (lib.getDev cryptsetup.dev)
-    ++ lib.optional withEfi gnu-efi
-    ++ lib.optional withKexectools kexectools
+    ++ lib.optional withKexectools kexec-tools
+    ++ lib.optional withKmod kmod
+    ++ lib.optional withLibidn2 libidn2
     ++ lib.optional withLibseccomp libseccomp
     ++ lib.optional withNetworkd iptables
+    ++ lib.optional withPam pam
     ++ lib.optional withPCRE2 pcre2
-    ++ lib.optional withResolved libgpgerror
     ++ lib.optional withSelinux libselinux
     ++ lib.optional withRemote libmicrohttpd
-    ++ lib.optionals withHomed [ p11-kit libfido2 ]
+    ++ lib.optionals (withHomed || withCryptsetup) [ p11-kit ]
+    ++ lib.optionals (withHomed || withCryptsetup) [ libfido2 ]
+    ++ lib.optionals withLibBPF [ libbpf ]
+    ++ lib.optional withTpm2Tss tpm2-tss
+    ++ lib.optional withUkify (python3Packages.python.withPackages (ps: with ps; [ pefile ]))
   ;
 
-  #dontAddPrefix = true;
+  mesonBuildType = "release";
 
   mesonFlags = [
+    "-Dversion-tag=${version}"
+    # We bump this variable on every (major) version change to ensure
+    # that we have known-good value for a timestamp that is in the (not so distant) past.
+    # This serves as a lower bound for valid system timestamps during startup. Systemd will
+    # reset the system timestamp if this date is +- 15 years from the system time.
+    # See the systemd v250 release notes for further details:
+    # https://github.com/systemd/systemd/blob/60e930fc3e6eb8a36fbc184773119eb8d2f30364/NEWS#L258-L266
+    "-Dtime-epoch=${releaseTimestamp}"
+
+    "-Dmode=release"
     "-Ddbuspolicydir=${placeholder "out"}/share/dbus-1/system.d"
     "-Ddbussessionservicedir=${placeholder "out"}/share/dbus-1/services"
     "-Ddbussystemservicedir=${placeholder "out"}/share/dbus-1/system-services"
+    "-Dpam=${lib.boolToString withPam}"
     "-Dpamconfdir=${placeholder "out"}/etc/pam.d"
     "-Drootprefix=${placeholder "out"}"
     "-Dpkgconfiglibdir=${placeholder "dev"}/lib/pkgconfig"
@@ -332,11 +471,13 @@ stdenv.mkDerivation {
     "-Dsetfont-path=${kbd}/bin/setfont"
     "-Dtty-gid=3" # tty in NixOS has gid 3
     "-Ddebug-shell=${bashInteractive}/bin/bash"
-    "-Dglib=${lib.boolToString (glib != null)}"
+    "-Dglib=${lib.boolToString withTests}"
     # while we do not run tests we should also not build them. Removes about 600 targets
     "-Dtests=false"
+    "-Dacl=${lib.boolToString withAcl}"
     "-Danalyze=${lib.boolToString withAnalyze}"
-    "-Dgcrypt=${lib.boolToString (libgcrypt != null)}"
+    "-Daudit=${lib.boolToString withAudit}"
+    "-Dgcrypt=${lib.boolToString wantGcrypt}"
     "-Dimportd=${lib.boolToString withImportd}"
     "-Dlz4=${lib.boolToString withCompression}"
     "-Dhomed=${lib.boolToString withHomed}"
@@ -347,11 +488,10 @@ stdenv.mkDerivation {
     "-Dnetworkd=${lib.boolToString withNetworkd}"
     "-Doomd=${lib.boolToString withOomd}"
     "-Dpolkit=${lib.boolToString withPolkit}"
-    "-Dcryptsetup=${lib.boolToString withCryptsetup}"
+    "-Dlibcryptsetup=${lib.boolToString withCryptsetup}"
     "-Dportabled=${lib.boolToString withPortabled}"
     "-Dhwdb=${lib.boolToString withHwdb}"
     "-Dremote=${lib.boolToString withRemote}"
-    "-Dsysusers=false"
     "-Dtimedated=${lib.boolToString withTimedated}"
     "-Dtimesyncd=${lib.boolToString withTimesyncd}"
     "-Duserdb=${lib.boolToString withUserDb}"
@@ -361,34 +501,41 @@ stdenv.mkDerivation {
     "-Dsplit-usr=false"
     "-Dlibcurl=${lib.boolToString wantCurl}"
     "-Dlibidn=false"
-    "-Dlibidn2=true"
+    "-Dlibidn2=${lib.boolToString withLibidn2}"
+    "-Dfirstboot=${lib.boolToString withFirstboot}"
+    "-Dsysusers=${lib.boolToString withSysusers}"
+    "-Drepart=${lib.boolToString withRepart}"
+    "-Dsysupdate=${lib.boolToString withSysupdate}"
     "-Dquotacheck=false"
     "-Dldconfig=false"
     "-Dsmack=true"
     "-Db_pie=true"
     "-Dinstall-sysconfdir=false"
+    "-Dsbat-distro=nixos"
+    "-Dsbat-distro-summary=NixOS"
+    "-Dsbat-distro-url=https://nixos.org/"
+    "-Dsbat-distro-pkgname=${pname}"
+    "-Dsbat-distro-version=${version}"
     /*
-    As of now, systemd doesn't allow runtime configuration of these values. So
-    the settings in /etc/login.defs have no effect on it. Many people think this
-    should be supported however, see
-    - https://github.com/systemd/systemd/issues/3855
-    - https://github.com/systemd/systemd/issues/4850
-    - https://github.com/systemd/systemd/issues/9769
-    - https://github.com/systemd/systemd/issues/9843
-    - https://github.com/systemd/systemd/issues/10184
+      As of now, systemd doesn't allow runtime configuration of these values. So
+      the settings in /etc/login.defs have no effect on it. Many people think this
+      should be supported however, see
+      - https://github.com/systemd/systemd/issues/3855
+      - https://github.com/systemd/systemd/issues/4850
+      - https://github.com/systemd/systemd/issues/9769
+      - https://github.com/systemd/systemd/issues/9843
+      - https://github.com/systemd/systemd/issues/10184
     */
     "-Dsystem-uid-max=999"
     "-Dsystem-gid-max=999"
-    # "-Dtime-epoch=1"
 
     "-Dsysvinit-path="
     "-Dsysvrcnd-path="
 
-    "-Dkill-path=${coreutils}/bin/kill"
-    "-Dkmod-path=${kmod}/bin/kmod"
-    "-Dsulogin-path=${util-linux}/bin/sulogin"
-    "-Dmount-path=${util-linux}/bin/mount"
-    "-Dumount-path=${util-linux}/bin/umount"
+    "-Dsulogin-path=${util-linux.login}/bin/sulogin"
+    "-Dnologin-path=${util-linux.login}/bin/nologin"
+    "-Dmount-path=${lib.getOutput "mount" util-linux}/bin/mount"
+    "-Dumount-path=${lib.getOutput "mount" util-linux}/bin/umount"
     "-Dcreate-log-dirs=false"
 
     # Use cgroupsv2. This is already the upstream default, but better be explicit.
@@ -398,11 +545,9 @@ stdenv.mkDerivation {
     "-Dman=true"
 
     "-Defi=${lib.boolToString withEfi}"
-    "-Dgnu-efi=${lib.boolToString withEfi}"
-  ] ++ lib.optionals withEfi [
-    "-Defi-libdir=${toString gnu-efi}/lib"
-    "-Defi-includedir=${toString gnu-efi}/include/efi"
-    "-Defi-ldsdir=${toString gnu-efi}/lib"
+    "-Dbootloader=${lib.boolToString withBootloader}"
+
+    "-Dukify=${lib.boolToString withUkify}"
   ] ++ lib.optionals (withShellCompletions == false) [
     "-Dbashcompletiondir=no"
     "-Dzshcompletiondir=no"
@@ -411,57 +556,121 @@ stdenv.mkDerivation {
     "-Dnss-mymachines=false"
     "-Dnss-resolve=false"
     "-Dnss-systemd=false"
+  ] ++ lib.optionals withLibBPF [
+    "-Dbpf-framework=true"
+  ] ++ lib.optionals withTpm2Tss [
+    "-Dtpm2=true"
+  ] ++ lib.optionals (!withUtmp) [
+    "-Dutmp=false"
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "-Dgshadow=false"
+    "-Didn=false"
+  ] ++ lib.optionals withKmod [
+    "-Dkmod=true"
+    "-Dkmod-path=${kmod}/bin/kmod"
   ];
+  preConfigure =
+    let
+      # A list of all the runtime binaries that the systemd executables, tests and libraries are referencing in their source code, scripts and unit files.
+      # As soon as a dependency isn't required anymore we should remove it from the list. The `where` attribute for each of the replacement patterns must be exhaustive. If another (unhandled) case is found in the source code the build fails with an error message.
+      binaryReplacements = [
+        { search = "/usr/bin/getent"; replacement = "${getent}/bin/getent"; where = [ "src/nspawn/nspawn-setuid.c" ]; }
+
+        {
+          search = "/sbin/mkswap";
+          replacement = "${lib.getBin util-linux}/sbin/mkswap";
+          where = [
+            "man/systemd-makefs@.service.xml"
+          ];
+        }
+        { search = "/sbin/swapon"; replacement = "${lib.getOutput "swap" util-linux}/sbin/swapon"; where = [ "src/core/swap.c" "src/basic/unit-def.h" ]; }
+        { search = "/sbin/swapoff"; replacement = "${lib.getOutput "swap" util-linux}/sbin/swapoff"; where = [ "src/core/swap.c" ]; }
+        {
+          search = "/bin/echo";
+          replacement = "${coreutils}/bin/echo";
+          where = [
+            "man/systemd-analyze.xml"
+            "man/systemd.service.xml"
+            "man/systemd-run.xml"
+            "src/analyze/test-verify.c"
+            "src/test/test-env-file.c"
+            "src/test/test-fileio.c"
+            "src/test/test-load-fragment.c"
+          ];
+        }
+        {
+          search = "/bin/cat";
+          replacement = "${coreutils}/bin/cat";
+          where = [ "test/test-execute/exec-noexecpaths-simple.service" "src/journal/cat.c" ];
+        }
+        {
+          search = "/usr/lib/systemd/systemd-fsck";
+          replacement = "$out/lib/systemd/systemd-fsck";
+          where = [
+            "man/systemd-fsck@.service.xml"
+          ];
+        }
+      ] ++ lib.optionals withImportd [
+        {
+          search = "\"gpg\"";
+          replacement = "\\\"${gnupg}/bin/gpg\\\"";
+          where = [ "src/import/pull-common.c" ];
+        }
+        {
+          search = "\"tar\"";
+          replacement = "\\\"${gnutar}/bin/tar\\\"";
+          where = [
+            "src/import/export-tar.c"
+            "src/import/import-common.c"
+            "src/import/import-tar.c"
+          ];
+          ignore = [
+            # occurrences here refer to the tar sub command
+            "src/sysupdate/sysupdate-resource.c"
+            "src/sysupdate/sysupdate-transfer.c"
+            "src/import/pull.c"
+            "src/import/export.c"
+            "src/import/import.c"
+            "src/import/importd.c"
+            # runs `tar` but also also creates a temporary directory with the string
+            "src/import/pull-tar.c"
+          ];
+        }
+      ] ++ lib.optionals withKmod [
+        { search = "/sbin/modprobe"; replacement = "${lib.getBin kmod}/sbin/modprobe"; where = [ "units/modprobe@.service" ]; }
+      ];
 
-  preConfigure = ''
-    mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
-    export LC_ALL="en_US.UTF-8";
-    # FIXME: patch this in systemd properly (and send upstream).
-    # already fixed in f00929ad622c978f8ad83590a15a765b4beecac9: (u)mount
-    for i in \
-      src/core/mount.c \
-      src/core/swap.c \
-      src/cryptsetup/cryptsetup-generator.c \
-      src/journal/cat.c \
-      src/nspawn/nspawn.c \
-      src/remount-fs/remount-fs.c \
-      src/shared/generator.c \
-      src/shutdown/shutdown.c \
-      units/emergency.service.in \
-      units/modprobe@.service \
-      units/rescue.service.in \
-      units/systemd-logind.service.in \
-      units/systemd-nspawn@.service.in; \
-    do
-      test -e $i
-      substituteInPlace $i \
-        --replace /usr/bin/getent ${getent}/bin/getent \
-        --replace /sbin/mkswap ${lib.getBin util-linux}/sbin/mkswap \
-        --replace /sbin/swapon ${lib.getBin util-linux}/sbin/swapon \
-        --replace /sbin/swapoff ${lib.getBin util-linux}/sbin/swapoff \
-        --replace /bin/echo ${coreutils}/bin/echo \
-        --replace /bin/cat ${coreutils}/bin/cat \
-        --replace /sbin/sulogin ${lib.getBin util-linux}/sbin/sulogin \
-        --replace /sbin/modprobe ${lib.getBin kmod}/sbin/modprobe \
-        --replace /usr/lib/systemd/systemd-fsck $out/lib/systemd/systemd-fsck \
-        --replace /bin/plymouth /run/current-system/sw/bin/plymouth # To avoid dependency
-    done
+      # { replacement, search, where } -> List[str]
+      mkSubstitute = { replacement, search, where, ignore ? [ ] }:
+        map (path: "substituteInPlace ${path} --replace '${search}' \"${replacement}\"") where;
+      mkEnsureSubstituted = { replacement, search, where, ignore ? [ ] }:
+        let
+          ignore' = lib.concatStringsSep "|" (ignore ++ [ "^test" "NEWS" ]);
+        in
+        ''
+          set +e
+          search=$(grep '${search}' -r | grep -v "${replacement}" | grep -Ev "${ignore'}")
+          set -e
+          if [[ -n "$search" ]]; then
+            echo "Not all references to '${search}' have been replaced. Found the following matches:"
+            echo "$search"
+            exit 1
+          fi
+        '';
+    in
+    ''
+      mesonFlagsArray+=(-Dntp-servers="0.nixos.pool.ntp.org 1.nixos.pool.ntp.org 2.nixos.pool.ntp.org 3.nixos.pool.ntp.org")
+      export LC_ALL="en_US.UTF-8";
 
-    for dir in tools src/resolve test src/test src/shared; do
-      patchShebangs $dir
-    done
+      ${lib.concatStringsSep "\n" (lib.flatten (map mkSubstitute binaryReplacements))}
+      ${lib.concatMapStringsSep "\n" mkEnsureSubstituted binaryReplacements}
 
-    # absolute paths to gpg & tar
-    substituteInPlace src/import/pull-common.c \
-      --replace '"gpg"' '"${gnupg}/bin/gpg"'
-    for file in src/import/{{export,import,pull}-tar,import-common}.c; do
-      substituteInPlace $file \
-        --replace '"tar"' '"${gnutar}/bin/tar"'
-    done
+      substituteInPlace src/libsystemd/sd-journal/catalog.c \
+        --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
 
-    substituteInPlace src/journal/catalog.c \
-      --replace /usr/lib/systemd/catalog/ $out/lib/systemd/catalog/
-  '';
+      substituteInPlace src/import/pull-tar.c \
+        --replace 'wait_for_terminate_and_check("tar"' 'wait_for_terminate_and_check("${gnutar}/bin/tar"'
+    '';
 
   # These defines are overridden by CFLAGS and would trigger annoying
   # warning messages
@@ -469,10 +678,10 @@ stdenv.mkDerivation {
     substituteInPlace config.h \
       --replace "POLKIT_AGENT_BINARY_PATH" "_POLKIT_AGENT_BINARY_PATH" \
       --replace "SYSTEMD_BINARY_PATH" "_SYSTEMD_BINARY_PATH" \
-      --replace "SYSTEMD_CGROUP_AGENT_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
+      --replace "SYSTEMD_CGROUP_AGENTS_PATH" "_SYSTEMD_CGROUP_AGENT_PATH"
   '';
 
-  NIX_CFLAGS_COMPILE = toString [
+  env.NIX_CFLAGS_COMPILE = toString ([
     # Can't say ${polkit.bin}/bin/pkttyagent here because that would
     # lead to a cyclic dependency.
     "-UPOLKIT_AGENT_BINARY_PATH"
@@ -481,12 +690,15 @@ stdenv.mkDerivation {
     # Set the release_agent on /sys/fs/cgroup/systemd to the
     # currently running systemd (/run/current-system/systemd) so
     # that we don't use an obsolete/garbage-collected release agent.
-    "-USYSTEMD_CGROUP_AGENT_PATH"
-    "-DSYSTEMD_CGROUP_AGENT_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
+    "-USYSTEMD_CGROUP_AGENTS_PATH"
+    "-DSYSTEMD_CGROUP_AGENTS_PATH=\"/run/current-system/systemd/lib/systemd/systemd-cgroups-agent\""
 
     "-USYSTEMD_BINARY_PATH"
     "-DSYSTEMD_BINARY_PATH=\"/run/current-system/systemd/lib/systemd/systemd\""
-  ];
+
+  ] ++ lib.optionals stdenv.hostPlatform.isMusl [
+    "-D__UAPI_DEF_ETHHDR=0"
+  ]);
 
   doCheck = false; # fails a bunch of tests
 
@@ -495,15 +707,11 @@ stdenv.mkDerivation {
     export DESTDIR=/
   '';
 
-  postInstall = ''
-    # sysinit.target: Don't depend on
-    # systemd-tmpfiles-setup.service. This interferes with NixOps's
-    # send-keys feature (since sshd.service depends indirectly on
-    # sysinit.target).
-    mv $out/lib/systemd/system/sysinit.target.wants/systemd-tmpfiles-setup-dev.service $out/lib/systemd/system/multi-user.target.wants/
+  mesonInstallTags = lib.optionals buildLibsOnly [ "devel" "libudev" "libsystemd" ];
 
+  postInstall = lib.optionalString (!buildLibsOnly) ''
     mkdir -p $out/example/systemd
-    mv $out/lib/{modules-load.d,binfmt.d,sysctl.d,tmpfiles.d} $out/example
+    mv $out/lib/{binfmt.d,sysctl.d,tmpfiles.d} $out/example
     mv $out/lib/systemd/{system,user} $out/example/systemd
 
     rm -rf $out/etc/systemd/system
@@ -519,22 +727,66 @@ stdenv.mkDerivation {
     find $out -name "*kernel-install*" -exec rm {} \;
   '' + lib.optionalString (!withDocumentation) ''
     rm -rf $out/share/doc
+  '' + lib.optionalString (withKmod && !buildLibsOnly) ''
+    mv $out/lib/modules-load.d $out/example
+  '' + lib.optionalString withSysusers ''
+    mv $out/lib/sysusers.d $out/example
   '';
 
-  # The interface version prevents NixOS from switching to an
-  # incompatible systemd at runtime.  (Switching across reboots is
-  # fine, of course.)  It should be increased whenever systemd changes
-  # in a backwards-incompatible way.  If the interface version of two
-  # systemd builds is the same, then we can switch between them at
-  # runtime; otherwise we can't and we need to reboot.
-  passthru.interfaceVersion = 2;
+  # Avoid *.EFI binary stripping. At least on aarch64-linux strip
+  # removes too much from PE32+ files:
+  #   https://github.com/NixOS/nixpkgs/issues/169693
+  # The hack is to move EFI file out of lib/ before doStrip
+  # run and return it after doStrip run.
+  preFixup = lib.optionalString withBootloader ''
+    mv $out/lib/systemd/boot/efi $out/dont-strip-me
+  '';
+
+  # Wrap in the correct path for LUKS2 tokens.
+  postFixup = lib.optionalString withCryptsetup ''
+    for f in lib/systemd/systemd-cryptsetup bin/systemd-cryptenroll; do
+      # This needs to be in LD_LIBRARY_PATH because rpath on a binary is not propagated to libraries using dlopen, in this case `libcryptsetup.so`
+      wrapProgram $out/$f --prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib/cryptsetup
+    done
+  '' + lib.optionalString withBootloader ''
+    mv $out/dont-strip-me $out/lib/systemd/boot/efi
+  '' + lib.optionalString withUkify ''
+    # To cross compile a derivation that builds a UKI with ukify, we need to wrap
+    # ukify with the correct binutils. When wrapping, no splicing happens so we
+    # have to explicitly pull binutils from targetPackages.
+    wrapProgram $out/lib/systemd/ukify --prefix PATH : ${lib.makeBinPath [ targetPackages.stdenv.cc.bintools ] }:${placeholder "out"}/lib/systemd
+  '';
+
+  disallowedReferences = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
+    # 'or p' is for manually specified buildPackages as they dont have __spliced
+    (builtins.map (p: p.__spliced.buildHost or p) finalAttrs.nativeBuildInputs);
+
+  passthru = {
+    # The interface version prevents NixOS from switching to an
+    # incompatible systemd at runtime.  (Switching across reboots is
+    # fine, of course.)  It should be increased whenever systemd changes
+    # in a backwards-incompatible way.  If the interface version of two
+    # systemd builds is the same, then we can switch between them at
+    # runtime; otherwise we can't and we need to reboot.
+    interfaceVersion = 2;
+
+    inherit withCryptsetup withHostnamed withImportd withKmod withLocaled withMachined withPortabled withTimedated withUtmp util-linux kmod kbd;
+
+    tests = {
+      inherit (nixosTests) switchTest;
+      cross = pkgsCross.${if stdenv.buildPlatform.isAarch64 then "gnu64" else "aarch64-multiplatform"}.systemd;
+    };
+  };
 
   meta = with lib; {
     homepage = "https://www.freedesktop.org/wiki/Software/systemd/";
     description = "A system and service manager for Linux";
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
+    badPlatforms = [ lib.systems.inspect.platformPatterns.isStatic ];
+    # https://github.com/systemd/systemd/issues/20600#issuecomment-912338965
+    broken = stdenv.hostPlatform.isStatic;
     priority = 10;
-    maintainers = with maintainers; [ andir eelco flokli kloenk ];
+    maintainers = with maintainers; [ flokli kloenk ];
   };
-}
+})
diff --git a/pkgs/os-specific/linux/sysvinit/default.nix b/pkgs/os-specific/linux/sysvinit/default.nix
index 8f9acdf0662..c8ba3164ab0 100644
--- a/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/pkgs/os-specific/linux/sysvinit/default.nix
@@ -1,13 +1,12 @@
-{ lib, stdenv, fetchurl, withoutInitTools ? false }:
+{ lib, stdenv, fetchurl, libxcrypt, withoutInitTools ? false }:
 
-let version = "2.97"; in
-
-stdenv.mkDerivation {
-  name = (if withoutInitTools then "sysvtools" else "sysvinit") + "-" + version;
+stdenv.mkDerivation rec {
+  pname = if withoutInitTools then "sysvtools" else "sysvinit";
+  version = "3.04";
 
   src = fetchurl {
     url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.xz";
-    sha256 = "042iyayyh3j28vfbypzn822b73r3nfmyn79f9mixigqrfn2rcn9d";
+    sha256 = "sha256-KmIf5uRSi8kTCLdIZ92q6733dT8COVwMW66Be9K346U=";
   };
 
   prePatch = ''
@@ -15,6 +14,8 @@ stdenv.mkDerivation {
     sed -i -e "s,/sbin/,$out/sbin/," src/halt.c src/init.c src/paths.h
   '';
 
+  buildInputs = [ libxcrypt ];
+
   makeFlags = [ "SULOGINLIBS=-lcrypt" "ROOT=$(out)" "MANDIR=/share/man" ];
 
   preInstall =
diff --git a/pkgs/os-specific/linux/tailor-gui/default.nix b/pkgs/os-specific/linux/tailor-gui/default.nix
new file mode 100644
index 00000000000..ecbec75fd82
--- /dev/null
+++ b/pkgs/os-specific/linux/tailor-gui/default.nix
@@ -0,0 +1,60 @@
+{ stdenv
+, lib
+, rustPlatform
+, cargo
+, rustc
+, pkg-config
+, desktop-file-utils
+, appstream-glib
+, wrapGAppsHook4
+, meson
+, ninja
+, libadwaita
+, gtk4
+, tuxedo-rs
+}:
+let
+  src = tuxedo-rs.src;
+  sourceRoot = "source/tailor_gui";
+  pname = "tailor_gui";
+  version = tuxedo-rs.version;
+in
+stdenv.mkDerivation {
+
+  inherit src sourceRoot pname version;
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src sourceRoot;
+    name = "${pname}-${version}";
+    hash = "sha256-mt4YQ0iB/Mlnm+o9sGgYVEdbxjF7qArxA5FIK4MAZ8M=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    pkg-config
+    desktop-file-utils
+    appstream-glib
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    cargo
+    rustc
+    meson
+    ninja
+    libadwaita
+    gtk4
+  ];
+
+  meta = with lib; {
+    description = "Rust GUI for interacting with hardware from TUXEDO Computers";
+    longDescription = ''
+      An alternative to the TUXEDO Control Center (https://www.tuxedocomputers.com/en/TUXEDO-Control-Center.tuxedo),
+      written in Rust.
+    '';
+    homepage = "https://github.com/AaronErhardt/tuxedo-rs";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ mrcjkb ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/targetcli/default.nix b/pkgs/os-specific/linux/targetcli/default.nix
index f08ac284f23..f6bb705258f 100644
--- a/pkgs/os-specific/linux/targetcli/default.nix
+++ b/pkgs/os-specific/linux/targetcli/default.nix
@@ -1,14 +1,14 @@
-{ lib, python3, fetchFromGitHub }:
+{ lib, python3, fetchFromGitHub, nixosTests }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "targetcli";
-  version = "2.1.54";
+  version = "2.1.57";
 
   src = fetchFromGitHub {
     owner = "open-iscsi";
     repo = "${pname}-fb";
     rev = "v${version}";
-    sha256 = "1kbbvx0lba96ynr5iwws9jpi319m4rzph4bmcj7yfb37k8mi161v";
+    hash = "sha256-7JRNHKku9zTeSafL327hkM/E5EWTKqwPudCfmngvWuo=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [ configshell rtslib ];
@@ -18,6 +18,10 @@ python3.pkgs.buildPythonApplication rec {
     install -D targetclid.8 -t $out/share/man/man8/
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) iscsi-root;
+  };
+
   meta = with lib; {
     description = "A command shell for managing the Linux LIO kernel target";
     homepage = "https://github.com/open-iscsi/targetcli-fb";
diff --git a/pkgs/os-specific/linux/tbs/default.nix b/pkgs/os-specific/linux/tbs/default.nix
index d2b0bc08071..54268693454 100644
--- a/pkgs/os-specific/linux/tbs/default.nix
+++ b/pkgs/os-specific/linux/tbs/default.nix
@@ -18,7 +18,8 @@ let
   };
 
 in stdenv.mkDerivation {
-  name = "tbs-2018.04.18-${kernel.version}";
+  pname = "tbs";
+  version = "2018.04.18-${kernel.version}";
 
   srcs = [ media build ];
   sourceRoot = build.name;
@@ -58,6 +59,6 @@ in stdenv.mkDerivation {
     license = licenses.gpl2;
     maintainers = with maintainers; [ ck3d ];
     priority = -1;
-    broken = lib.versionAtLeast kernel.version "4.18";
+    broken = true;
   };
 }
diff --git a/pkgs/os-specific/linux/teensy-udev-rules/default.nix b/pkgs/os-specific/linux/teensy-udev-rules/default.nix
new file mode 100644
index 00000000000..e3d50eee5f6
--- /dev/null
+++ b/pkgs/os-specific/linux/teensy-udev-rules/default.nix
@@ -0,0 +1,34 @@
+{ lib, stdenv, coreutils }:
+
+stdenv.mkDerivation {
+  pname = "teensy-udev-rules";
+  version = "2022-05-15";
+
+  # Source: https://www.pjrc.com/teensy/00-teensy.rules
+  src = ./teensy.rules;
+
+  dontUnpack = true;
+
+  runtimeDeps = [ coreutils ];
+
+  installPhase = ''
+    install -D $src $out/etc/udev/rules.d/70-teensy.rules
+    substituteInPlace $out/etc/udev/rules.d/70-teensy.rules \
+      --replace "/bin/stty" "${coreutils}/bin/stty"
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.pjrc.com/teensy/00-teensy.rules";
+    description = ''
+      udev rules that give non-root users permission to communicate with the
+      Teensy family of microcontrolers.
+
+      ModemManager (part of NetworkManager) can interfere with USB Serial
+      devices, which includes the Teensy.  See comments in the .rules file (or
+      this package's homepage) for possible workarounds.
+    '';
+    platforms = platforms.linux;
+    license = "unknown";
+    maintainers = with maintainers; [ aidalgol ];
+  };
+}
diff --git a/pkgs/os-specific/linux/teensy-udev-rules/teensy.rules b/pkgs/os-specific/linux/teensy-udev-rules/teensy.rules
new file mode 100644
index 00000000000..0a921a507af
--- /dev/null
+++ b/pkgs/os-specific/linux/teensy-udev-rules/teensy.rules
@@ -0,0 +1,39 @@
+# UDEV Rules for Teensy boards, http://www.pjrc.com/teensy/
+#
+# The latest version of this file may be found at:
+#   http://www.pjrc.com/teensy/00-teensy.rules
+#
+# This file must be placed at:
+#
+# /etc/udev/rules.d/00-teensy.rules    (preferred location)
+#   or
+# /lib/udev/rules.d/00-teensy.rules    (req'd on some broken systems)
+#
+# To install, type this command in a terminal:
+#   sudo cp 00-teensy.rules /etc/udev/rules.d/00-teensy.rules
+#
+# After this file is installed, physically unplug and reconnect Teensy.
+#
+ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04*", ENV{ID_MM_DEVICE_IGNORE}="1", ENV{ID_MM_PORT_IGNORE}="1"
+ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789a]*", ENV{MTP_NO_PROBE}="1"
+KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04*", MODE:="0666", RUN:="/bin/stty -F /dev/%k raw -echo"
+KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04*", MODE:="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04*", MODE:="0666"
+KERNEL=="hidraw*", ATTRS{idVendor}=="1fc9", ATTRS{idProduct}=="013*", MODE:="0666"
+SUBSYSTEMS=="usb", ATTRS{idVendor}=="1fc9", ATTRS{idProduct}=="013*", MODE:="0666"
+
+#
+# If you share your linux system with other users, or just don't like the
+# idea of write permission for everybody, you can replace MODE:="0666" with
+# OWNER:="yourusername" to create the device owned by you, or with
+# GROUP:="somegroupname" and mange access using standard unix groups.
+#
+# ModemManager tends to interfere with USB Serial devices like Teensy.
+# Problems manifest as the Arduino Serial Monitor missing some incoming
+# data, and "Unable to open /dev/ttyACM0 for reboot request" when
+# uploading.  If you experience these problems, disable or remove
+# ModemManager from your system.  If you must use a modem, perhaps
+# try disabling the "MM_FILTER_RULE_TTY_ACM_INTERFACE" ModemManager
+# rule.  Changing ModemManager's filter policy from "strict" to "default"
+# may also help.  But if you don't use a modem, completely removing
+# the troublesome ModemManager is the most effective solution.
diff --git a/pkgs/os-specific/linux/tiptop/default.nix b/pkgs/os-specific/linux/tiptop/default.nix
index c6870d2a4c4..a26602b6b44 100644
--- a/pkgs/os-specific/linux/tiptop/default.nix
+++ b/pkgs/os-specific/linux/tiptop/default.nix
@@ -9,11 +9,20 @@ stdenv.mkDerivation rec {
     sha256 = "10j1138y3cj3hsmfz4w0bmk90523b0prqwi9nhb4z8xvjnf49i2i";
   };
 
-  patches = [(fetchpatch {
-    name = "reproducibility.patch";
-    url = "https://salsa.debian.org/debian/tiptop/raw/debian/2.3.1-1/debian/patches/0001-fix-reproducibility-of-build-process.patch";
-    sha256 = "116l7n3nl9lj691i7j8x0d0za1i6zpqgghw5d70qfpb17c04cblp";
-  })];
+  patches = [
+    (fetchpatch {
+      name = "reproducibility.patch";
+      url = "https://salsa.debian.org/debian/tiptop/raw/debian/2.3.1-1/debian/patches/0001-fix-reproducibility-of-build-process.patch";
+      sha256 = "116l7n3nl9lj691i7j8x0d0za1i6zpqgghw5d70qfpb17c04cblp";
+    })
+
+    # Pull upstream patch for ncurses-6.3
+    (fetchpatch {
+      name = "ncurses-6.3.patch";
+      url = "https://gitlab.inria.fr/rohou/tiptop/-/commit/a78234c27fdd62fed09430d998950e49e11a1832.patch";
+      sha256 = "1k55agdri7iw3gwm4snj3ps62qzmxlqr6s0868l8qamjw38z9g00";
+    })
+  ];
 
   postPatch = ''
     substituteInPlace ./configure --replace -lcurses -lncurses
@@ -22,14 +31,14 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ flex bison ];
   buildInputs = [ libxml2 ncurses ];
 
-  NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
+  env.NIX_CFLAGS_COMPILE = "-I${libxml2.dev}/include/libxml2";
 
   meta = with lib; {
     description = "Performance monitoring tool for Linux";
     homepage = "http://tiptop.gforge.inria.fr";
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = [ maintainers.vcunat ];
+    maintainers = [ ];
   };
 }
 
diff --git a/pkgs/os-specific/linux/tiscamera/0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch b/pkgs/os-specific/linux/tiscamera/0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch
new file mode 100644
index 00000000000..0e982146785
--- /dev/null
+++ b/pkgs/os-specific/linux/tiscamera/0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch
@@ -0,0 +1,25 @@
+From 90b540bd135de2587352719b14c385b20aa572be Mon Sep 17 00:00:00 2001
+From: Raymond Gauthier <jraygauthier@gmail.com>
+Date: Wed, 15 Jun 2022 16:09:58 -0400
+Subject: [PATCH] cmake-find-aravis: fix pkg cfg include dirs
+
+---
+ cmake/modules/FindAravis.cmake | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cmake/modules/FindAravis.cmake b/cmake/modules/FindAravis.cmake
+index 5dab5431..811302b9 100644
+--- a/cmake/modules/FindAravis.cmake
++++ b/cmake/modules/FindAravis.cmake
+@@ -20,7 +20,7 @@ find_path(aravis_INCLUDE_DIR
+ 	arv.h
+ 	PATHS
+ 	${aravis_PKGCONF_INCLUDE_DIRS}
+-	${aravis0_6_PKGCONF_INCLUDE_DIRS}
++	${aravis0_8_PKGCONF_INCLUDE_DIRS}
+ 	/usr/local/include
+ 	# /usr/local/include/aravis-0.4
+ 	/usr/local/include/aravis-0.8
+-- 
+2.31.1
+
diff --git a/pkgs/os-specific/linux/tiscamera/0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch b/pkgs/os-specific/linux/tiscamera/0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch
new file mode 100644
index 00000000000..3d1e5503bcd
--- /dev/null
+++ b/pkgs/os-specific/linux/tiscamera/0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch
@@ -0,0 +1,70 @@
+From 5e7146e176cb1b01b47d16a66763469dccd87f25 Mon Sep 17 00:00:00 2001
+From: Raymond Gauthier <jraygauthier@gmail.com>
+Date: Thu, 9 Jun 2022 19:45:30 -0400
+Subject: [PATCH] tcamconvert&tcamsrc: add missing include/lib dirs
+
+These were building libraries with dependencies on gstreamer-video
+and gstreamer-base but weren't adding the proper include and
+lib directories which resulted in build failure on systems
+where video and base aren't installed in the same location
+as gstreamer itself (e.g: nix, nixos).
+---
+ src/gstreamer-1.0/tcamconvert/CMakeLists.txt |  2 ++
+ src/gstreamer-1.0/tcamsrc/CMakeLists.txt     | 11 +++++++++++
+ 2 files changed, 13 insertions(+)
+
+diff --git a/src/gstreamer-1.0/tcamconvert/CMakeLists.txt b/src/gstreamer-1.0/tcamconvert/CMakeLists.txt
+index 30563c38..066cb5d7 100644
+--- a/src/gstreamer-1.0/tcamconvert/CMakeLists.txt
++++ b/src/gstreamer-1.0/tcamconvert/CMakeLists.txt
+@@ -28,6 +28,8 @@ add_library(tcamconvert SHARED
+ target_include_directories(tcamconvert
+   PRIVATE
+   ${GSTREAMER_INCLUDE_DIRS}
++  ${GSTREAMER_BASE_INCLUDE_DIRS}
++  ${GSTREAMER_VIDEO_INCLUDE_DIRS}
+   )
+ 
+ set_project_warnings(tcamconvert)
+diff --git a/src/gstreamer-1.0/tcamsrc/CMakeLists.txt b/src/gstreamer-1.0/tcamsrc/CMakeLists.txt
+index 3bc7ed97..ed5be37f 100644
+--- a/src/gstreamer-1.0/tcamsrc/CMakeLists.txt
++++ b/src/gstreamer-1.0/tcamsrc/CMakeLists.txt
+@@ -21,12 +21,15 @@ add_library(gsttcamstatistics SHARED
+ target_include_directories(gsttcamstatistics
+   PRIVATE
+   ${GSTREAMER_INCLUDE_DIRS}
++  ${GSTREAMER_BASE_INCLUDE_DIRS}
++  ${GSTREAMER_VIDEO_INCLUDE_DIRS}
+   )
+ 
+ target_link_libraries( gsttcamstatistics
+   PRIVATE
+   ${GSTREAMER_LIBRARIES}
+   ${GSTREAMER_BASE_LIBRARIES}
++  ${GSTREAMER_VIDEO_LIBRARIES}
+   )
+ 
+ 
+@@ -53,10 +56,18 @@ add_library(gsttcamsrc SHARED
+ 	tcambind.cpp
+     )
+ 
++  target_include_directories(gsttcamsrc
++    PRIVATE
++    ${GSTREAMER_INCLUDE_DIRS}
++    ${GSTREAMER_BASE_INCLUDE_DIRS}
++    ${GSTREAMER_VIDEO_INCLUDE_DIRS}
++    )
++
+   target_link_libraries( gsttcamsrc
+     PRIVATE
+ 	${GSTREAMER_LIBRARIES}
+ 	${GSTREAMER_BASE_LIBRARIES}
++    ${GSTREAMER_VIDEO_LIBRARIES}
+ 
+ 	tcamgstbase
+ 	tcam::gst-helper
+-- 
+2.31.1
+
diff --git a/pkgs/os-specific/linux/tiscamera/0001-udev-rules-fix-install-location.patch b/pkgs/os-specific/linux/tiscamera/0001-udev-rules-fix-install-location.patch
new file mode 100644
index 00000000000..9b373516aa9
--- /dev/null
+++ b/pkgs/os-specific/linux/tiscamera/0001-udev-rules-fix-install-location.patch
@@ -0,0 +1,25 @@
+From fdbc0b74812b9afd663226715375b5688e5408b5 Mon Sep 17 00:00:00 2001
+From: Raymond Gauthier <jraygauthier@gmail.com>
+Date: Thu, 9 Jun 2022 20:23:02 -0400
+Subject: [PATCH] udev/rules: fix install location
+
+---
+ CMakeInstall.cmake | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeInstall.cmake b/CMakeInstall.cmake
+index 4773091f..962c9b09 100644
+--- a/CMakeInstall.cmake
++++ b/CMakeInstall.cmake
+@@ -92,7 +92,7 @@ else()
+ 
+   else()
+ 
+-    set(TCAM_INSTALL_UDEV "${CMAKE_INSTALL_PREFIX}/udev/rules.d" CACHE PATH "udev rules installation path" FORCE)
++    set(TCAM_INSTALL_UDEV "${CMAKE_INSTALL_PREFIX}/lib/udev/rules.d" CACHE PATH "udev rules installation path" FORCE)
+     set(TCAM_INSTALL_SYSTEMD "${CMAKE_INSTALL_PREFIX}/lib/systemd/system/" CACHE PATH "systemd unit installation path" FORCE)
+ 
+     set(TCAM_INSTALL_PKGCONFIG "${CMAKE_INSTALL_PREFIX}/lib/pkgconfig" CACHE PATH "pkgconfig installation path" FORCE)
+-- 
+2.31.1
+
diff --git a/pkgs/os-specific/linux/tiscamera/default.nix b/pkgs/os-specific/linux/tiscamera/default.nix
index 38bc7c3eaff..ce59cea368b 100644
--- a/pkgs/os-specific/linux/tiscamera/default.nix
+++ b/pkgs/os-specific/linux/tiscamera/default.nix
@@ -3,81 +3,111 @@
 , fetchFromGitHub
 , cmake
 , pkg-config
-, pcre
-, tinyxml
+, runtimeShell
+, catch2
+, elfutils
+, libselinux
+, libsepol
+, libunwind
 , libusb1
+, libuuid
 , libzip
+, orc
+, pcre
+, zstd
 , glib
 , gobject-introspection
 , gst_all_1
-, libwebcam
-, libunwind
-, elfutils
-, orc
-, python3Packages
-, libuuid
 , wrapGAppsHook
+, withDoc ? true
+, sphinx
+, graphviz
+, withAravis ? true
+, aravis
+, meson
+, withAravisUsbVision ? withAravis
+, withGui ? true
+, qt5
 }:
 
 stdenv.mkDerivation rec {
   pname = "tiscamera";
-  version = "0.13.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "TheImagingSource";
     repo = pname;
     rev = "v-${pname}-${version}";
-    sha256 = "0hpy9yhc4mn6w8gvzwif703smmcys0j2jqbz2xfghqxcyb0ykplj";
+    sha256 = "0msz33wvqrji11kszdswcvljqnjflmjpk0aqzmsv6i855y8xn6cd";
   };
 
+  patches = [
+    ./0001-tcamconvert-tcamsrc-add-missing-include-lib-dirs.patch
+    ./0001-udev-rules-fix-install-location.patch
+    ./0001-cmake-find-aravis-fix-pkg-cfg-include-dirs.patch
+  ];
+
+  postPatch = ''
+    cp ${catch2}/include/catch2/catch.hpp external/catch/catch.hpp
+
+    substituteInPlace ./data/udev/80-theimagingsource-cameras.rules.in \
+      --replace "/bin/sh" "${runtimeShell}/bin/sh" \
+      --replace "typically /usr/bin/" "" \
+      --replace "typically /usr/share/theimagingsource/tiscamera/uvc-extension/" ""
+  '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
-    python3Packages.wrapPython
     wrapGAppsHook
+    gobject-introspection
+  ] ++ lib.optionals withDoc [
+    sphinx
+    graphviz
+  ] ++ lib.optionals withAravis [
+    meson
+  ] ++ lib.optionals withGui [
+    qt5.wrapQtAppsHook
   ];
 
   buildInputs = [
-    pcre
-    tinyxml
+    elfutils
+    libselinux
+    libsepol
+    libunwind
     libusb1
+    libuuid
     libzip
+    orc
+    pcre
+    zstd
     glib
-    gobject-introspection
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
-    libwebcam
-    libunwind
-    elfutils
-    orc
-    libuuid
-    python3Packages.python
-    python3Packages.pyqt5
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-ugly
+  ] ++ lib.optionals withAravis [
+    aravis
+  ] ++ lib.optionals withGui [
+    qt5.qtbase
   ];
 
-  pythonPath = with python3Packages; [ pyqt5 pygobject3 ];
-
-  propagatedBuildInputs = pythonPath;
+  hardeningDisable = [ "format" ];
 
   cmakeFlags = [
-    "-DBUILD_ARAVIS=OFF" # For GigE support. Won't need it as our camera is usb.
-    "-DBUILD_GST_1_0=ON"
-    "-DBUILD_TOOLS=ON"
-    "-DBUILD_V4L2=ON"
-    "-DBUILD_LIBUSB=ON"
-    "-DBUILD_TESTS=ON"
-    "-DTCAM_INSTALL_UDEV=${placeholder "out"}/lib/udev/rules.d"
-    "-DTCAM_INSTALL_UVCDYNCTRL=${placeholder "out"}/share/uvcdynctrl/data/199e"
-    "-DTCAM_INSTALL_GST_1_0=${placeholder "out"}/lib/gstreamer-1.0"
-    "-DTCAM_INSTALL_GIR=${placeholder "out"}/share/gir-1.0"
-    "-DTCAM_INSTALL_TYPELIB=${placeholder "out"}/lib/girepository-1.0"
-    "-DTCAM_INSTALL_SYSTEMD=${placeholder "out"}/etc/systemd/system"
-    "-DTCAM_INSTALL_PYTHON3_MODULES=${placeholder "out"}/lib/${python3Packages.python.libPrefix}/site-packages"
-    "-DGSTREAMER_1.0_INCLUDEDIR=${placeholder "out"}/include/gstreamer-1.0"
-    # There are gobject introspection commands launched as part of the build. Those have a runtime
-    # dependency on `libtcam` (which itself is built as part of this build). In order to allow
-    # that, we set the dynamic linker's path to point on the build time location of the library.
-    "-DCMAKE_SKIP_BUILD_RPATH=OFF"
+    "-DTCAM_BUILD_GST_1_0=ON"
+    "-DTCAM_BUILD_TOOLS=ON"
+    "-DTCAM_BUILD_V4L2=ON"
+    "-DTCAM_BUILD_LIBUSB=ON"
+    "-DTCAM_BUILD_TESTS=ON"
+    "-DTCAM_BUILD_ARAVIS=${if withAravis then "ON" else "OFF"}"
+    "-DTCAM_BUILD_DOCUMENTATION=${if withDoc then "ON" else "OFF"}"
+    "-DTCAM_BUILD_WITH_GUI=${if withGui then "ON" else "OFF"}"
+    "-DTCAM_DOWNLOAD_MESON=OFF"
+    "-DTCAM_INTERNAL_ARAVIS=OFF"
+    "-DTCAM_ARAVIS_USB_VISION=${if withAravis && withAravisUsbVision then "ON" else "OFF"}"
+    "-DTCAM_INSTALL_FORCE_PREFIX=ON"
   ];
 
   doCheck = true;
@@ -85,8 +115,17 @@ stdenv.mkDerivation rec {
   # gstreamer tests requires, besides gst-plugins-bad, plugins installed by this expression.
   checkPhase = "ctest --force-new-ctest-process -E gstreamer";
 
-  postFixup = ''
-    wrapPythonPrograms "$out $pythonPath"
+  # wrapGAppsHook: make sure we add ourselves to the introspection
+  # and gstreamer paths.
+  GI_TYPELIB_PATH = "${placeholder "out"}/lib/girepository-1.0";
+  GST_PLUGIN_SYSTEM_PATH_1_0 = "${placeholder "out"}/lib/gstreamer-1.0";
+
+  QT_PLUGIN_PATH = lib.optionalString withGui "${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}";
+
+  dontWrapQtApps = true;
+
+  preFixup = ''
+    gappsWrapperArgs+=("''${qtWrapperArgs[@]}")
   '';
 
   meta = with lib; {
diff --git a/pkgs/os-specific/linux/tmon/default.nix b/pkgs/os-specific/linux/tmon/default.nix
index 5a14d3d2ee3..3a2697e0a71 100644
--- a/pkgs/os-specific/linux/tmon/default.nix
+++ b/pkgs/os-specific/linux/tmon/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, kernel, ncurses }:
 
 stdenv.mkDerivation {
-  name = "tmon-${kernel.version}";
+  pname = "tmon";
+  version = kernel.version;
 
   inherit (kernel) src;
 
diff --git a/pkgs/os-specific/linux/tomb/default.nix b/pkgs/os-specific/linux/tomb/default.nix
index af04476aa1d..9c97377cfe0 100644
--- a/pkgs/os-specific/linux/tomb/default.nix
+++ b/pkgs/os-specific/linux/tomb/default.nix
@@ -1,19 +1,37 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper
-, gettext, zsh, pinentry, cryptsetup, gnupg, util-linux, e2fsprogs, sudo
+{ stdenv
+, lib
+, fetchFromGitHub
+, substituteAll
+, makeWrapper
+, zsh
+, coreutils
+, cryptsetup
+, e2fsprogs
+, file
+, gawk
+, getent
+, gettext
+, gnugrep
+, gnupg
+, libargon2
+, lsof
+, pinentry
+, util-linux
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "tomb";
-  version = "2.9";
+  version = "2.10";
 
   src = fetchFromGitHub {
-    owner  = "dyne";
-    repo   = "Tomb";
-    rev    = "v${version}";
-    sha256 = "0d6vmfcf4kd0p2bcljmdnyc2fmbwvar81cc472zx86r7yc3ih102";
+    owner = "dyne";
+    repo = "Tomb";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lLxQJX0P6b6lbXEcrq45EsX9iKiayZ9XkhqgMfpN3/w=";
   };
 
-  buildInputs = [ sudo zsh pinentry ];
+  buildInputs = [ zsh pinentry ];
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -23,22 +41,39 @@ stdenv.mkDerivation rec {
       --replace 'TOMBEXEC=$0' 'TOMBEXEC=tomb'
   '';
 
-  doInstallCheck = true;
-  installCheckPhase = "$out/bin/tomb -h";
-
   installPhase = ''
-    install -Dm755 tomb       $out/bin/tomb
+    install -Dm755 tomb $out/bin/tomb
     install -Dm644 doc/tomb.1 $out/share/man/man1/tomb.1
 
     wrapProgram $out/bin/tomb \
-      --prefix PATH : $out/bin:${lib.makeBinPath [ cryptsetup gettext gnupg pinentry util-linux e2fsprogs ]}
+      --prefix PATH : $out/bin:${lib.makeBinPath [
+          coreutils
+          cryptsetup
+          e2fsprogs
+          file
+          gawk
+          getent
+          gettext
+          gnugrep
+          gnupg
+          libargon2
+          lsof
+          pinentry
+          util-linux
+        ]}
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "File encryption on GNU/Linux";
-    homepage    = "https://www.dyne.org/software/tomb/";
-    license     = licenses.gpl3;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms   = platforms.linux;
+    homepage = "https://www.dyne.org/software/tomb/";
+    changelog = "https://github.com/dyne/Tomb/blob/v${version}/ChangeLog.md";
+    license = licenses.gpl3Only;
+    mainProgram = "tomb";
+    maintainers = with maintainers; [ peterhoeg anthonyroussel ];
+    platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/tp_smapi/default.nix b/pkgs/os-specific/linux/tp_smapi/default.nix
index d9b4333d249..d9c5921d465 100644
--- a/pkgs/os-specific/linux/tp_smapi/default.nix
+++ b/pkgs/os-specific/linux/tp_smapi/default.nix
@@ -1,4 +1,15 @@
-{ stdenv, lib, fetchFromGitHub, kernel, writeScript, coreutils, gnugrep, jq, curl, common-updater-scripts, runtimeShell
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchpatch
+, kernel
+, writeScript
+, coreutils
+, gnugrep
+, jq
+, curl
+, common-updater-scripts
+, runtimeShell
 }:
 
 stdenv.mkDerivation rec {
@@ -6,13 +17,21 @@ stdenv.mkDerivation rec {
   version = "0.43";
 
   src = fetchFromGitHub {
-    owner = "evgeni";
+    owner = "linux-thinkpad";
     repo = "tp_smapi";
     rev = "tp-smapi/${version}";
     sha256 = "1rjb0njckczc2mj05cagvj0lkyvmyk6bw7wkiinv81lw8m90g77g";
-    name = "tp-smapi-${version}";
   };
 
+  patches = [
+    # update DEFINE_SEMAPHORE usage for linux 6.4+
+    # https://github.com/linux-thinkpad/tp_smapi/pull/45
+    (fetchpatch {
+      url = "https://github.com/linux-thinkpad/tp_smapi/commit/0c3398b1acf2a2cabd9cee91dc3fe3d35805fa8b.patch";
+      hash = "sha256-J/WvijrpHGwFOZMMxnHdNin5eh8vViTcNb4nwsCqsLs=";
+    })
+  ];
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
@@ -39,7 +58,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "IBM ThinkPad hardware functions driver";
-    homepage = "https://github.com/evgeni/tp_smapi";
+    homepage = "https://github.com/linux-thinkpad/tp_smapi";
     license = lib.licenses.gpl2;
     maintainers = [ ];
     # driver is only ment for linux thinkpads i think  bellow platforms should cover it.
diff --git a/pkgs/os-specific/linux/tpacpi-bat/default.nix b/pkgs/os-specific/linux/tpacpi-bat/default.nix
index 5512eed63ab..455a36eb7ae 100644
--- a/pkgs/os-specific/linux/tpacpi-bat/default.nix
+++ b/pkgs/os-specific/linux/tpacpi-bat/default.nix
@@ -3,13 +3,13 @@
 # Requires the acpi_call kernel module in order to run.
 stdenv.mkDerivation rec {
   pname = "tpacpi-bat";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchFromGitHub {
     owner = "teleshoes";
     repo = "tpacpi-bat";
     rev = "v${version}";
-    sha256 = "0wbaz34z99gqx721alh5vmpxpj2yxg3x9m8jqyivfi1wfpwc2nd5";
+    sha256 = "sha256-9XnvVNdgB5VeI3juZfc8N5weEyULXuqu1IDChZfQqFk=";
   };
 
   buildInputs = [ perl ];
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   meta = {
     maintainers = [lib.maintainers.orbekk];
     platforms = lib.platforms.linux;
-    description = "Tool to set battery charging thesholds on Lenovo Thinkpad";
+    description = "Tool to set battery charging thresholds on Lenovo Thinkpad";
     license = lib.licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/os-specific/linux/trace-cmd/default.nix b/pkgs/os-specific/linux/trace-cmd/default.nix
index 0a7860c0238..371f66856de 100644
--- a/pkgs/os-specific/linux/trace-cmd/default.nix
+++ b/pkgs/os-specific/linux/trace-cmd/default.nix
@@ -1,40 +1,64 @@
-{ lib, stdenv, fetchgit, asciidoc, docbook_xsl, libxslt }:
+{ lib, stdenv, fetchgit, pkg-config, asciidoc, xmlto, docbook_xsl, docbook_xml_dtd_45, libxslt, libtraceevent, libtracefs, zstd, sourceHighlight }:
 stdenv.mkDerivation rec {
   pname = "trace-cmd";
-  version = "2.9.1";
+  version = "3.2";
 
   src = fetchgit {
-    url    = "git://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
+    url    = "https://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
     rev    = "trace-cmd-v${version}";
-    sha256 = "19c63a0qmcppm1456qf4k6a0d1agcvpa6jnbzrdcyc520yax6khw";
+    sha256 = "sha256-KlykIYF4uy1phgWRG5j76FJqgO7XhNnyrTDVTs8YOXY=";
   };
 
-  patches = [ ./fix-Makefiles.patch ];
+  # Don't build and install html documentation
+  postPatch = ''
+    sed -i -e '/^all:/ s/html//' -e '/^install:/ s/install-html//' \
+       Documentation{,/trace-cmd,/libtracecmd}/Makefile
+    patchShebangs check-manpages.sh
+  '';
 
-  nativeBuildInputs = [ asciidoc libxslt ];
+  nativeBuildInputs = [ asciidoc libxslt pkg-config xmlto docbook_xsl docbook_xml_dtd_45 sourceHighlight ];
 
-  outputs = [ "out" "lib" "dev" "man" ];
+  buildInputs = [ libtraceevent libtracefs zstd ];
+
+  outputs = [ "out" "lib" "dev" "man" "devman" ];
 
   MANPAGE_DOCBOOK_XSL="${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl";
 
   dontConfigure = true;
 
-  buildPhase = "make trace-cmd libs doc";
+  enableParallelBuilding = true;
+  makeFlags = [
+    # The following values appear in the generated .pc file
+    "prefix=${placeholder "lib"}"
+  ];
+
+  # We do not mention targets (like "doc") explicitly in makeFlags
+  # because the Makefile would not print warnings about too old
+  # libraries (see "warning:" in the Makefile)
+  postBuild = ''
+    make libs doc -j$NIX_BUILD_CORES
+  '';
 
-  installTargets = [ "install_cmd" "install_libs" "install_doc" ];
+  installTargets = [
+    "install_cmd"
+    "install_libs"
+    "install_doc"
+  ];
   installFlags = [
+    "LDCONFIG=false"
     "bindir=${placeholder "out"}/bin"
-    "man_dir=${placeholder "man"}/share/man"
+    "mandir=${placeholder "man"}/share/man"
     "libdir=${placeholder "lib"}/lib"
+    "pkgconfig_dir=${placeholder "dev"}/lib/pkgconfig"
     "includedir=${placeholder "dev"}/include"
     "BASH_COMPLETE_DIR=${placeholder "out"}/share/bash-completion/completions"
   ];
 
   meta = with lib; {
     description = "User-space tools for the Linux kernel ftrace subsystem";
-    homepage    = "https://kernelshark.org/";
-    license     = licenses.gpl2;
+    homepage    = "https://www.trace-cmd.org/";
+    license     = with licenses; [ lgpl21Only gpl2Only ];
     platforms   = platforms.linux;
-    maintainers = with maintainers; [ thoughtpolice basvandijk ];
+    maintainers = with maintainers; [ thoughtpolice basvandijk wentasah ];
   };
 }
diff --git a/pkgs/os-specific/linux/trace-cmd/fix-Makefiles.patch b/pkgs/os-specific/linux/trace-cmd/fix-Makefiles.patch
deleted file mode 100644
index 1e783999af6..00000000000
--- a/pkgs/os-specific/linux/trace-cmd/fix-Makefiles.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-diff --git a/Makefile b/Makefile
-index b034042..b8a06bc 100644
---- a/Makefile
-+++ b/Makefile
-@@ -338,6 +338,7 @@ libtracefs.a: $(LIBTRACEFS_STATIC)
- libtracefs.so: $(LIBTRACEFS_SHARED)
- 
- libs: $(LIBTRACECMD_SHARED) $(LIBTRACEEVENT_SHARED) $(LIBTRACEFS_SHARED)
-+libs: $(LIBTRACECMD_STATIC) $(LIBTRACEEVENT_STATIC) $(LIBTRACEFS_STATIC)
- 
- test: force $(LIBTRACEEVENT_STATIC) $(LIBTRACEFS_STATIC) $(LIBTRACECMD_STATIC)
- ifneq ($(CUNIT_INSTALLED),1)
-@@ -414,6 +415,9 @@ install_libs: libs
- 	$(Q)$(call do_install,$(LIBTRACECMD_SHARED),$(libdir_SQ)/trace-cmd)
- 	$(Q)$(call do_install,$(LIBTRACEEVENT_SHARED),$(libdir_SQ)/traceevent)
- 	$(Q)$(call do_install,$(LIBTRACEFS_SHARED),$(libdir_SQ)/tracefs)
-+	$(Q)$(call do_install,$(LIBTRACECMD_STATIC),$(libdir_SQ)/trace-cmd)
-+	$(Q)$(call do_install,$(LIBTRACEEVENT_STATIC),$(libdir_SQ)/traceevent)
-+	$(Q)$(call do_install,$(LIBTRACEFS_STATIC),$(libdir_SQ)/tracefs)
- 	$(Q)$(call do_install,$(src)/include/traceevent/event-parse.h,$(includedir_SQ)/traceevent)
- 	$(Q)$(call do_install,$(src)/include/traceevent/trace-seq.h,$(includedir_SQ)/traceevent)
- 	$(Q)$(call do_install,$(src)/include/trace-cmd/trace-cmd.h,$(includedir_SQ)/trace-cmd)
-diff --git a/kernel-shark/src/CMakeLists.txt b/kernel-shark/src/CMakeLists.txt
-index 457c100..687e150 100644
---- a/kernel-shark/src/CMakeLists.txt
-+++ b/kernel-shark/src/CMakeLists.txt
-@@ -92,7 +92,7 @@ if (Qt5Widgets_FOUND AND Qt5Network_FOUND)
-             DESTINATION ${_INSTALL_PREFIX}/share/icons/${KS_APP_NAME})
- 
-     install(FILES "${KS_DIR}/org.freedesktop.kshark-record.policy"
--            DESTINATION /usr/share/polkit-1/actions/)
-+            DESTINATION ${_INSTALL_PREFIX}/share/polkit-1/actions/)
- 
-     install(PROGRAMS "${KS_DIR}/bin/kshark-su-record"
-             DESTINATION ${_INSTALL_PREFIX}/bin/)
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index 45d984c7863..23ebbae8d1c 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -1,40 +1,31 @@
-{ lib, mkDerivation, fetchgit, qtbase, cmake, asciidoc, docbook_xsl, json_c, mesa_glu, freeglut, trace-cmd, pkg-config }:
+{ lib, mkDerivation, fetchgit, qtbase, cmake, asciidoc
+, docbook_xsl, json_c, mesa_glu, freeglut, trace-cmd, pkg-config
+, libtraceevent, libtracefs, freefont_ttf
+}:
+
 mkDerivation rec {
   pname = "kernelshark";
-  version = "1.2";
+  version = "2.2.1";
 
   src = fetchgit {
-    url    = "git://git.kernel.org/pub/scm/utils/trace-cmd/trace-cmd.git/";
-    rev    = "kernelshark-v${version}";
-    sha256 = "0wzzm2imk9n94v96v6sbvbff6j47lz4qj0snhiyv3nj3slg0anvh";
+    url = "https://git.kernel.org/pub/scm/utils/trace-cmd/kernel-shark.git/";
+    rev = "kernelshark-v${version}";
+    hash = "sha256-V25IzPDOt6V03wgIa/AJ0T8mRaGmXYuMCcvbSOKleY0=";
   };
 
-  patches = [ ./fix-Makefiles.patch ];
-
-  outputs = [ "out" "doc" ];
+  outputs = [ "out" ];
 
-  preConfigure = "pushd kernel-shark";
+  nativeBuildInputs = [ pkg-config cmake ];
 
-  nativeBuildInputs = [ pkg-config cmake asciidoc ];
-
-  buildInputs = [ qtbase json_c mesa_glu freeglut ];
+  buildInputs = [ qtbase json_c mesa_glu freeglut libtraceevent libtracefs trace-cmd ];
 
   cmakeFlags = [
     "-D_INSTALL_PREFIX=${placeholder "out"}"
-    "-DTRACECMD_BIN_DIR=${trace-cmd}/bin"
-    "-DTRACECMD_INCLUDE_DIR=${trace-cmd.dev}/include"
-    "-DTRACECMD_LIBRARY=${trace-cmd.lib}/lib/trace-cmd/libtracecmd.a"
-    "-DTRACEEVENT_LIBRARY=${trace-cmd.lib}/lib/traceevent/libtraceevent.a"
-    "-DTRACEFS_LIBRARY=${trace-cmd.lib}/lib/tracefs/libtracefs.a"
+    "-D_POLKIT_INSTALL_PREFIX=${placeholder "out"}"
+    "-DPKG_CONGIG_DIR=${placeholder "out"}/lib/pkgconfig"
+    "-DTT_FONT_FILE=${freefont_ttf}/share/fonts/truetype/FreeSans.ttf"
   ];
 
-  preInstall = ''
-    popd
-    make install_doc_gui prefix=$doc \
-      FIND_MANPAGE_DOCBOOK_XSL=${docbook_xsl}/share/xml/docbook-xsl-nons/manpages/docbook.xsl
-    pushd kernel-shark/build
-  '';
-
   meta = with lib; {
     description = "GUI for trace-cmd which is an interface for the Linux kernel ftrace subsystem";
     homepage    = "https://kernelshark.org/";
diff --git a/pkgs/os-specific/linux/trelay/Makefile b/pkgs/os-specific/linux/trelay/Makefile
new file mode 100644
index 00000000000..3206728dfbf
--- /dev/null
+++ b/pkgs/os-specific/linux/trelay/Makefile
@@ -0,0 +1,14 @@
+KERNELRELEASE ?= $(shell uname -r)
+KERNEL_DIR  ?= /lib/modules/$(KERNELRELEASE)/build
+PWD := $(shell pwd)
+
+obj-m := trelay.o
+
+all:
+	$(MAKE) -C $(KERNEL_DIR) M=$(PWD) modules
+
+install:
+	$(MAKE) -C $(KERNEL_DIR) M=$(PWD) modules_install
+
+clean:
+	$(MAKE) -C $(KERNEL_DIR) M=$(PWD) clean
diff --git a/pkgs/os-specific/linux/trelay/default.nix b/pkgs/os-specific/linux/trelay/default.nix
new file mode 100644
index 00000000000..aea5b57dfca
--- /dev/null
+++ b/pkgs/os-specific/linux/trelay/default.nix
@@ -0,0 +1,46 @@
+{ stdenv, lib, fetchgit, kernel, kmod }:
+let
+  version = "22.03.5";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "trelay";
+  version = "${version}-${kernel.version}";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/openwrt/openwrt.git";
+    rev = "v${version}";
+    hash = "sha256-5f9LvaZUxtfTpTR268QMkEmHUpn/nct+MVa44SBGT5c=";
+    sparseCheckout = [ "package/kernel/trelay/src" ];
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/package/kernel/trelay/src";
+  hardeningDisable = [ "pic" "format" ];
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  postPatch = ''
+    cp '${./Makefile}' Makefile
+  '';
+
+  makeFlags = kernel.makeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+  ];
+
+  meta = with lib; {
+    description = "For relaying IP packets between two devices to build a IP bridge between them";
+    longDescription = ''
+      A kernel module that relays ethernet packets between two devices (similar to a bridge),
+      but without any MAC address checks.
+
+      This makes it possible to bridge client mode or ad-hoc mode wifi devices to ethernet VLANs,
+      assuming the remote end uses the same source MAC address as the device that packets are
+      supposed to exit from.
+    '';
+    homepage = "https://github.com/openwrt/openwrt/tree/main/package/kernel/trelay";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.aprl ];
+    platforms = platforms.linux;
+    broken = lib.versionOlder kernel.version "5.10";
+  };
+})
diff --git a/pkgs/os-specific/linux/trinity/default.nix b/pkgs/os-specific/linux/trinity/default.nix
index 9bfe0e942ee..e0ab2b2802f 100644
--- a/pkgs/os-specific/linux/trinity/default.nix
+++ b/pkgs/os-specific/linux/trinity/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "trinity";
-  version = "1.9";
+  version = "1.9-unstable-2023-07-10";
 
   src = fetchFromGitHub {
     owner = "kernelslacker";
     repo = "trinity";
-    rev = "v${version}";
-    sha256 = "0z1a7x727xacam74jccd223k303sllgwpq30lnq9b6xxy8b659bv";
+    rev = "e71872454d26baf37ae1d12e9b04a73d64179555";
+    hash = "sha256-Zy+4L1CuB2Ul5iF+AokDkAW1wheDzoCTNkvRZFGRNps=";
   };
 
   postPatch = ''
@@ -18,12 +18,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  makeFlags = [ "DESTDIR=$(out)" ];
+  installFlags = [ "DESTDIR=$(out)" ];
 
   meta = with lib; {
     description = "A Linux System call fuzz tester";
-    homepage = "https://codemonkey.org.uk/projects/trinity/";
-    license = licenses.gpl2;
+    homepage = "https://github.com/kernelslacker/trinity";
+    license = licenses.gpl2Only;
     maintainers = [ maintainers.dezgeg ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/tuigreet/default.nix b/pkgs/os-specific/linux/tuigreet/default.nix
deleted file mode 100644
index 89dfe85c082..00000000000
--- a/pkgs/os-specific/linux/tuigreet/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, rustPlatform
-, fetchFromGitHub
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "tuigreet";
-  version = "0.5.0";
-
-  src = fetchFromGitHub {
-    owner = "apognu";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-Ip/GhpHgTgWFyCdujcCni1CLFDDirUbJuzCj8QiUsFc=";
-  };
-
-  cargoSha256 = "sha256-G/E/2wjeSY57bQJgrZYUA1sWUwtk5mRavmLwy1EgHRM=";
-
-  meta = with lib; {
-    description = "Graphical console greter for greetd";
-    homepage = "https://github.com/apognu/tuigreet";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/tunctl/default.nix b/pkgs/os-specific/linux/tunctl/default.nix
index 549a607b152..e71e349a251 100644
--- a/pkgs/os-specific/linux/tunctl/default.nix
+++ b/pkgs/os-specific/linux/tunctl/default.nix
@@ -1,9 +1,11 @@
 {lib, stdenv, fetchurl}:
 
-stdenv.mkDerivation {
-  name = "tunctl-1.5";
+stdenv.mkDerivation rec {
+  pname = "tunctl";
+  version = "1.5";
+
   src = fetchurl {
-    url = "mirror://sourceforge/tunctl/tunctl-1.5.tar.gz";
+    url = "mirror://sourceforge/tunctl/tunctl-${version}.tar.gz";
     sha256 = "aa2a6c4cc6bfacb11e0d9f62334a6638a0d435475c61230116f00b6af8b14fff";
   };
 
@@ -14,7 +16,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = "http://tunctl.sourceforge.net/";
+    homepage = "https://tunctl.sourceforge.net/";
     description = "Utility to set up and maintain TUN/TAP network interfaces";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
diff --git a/pkgs/os-specific/linux/tuxedo-keyboard/default.nix b/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
index 17f8b3a28c4..353857de320 100644
--- a/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
+++ b/pkgs/os-specific/linux/tuxedo-keyboard/default.nix
@@ -1,31 +1,47 @@
-{ lib, stdenv, fetchFromGitHub, kernel, linuxHeaders }:
+{ lib, stdenv, fetchFromGitHub, kernel, linuxHeaders, pahole }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tuxedo-keyboard-${kernel.version}";
-  version = "3.0.7";
+  version = "3.2.7";
 
   src = fetchFromGitHub {
     owner = "tuxedocomputers";
     repo = "tuxedo-keyboard";
-    rev = "v${version}";
-    sha256 = "sha256-JloLwfJfDdVowx1hOehjxPbnaKBCAMn7SZe09SE03HU=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Q0wnejeLGLSDS0GPxQuYUKCAdzbYA66KT0DuWsEKIRs=";
   };
 
-  buildInputs = [ linuxHeaders ];
+  buildInputs = [
+    pahole
+    linuxHeaders
+  ];
 
   makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p "$out/lib/modules/${kernel.modDirVersion}"
-    mv src/tuxedo_keyboard.ko $out/lib/modules/${kernel.modDirVersion}
+
+    for module in clevo_acpi.ko clevo_wmi.ko tuxedo_keyboard.ko tuxedo_io/tuxedo_io.ko uniwill_wmi.ko; do
+        mv src/$module $out/lib/modules/${kernel.modDirVersion}
+    done
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
-    description = "Full color keyboard driver for tuxedo computers laptops";
+  meta = {
+    broken = stdenv.isAarch64 || (lib.versionOlder kernel.version "5.5");
+    description = "Keyboard and hardware I/O driver for TUXEDO Computers laptops";
     homepage = "https://github.com/tuxedocomputers/tuxedo-keyboard/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    broken = stdenv.isAarch64;
-    maintainers = [ maintainers.blanky0230 ];
+    license = lib.licenses.gpl3Plus;
+    longDescription = ''
+      This driver provides support for Fn keys, brightness/color/mode for most TUXEDO
+      keyboards (except white backlight-only models).
+
+      Can be used with the "hardware.tuxedo-keyboard" NixOS module.
+    '';
+    maintainers = [ lib.maintainers.blanky0230 ];
+    platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/tuxedo-rs/default.nix b/pkgs/os-specific/linux/tuxedo-rs/default.nix
new file mode 100644
index 00000000000..04c1518aab8
--- /dev/null
+++ b/pkgs/os-specific/linux/tuxedo-rs/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+let
+
+  # NOTE: This src is shared with tailor-gui.
+  # When updating, the tailor-gui.cargoDeps hash needs to be updated.
+  src = fetchFromGitHub {
+    owner = "AaronErhardt";
+    repo = "tuxedo-rs";
+    rev = "74b863e6dcb1ec2e6c8fb02c16bb6f23b59e67f6";
+    hash = "sha256-Yujki2vGzaT8Ze5Usk8FPg8bn86MvyyPTiWuWwEw7Xs=";
+  };
+
+in
+rustPlatform.buildRustPackage {
+  pname = "tuxedo-rs";
+  version = "0.2.3";
+
+  inherit src;
+
+  # Some of the tests are impure and rely on files in /etc/tailord
+  doCheck = false;
+
+  cargoHash = "sha256-uYt442u/BIzw/lBu18LrsJf5D46oUOFzBJ5pUjCpK6w=";
+
+  postInstall = ''
+    install -Dm444 tailord/com.tux.Tailor.conf -t $out/share/dbus-1/system.d
+  '';
+
+  meta = with lib; {
+    description = "Rust utilities for interacting with hardware from TUXEDO Computers";
+    longDescription = ''
+      An alternative to the TUXEDO Control Center daemon.
+
+      Contains the following binaries:
+      - tailord: Daemon handling fan, keyboard and general HW support for Tuxedo laptops
+      - tailor: CLI
+    '';
+    homepage = "https://github.com/AaronErhardt/tuxedo-rs";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ mrcjkb ];
+    platforms = platforms.linux;
+  };
+}
+
diff --git a/pkgs/os-specific/linux/uclibc/default.nix b/pkgs/os-specific/linux/uclibc/default.nix
deleted file mode 100644
index 8dc0d4613f4..00000000000
--- a/pkgs/os-specific/linux/uclibc/default.nix
+++ /dev/null
@@ -1,114 +0,0 @@
-{ lib, stdenv, buildPackages
-, fetchurl, linuxHeaders, libiconvReal
-, extraConfig ? ""
-}:
-
-let
-  configParser = ''
-    function parseconfig {
-        set -x
-        while read LINE; do
-            NAME=`echo "$LINE" | cut -d \  -f 1`
-            OPTION=`echo "$LINE" | cut -d \  -f 2`
-
-            if test -z "$NAME"; then
-                continue
-            fi
-
-            echo "parseconfig: removing $NAME"
-            sed -i /^$NAME=/d .config
-
-            #if test "$OPTION" != n; then
-                echo "parseconfig: setting $NAME=$OPTION"
-                echo "$NAME=$OPTION" >> .config
-            #fi
-        done
-        set +x
-    }
-  '';
-
-  # UCLIBC_SUSV4_LEGACY defines 'tmpnam', needed for gcc libstdc++ builds.
-  nixConfig = ''
-    RUNTIME_PREFIX "/"
-    DEVEL_PREFIX "/"
-    UCLIBC_HAS_WCHAR y
-    UCLIBC_HAS_FTW y
-    UCLIBC_HAS_RPC y
-    DO_C99_MATH y
-    UCLIBC_HAS_PROGRAM_INVOCATION_NAME y
-    UCLIBC_SUSV4_LEGACY y
-    UCLIBC_HAS_THREADS_NATIVE y
-    KERNEL_HEADERS "${linuxHeaders}/include"
-  '' + lib.optionalString (stdenv.isAarch32 && stdenv.buildPlatform != stdenv.hostPlatform) ''
-    CONFIG_ARM_EABI y
-    ARCH_WANTS_BIG_ENDIAN n
-    ARCH_BIG_ENDIAN n
-    ARCH_WANTS_LITTLE_ENDIAN y
-    ARCH_LITTLE_ENDIAN y
-    UCLIBC_HAS_FPU n
-  '';
-
-  version = "1.0.37";
-in
-
-stdenv.mkDerivation {
-  name = "uclibc-ng-${version}";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://downloads.uclibc-ng.org/releases/${version}/uClibc-ng-${version}.tar.bz2";
-    # from "${url}.sha256";
-    sha256 = "sha256-wThkkRBA42CskGC8kUlgmxk88Qy2Z8qRfLqD6kP8JY0=";
-  };
-
-  # 'ftw' needed to build acl, a coreutils dependency
-  configurePhase = ''
-    make defconfig
-    ${configParser}
-    cat << EOF | parseconfig
-    ${nixConfig}
-    ${extraConfig}
-    ${stdenv.hostPlatform.uclibc.extraConfig or ""}
-    EOF
-    ( set +o pipefail; yes "" | make oldconfig )
-  '';
-
-  hardeningDisable = [ "stackprotector" ];
-
-  # Cross stripping hurts.
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  makeFlags = [
-    "ARCH=${stdenv.hostPlatform.parsed.cpu.name}"
-    "VERBOSE=1"
-  ] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-    "CROSS=${stdenv.cc.targetPrefix}"
-  ];
-
-  # `make libpthread/nptl/sysdeps/unix/sysv/linux/lowlevelrwlock.h`:
-  # error: bits/sysnum.h: No such file or directory
-  enableParallelBuilding = false;
-
-  installPhase = ''
-    mkdir -p $out
-    make PREFIX=$out VERBOSE=1 install
-    (cd $out/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
-    # libpthread.so may not exist, so I do || true
-    sed -i s@/lib/@$out/lib/@g $out/lib/libc.so $out/lib/libpthread.so || true
-  '';
-
-  passthru = {
-    # Derivations may check for the existance of this attribute, to know what to link to.
-    libiconv = libiconvReal;
-  };
-
-  meta = with lib; {
-    homepage = "https://uclibc-ng.org";
-    description = "A small implementation of the C library";
-    maintainers = with maintainers; [ rasendubi ];
-    license = licenses.lgpl2;
-    platforms = intersectLists platforms.linux platforms.x86; # fails to build on ARM
-  };
-}
diff --git a/pkgs/os-specific/linux/udisks-glue/default.nix b/pkgs/os-specific/linux/udisks-glue/default.nix
deleted file mode 100644
index 453df94f8fb..00000000000
--- a/pkgs/os-specific/linux/udisks-glue/default.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, automake, autoconf, udisks1, dbus-glib, glib, libconfuse }:
-
-stdenv.mkDerivation {
-  name = "udisks-glue-1.3.5";
-
-  src = fetchurl {
-    url = "https://github.com/fernandotcl/udisks-glue/archive/release-1.3.5.tar.gz";
-    sha256 = "317d25bf249278dc8f6a5dcf18f760512427c772b9afe3cfe34e6e1baa258176";
-  };
-
-  nativeBuildInputs = [ pkg-config automake autoconf ];
-  buildInputs = [ udisks1 dbus-glib glib libconfuse ];
-
-  preConfigure = "sh autogen.sh";
-
-  meta = {
-    homepage = "https://github.com/fernandotcl/udisks-glue";
-    description = "A tool to associate udisks events to user-defined actions";
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [pSub];
-    license = lib.licenses.bsd2;
-    broken = true;
-    hydraPlatforms = [];
-  };
-}
diff --git a/pkgs/os-specific/linux/udisks/1-default.nix b/pkgs/os-specific/linux/udisks/1-default.nix
deleted file mode 100644
index f20dc6b6076..00000000000
--- a/pkgs/os-specific/linux/udisks/1-default.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, sg3_utils, udev, glib, dbus, dbus-glib
-, polkit, parted, lvm2, libatasmart, intltool, libuuid, mdadm
-, libxslt, docbook_xsl, util-linux, libgudev }:
-
-stdenv.mkDerivation rec {
-  name = "udisks-1.0.5";
-
-  src = fetchurl {
-    url = "https://hal.freedesktop.org/releases/${name}.tar.gz";
-    sha256 = "0wbg3jrv8limdgvcygf4dqin3y6d30y9pcmmk711vq571vmq5v7j";
-  };
-
-  patches = [ ./purity.patch ./no-pci-db.patch ./glibc.patch ];
-
-  preConfigure =
-    ''
-      configureFlagsArray+=(--with-systemdsystemunitdir=$out/lib/systemd/system)
-    '';
-
-  postPatch =
-    ''
-      sed -e 's,/sbin/mdadm,${mdadm}&,g' -e "s,@slashlibdir@,$out/lib,g" -i data/80-udisks.rules
-
-      substituteInPlace src/main.c --replace \
-        "/sbin:/bin:/usr/sbin:/usr/bin" \
-        "${util-linux}/bin:${mdadm}/sbin:/run/current-system/sw/bin:/run/current-system/sw/bin"
-    '';
-
-  buildInputs =
-    [ sg3_utils udev glib dbus dbus-glib polkit parted libgudev
-      lvm2 libatasmart intltool libuuid libxslt docbook_xsl
-    ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  configureFlags = [ "--localstatedir=/var" "--enable-lvm2" ];
-
-  meta = with lib; {
-    homepage = "http://www.freedesktop.org/wiki/Software/udisks";
-    description = "A daemon and command-line utility for querying and manipulating storage devices";
-    platforms = platforms.linux;
-    license = with licenses; [ gpl2 lgpl2Plus ];
-    broken = true;
-    hydraPlatforms = [];
-  };
-}
diff --git a/pkgs/os-specific/linux/udisks/2-default.nix b/pkgs/os-specific/linux/udisks/2-default.nix
index 7be729f4ac8..11b2ed28fb3 100644
--- a/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/pkgs/os-specific/linux/udisks/2-default.nix
@@ -1,19 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, substituteAll, libtool, pkg-config, gettext, gnused
+{ lib, stdenv, fetchFromGitHub, substituteAll, pkg-config, gnused, autoreconfHook
 , gtk-doc, acl, systemd, glib, libatasmart, polkit, coreutils, bash, which
 , expat, libxslt, docbook_xsl, util-linux, mdadm, libgudev, libblockdev, parted
-, gobject-introspection, docbook_xml_dtd_412, docbook_xml_dtd_43, autoconf, automake
+, gobject-introspection, docbook_xml_dtd_412, docbook_xml_dtd_43
 , xfsprogs, f2fs-tools, dosfstools, e2fsprogs, btrfs-progs, exfat, nilfs-utils, ntfs3g
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
   pname = "udisks";
-  version = "2.8.4";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "storaged-project";
     repo = "udisks";
     rev = "${pname}-${version}";
-    sha256 = "01wx2x8xyal595dhdih7rva2bz7gqzgwdp56gi0ikjdzayx17wcf";
+    sha256 = "sha256-L8jr1+SJWsCizkPXC8VKDy2eVa7/FpqdB8SkBYq6vwc=";
   };
 
   outputs = [ "out" "man" "dev" ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "devdoc";
@@ -22,12 +23,13 @@ stdenv.mkDerivation rec {
     (substituteAll {
       src = ./fix-paths.patch;
       bash = "${bash}/bin/bash";
-      blkid = "${util-linux}/bin/blkid";
       false = "${coreutils}/bin/false";
       mdadm = "${mdadm}/bin/mdadm";
+      mkswap = "${util-linux}/bin/mkswap";
       sed = "${gnused}/bin/sed";
       sh = "${bash}/bin/sh";
       sleep = "${coreutils}/bin/sleep";
+      swapon = "${util-linux}/bin/swapon";
       true = "${coreutils}/bin/true";
     })
     (substituteAll {
@@ -37,16 +39,13 @@ stdenv.mkDerivation rec {
         xfsprogs ntfs3g parted util-linux
       ];
     })
-
-    # Fix tests: https://github.com/storaged-project/udisks/issues/724
-    (fetchpatch {
-      url = "https://github.com/storaged-project/udisks/commit/60a0c1c967821d317046d9494e45b9a8e4e7a1c1.patch";
-      sha256 = "0rlgqsxn7rb074x6ivm0ya5lywc4llifj5br0zr31mwwckv7hsdm";
-    })
   ];
 
+  strictDeps = true;
+  # pkg-config had to be in both to find gtk-doc and gobject-introspection
+  depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [
-    autoconf automake pkg-config libtool gettext which gobject-introspection
+    autoreconfHook which gobject-introspection pkg-config
     gtk-doc libxslt docbook_xml_dtd_412 docbook_xml_dtd_43 docbook_xsl
   ];
 
@@ -57,13 +56,14 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    expat libgudev libblockdev acl systemd glib libatasmart polkit
+    expat libgudev libblockdev acl systemd glib libatasmart polkit util-linux
   ];
 
   preConfigure = "NOCONFIGURE=1 ./autogen.sh";
 
   configureFlags = [
     (lib.enableFeature (stdenv.buildPlatform == stdenv.hostPlatform) "gtk-doc")
+    "--sysconfdir=/etc"
     "--localstatedir=/var"
     "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
     "--with-udevdir=$(out)/lib/udev"
@@ -75,15 +75,24 @@ stdenv.mkDerivation rec {
     "INTROSPECTION_TYPELIBDIR=$(out)/lib/girepository-1.0"
   ];
 
+  installFlags = [
+    "sysconfdir=${placeholder "out"}/etc"
+  ];
+
   enableParallelBuilding = true;
 
   doCheck = true;
 
+  passthru = {
+    inherit libblockdev;
+    tests.vm = nixosTests.udisks2;
+  };
+
   meta = with lib; {
     description = "A daemon, tools and libraries to access and manipulate disks, storage devices and technologies";
     homepage = "https://www.freedesktop.org/wiki/Software/udisks/";
     license = with licenses; [ lgpl2Plus gpl2Plus ]; # lgpl2Plus for the library, gpl2Plus for the tools & daemon
-    maintainers = with maintainers; [ johnazoidberg ];
+    maintainers = teams.freedesktop.members ++ (with maintainers; [ johnazoidberg ]);
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/udisks/fix-paths.patch b/pkgs/os-specific/linux/udisks/fix-paths.patch
index c2744c3b42e..76d44b96d55 100644
--- a/pkgs/os-specific/linux/udisks/fix-paths.patch
+++ b/pkgs/os-specific/linux/udisks/fix-paths.patch
@@ -1,98 +1,36 @@
---- a/Makefile.am
-+++ b/Makefile.am
-@@ -1,6 +1,6 @@
- ## Process this file with automake to produce Makefile.in
- 
--SHELL = /bin/bash
-+SHELL = @bash@
- .SHELLFLAGS = -o pipefail -c
- 
- PYTHON ?= python3
+diff --git a/data/80-udisks2.rules b/data/80-udisks2.rules
+index ca802cce..bfd1c29e 100644
 --- a/data/80-udisks2.rules
 +++ b/data/80-udisks2.rules
-@@ -17,9 +17,9 @@
+@@ -17,9 +17,9 @@ ENV{DM_UDEV_DISABLE_OTHER_RULES_FLAG}=="?*", GOTO="udisks_probe_end"
  #
  # TODO: file bug against mdadm(8) to have --export-prefix option that can be used with e.g. UDISKS_MD_MEMBER
  #
 -SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="raid", ENV{ID_FS_TYPE}=="linux_raid_member", ENV{UDISKS_MD_MEMBER_LEVEL}=="", IMPORT{program}="/bin/sh -c '/sbin/mdadm --examine --export $tempnode | /bin/sed s/^MD_/UDISKS_MD_MEMBER_/g'"
 +SUBSYSTEM=="block", ENV{ID_FS_USAGE}=="raid", ENV{ID_FS_TYPE}=="linux_raid_member", ENV{UDISKS_MD_MEMBER_LEVEL}=="", IMPORT{program}="@sh@ -c '@mdadm@ --examine --export $tempnode | @sed@ s/^MD_/UDISKS_MD_MEMBER_/g'"
- 
+
 -SUBSYSTEM=="block", KERNEL=="md*", ENV{DEVTYPE}!="partition", IMPORT{program}="/bin/sh -c '/sbin/mdadm --detail --export $tempnode | /bin/sed s/^MD_/UDISKS_MD_/g'"
 +SUBSYSTEM=="block", KERNEL=="md*", ENV{DEVTYPE}!="partition", IMPORT{program}="@sh@ -c '@mdadm@ --detail --export $tempnode | @sed@ s/^MD_/UDISKS_MD_/g'"
- 
+
  LABEL="udisks_probe_end"
- 
---- a/modules/zram/udiskslinuxmanagerzram.c
-+++ b/modules/zram/udiskslinuxmanagerzram.c
-@@ -250,7 +250,7 @@
- 
-       g_snprintf (tmp, 255, "zram%" G_GUINT64_FORMAT, i);
-       filename = g_build_filename (PACKAGE_ZRAMCONF_DIR, tmp, NULL);
--      contents = g_strdup_printf ("#!/bin/bash\n\n"
-+      contents = g_strdup_printf ("#!@bash@\n\n"
-                                   "ZRAM_NUM_STR=%" G_GUINT64_FORMAT "\n"
-                                   "ZRAM_DEV_SIZE=%" G_GUINT64_FORMAT "\n"
-                                   "SWAP=n\n",
---- a/src/tests/install-udisks/runtest.sh
-+++ b/src/tests/install-udisks/runtest.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!@bash@
- # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
- # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- #
---- a/src/tests/integration-test
-+++ b/src/tests/integration-test
-@@ -414,7 +414,7 @@
-                 f.write('KERNEL=="sr*", ENV{DISK_EJECT_REQUEST}!="?*", '
-                         'ATTRS{model}=="scsi_debug*", '
-                         'ENV{ID_CDROM_MEDIA}=="?*", '
--                        'IMPORT{program}="/sbin/blkid -o udev -p -u noraid $tempnode"\n')
-+                        'IMPORT{program}="@blkid@ -o udev -p -u noraid $tempnode"\n')
-             # reload udev
-             subprocess.call('sync; pkill --signal HUP udevd || '
-                             'pkill --signal HUP systemd-udevd',
-@@ -1079,7 +1079,7 @@
-         self.assertFalse(os.access(f, os.X_OK))
- 
-         f = os.path.join(mount_point, 'simple.exe')
--        shutil.copy('/bin/bash', f)
-+        shutil.copy('@bash@', f)
-         self.assertTrue(os.access(f, os.R_OK))
-         self.assertTrue(os.access(f, os.W_OK))
-         self.assertTrue(os.access(f, os.X_OK))
-@@ -1092,7 +1092,7 @@
-         self.assertFalse(os.access(f, os.X_OK))
- 
-         f = os.path.join(mount_point, 'subdir', 'subdir.exe')
--        shutil.copy('/bin/bash', f)
-+        shutil.copy('@bash@', f)
-         self.assertTrue(os.access(f, os.R_OK))
-         self.assertTrue(os.access(f, os.W_OK))
-         self.assertTrue(os.access(f, os.X_OK))
---- a/src/tests/storadectl/runtest.sh
-+++ b/src/tests/storadectl/runtest.sh
-@@ -1,4 +1,4 @@
--#!/bin/bash
-+#!@bash@
- # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
- # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- #
+
+diff --git a/src/tests/test.c b/src/tests/test.c
+index 3ddbdf2c..a87f960a 100644
 --- a/src/tests/test.c
 +++ b/src/tests/test.c
-@@ -71,7 +71,7 @@
+@@ -71,7 +71,7 @@ test_spawned_job_successful (void)
  {
    UDisksSpawnedJob *job;
- 
+
 -  job = udisks_spawned_job_new ("/bin/true", NULL, getuid (), geteuid (), NULL, NULL);
 +  job = udisks_spawned_job_new ("@true@", NULL, getuid (), geteuid (), NULL, NULL);
    udisks_spawned_job_start (job);
    _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_success), NULL);
    g_object_unref (job);
-@@ -84,10 +84,10 @@
+@@ -84,10 +84,10 @@ test_spawned_job_failure (void)
  {
    UDisksSpawnedJob *job;
- 
+
 -  job = udisks_spawned_job_new ("/bin/false", NULL, getuid (), geteuid (), NULL, NULL);
 +  job = udisks_spawned_job_new ("@false@", NULL, getuid (), geteuid (), NULL, NULL);
    udisks_spawned_job_start (job);
@@ -101,9 +39,9 @@
 +                             (gpointer) "Command-line `@false@' exited with non-zero exit status 1: ");
    g_object_unref (job);
  }
- 
-@@ -119,7 +119,7 @@
- 
+
+@@ -119,7 +119,7 @@ test_spawned_job_cancelled_at_start (void)
+
    cancellable = g_cancellable_new ();
    g_cancellable_cancel (cancellable);
 -  job = udisks_spawned_job_new ("/bin/true", NULL, getuid (), geteuid (), NULL, cancellable);
@@ -111,19 +49,19 @@
    udisks_spawned_job_start (job);
    _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_failure),
                               (gpointer) "Operation was cancelled (g-io-error-quark, 19)");
-@@ -145,7 +145,7 @@
+@@ -144,7 +144,7 @@ test_spawned_job_cancelled_midway (void)
    GCancellable *cancellable;
- 
+
    cancellable = g_cancellable_new ();
 -  job = udisks_spawned_job_new ("/bin/sleep 0.5", NULL, getuid (), geteuid (), NULL, cancellable);
 +  job = udisks_spawned_job_new ("@sleep@ 0.5", NULL, getuid (), geteuid (), NULL, cancellable);
    udisks_spawned_job_start (job);
    g_timeout_add (10, on_timeout, cancellable); /* 10 msec */
-   g_main_loop_run (loop);
-@@ -199,7 +199,7 @@
+   _g_assert_signal_received (job, "completed", G_CALLBACK (on_completed_expect_failure),
+@@ -197,7 +197,7 @@ test_spawned_job_premature_termination (void)
  {
    UDisksSpawnedJob *job;
- 
+
 -  job = udisks_spawned_job_new ("/bin/sleep 1000", NULL, getuid (), geteuid (), NULL, NULL /* GCancellable */);
 +  job = udisks_spawned_job_new ("@sleep@ 1000", NULL, getuid (), geteuid (), NULL, NULL /* GCancellable */);
    udisks_spawned_job_start (job);
diff --git a/pkgs/os-specific/linux/udisks/force-path.patch b/pkgs/os-specific/linux/udisks/force-path.patch
index 16c7ea5322f..741f53544be 100644
--- a/pkgs/os-specific/linux/udisks/force-path.patch
+++ b/pkgs/os-specific/linux/udisks/force-path.patch
@@ -1,8 +1,9 @@
-diff -ruN udisks-2.1.0.orig/src/main.c udisks-2.1.0/src/main.c
---- udisks-2.1.0.orig/src/main.c	2013-04-02 10:43:41.629332135 +0000
-+++ udisks-2.1.0/src/main.c	2013-04-02 11:04:55.635342823 +0000
-@@ -140,8 +140,7 @@
-         }
+diff --git a/src/main.c b/src/main.c
+index b4dbf9e0..3171fa34 100644
+--- a/src/main.c
++++ b/src/main.c
+@@ -144,8 +144,7 @@ main (int    argc,
+       g_setenv("G_MESSAGES_DEBUG", "udisks", FALSE);
      }
  
 -  if (g_getenv ("PATH") == NULL)
@@ -11,3 +12,6 @@ diff -ruN udisks-2.1.0.orig/src/main.c udisks-2.1.0/src/main.c
  
    udisks_notice ("udisks daemon version %s starting", PACKAGE_VERSION);
  
+-- 
+2.33.1
+
diff --git a/pkgs/os-specific/linux/udisks/glibc.patch b/pkgs/os-specific/linux/udisks/glibc.patch
deleted file mode 100644
index 85ef5208049..00000000000
--- a/pkgs/os-specific/linux/udisks/glibc.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 0aa652a7b257f98f9e8e7dc7b0ddc9bc62377d09 Mon Sep 17 00:00:00 2001
-From: Alexandre Rostovtsev <tetromino@gentoo.org>
-Date: Fri, 29 May 2015 21:09:39 -0400
-Subject: [PATCH] Bug 90778 - fix build with newer glibc versions
-
-https://bugs.freedesktop.org/show_bug.cgi?id=90778
----
- src/helpers/job-drive-detach.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/helpers/job-drive-detach.c b/src/helpers/job-drive-detach.c
-index eeafcab..d122a1f 100644
---- a/src/helpers/job-drive-detach.c
-+++ b/src/helpers/job-drive-detach.c
-@@ -18,6 +18,7 @@
-  *
-  */
- 
-+#include <sys/stat.h>
- #include <stdio.h>
- #include <string.h>
- #include <errno.h>
--- 
-2.4.2
-
diff --git a/pkgs/os-specific/linux/udisks/no-pci-db.patch b/pkgs/os-specific/linux/udisks/no-pci-db.patch
deleted file mode 100644
index b323b515c40..00000000000
--- a/pkgs/os-specific/linux/udisks/no-pci-db.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Systemd no longer has the pci-db program.
-
-diff -ru -x '*~' udisks-1.0.4-orig/data/80-udisks.rules udisks-1.0.4/data/80-udisks.rules
---- udisks-1.0.4-orig/data/80-udisks.rules	2011-08-25 23:31:20.000000000 +0200
-+++ udisks-1.0.4/data/80-udisks.rules	2012-12-13 13:06:52.189650854 +0100
-@@ -3,7 +3,6 @@
- 
- # import names for PCI storage controllers
- #
--SUBSYSTEM=="pci", ACTION=="add|change", ENV{ID_MODEL_FROM_DATABASE}=="", ATTR{class}=="0x01*", IMPORT{program}="pci-db %p"
- 
- # Set eSATA port type for known eSATA CardBus adapters - first we want to ensure
- # the device is on a cardbus controller (upper PCI device) - then we check
diff --git a/pkgs/os-specific/linux/udisks/purity.patch b/pkgs/os-specific/linux/udisks/purity.patch
deleted file mode 100644
index bf1121ddb65..00000000000
--- a/pkgs/os-specific/linux/udisks/purity.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-diff --git a/data/80-udisks.rules b/data/80-udisks.rules
-index 6720394..60b67ed 100644
---- a/data/80-udisks.rules
-+++ b/data/80-udisks.rules
-@@ -23,7 +23,7 @@ LABEL="ata_port_cardbus_end"
- #  this is the case we can trigger a 'change' on the sas_expander device
- #  when the bsg device appears)
- #
--SUBSYSTEM=="sas_expander", ACTION=="add|change", IMPORT{program}="udisks-probe-sas-expander /sys/%p"
-+SUBSYSTEM=="sas_expander", ACTION=="add|change", IMPORT{program}="@slashlibdir@/udev/udisks-probe-sas-expander /sys/%p"
- 
- ##############################################################################################################
- 
-@@ -54,7 +54,7 @@ ENV{DM_UDEV_DISABLE_DISK_RULES_FLAG}=="1", GOTO="udisks_end"
- # import UDISKS_DM_* and UDISKS_LVM2_* properties - the long-term plan is to make the lvm2 and
- # device-mapper packages provide this information
- #
--KERNEL=="dm-*", IMPORT{program}="udisks-dm-export %M %m"
-+KERNEL=="dm-*", IMPORT{program}="@slashlibdir@/udev/udisks-dm-export %M %m"
- 
- # Make udevd synthesize a 'change' uevent when last opener of a rw-fd closes the fd - this
- # should be part of the device-mapper rules
-@@ -63,7 +63,7 @@ KERNEL=="dm-*", OPTIONS+="watch"
- ##############################################################################################################
- # Probe LVM2 Physical Volumes - this will eventually be part of the LVM2 package
- 
--ENV{ID_FS_TYPE}=="LVM2_member", TEST=="/lib/udev/udisks-lvm-pv-export", IMPORT{program}="udisks-lvm-pv-export $env{ID_FS_UUID}"
-+ENV{ID_FS_TYPE}=="LVM2_member", TEST=="@slashlibdir@/udev/udisks-lvm-pv-export", IMPORT{program}="@slashlibdir@/udev/udisks-lvm-pv-export $env{ID_FS_UUID}"
- 
- ##############################################################################################################
- 
-@@ -85,7 +85,7 @@ KERNEL=="sr*", ENV{ID_CDROM_MEDIA_TRACK_COUNT_DATA}=="", GOTO="probe_parttable_e
- 
- # scan for partition tables both on whole-disk and partitions
- #
--IMPORT{program}="udisks-part-id $tempnode"
-+IMPORT{program}="@slashlibdir@/udev/udisks-part-id $tempnode"
- 
- LABEL="probe_parttable_end"
- 
-@@ -109,13 +109,13 @@ LABEL="md_end"
- #
- 
- # USB ATA enclosures with a SAT layer
--KERNEL=="sd*[!0-9]", ATTR{removable}=="0", ENV{ID_BUS}=="usb", ENV{DEVTYPE}=="disk", IMPORT{program}="udisks-probe-ata-smart $tempnode"
-+KERNEL=="sd*[!0-9]", ATTR{removable}=="0", ENV{ID_BUS}=="usb", ENV{DEVTYPE}=="disk", IMPORT{program}="@slashlibdir@/udev/udisks-probe-ata-smart $tempnode"
- 
- # ATA disks driven by libata
--KERNEL=="sd*[!0-9]", ATTR{removable}=="0", ENV{ID_BUS}=="ata", ENV{DEVTYPE}=="disk", IMPORT{program}="udisks-probe-ata-smart $tempnode"
-+KERNEL=="sd*[!0-9]", ATTR{removable}=="0", ENV{ID_BUS}=="ata", ENV{DEVTYPE}=="disk", IMPORT{program}="@slashlibdir@/udev/udisks-probe-ata-smart $tempnode"
- 
- # ATA disks connected via SAS (not driven by libata)
--KERNEL=="sd*[!0-9]", ATTR{removable}=="0", ENV{ID_BUS}=="scsi", ENV{DEVTYPE}=="disk", ENV{ID_VENDOR}=="ATA", IMPORT{program}="udisks-probe-ata-smart $tempnode"
-+KERNEL=="sd*[!0-9]", ATTR{removable}=="0", ENV{ID_BUS}=="scsi", ENV{DEVTYPE}=="disk", ENV{ID_VENDOR}=="ATA", IMPORT{program}="@slashlibdir@/udev/udisks-probe-ata-smart $tempnode"
- 
- 
- # Example rule for tagging a device with a specific media type. Where and
diff --git a/pkgs/os-specific/linux/uhk-agent/default.nix b/pkgs/os-specific/linux/uhk-agent/default.nix
new file mode 100644
index 00000000000..5ee485b09cf
--- /dev/null
+++ b/pkgs/os-specific/linux/uhk-agent/default.nix
@@ -0,0 +1,73 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, appimageTools
+, electron
+, makeWrapper
+, asar
+, autoPatchelfHook
+, libusb1
+}:
+
+let
+  pname = "uhk-agent";
+  version = "3.2.1";
+
+  src = fetchurl {
+    url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
+    name = "${pname}-${version}.AppImage";
+    sha256 = "sha256-qAZ92/iN5E+1KGPs6u9Bb6vLfi0Keog/yOcLtnRD7yc=";
+  };
+
+  appimageContents = appimageTools.extract {
+    name = "${pname}-${version}";
+    inherit src;
+  };
+in
+stdenvNoCC.mkDerivation {
+  inherit pname version src;
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [
+    asar
+    makeWrapper
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    libusb1
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out"/{opt,share/applications}
+
+    cp -r --no-preserve=mode "${appimageContents}/resources"        "$out/opt/${pname}"
+    cp -r --no-preserve=mode "${appimageContents}/usr/share/icons"  "$out/share/icons"
+    cp -r --no-preserve=mode "${appimageContents}/${pname}.desktop" "$out/share/applications/${pname}.desktop"
+
+    substituteInPlace "$out/share/applications/${pname}.desktop" \
+      --replace "Exec=AppRun" "Exec=${pname}"
+
+    asar extract "$out/opt/${pname}/app.asar" "$out/opt/${pname}/app.asar.unpacked"
+    rm           "$out/opt/${pname}/app.asar"
+
+    makeWrapper "${electron}/bin/electron" "$out/bin/${pname}" \
+      --add-flags "$out/opt/${pname}/app.asar.unpacked" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Agent is the configuration application of the Ultimate Hacking Keyboard";
+    homepage = "https://github.com/UltimateHackingKeyboard/agent";
+    license = licenses.unfreeRedistributable;
+    maintainers = with maintainers; [ ngiger nickcao ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/uhk-udev-rules/default.nix b/pkgs/os-specific/linux/uhk-udev-rules/default.nix
new file mode 100644
index 00000000000..1b68c46b657
--- /dev/null
+++ b/pkgs/os-specific/linux/uhk-udev-rules/default.nix
@@ -0,0 +1,20 @@
+{ lib, stdenv, uhk-agent }:
+
+stdenv.mkDerivation {
+  pname = "uhk-udev-rules";
+  inherit (uhk-agent) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+  installPhase = ''
+    runHook preInstall
+    install -D -m 644 ${uhk-agent.out}/opt/uhk-agent/rules/50-uhk60.rules $out/lib/udev/rules.d/50-uhk60.rules
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "udev rules for UHK keyboards from https://ultimatehackingkeyboard.com";
+    inherit (uhk-agent.meta) license;
+    maintainers = [ lib.maintainers.ngiger ];
+  };
+}
diff --git a/pkgs/os-specific/linux/ulogd/default.nix b/pkgs/os-specific/linux/ulogd/default.nix
new file mode 100644
index 00000000000..a79a38389e4
--- /dev/null
+++ b/pkgs/os-specific/linux/ulogd/default.nix
@@ -0,0 +1,78 @@
+{ stdenv, lib, fetchurl, gnumake, libnetfilter_acct, libnetfilter_conntrack
+, libnetfilter_log, libmnl, libnfnetlink, automake, autoconf, autogen, libtool
+, postgresql, libmysqlclient, sqlite
+, pkg-config, libpcap, linuxdoc-tools, autoreconfHook, nixosTests }:
+
+stdenv.mkDerivation rec {
+  version = "2.0.8";
+  pname = "ulogd";
+
+  src = fetchurl {
+    url = "https://netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2";
+    hash = "sha256-Tq1sOXDD9X+h6J/i18xIO6b+K9GwhwFSHgs6/WZ98pE=";
+  };
+
+  outputs = [ "out" "doc" "man" ];
+
+  postPatch = ''
+    substituteInPlace ulogd.8 --replace "/usr/share/doc" "$doc/share/doc"
+  '';
+
+  postBuild = ''
+    pushd doc/
+    linuxdoc --backend=txt --filter ulogd.sgml
+    linuxdoc --backend=html --split=0 ulogd.sgml
+    popd
+  '';
+
+  postInstall = ''
+    install -Dm444 -t $out/share/doc/${pname} ulogd.conf doc/ulogd.txt doc/ulogd.html README doc/*table
+    install -Dm444 -t $out/share/doc/${pname}-mysql doc/mysql*.sql
+    install -Dm444 -t $out/share/doc/${pname}-pgsql doc/pgsql*.sql
+  '';
+
+  buildInputs = [
+    libnetfilter_acct
+    libnetfilter_conntrack
+    libnetfilter_log
+    libmnl
+    libnfnetlink
+    libpcap
+    postgresql
+    libmysqlclient
+    sqlite
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    automake
+    autoconf
+    autogen
+    libtool
+    linuxdoc-tools
+  ];
+
+  passthru.tests = { inherit (nixosTests) ulogd; };
+
+  meta = with lib; {
+    description = "Userspace logging daemon for netfilter/iptables";
+
+    longDescription = ''
+      Logging daemon that reads event messages coming from the Netfilter
+      connection tracking, the Netfilter packet logging subsystem and from the
+      Netfilter accounting subsystem. You have to enable support for connection
+      tracking event delivery; ctnetlink and the NFLOG target in your Linux
+      kernel 2.6.x or load their respective modules. The deprecated ULOG target
+      (which has been superseded by NFLOG) is also supported.
+
+      The received messages can be logged into files or into a MySQL, SQLite3
+      or PostgreSQL database. IPFIX and Graphite output are also supported.
+    '';
+
+    homepage = "https://www.netfilter.org/projects/ulogd/index.html";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ p-h ];
+  };
+}
diff --git a/pkgs/os-specific/linux/ultrablue-server/default.nix b/pkgs/os-specific/linux/ultrablue-server/default.nix
new file mode 100644
index 00000000000..bb162f1693b
--- /dev/null
+++ b/pkgs/os-specific/linux/ultrablue-server/default.nix
@@ -0,0 +1,31 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "ultrablue-server";
+  version = "unstable-fosdem2023";
+
+  src = fetchFromGitHub {
+    owner = "ANSSI-FR";
+    repo = "ultrablue";
+    # Do not use a more recent
+    rev = "tags/fosdem-2023";
+    hash = "sha256-rnUbgZI+SycYCDUoSziOy+WxRFvyM3XJWJnk3+t0eb4=";
+    # rev = "6de04af6e353e38c030539c5678e5918f64be37e";
+  };
+
+  sourceRoot = "${src.name}/server";
+
+  vendorHash = "sha256-249LWguTHIF0HNIo8CsE/HWpAtBw4P46VPvlTARLTpw=";
+  doCheck = false;
+
+  meta = with lib; {
+    description = "User-friendly Lightweight TPM Remote Attestation over Bluetooth";
+    homepage = "https://github.com/ANSSI-FR/ultrablue";
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ raitobezarius ];
+  };
+}
diff --git a/pkgs/os-specific/linux/unscd/0001-adjust-socket-paths-for-nixos.patch b/pkgs/os-specific/linux/unscd/0001-adjust-socket-paths-for-nixos.patch
new file mode 100644
index 00000000000..941b5c90a62
--- /dev/null
+++ b/pkgs/os-specific/linux/unscd/0001-adjust-socket-paths-for-nixos.patch
@@ -0,0 +1,41 @@
+From 9d76d183a97cb667a1ab6d95af69d6db745215df Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Milan=20P=C3=A4ssler?= <milan@petabyte.dev>
+Date: Tue, 1 Jun 2021 16:55:45 +0200
+Subject: [PATCH] adjust socket paths for nixos
+
+The original unscd would crash, because it is not allowed to create its
+legacy socket at /var/run/.nscd_socket.
+
+This socket is only required for very old glibc versions, but removing it
+is currently non-trivial, so we just move it somewhere, where it is
+allowed to be created. A patch has been submitted upstream to make this
+hack unnecessary.
+
+Also change /var/run to /run, since we shouldn't be using /var/run
+anymore.
+---
+ nscd.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/nscd.c b/nscd.c
+index a71e474..0cd7106 100644
+--- a/nscd.c
++++ b/nscd.c
+@@ -2100,10 +2100,10 @@ static void main_loop(void)
+ ** Initialization
+ */
+ 
+-#define NSCD_PIDFILE    "/var/run/nscd/nscd.pid"
+-#define NSCD_DIR        "/var/run/nscd"
+-#define NSCD_SOCKET     "/var/run/nscd/socket"
+-#define NSCD_SOCKET_OLD "/var/run/.nscd_socket"
++#define NSCD_PIDFILE    "/run/nscd/nscd.pid"
++#define NSCD_DIR        "/run/nscd"
++#define NSCD_SOCKET     "/run/nscd/socket"
++#define NSCD_SOCKET_OLD "/run/nscd/socket_legacy"
+ 
+ static smallint wrote_pidfile;
+ 
+-- 
+2.31.1
+
diff --git a/pkgs/os-specific/linux/unscd/default.nix b/pkgs/os-specific/linux/unscd/default.nix
new file mode 100644
index 00000000000..82b8c707627
--- /dev/null
+++ b/pkgs/os-specific/linux/unscd/default.nix
@@ -0,0 +1,76 @@
+{ fetchurl, fetchpatch, stdenv, systemd, lib }:
+
+stdenv.mkDerivation rec {
+  pname = "unscd";
+  version = "0.54";
+
+  src = fetchurl {
+    url = "https://busybox.net/~vda/unscd/nscd-${version}.c";
+    sha256 = "0iv4iwgs3sjnqnwd7dpcw6s7i4ar9q89vgsms32clx14fdqjrqch";
+  };
+
+  unpackPhase = ''
+    runHook preUnpack
+    cp $src nscd.c
+    chmod u+w nscd.c
+    runHook postUnpack
+  '';
+
+  patches = [
+    # Patches from Debian that have not (yet) been included upstream, but are useful to us
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/u/${pname}/${version}-1/debian/patches/change_invalidate_request_info_output";
+      sha256 = "17whakazpisiq9nnw3zybaf7v3lqkww7n6jkx0igxv4z2r3mby6l";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/u/${pname}/${version}-1/debian/patches/support_large_numbers_in_config";
+      sha256 = "0jrqb4cwclwirpqfb6cvnmiff3sm2jhxnjwxa7h0wx78sg0y3bpp";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/u/${pname}/${version}-1/debian/patches/no_debug_on_invalidate";
+      sha256 = "0znwzb522zgikb0mm7awzpvvmy0wf5z7l3jgjlkdpgj0scxgz86w";
+    })
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/u/${pname}/${version}-1/debian/patches/notify_systemd_about_successful_startup";
+      sha256 = "1ipwmbfwm65yisy74nig9960vxpjx683l3skgxfgssfx1jb9z2mc";
+    })
+
+    # The original unscd would crash, because it is not allowed to create its
+    # legacy socket at /var/run/.nscd_socket.
+    # This socket is only required for very old glibc versions, but removing it
+    # is currently non-trivial, so we just move it somewhere, where it is
+    # allowed to be created. A patch has been submitted upstream to make this
+    # hack unnecessary.
+    # Also change /var/run to /run, since we shouldn't be using /var/run
+    # anymore.
+    # See also: http://lists.busybox.net/pipermail/busybox/2021-June/088866.html
+    ./0001-adjust-socket-paths-for-nixos.patch
+  ];
+
+  buildInputs = [ systemd ];
+
+  buildPhase = ''
+    runHook preBuild
+    gcc -Wall \
+      -Wl,--sort-section -Wl,alignment \
+      -Wl,--sort-common \
+      -fomit-frame-pointer \
+      -lsystemd \
+      -o nscd nscd.c
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 -t $out/bin nscd
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://busybox.net/~vda/unscd/";
+    description = "Less buggy replacement for the glibc name service cache daemon";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ];
+  };
+}
diff --git a/pkgs/os-specific/linux/unstick/default.nix b/pkgs/os-specific/linux/unstick/default.nix
index 7d839f8acdb..ee82679de4e 100644
--- a/pkgs/os-specific/linux/unstick/default.nix
+++ b/pkgs/os-specific/linux/unstick/default.nix
@@ -1,17 +1,17 @@
 { stdenv, lib, fetchFromGitHub, meson, ninja, pkg-config, libseccomp }:
 
 stdenv.mkDerivation rec {
-  name = "unstick";
+  pname = "unstick";
   version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "kwohlfahrt";
-    repo = name;
+    repo = "unstick";
     rev = "effee9aa242ca12dc94cc6e96bc073f4cc9e8657";
     sha256 = "08la3jmmzlf4pm48bf9zx4cqj9gbqalpqy0s57bh5vfsdk74nnhv";
   };
 
-  sourceRoot = "source/src";
+  sourceRoot = "${src.name}/src";
 
   nativeBuildInputs = [ meson ninja pkg-config ];
   buildInputs = [ libseccomp ];
diff --git a/pkgs/os-specific/linux/upower/default.nix b/pkgs/os-specific/linux/upower/default.nix
index 08bebefed13..36d8a3b9c45 100644
--- a/pkgs/os-specific/linux/upower/default.nix
+++ b/pkgs/os-specific/linux/upower/default.nix
@@ -1,36 +1,82 @@
-{ lib, stdenv
-, fetchurl
+{ lib
+, stdenv
+, fetchFromGitLab
+, makeWrapper
 , pkg-config
+, rsync
 , libxslt
-, docbook_xsl
+, meson
+, ninja
+, python3
+, dbus
+, umockdev
+, libeatmydata
+, gtk-doc
+, docbook-xsl-nons
 , udev
 , libgudev
 , libusb1
 , glib
-, gobject-introspection
 , gettext
 , systemd
+, nixosTests
 , useIMobileDevice ? true
 , libimobiledevice
+, withDocs ? withIntrospection
+, mesonEmulatorHook
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
+, buildPackages
+, gobject-introspection
 }:
 
-stdenv.mkDerivation {
+assert withDocs -> withIntrospection;
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
-  version = "0.99.11";
+  version = "1.90.2";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "installedTests" ]
+    ++ lib.optionals withDocs [ "devdoc" ];
 
-  src = fetchurl {
-    url = "https://gitlab.freedesktop.org/upower/upower/uploads/93cfe7c8d66ed486001c4f3f55399b7a/upower-0.99.11.tar.xz";
-    sha256 = "1vxxvmz2cxb1qy6ibszaz5bskqdy9nd9fxspj9fv3gfmrjzzzdb4";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "upower";
+    repo = "upower";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-7WzMAJuf1czU8ZalsEU/NwCXYqTGvcqEqxFt5ocgt48=";
   };
 
+  patches = lib.optionals (stdenv.hostPlatform.system == "i686-linux") [
+    # Remove when this is fixed upstream:
+    # https://gitlab.freedesktop.org/upower/upower/-/issues/214
+    ./i686-test-remove-battery-check.patch
+  ] ++ [
+    ./installed-tests-path.patch
+  ];
+
+  strictDeps = true;
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
   nativeBuildInputs = [
-    docbook_xsl
+    meson
+    ninja
+    python3
+    docbook-xsl-nons
     gettext
-    gobject-introspection
     libxslt
+    makeWrapper
     pkg-config
+    rsync
+    glib
+  ] ++ lib.optionals withIntrospection [
+    gobject-introspection
+  ] ++ lib.optionals withDocs [
+    gtk-doc
+  ] ++ lib.optionals (withDocs && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    mesonEmulatorHook
   ];
 
   buildInputs = [
@@ -38,34 +84,131 @@ stdenv.mkDerivation {
     libusb1
     udev
     systemd
-  ]
-  ++ lib.optional useIMobileDevice libimobiledevice
-  ;
+    # Duplicate from nativeCheckInputs until https://github.com/NixOS/nixpkgs/issues/161570 is solved
+    umockdev
+
+    # For installed tests.
+    (python3.withPackages (pp: [
+      pp.dbus-python
+      pp.python-dbusmock
+      pp.pygobject3
+      pp.packaging
+    ]))
+  ] ++ lib.optionals useIMobileDevice [
+    libimobiledevice
+  ];
+
+  nativeCheckInputs = [
+    python3.pkgs.dbus-python
+    python3.pkgs.python-dbusmock
+    python3.pkgs.pygobject3
+    dbus
+    umockdev
+    libeatmydata
+    python3.pkgs.packaging
+  ];
 
   propagatedBuildInputs = [
     glib
   ];
 
-  configureFlags = [
+  mesonFlags = [
     "--localstatedir=/var"
-    "--with-backend=linux"
-    "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
-    "--with-systemdutildir=${placeholder "out"}/lib/systemd"
-    "--with-udevrulesdir=${placeholder "out"}/lib/udev/rules.d"
     "--sysconfdir=/etc"
+    "-Dos_backend=linux"
+    "-Dsystemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
+    "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
+    "-Dudevhwdbdir=${placeholder "out"}/lib/udev/hwdb.d"
+    (lib.mesonEnable "introspection" withIntrospection)
+    (lib.mesonBool "gtk-doc" withDocs)
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
   ];
 
-  doCheck = false; # fails with "env: './linux/integration-test': No such file or directory"
+  doCheck = true;
 
-  installFlags = [
-    "historydir=$(TMPDIR)/foo"
-    "sysconfdir=${placeholder "out"}/etc"
-  ];
+  postPatch = ''
+    patchShebangs src/linux/integration-test.py
+    patchShebangs src/linux/unittest_inspector.py
+
+    substituteInPlace src/linux/integration-test.py \
+      --replace "/usr/share/dbus-1" "$out/share/dbus-1"
+  '';
+
+  preCheck = ''
+    # Our gobject-introspection patches make the shared library paths absolute
+    # in the GIR files. When running tests, the library is not yet installed,
+    # though, so we need to replace the absolute path with a local one during build.
+    # We are using a symlink that will be overwitten during installation.
+    mkdir -p "$out/lib"
+    ln -s "$PWD/libupower-glib/libupower-glib.so" "$out/lib/libupower-glib.so.3"
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+
+    # Slow fsync calls can make self-test fail:
+    # https://gitlab.freedesktop.org/upower/upower/-/issues/195
+    eatmydata meson test --print-errorlogs
+
+    runHook postCheck
+  '';
+
+  postCheck = ''
+    # Undo patchShebangs from postPatch so that it can be replaced with runtime shebang
+    # unittest_inspector.py intentionally not reverted because it would trigger
+    # meson rebuild during install and it is not used at runtime anyway.
+    sed -Ei 's~#!.+/bin/python3~#!/usr/bin/python3~' \
+      ../src/linux/integration-test.py
+  '';
+
+  postInstall = ''
+    # Move stuff from DESTDIR to proper location.
+    # We use rsync to merge the directories.
+    for dir in etc var; do
+        rsync --archive "$DESTDIR/$dir" "$out"
+        rm --recursive "$DESTDIR/$dir"
+    done
+    for o in out dev installedTests; do
+        rsync --archive "$DESTDIR/''${!o}" "$(dirname "''${!o}")"
+        rm --recursive "$DESTDIR/''${!o}"
+    done
+    # Ensure the DESTDIR is removed.
+    rmdir "$DESTDIR/nix/store" "$DESTDIR/nix" "$DESTDIR"
+  '';
+
+  postFixup = ''
+    wrapProgram "$installedTests/libexec/upower/integration-test.py" \
+      --prefix GI_TYPELIB_PATH : "${lib.makeSearchPath "lib/girepository-1.0" [
+        "$out"
+        umockdev.out
+      ]}" \
+      --prefix PATH : "${lib.makeBinPath [
+        umockdev
+      ]}"
+  '';
+
+  env = {
+    # HACK: We want to install configuration files to $out/etc
+    # but upower should read them from /etc on a NixOS system.
+    # With autotools, it was possible to override Make variables
+    # at install time but Meson does not support this
+    # so we need to convince it to install all files to a temporary
+    # location using DESTDIR and then move it to proper one in postInstall.
+    DESTDIR = "${placeholder "out"}/dest";
+  };
+
+  passthru = {
+    tests = {
+      installedTests = nixosTests.installed-tests.upower;
+    };
+  };
 
   meta = with lib; {
     homepage = "https://upower.freedesktop.org/";
+    changelog = "https://gitlab.freedesktop.org/upower/upower/-/blob/v${finalAttrs.version}/NEWS";
     description = "A D-Bus service for power management";
+    maintainers = teams.freedesktop.members;
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch b/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch
new file mode 100644
index 00000000000..c9121dfb038
--- /dev/null
+++ b/pkgs/os-specific/linux/upower/i686-test-remove-battery-check.patch
@@ -0,0 +1,12 @@
+diff -u "a/src/linux/integration-test.py" "b/src/linux/integration-test.py"

+--- a/src/linux/integration-test.py

++++ b/src/linux/integration-test.py

+@@ -870,5 +870,4 @@

+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'EnergyFull'), 126.0)

+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'EnergyFullDesign'), 132.0)

+         self.assertEqual(self.get_dbus_dev_property(bat0_up, 'Voltage'), 12.0)

+-        self.assertEqual(self.get_dbus_dev_property(bat0_up, 'Percentage'), 40.0)

+         self.stop_daemon()

+

+

+Diff finished.  Tue Nov  8 16:48:57 2022

diff --git a/pkgs/os-specific/linux/upower/installed-tests-path.patch b/pkgs/os-specific/linux/upower/installed-tests-path.patch
new file mode 100644
index 00000000000..367f3eab096
--- /dev/null
+++ b/pkgs/os-specific/linux/upower/installed-tests-path.patch
@@ -0,0 +1,56 @@
+diff --git a/meson_options.txt b/meson_options.txt
+index eec3659..f064a1b 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -6,6 +6,10 @@ option('gtk-doc',
+        type : 'boolean',
+        value : 'true',
+        description : 'Build developer documentation')
++option('installed_test_prefix',
++       type: 'string',
++       value: '',
++       description: 'Prefix for installed tests')
+ option('introspection',
+        type : 'feature',
+        value : 'auto',
+diff --git a/src/meson.build b/src/meson.build
+index a2352ac..c1f25ac 100644
+--- a/src/meson.build
++++ b/src/meson.build
+@@ -85,6 +85,7 @@ install_subdir('does-not-exist', install_dir: historydir, strip_directory : true
+ 
+ cdata = configuration_data()
+ cdata.set('libexecdir', get_option('prefix') / get_option('libexecdir'))
++cdata.set('installed_test_bindir', get_option('installed_test_prefix') / 'libexec' / 'upower')
+ cdata.set('historydir', historydir)
+ 
+ configure_file(
+@@ -147,16 +148,16 @@ if os_backend == 'linux' and gobject_introspection.found()
+         'linux/integration-test.py',
+         'linux/output_checker.py',
+       ],
+-      install_dir: get_option('prefix') / get_option('libexecdir') / 'upower'
++      install_dir: get_option('installed_test_prefix') / 'libexec' / 'upower'
+     )
+     install_subdir('linux/tests/',
+-      install_dir: get_option('prefix') / get_option('libexecdir') / 'upower'
++      install_dir: get_option('installed_test_prefix') / 'libexec' / 'upower'
+     )
+ 
+     configure_file(
+       input: 'upower-integration.test.in',
+       output: 'upower-integration.test',
+-      install_dir: get_option('datadir') / 'installed-tests' / 'upower',
++      install_dir: get_option('installed_test_prefix') / 'share' / 'installed-tests' / 'upower',
+       configuration: cdata
+     )
+ endif
+diff --git a/src/upower-integration.test.in b/src/upower-integration.test.in
+index 151ded0..b0a9bec 100644
+--- a/src/upower-integration.test.in
++++ b/src/upower-integration.test.in
+@@ -1,3 +1,3 @@
+ [Test]
+ Type=session
+-Exec=@libexecdir@/upower/integration-test.py
++Exec=@installed_test_bindir@/integration-test.py
diff --git a/pkgs/os-specific/linux/usb-blaster-udev-rules/default.nix b/pkgs/os-specific/linux/usb-blaster-udev-rules/default.nix
new file mode 100644
index 00000000000..d04c8ddb939
--- /dev/null
+++ b/pkgs/os-specific/linux/usb-blaster-udev-rules/default.nix
@@ -0,0 +1,26 @@
+{ lib, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation rec {
+  name = "usb-blaster-udev-rules";
+
+  udevRules = ./usb-blaster.rules;
+  dontUnpack = true;
+
+  installPhase = ''
+    install -Dm 644 "${udevRules}" "$out/lib/udev/rules.d/51-usbblaster.rules"
+  '';
+
+  meta = with lib; {
+    description = "udev rules that give NixOS permission to communicate with usb blasters";
+    longDescription = ''
+      udev rules that give NixOS permission to communicate with usb blasters.
+      To use it under NixOS, add
+
+        services.udev.packages = [ pkgs.usb-blaster-udev-rules ];
+
+      to the system configuration.
+    '';
+    license = licenses.free;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/usb-blaster-udev-rules/usb-blaster.rules b/pkgs/os-specific/linux/usb-blaster-udev-rules/usb-blaster.rules
new file mode 100644
index 00000000000..0add604ee81
--- /dev/null
+++ b/pkgs/os-specific/linux/usb-blaster-udev-rules/usb-blaster.rules
@@ -0,0 +1,8 @@
+# USB-Blaster
+ATTRS{idVendor}=="09fb", ATTRS{idProduct}=="6001", TAG+="uaccess"
+ATTRS{idVendor}=="09fb", ATTRS{idProduct}=="6002", TAG+="uaccess"
+ATTRS{idVendor}=="09fb", ATTRS{idProduct}=="6003", TAG+="uaccess"
+
+# USB-Blaster II
+ATTRS{idVendor}=="09fb", ATTRS{idProduct}=="6010", TAG+="uaccess"
+ATTRS{idVendor}=="09fb", ATTRS{idProduct}=="6810", TAG+="uaccess"
diff --git a/pkgs/os-specific/linux/usbguard-notifier/default.nix b/pkgs/os-specific/linux/usbguard-notifier/default.nix
new file mode 100644
index 00000000000..c5b296809da
--- /dev/null
+++ b/pkgs/os-specific/linux/usbguard-notifier/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  libqb,
+  usbguard,
+  librsvg,
+  libnotify,
+  catch2,
+  asciidoc,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "usbguard-notifier";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Cropi";
+    repo = pname;
+    rev = "${pname}-${version}";
+    hash = "sha256-gWvCGSbOuey2ELAPD2WCG4q77IClL0S7rE2RaUJDc1I=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config asciidoc ];
+  buildInputs = [ libqb usbguard librsvg libnotify ];
+
+  configureFlags = [ "CPPFLAGS=-I${catch2}/include/catch2" ];
+
+  prePatch = ''
+    substituteInPlace configure.ac \
+      --replace 'AC_MSG_FAILURE([Cannot detect the systemd system unit dir])' \
+        'systemd_unit_dir="$out/lib/systemd/user"'
+  '';
+
+  meta = {
+    description = "Notifications for detecting usbguard policy and device presence changes";
+    homepage = "https://github.com/Cropi/usbguard-notifier";
+    maintainers = with lib.maintainers; [ fpletz ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
index 7d4563baee4..46e9ee3d0a5 100644
--- a/pkgs/os-specific/linux/usbguard/default.nix
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -17,21 +17,18 @@
 , polkit
 , protobuf
 , audit
-, libgcrypt
 , libsodium
 }:
 
-assert libgcrypt != null -> libsodium == null;
-
 stdenv.mkDerivation rec {
-  version = "1.0.0";
+  version = "1.1.2";
   pname = "usbguard";
 
   src = fetchFromGitHub {
     owner = "USBGuard";
     repo = pname;
     rev = "usbguard-${version}";
-    sha256 = "sha256-CPuBQmDOpXWn0jPo4HRyDCZUpDy5NmbvUHxXoVbMd/I=";
+    sha256 = "sha256-uwNoKczmVOMpkU4KcKTOtbcTHiYVGXjk/rVbqMl5pGk=";
     fetchSubmodules = true;
   };
 
@@ -44,6 +41,8 @@ stdenv.mkDerivation rec {
     libxml2 # xmllint
     docbook_xml_dtd_45
     docbook_xsl
+    dbus-glib # gdbus-codegen
+    protobuf # protoc
   ];
 
   buildInputs = [
@@ -51,21 +50,19 @@ stdenv.mkDerivation rec {
     libcap_ng
     libqb
     libseccomp
+    libsodium
     polkit
     protobuf
     audit
-  ]
-  ++ (lib.optional (libgcrypt != null) libgcrypt)
-  ++ (lib.optional (libsodium != null) libsodium);
+  ];
 
   configureFlags = [
     "--with-bundled-catch"
     "--with-bundled-pegtl"
     "--with-dbus"
+    "--with-crypto-library=sodium"
     "--with-polkit"
-  ]
-  ++ (lib.optional (libgcrypt != null) "--with-crypto-library=gcrypt")
-  ++ (lib.optional (libsodium != null) "--with-crypto-library=sodium");
+  ];
 
   enableParallelBuilding = true;
 
diff --git a/pkgs/os-specific/linux/usbip/default.nix b/pkgs/os-specific/linux/usbip/default.nix
index 43c22a8fd12..b91f55dcd2f 100644
--- a/pkgs/os-specific/linux/usbip/default.nix
+++ b/pkgs/os-specific/linux/usbip/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, kernel, udev, autoconf, automake, libtool, hwdata, kernelOlder }:
+{ lib, stdenv, fetchpatch, kernel, udev, autoconf, automake, libtool, hwdata, kernelOlder }:
 
 stdenv.mkDerivation {
   name = "usbip-${kernel.name}";
@@ -10,12 +10,12 @@ stdenv.mkDerivation {
     ./fix-snprintf-truncation.patch
     # fixes build with gcc9
     ./fix-strncpy-truncation.patch
-  ];
+  ] ++ kernel.patches;
 
   nativeBuildInputs = [ autoconf automake libtool ];
   buildInputs = [ udev ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=address-of-packed-member" ];
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=address-of-packed-member" ];
 
   preConfigure = ''
     cd tools/usb/usbip
diff --git a/pkgs/os-specific/linux/usbrelay/daemon.nix b/pkgs/os-specific/linux/usbrelay/daemon.nix
new file mode 100644
index 00000000000..6e4e4661fd5
--- /dev/null
+++ b/pkgs/os-specific/linux/usbrelay/daemon.nix
@@ -0,0 +1,39 @@
+{ stdenv, usbrelay, python3, installShellFiles }:
+let
+  python = python3.withPackages (ps: with ps; [ usbrelay-py paho-mqtt ]);
+in
+# This is a separate derivation, not just an additional output of
+# usbrelay, because otherwise, we have a cyclic dependency between
+# usbrelay (default.nix) and the python module (python.nix).
+stdenv.mkDerivation {
+  pname = "usbrelayd";
+
+  inherit (usbrelay) src version;
+
+  postPatch = ''
+    substituteInPlace 'usbrelayd.service' \
+      --replace '/usr/bin/python3' "${python}/bin/python3" \
+      --replace '/usr/sbin/usbrelayd' "$out/bin/usbrelayd"
+  '';
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildInputs = [ python ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall;
+    install -m 644 -D usbrelayd $out/bin/usbrelayd
+    install -m 644 -D usbrelayd.service $out/lib/systemd/system/usbrelayd.service
+    install -m 644 -D 50-usbrelay.rules $out/lib/udev/rules.d/50-usbrelay.rules
+    install -m 644 -D usbrelayd.conf $out/etc/usbrelayd.conf # include this as an example
+    installManPage usbrelayd.8
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "USB Relay MQTT service";
+    inherit (usbrelay.meta) homepage license maintainers platforms;
+  };
+}
diff --git a/pkgs/os-specific/linux/usbrelay/default.nix b/pkgs/os-specific/linux/usbrelay/default.nix
new file mode 100644
index 00000000000..670de2028c4
--- /dev/null
+++ b/pkgs/os-specific/linux/usbrelay/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, lib, fetchFromGitHub, hidapi, installShellFiles }:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "usbrelay";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "darrylb123";
+    repo = "usbrelay";
+    rev = finalAttrs.version;
+    sha256 = "sha256-9jEiMmBEpqY4+nKh3H8N/JrLohp/7oPK3rPmRjp2gvc=";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  buildInputs = [
+    hidapi
+  ];
+
+  makeFlags = [
+    "DIR_VERSION=${finalAttrs.version}"
+    "PREFIX=${placeholder "out"}"
+    "LDCONFIG=${stdenv.cc.libc.bin}/bin/ldconfig"
+  ];
+
+  postInstall = ''
+    installManPage usbrelay.1
+  '';
+
+  meta = with lib; {
+    description = "Tool to control USB HID relays";
+    homepage = "https://github.com/darrylb123/usbrelay";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ wentasah ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/os-specific/linux/usbrelay/python.nix b/pkgs/os-specific/linux/usbrelay/python.nix
new file mode 100644
index 00000000000..90838295ecb
--- /dev/null
+++ b/pkgs/os-specific/linux/usbrelay/python.nix
@@ -0,0 +1,16 @@
+{ buildPythonPackage, usbrelay }:
+
+buildPythonPackage {
+  pname = "usbrelay_py";
+  inherit (usbrelay) version src;
+
+  preConfigure = ''
+    cd usbrelay_py
+  '';
+
+  buildInputs = [ usbrelay ];
+
+  pythonImportsCheck = [ "usbrelay_py" ];
+
+  inherit (usbrelay) meta;
+}
diff --git a/pkgs/os-specific/linux/usbrelay/test.nix b/pkgs/os-specific/linux/usbrelay/test.nix
new file mode 100644
index 00000000000..58e4375dab8
--- /dev/null
+++ b/pkgs/os-specific/linux/usbrelay/test.nix
@@ -0,0 +1,64 @@
+# NixOS test for usbrelayd
+#
+# It is not stored in nixos/tests directory, because it requires the
+# USB relay connected to the host computer and as such, it cannot be
+# run automatically.
+#
+# Run this test as:
+#
+#     nix-build test.nix -A driverInteractive && ./result/bin/nixos-test-driver --no-interactive
+#
+# The interactive driver is required because the default
+# (non-interactive) driver uses qemu without support for passing USB
+# devices to the guest (see
+# https://discourse.nixos.org/t/hardware-dependent-nixos-tests/18564
+# for discussion of other alternatives).
+
+import ../../../../nixos/tests/make-test-python.nix ({ pkgs, ... }: {
+  name = "usbrelayd";
+
+  nodes.machine = {
+    virtualisation.qemu.options = [
+      "-device qemu-xhci"
+      "-device usb-host,vendorid=0x16c0,productid=0x05df"
+    ];
+    services.usbrelayd.enable = true;
+    systemd.services.usbrelayd = {
+      after = [ "mosquitto.service" ];
+    };
+    services.mosquitto = {
+      enable = true;
+      listeners = [{
+        acl = [ "pattern readwrite #" ];
+        omitPasswordAuth = true;
+        settings.allow_anonymous = true;
+      }];
+    };
+    environment.systemPackages = [
+      pkgs.usbrelay
+      pkgs.mosquitto
+    ];
+    documentation.nixos.enable = false; # building nixos manual takes long time
+  };
+
+  testScript = ''
+    import os
+    if os.waitstatus_to_exitcode(os.system("lsusb -d 16c0:05df")) != 0:
+        print("No USB relay detected, skipping test")
+        import sys
+        sys.exit(2)
+    machine.start()
+    # usbrelayd is started by udev when an relay is detected
+    machine.wait_for_unit("usbrelayd.service")
+
+    stdout = machine.succeed("usbrelay")
+    relay_id = stdout.split(sep="_")[0]
+    assert relay_id != ""
+    import time
+    time.sleep(1)
+    machine.succeed(f"mosquitto_pub -h localhost -t cmnd/{relay_id}/1 -m ON")
+    time.sleep(1)
+    machine.succeed(f"mosquitto_pub -h localhost -t cmnd/{relay_id}/1 -m OFF")
+    print("Did you see the relay switching on and off?")
+  '';
+})
diff --git a/pkgs/os-specific/linux/usbtop/default.nix b/pkgs/os-specific/linux/usbtop/default.nix
index 6948d51e5dc..fb3d32df09a 100644
--- a/pkgs/os-specific/linux/usbtop/default.nix
+++ b/pkgs/os-specific/linux/usbtop/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/aguinet/usbtop";
     description = "A top utility that shows an estimated instantaneous bandwidth on USB buses and devices";
-    maintainers = with maintainers; [ etu ];
+    maintainers = with maintainers; [ ];
     license = licenses.bsd3;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index fba025b29d9..cfd94bf33c4 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -1,11 +1,12 @@
-{ lib, stdenv, fetchurl, substituteAll, autoreconfHook, pkg-config, libusb1, hwdata , python3 }:
+{ lib, stdenv, fetchurl, substituteAll, autoreconfHook, pkg-config, libusb1, hwdata, python3 }:
 
 stdenv.mkDerivation rec {
-  name = "usbutils-013";
+  pname = "usbutils";
+  version = "017";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/usb/usbutils/${name}.tar.xz";
-    sha256 = "0f0klk6d3hmbpf6p4dcwa1qjzblmkhbxs1wsw87aidvqri7lj8wy";
+    url = "mirror://kernel/linux/utils/usb/usbutils/usbutils-${version}.tar.xz";
+    hash = "sha256-pqJf/c+RA+ONekRzKsoXBz9OYCuS5K5VYlIxqCcC4Fs=";
   };
 
   patches = [
@@ -26,6 +27,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "http://www.linux-usb.org/";
     description = "Tools for working with USB devices, such as lsusb";
+    maintainers = with maintainers; [ ];
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/usermount/default.nix b/pkgs/os-specific/linux/usermount/default.nix
index d0c690a9527..475ccd848eb 100644
--- a/pkgs/os-specific/linux/usermount/default.nix
+++ b/pkgs/os-specific/linux/usermount/default.nix
@@ -1,18 +1,20 @@
-{ lib, stdenv, fetchgit, pkg-config, dbus, libnotify, udisks2, gdk-pixbuf }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, dbus, libnotify, udisks2, gdk-pixbuf }:
 
 stdenv.mkDerivation {
-  name = "usermount-0.1";
+  pname = "usermount";
+  version = "0.1";
 
-  src = fetchgit {
-    url = "https://github.com/tom5760/usermount.git";
+  src = fetchFromGitHub {
+    owner = "tom5760";
+    repo = "usermount";
     rev = "0d6aba3c1f8fec80de502f5b92fd8b28041cc8e4";
-    sha256 = "0gpp0vwiwr7kgbhh26jspv3255662mnvnav6g8i2h0qxar8hf8w2";
+    sha256 = "sha256-giMHUVYdAygiemYru20VxpQixr5aGgHhevNkHvkG9z4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus libnotify udisks2 gdk-pixbuf ];
 
-  NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
+  env.NIX_CFLAGS_COMPILE = "-DENABLE_NOTIFICATIONS";
 
   installPhase = ''
     mkdir -p $out/bin
diff --git a/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
new file mode 100644
index 00000000000..068744d4f32
--- /dev/null
+++ b/pkgs/os-specific/linux/util-linux/bcachefs-patch-set.patch
@@ -0,0 +1,277 @@
+commit 68564ebb50f8afab5a9527c534417e247cca0b27
+Author: Filipe Manana <fdmanana@kernel.org>
+Date:   Thu Aug 17 10:20:13 2023 +0100
+
+    libmount: Fix regression when mounting with atime
+    
+    A regression was introduced in v2.39 that causes mounting with the atime
+    option to fail:
+    
+      $ mkfs.ext4 -F /dev/sdi
+      $ mount -o atime /dev/sdi /mnt/sdi
+      mount: /mnt/sdi: not mount point or bad option.
+             dmesg(1) may have more information after failed mount system call.
+    
+    The failure comes from the mount_setattr(2) call returning -EINVAL. This
+    is because we pass an invalid value for the attr_clr argument. From a
+    strace capture we have:
+    
+      mount_setattr(4, "", AT_EMPTY_PATH, {attr_set=0, attr_clr=MOUNT_ATTR_NOATIME, propagation=0 /* MS_??? */, userns_fd=0}, 32) = -1 EINVAL (Invalid argument)
+    
+    We can't pass MOUNT_ATTR_NOATIME to mount_setattr(2) through the attr_clr
+    argument because all atime options are exclusive, so in order to set atime
+    one has to pass MOUNT_ATTR__ATIME to attr_clr and leave attr_set as
+    MOUNT_ATTR_RELATIME (which is defined as a value of 0).
+    
+    This can be read from the man page for mount_setattr(2) and also from the
+    kernel source:
+    
+      $ cat fs/namespace.c
+      static int build_mount_kattr(const struct mount_attr *attr, size_t usize,
+                                   struct mount_kattr *kattr, unsigned int flags)
+      {
+          (...)
+          /*
+           * Since the MOUNT_ATTR_<atime> values are an enum, not a bitmap,
+           * users wanting to transition to a different atime setting cannot
+           * simply specify the atime setting in @attr_set, but must also
+           * specify MOUNT_ATTR__ATIME in the @attr_clr field.
+           * So ensure that MOUNT_ATTR__ATIME can't be partially set in
+           * @attr_clr and that @attr_set can't have any atime bits set if
+           * MOUNT_ATTR__ATIME isn't set in @attr_clr.
+           */
+          if (attr->attr_clr & MOUNT_ATTR__ATIME) {
+              if ((attr->attr_clr & MOUNT_ATTR__ATIME) != MOUNT_ATTR__ATIME)
+                  return -EINVAL;
+    
+                  /*
+                   * Clear all previous time settings as they are mutually
+                   * exclusive.
+                   */
+                  kattr->attr_clr |= MNT_RELATIME | MNT_NOATIME;
+                  switch (attr->attr_set & MOUNT_ATTR__ATIME) {
+                  case MOUNT_ATTR_RELATIME:
+                      kattr->attr_set |= MNT_RELATIME;
+                      break;
+                  case MOUNT_ATTR_NOATIME:
+                      kattr->attr_set |= MNT_NOATIME;
+                      break;
+                  case MOUNT_ATTR_STRICTATIME:
+                      break;
+                  default:
+                      return -EINVAL;
+                  }
+        (...)
+    
+    So fix this by setting attr_clr MOUNT_ATTR__ATIME if we want to clear any
+    atime related option.
+    
+    Signed-off-by: Filipe Manana <fdmanana@kernel.org>
+
+diff --git a/libmount/src/optlist.c b/libmount/src/optlist.c
+index 1e962ec6d..0702adae7 100644
+--- a/libmount/src/optlist.c
++++ b/libmount/src/optlist.c
+@@ -875,7 +875,18 @@ int mnt_optlist_get_attrs(struct libmnt_optlist *ls, uint64_t *set, uint64_t *cl
+ 
+ 		if (opt->ent->mask & MNT_INVERT) {
+ 			DBG(OPTLIST, ul_debugobj(ls, " clr: %s", opt->ent->name));
+-			*clr |= x;
++			/*
++			 * All atime settings are mutually exclusive so *clr must
++			 * have MOUNT_ATTR__ATIME set.
++			 *
++			 * See the function fs/namespace.c:build_mount_kattr()
++			 * in the linux kernel source.
++			 */
++			if (x == MOUNT_ATTR_RELATIME || x == MOUNT_ATTR_NOATIME ||
++			    x == MOUNT_ATTR_STRICTATIME)
++				*clr |= MOUNT_ATTR__ATIME;
++			else
++				*clr |= x;
+ 		} else {
+ 			DBG(OPTLIST, ul_debugobj(ls, " set: %s", opt->ent->name));
+ 			*set |= x;
+diff --git a/tests/expected/libmount/context-mount-flags b/tests/expected/libmount/context-mount-flags
+index 960641863..eb71323dd 100644
+--- a/tests/expected/libmount/context-mount-flags
++++ b/tests/expected/libmount/context-mount-flags
+@@ -3,3 +3,6 @@ ro,nosuid,noexec
+ successfully mounted
+ rw,nosuid,noexec
+ successfully umounted
++successfully mounted
++rw,relatime
++successfully umounted
+diff --git a/tests/ts/libmount/context b/tests/ts/libmount/context
+index f5b47185e..a5d2e81a3 100755
+--- a/tests/ts/libmount/context
++++ b/tests/ts/libmount/context
+@@ -116,8 +116,15 @@ $TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPU
+ 
+ ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
+ is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
+-ts_finalize_subtest
+ 
++# Test that the atime option works after the migration to use the new kernel mount APIs.
++ts_run $TESTPROG --mount -o atime $DEVICE $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
++$TS_CMD_FINDMNT --kernel --mountpoint $MOUNTPOINT -o VFS-OPTIONS -n >> $TS_OUTPUT 2>> $TS_ERRLOG
++is_mounted $DEVICE || echo "$DEVICE not mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
++ts_run $TESTPROG --umount $MOUNTPOINT >> $TS_OUTPUT 2>> $TS_ERRLOG
++is_mounted $DEVICE && echo "$DEVICE still mounted" >> $TS_OUTPUT 2>> $TS_ERRLOG
++
++ts_finalize_subtest
+ 
+ ts_init_subtest "mount-loopdev"
+ mkdir -p $MOUNTPOINT &> /dev/null
+
+commit 1ec71634aa4ef5ddca23d65c8a296f3614231e8a
+Author: Colin Gillespie <colin@cgillespie.xyz>
+Date:   Wed Aug 9 18:28:07 2023 +1000
+
+    libblkid: (bcachefs) fix not detecting large superblocks
+    
+    Probing does not detect bcachefs filesystems with a superblock larger
+    than 4KiB. Bcachefs superblocks grow in size and can become much larger
+    than this.
+    
+    Increase the superblock maximum size limit to 1MiB.
+    
+    Validate the superblock isn't larger than the maximum size defined in
+    the superblocks layout section.
+    
+    (cherry picked from commit 48d573797797650d96456979797c0155d58f61cb)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 40e702d75..236877042 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -102,6 +102,15 @@ union bcachefs_sb_csum {
+ 	uint8_t raw[16];
+ } __attribute__((packed));
+ 
++struct bcachefs_sb_layout {
++	uint8_t		magic[16];
++	uint8_t		layout_type;
++	uint8_t		sb_max_size_bits;
++	uint8_t		nr_superblocks;
++	uint8_t		pad[5];
++	uint64_t	sb_offset[61];
++} __attribute__((packed));
++
+ struct bcachefs_super_block {
+ 	union bcachefs_sb_csum	csum;
+ 	uint16_t	version;
+@@ -123,7 +132,7 @@ struct bcachefs_super_block {
+ 	uint64_t	flags[8];
+ 	uint64_t	features[2];
+ 	uint64_t	compat[2];
+-	uint8_t		layout[512];
++	struct bcachefs_sb_layout layout;
+ 	struct bcachefs_sb_field _start[];
+ }  __attribute__((packed));
+ 
+@@ -143,7 +152,7 @@ struct bcachefs_super_block {
+ /* granularity of offset and length fields within superblock */
+ #define BCACHEFS_SECTOR_SIZE   512
+ /* maximum superblock size */
+-#define BCACHEFS_SB_MAX_SIZE   4096
++#define BCACHEFS_SB_MAX_SIZE   0x100000
+ /* fields offset within super block */
+ #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
+ /* tag value for members field */
+@@ -302,6 +311,9 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
++	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
++		return BLKID_PROBE_NONE;
++
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+ 		return BLKID_PROBE_NONE;
+ 
+
+commit acbf17ae8f8ee0f941fe98ed12f115f2b349bba8
+Author: Karel Zak <kzak@redhat.com>
+Date:   Wed Aug 23 11:53:45 2023 +0200
+
+    libblkid: (bcachefs) fix compiler warning [-Werror=sign-compare]
+    
+    Addresses: https://github.com/util-linux/util-linux/pull/2427
+    Signed-off-by: Karel Zak <kzak@redhat.com>
+    (cherry picked from commit 17873d38fc97913c0a31d4bd08cfbfe45c4de5be)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 236877042..6ab3fe9d4 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -311,7 +311,7 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
+-	if (sb_size > BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits)
++	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
+ 		return BLKID_PROBE_NONE;
+ 
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+
+commit 6b9fda87c4e5d0c6f945d7565197f157b9fa3d5f
+Author: Thomas Weißschuh <thomas@t-8ch.de>
+Date:   Wed Aug 23 11:58:33 2023 +0200
+
+    libblkid: (bcachefs) fix size validation
+    
+    Avoid signed shift out-of-bounds.
+    
+    Also mark the constants explitly as unsigned instead of casting.
+    
+    Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
+    (cherry picked from commit befe455f59de8c7bc66b85ed52aae8cbc95325fa)
+
+diff --git a/libblkid/src/superblocks/bcache.c b/libblkid/src/superblocks/bcache.c
+index 6ab3fe9d4..28ac4b52b 100644
+--- a/libblkid/src/superblocks/bcache.c
++++ b/libblkid/src/superblocks/bcache.c
+@@ -142,17 +142,19 @@ struct bcachefs_super_block {
+ /* magic string len */
+ #define BCACHE_SB_MAGIC_LEN (sizeof(BCACHE_SB_MAGIC) - 1)
+ /* super block offset */
+-#define BCACHE_SB_OFF       0x1000
++#define BCACHE_SB_OFF       0x1000U
+ /* supper block offset in kB */
+ #define BCACHE_SB_KBOFF     (BCACHE_SB_OFF >> 10)
+ /* magic string offset within super block */
+ #define BCACHE_SB_MAGIC_OFF offsetof(struct bcache_super_block, magic)
+ /* start of checksummed data within superblock */
+-#define BCACHE_SB_CSUMMED_START 8
++#define BCACHE_SB_CSUMMED_START 8U
+ /* granularity of offset and length fields within superblock */
+-#define BCACHEFS_SECTOR_SIZE   512
++#define BCACHEFS_SECTOR_SIZE   512U
++/* maximum superblock size shift */
++#define BCACHEFS_SB_MAX_SIZE_SHIFT   0x10U
+ /* maximum superblock size */
+-#define BCACHEFS_SB_MAX_SIZE   0x100000
++#define BCACHEFS_SB_MAX_SIZE   (1U << BCACHEFS_SB_MAX_SIZE_SHIFT)
+ /* fields offset within super block */
+ #define BCACHEFS_SB_FIELDS_OFF offsetof(struct bcachefs_super_block, _start)
+ /* tag value for members field */
+@@ -311,12 +313,16 @@ static int probe_bcachefs(blkid_probe pr, const struct blkid_idmag *mag)
+ 		return BLKID_PROBE_NONE;
+ 
+ 	sb_size = BCACHEFS_SB_FIELDS_OFF + BYTES(bcs);
+-	if (sb_size > ((uint64_t) BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
+-		return BLKID_PROBE_NONE;
+ 
+ 	if (sb_size > BCACHEFS_SB_MAX_SIZE)
+ 		return BLKID_PROBE_NONE;
+ 
++	if (bcs->layout.sb_max_size_bits > BCACHEFS_SB_MAX_SIZE_SHIFT)
++		return BLKID_PROBE_NONE;
++
++	if (sb_size > (BCACHEFS_SECTOR_SIZE << bcs->layout.sb_max_size_bits))
++		return BLKID_PROBE_NONE;
++
+ 	sb = blkid_probe_get_sb_buffer(pr, mag, sb_size);
+ 	if (!sb)
+ 		return BLKID_PROBE_NONE;
diff --git a/pkgs/os-specific/linux/util-linux/default.nix b/pkgs/os-specific/linux/util-linux/default.nix
index 73f321f2631..d710fabb7ac 100644
--- a/pkgs/os-specific/linux/util-linux/default.nix
+++ b/pkgs/os-specific/linux/util-linux/default.nix
@@ -1,28 +1,53 @@
-{ lib, stdenv, fetchurl, pkg-config, zlib, shadow, libcap_ng
-, ncurses ? null, perl ? null, pam, systemd ? null, minimal ? false }:
+{ lib, stdenv, fetchurl, pkg-config, zlib, shadow
+, capabilitiesSupport ? stdenv.isLinux
+, libcap_ng
+, libxcrypt
+, ncursesSupport ? true
+, ncurses
+, pamSupport ? true
+, pam
+, systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
+, systemd
+, nlsSupport ? true
+, translateManpages ? true
+, po4a
+, installShellFiles
+, writeSupport ? stdenv.isLinux
+, shadowSupport ? stdenv.isLinux
+, memstreamHook
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
-  pname = "util-linux";
-  version = "2.36.2";
+  pname = "util-linux" + lib.optionalString (!nlsSupport && !ncursesSupport && !systemdSupport) "-minimal";
+  version = "2.39.2";
 
   src = fetchurl {
-    url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0psc0asjp1rmfx1j7468zfnk9nphlphybw2n8dcl74v8v2lnnlgp";
+    url = "mirror://kernel/linux/utils/util-linux/v${lib.versions.majorMinor version}/util-linux-${version}.tar.xz";
+    hash = "sha256-h6vfqo5JD4vm3el298gLm1/58wHhtn44meHwWlmhUx8=";
   };
 
   patches = [
     ./rtcwake-search-PATH-for-shutdown.patch
+    ./bcachefs-patch-set.patch
   ];
 
-  outputs = [ "bin" "dev" "out" "man" ];
+  # We separate some of the utilities into their own outputs. This
+  # allows putting together smaller systems depending on only part of
+  # the greater util-linux toolset.
+  # Compatibility is maintained by symlinking the binaries from the
+  # smaller outputs in the bin output.
+  outputs = [ "bin" "dev" "out" "lib" "man" ] ++ lib.optionals stdenv.isLinux [ "mount" ] ++ [ "login" ] ++ lib.optionals stdenv.isLinux [ "swap" ];
+  separateDebugInfo = true;
 
   postPatch = ''
     patchShebangs tests/run.sh
 
-    substituteInPlace include/pathnames.h \
-      --replace "/bin/login" "${shadow}/bin/login"
     substituteInPlace sys-utils/eject.c \
       --replace "/bin/umount" "$bin/bin/umount"
+  '' + lib.optionalString shadowSupport ''
+    substituteInPlace include/pathnames.h \
+      --replace "/bin/login" "${shadow}/bin/login"
   '';
 
   # !!! It would be better to obtain the path to the mount helpers
@@ -30,38 +55,72 @@ stdenv.mkDerivation rec {
   # somewhat risky because we have to consider that mount can setuid
   # root...
   configureFlags = [
-    "--enable-write"
-    "--enable-last"
-    "--enable-mesg"
+    "--localstatedir=/var"
     "--disable-use-tty-group"
     "--enable-fs-paths-default=/run/wrappers/bin:/run/current-system/sw/bin:/sbin"
     "--disable-makeinstall-setuid" "--disable-makeinstall-chown"
     "--disable-su" # provided by shadow
-    (lib.withFeature (ncurses != null) "ncursesw")
-    (lib.withFeature (systemd != null) "systemd")
-    (lib.withFeatureAs (systemd != null)
+    (lib.enableFeature writeSupport "write")
+    (lib.enableFeature nlsSupport "nls")
+    (lib.withFeature ncursesSupport "ncursesw")
+    (lib.withFeature systemdSupport "systemd")
+    (lib.withFeatureAs systemdSupport
        "systemdsystemunitdir" "${placeholder "bin"}/lib/systemd/system/")
+    (lib.enableFeature translateManpages "poman")
+    "SYSCONFSTATICDIR=${placeholder "lib"}/lib"
   ] ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform)
        "scanf_cv_type_modifier=ms"
   ;
 
   makeFlags = [
     "usrbin_execdir=${placeholder "bin"}/bin"
+    "usrlib_execdir=${placeholder "lib"}/lib"
     "usrsbin_execdir=${placeholder "bin"}/sbin"
   ];
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs =
-    [ zlib pam libcap_ng ]
-    ++ lib.filter (p: p != null) [ ncurses systemd perl ];
+  nativeBuildInputs = [ pkg-config installShellFiles ]
+    ++ lib.optionals translateManpages [ po4a ];
+
+  buildInputs = [ zlib libxcrypt ]
+    ++ lib.optionals pamSupport [ pam ]
+    ++ lib.optionals capabilitiesSupport [ libcap_ng ]
+    ++ lib.optionals ncursesSupport [ ncurses ]
+    ++ lib.optionals systemdSupport [ systemd ]
+    ++ lib.optionals (stdenv.system == "x86_64-darwin") [ memstreamHook ];
 
   doCheck = false; # "For development purpose only. Don't execute on production system!"
 
-  postInstall = lib.optionalString minimal ''
-    rm -rf $out/share/{locale,doc,bash-completion}
+  enableParallelBuilding = true;
+
+  postInstall = lib.optionalString stdenv.isLinux ''
+    moveToOutput bin/mount "$mount"
+    moveToOutput bin/umount "$mount"
+    ln -svf "$mount/bin/"* $bin/bin/
+    '' + ''
+
+    moveToOutput sbin/nologin "$login"
+    moveToOutput sbin/sulogin "$login"
+    prefix=$login _moveSbin
+    ln -svf "$login/bin/"* $bin/bin/
+    '' + lib.optionalString stdenv.isLinux ''
+
+    moveToOutput sbin/swapon "$swap"
+    moveToOutput sbin/swapoff "$swap"
+    prefix=$swap _moveSbin
+    ln -svf "$swap/bin/"* $bin/bin/
+    '' + ''
+
+    installShellCompletion --bash bash-completion/*
   '';
 
-  enableParallelBuilding = true;
+  passthru = {
+    updateScript = gitUpdater {
+      # No nicer place to find latest release.
+      url = "https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git";
+      rev-prefix = "v";
+      ignoredVersions = "(-rc).*";
+    };
+  };
 
   meta = with lib; {
     homepage = "https://www.kernel.org/pub/linux/utils/util-linux/";
@@ -69,7 +128,14 @@ stdenv.mkDerivation rec {
     changelog = "https://mirrors.edge.kernel.org/pub/linux/utils/util-linux/v${lib.versions.majorMinor version}/v${version}-ReleaseNotes";
     # https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/README.licensing
     license = with licenses; [ gpl2Only gpl2Plus gpl3Plus lgpl21Plus bsd3 bsdOriginalUC publicDomain ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
+    pkgConfigModules = [
+      "blkid"
+      "fdisk"
+      "mount"
+      "smartcols"
+      "uuid"
+    ];
     priority = 6; # lower priority than coreutils ("kill") and shadow ("login" etc.) packages
   };
 }
diff --git a/pkgs/os-specific/linux/uvcdynctrl/default.nix b/pkgs/os-specific/linux/uvcdynctrl/default.nix
index d5f3a729978..8fa91e158e1 100644
--- a/pkgs/os-specific/linux/uvcdynctrl/default.nix
+++ b/pkgs/os-specific/linux/uvcdynctrl/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "A simple interface for devices supported by the linux UVC driver";
-    homepage = "http://guvcview.sourceforge.net";
+    homepage = "https://guvcview.sourceforge.net";
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.puffnfresh ];
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/v4l-utils/default.nix b/pkgs/os-specific/linux/v4l-utils/default.nix
index 90a052fdef9..87fd282f696 100644
--- a/pkgs/os-specific/linux/v4l-utils/default.nix
+++ b/pkgs/os-specific/linux/v4l-utils/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, pkg-config, perl
-, libjpeg, udev
+, argp-standalone, libjpeg, udev
 , withUtils ? true
 , withGUI ? true, alsa-lib, libX11, qtbase, libGLU, wrapQtAppsHook
 }:
@@ -12,11 +12,11 @@ let
 # we need to use stdenv.mkDerivation in order not to pollute the libv4l’s closure with Qt
 in stdenv.mkDerivation rec {
   pname = "v4l-utils";
-  version = "1.20.0";
+  version = "1.24.1";
 
   src = fetchurl {
     url = "https://linuxtv.org/downloads/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "1xr66y6w422hil6s7n8d61a2vhwh4im8l267amf41jvw7xqihqcm";
+    hash = "sha256-y7f+imMH9c5TOgXN7XC7k8O6BjlaubbQB+tTt12AX1s=";
   };
 
   outputs = [ "out" ] ++ lib.optional withUtils "lib" ++ [ "dev" ];
@@ -35,19 +35,23 @@ in stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config perl ] ++ lib.optional withQt wrapQtAppsHook;
 
-  buildInputs = [ udev ] ++ lib.optionals withQt [ alsa-lib libX11 qtbase libGLU ];
+  buildInputs = [ udev ]
+    ++ lib.optional (!stdenv.hostPlatform.isGnu) argp-standalone
+    ++ lib.optionals withQt [ alsa-lib libX11 qtbase libGLU ];
 
   propagatedBuildInputs = [ libjpeg ];
 
   postPatch = ''
-    patchShebangs utils/cec-ctl/msg2ctl.pl
-    patchShebangs utils/libcecutil/cec-gen.pl
+    patchShebangs utils/
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "V4L utils and libv4l, provide common image formats regardless of the v4l device";
     homepage = "https://linuxtv.org/projects.php";
-    license = licenses.lgpl21Plus;
+    changelog = "https://git.linuxtv.org/v4l-utils.git/plain/ChangeLog?h=v4l-utils-${version}";
+    license = with licenses; [ lgpl21Plus gpl2Plus ];
     maintainers = with maintainers; [ codyopel ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/v4l2-relayd/default.nix b/pkgs/os-specific/linux/v4l2-relayd/default.nix
new file mode 100644
index 00000000000..a089ce8c77f
--- /dev/null
+++ b/pkgs/os-specific/linux/v4l2-relayd/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, stdenv
+, fetchgit
+, autoreconfHook
+, glib
+, gst_all_1
+, libtool
+, pkg-config
+, which
+}:
+stdenv.mkDerivation rec {
+  pname = "v4l2-relayd";
+  version = "0.1.3";
+
+  src = fetchgit {
+    url = "https://git.launchpad.net/v4l2-relayd";
+    rev = "refs/tags/upstream/${version}";
+    hash = "sha256-oU6naDFZ0PQVHZ3brANfMULDqYMYxeJN+MCUCvN/DpU=";
+  };
+
+  patches = [
+    ./upstream-v4l2loopback-compatibility.patch
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    libtool
+    pkg-config
+    which
+  ];
+
+  buildInputs = [
+    glib
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+  ];
+
+  preConfigure = "./autogen.sh --prefix=$out";
+
+  meta = with lib; {
+    description = "Streaming relay for v4l2loopback using GStreamer";
+    homepage = "https://git.launchpad.net/v4l2-relayd";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ betaboon ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/os-specific/linux/v4l2-relayd/upstream-v4l2loopback-compatibility.patch b/pkgs/os-specific/linux/v4l2-relayd/upstream-v4l2loopback-compatibility.patch
new file mode 100644
index 00000000000..64353522825
--- /dev/null
+++ b/pkgs/os-specific/linux/v4l2-relayd/upstream-v4l2loopback-compatibility.patch
@@ -0,0 +1,16 @@
+diff --git a/src/v4l2-relayd.c b/src/v4l2-relayd.c
+index 21bb0d5..cfc9e27 100644
+--- a/src/v4l2-relayd.c
++++ b/src/v4l2-relayd.c
+@@ -27,7 +27,10 @@
+ #include <gst/app/gstappsrc.h>
+ #include <gst/video/video-info.h>
+ 
+-#define V4L2_EVENT_PRI_CLIENT_USAGE  V4L2_EVENT_PRIVATE_START
++#define V4L2LOOPBACK_EVENT_BASE (V4L2_EVENT_PRIVATE_START)
++#define V4L2LOOPBACK_EVENT_OFFSET 0x08E00000
++#define V4L2_EVENT_PRI_CLIENT_USAGE \
++	(V4L2LOOPBACK_EVENT_BASE + V4L2LOOPBACK_EVENT_OFFSET + 1)
+ 
+ struct v4l2_event_client_usage {
+   __u32 count;
diff --git a/pkgs/os-specific/linux/v4l2loopback/default.nix b/pkgs/os-specific/linux/v4l2loopback/default.nix
index 53f37e805fa..e17fda67218 100644
--- a/pkgs/os-specific/linux/v4l2loopback/default.nix
+++ b/pkgs/os-specific/linux/v4l2loopback/default.nix
@@ -2,28 +2,36 @@
 
 stdenv.mkDerivation rec {
   pname = "v4l2loopback";
-  version = "unstable-2020-04-22-${kernel.version}";
+  version = "unstable-2023-02-19-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "umlaeute";
     repo = "v4l2loopback";
-    rev = "d26e624b4ead762d34152f9f825b3a51fb92fb9c";
-    sha256 = "sha256-OA45vmuVieoL7J83D3TD5qi3SBsiqi0kiQn4i1K6dVE=";
+    rev = "fb410fc7af40e972058809a191fae9517b9313af";
+    hash = "sha256-gLFtR7s+3LUQ0BZxHbmaArHbufuphbtAX99nxJU3c84=";
   };
 
+  patches = [
+    # fix bug https://github.com/umlaeute/v4l2loopback/issues/535
+    ./revert-pr518.patch
+  ];
+
   hardeningDisable = [ "format" "pic" ];
 
   preBuild = ''
     substituteInPlace Makefile --replace "modules_install" "INSTALL_MOD_PATH=$out modules_install"
     sed -i '/depmod/d' Makefile
-    export PATH=${kmod}/sbin:$PATH
   '';
 
-  nativeBuildInputs = kernel.moduleBuildDependencies;
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  postInstall = ''
+    make install-utils PREFIX=$bin
+  '';
 
-  buildInputs = [ kmod ];
+  outputs = [ "out" "bin" ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "KERNELRELEASE=${kernel.modDirVersion}"
     "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ];
@@ -32,7 +40,8 @@ stdenv.mkDerivation rec {
     description = "A kernel module to create V4L2 loopback devices";
     homepage = "https://github.com/umlaeute/v4l2loopback";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ fortuneteller2k ];
+    maintainers = with maintainers; [ moni ];
     platforms = platforms.linux;
+    outputsToInstall = [ "out" ];
   };
 }
diff --git a/pkgs/os-specific/linux/v4l2loopback/revert-pr518.patch b/pkgs/os-specific/linux/v4l2loopback/revert-pr518.patch
new file mode 100644
index 00000000000..d5d2564c32c
--- /dev/null
+++ b/pkgs/os-specific/linux/v4l2loopback/revert-pr518.patch
@@ -0,0 +1,55 @@
+diff --git a/v4l2loopback.c b/v4l2loopback.c
+index 2ab1f76..2514f09 100644
+--- a/v4l2loopback.c
++++ b/v4l2loopback.c
+@@ -92,17 +92,6 @@ MODULE_LICENSE("GPL");
+ 		}                                                      \
+ 	} while (0)
+ 
+-/* TODO: Make sure that function is never interrupted. */
+-static inline int mod_inc(int *number, int mod)
+-{
+-	int result;
+-	result = (*number + 1) % mod;
+-	if (unlikely(result < 0))
+-		result += mod;
+-	*number = result;
+-	return result;
+-}
+-
+ static inline void v4l2l_get_timestamp(struct v4l2_buffer *b)
+ {
+ 	/* ktime_get_ts is considered deprecated, so use ktime_get_ts64 if possible */
+@@ -1424,8 +1413,9 @@ static int vidioc_reqbufs(struct file *file, void *fh,
+ 			i = dev->write_position;
+ 			list_for_each_entry(pos, &dev->outbufs_list,
+ 					    list_head) {
+-				dev->bufpos2index[mod_inc(&i, b->count)] =
++				dev->bufpos2index[i % b->count] =
+ 					pos->buffer.index;
++				++i;
+ 			}
+ 		}
+ 
+@@ -1489,9 +1479,10 @@ static void buffer_written(struct v4l2_loopback_device *dev,
+ 	del_timer_sync(&dev->timeout_timer);
+ 	spin_lock_bh(&dev->lock);
+ 
+-	dev->bufpos2index[mod_inc(&dev->write_position, dev->used_buffers)] =
++	dev->bufpos2index[dev->write_position % dev->used_buffers] =
+ 		buf->buffer.index;
+ 	list_move_tail(&buf->list_head, &dev->outbufs_list);
++	++dev->write_position;
+ 	dev->reread_count = 0;
+ 
+ 	check_timers(dev);
+@@ -1586,7 +1577,8 @@ static int get_capture_buffer(struct file *file)
+ 		if (dev->write_position >
+ 		    opener->read_position + dev->used_buffers)
+ 			opener->read_position = dev->write_position - 1;
+-		pos = mod_inc(&opener->read_position, dev->used_buffers);
++		pos = opener->read_position % dev->used_buffers;
++		++opener->read_position;
+ 	}
+ 	timeout_happened = dev->timeout_happened;
+ 	dev->timeout_happened = 0;
diff --git a/pkgs/os-specific/linux/v86d/default.nix b/pkgs/os-specific/linux/v86d/default.nix
index 36270cdfcc0..dbc98344c5e 100644
--- a/pkgs/os-specific/linux/v86d/default.nix
+++ b/pkgs/os-specific/linux/v86d/default.nix
@@ -1,14 +1,21 @@
-{ lib, stdenv, fetchurl
-, kernel, klibc
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+, klibc
 }:
 
-stdenv.mkDerivation rec {
-  name = "v86d-${version}-${kernel.version}";
-  version = "0.1.10";
-
-  src = fetchurl {
-    url = "https://github.com/mjanusz/v86d/archive/v86d-${version}.tar.gz";
-    sha256 = "1flnpp8rc945cxr6jr9dlm8mi8gr181zrp2say4269602s1a4ymg";
+let
+  pversion = "0.1.10";
+in stdenv.mkDerivation rec {
+  pname = "v86d";
+  version = "${pversion}-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "mjanusz";
+    repo = "v86d";
+    rev = "v86d-${pversion}";
+    hash = "sha256-95LRzVbO/DyddmPwQNNQ290tasCGoQk7FDHlst6LkbA=";
   };
 
   patchPhase = ''
diff --git a/pkgs/os-specific/linux/vdo/default.nix b/pkgs/os-specific/linux/vdo/default.nix
new file mode 100644
index 00000000000..11597c9ed65
--- /dev/null
+++ b/pkgs/os-specific/linux/vdo/default.nix
@@ -0,0 +1,65 @@
+{ lib, stdenv
+, fetchFromGitHub
+, installShellFiles
+, libuuid
+, lvm2_dmeventd  # <libdevmapper-event.h>
+, zlib
+, python3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "vdo";
+  version = "8.2.2.2";  # bump this version with kvdo
+
+  src = fetchFromGitHub {
+    owner = "dm-vdo";
+    repo = pname;
+    rev = version;
+    hash = "sha256-+2w9jzJemI2xr+i/Jd5TIBZ/o8Zv+Ett0fbJbkOD7KI=";
+  };
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  buildInputs = [
+    libuuid
+    lvm2_dmeventd
+    zlib
+    python3.pkgs.wrapPython
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pyyaml
+  ];
+
+  pythonPath = propagatedBuildInputs;
+
+  makeFlags = [
+    "DESTDIR=${placeholder "out"}"
+    "INSTALLOWNER="
+    # all of these paths are relative to DESTDIR and have defaults that don't work for us
+    "bindir=/bin"
+    "defaultdocdir=/share/doc"
+    "mandir=/share/man"
+    "python3_sitelib=${python3.sitePackages}"
+  ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    installShellCompletion --bash $out/bash_completion.d/*
+    rm -r $out/bash_completion.d
+
+    wrapPythonPrograms
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/dm-vdo/vdo";
+    description = "A set of userspace tools for managing pools of deduplicated and/or compressed block storage";
+    # platforms are defined in https://github.com/dm-vdo/vdo/blob/master/utils/uds/atomicDefs.h
+    platforms = [ "x86_64-linux" "aarch64-linux" "s390-linux" "powerpc64-linux" "powerpc64le-linux" ];
+    license = with licenses; [ gpl2Plus ];
+    maintainers = with maintainers; [ ajs124 ];
+  };
+}
diff --git a/pkgs/os-specific/linux/veikk-linux-driver/default.nix b/pkgs/os-specific/linux/veikk-linux-driver/default.nix
index a1019d7b7fd..8cf4896ae02 100644
--- a/pkgs/os-specific/linux/veikk-linux-driver/default.nix
+++ b/pkgs/os-specific/linux/veikk-linux-driver/default.nix
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ kernel ];
 
-  buildPhase = ''
-    make BUILD_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build
-  '';
+  makeFlags = kernel.makeFlags ++ [
+    "BUILD_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
 
   installPhase = ''
     mkdir -p $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/veikk
diff --git a/pkgs/os-specific/linux/vendor-reset/default.nix b/pkgs/os-specific/linux/vendor-reset/default.nix
index 8f1bde7ecbd..f4430f3224a 100644
--- a/pkgs/os-specific/linux/vendor-reset/default.nix
+++ b/pkgs/os-specific/linux/vendor-reset/default.nix
@@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub, kernel, lib }:
+{ stdenv, fetchFromGitHub, fetchpatch, kernel, lib }:
 
 stdenv.mkDerivation rec {
-  name = "vendor-reset-${version}-${kernel.version}";
-  version = "unstable-2021-02-16";
+  pname = "vendor-reset";
+  version = "unstable-2021-02-16-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "gnif";
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-xa7P7+mRk4FVgi+YYCcsFLfyNqPmXvy3xhGoTDVqPxw=";
   };
 
+  patches = [
+    # Fix build with Linux 5.18.
+    # https://github.com/gnif/vendor-reset/pull/58
+    (fetchpatch {
+      url = "https://github.com/gnif/vendor-reset/commit/5bbffcd6fee5348e8808bdbfcb5b21d455b02f55.patch";
+      sha256 = "sha256-L1QxVpcZAVYiaMFCBfL2EJgeMyOR8sDa1UqF1QB3bns=";
+    })
+  ];
+
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
   hardeningDisable = [ "pic" ];
@@ -24,11 +33,13 @@ stdenv.mkDerivation rec {
     install -D vendor-reset.ko -t "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/misc/"
   '';
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     description = "Linux kernel vendor specific hardware reset module";
     homepage = "https://github.com/gnif/vendor-reset";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ wedens ];
+    maintainers = with maintainers; [ ];
     platforms = [ "x86_64-linux" ];
     broken = kernel.kernelOlder "4.19";
   };
diff --git a/pkgs/os-specific/linux/virtio_vmmci/default.nix b/pkgs/os-specific/linux/virtio_vmmci/default.nix
new file mode 100644
index 00000000000..7c6d57273be
--- /dev/null
+++ b/pkgs/os-specific/linux/virtio_vmmci/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, lib, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  name = "virtio_vmmci";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "voutilad";
+    repo = "virtio_vmmci";
+    rev = version;
+    hash = "sha256-ZHslYYZFjM3wp0W5J3/WwCtQ2wDzT1jNc26Z/giTC8g=";
+  };
+
+  hardeningDisable = [ "pic" "format" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  extraConfig = ''
+    CONFIG_RTC_HCTOSYS yes
+  '';
+
+  makeFlags = kernel.makeFlags ++ [
+    "DEPMOD=echo"
+    "INSTALL_MOD_PATH=$(out)"
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  meta = with lib; {
+    description = "An OpenBSD VMM Control Interface (vmmci) for Linux";
+    homepage = "https://github.com/voutilad/virtio_vmmci";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ qbit ];
+    platforms = platforms.linux;
+  };
+
+  enableParallelBuilding = true;
+}
diff --git a/pkgs/os-specific/linux/virtualbox/default.nix b/pkgs/os-specific/linux/virtualbox/default.nix
index f795d36207a..3aae58933c8 100644
--- a/pkgs/os-specific/linux/virtualbox/default.nix
+++ b/pkgs/os-specific/linux/virtualbox/default.nix
@@ -1,7 +1,8 @@
 { stdenv, virtualbox, kernel }:
 
 stdenv.mkDerivation {
-  name = "virtualbox-modules-${virtualbox.version}-${kernel.version}";
+  pname = "virtualbox-modules";
+  version = "${virtualbox.version}-${kernel.version}";
   src = virtualbox.modsrc;
   hardeningDisable = [
     "fortify" "pic" "stackprotector"
diff --git a/pkgs/os-specific/linux/vm-tools/default.nix b/pkgs/os-specific/linux/vm-tools/default.nix
new file mode 100644
index 00000000000..c5981bfc271
--- /dev/null
+++ b/pkgs/os-specific/linux/vm-tools/default.nix
@@ -0,0 +1,16 @@
+{ lib, stdenv, linux }:
+
+stdenv.mkDerivation {
+  pname = "vm-tools";
+  inherit (linux) version src;
+
+  makeFlags = [ "sbindir=${placeholder "out"}/bin" ];
+
+  preConfigure = "cd tools/vm";
+
+  meta = with lib; {
+    inherit (linux.meta) license platforms;
+    description = "Set of virtual memory tools";
+    maintainers = [ maintainers.evils ];
+  };
+}
diff --git a/pkgs/os-specific/linux/vmm_clock/default.nix b/pkgs/os-specific/linux/vmm_clock/default.nix
new file mode 100644
index 00000000000..7ce99f40df1
--- /dev/null
+++ b/pkgs/os-specific/linux/vmm_clock/default.nix
@@ -0,0 +1,38 @@
+{ stdenv, lib, fetchFromGitHub, kernel }:
+
+stdenv.mkDerivation rec {
+  pname = "vmm_clock";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "voutilad";
+    repo = "vmm_clock";
+    rev = version;
+    hash = "sha256-8z/N/dbkeFd40sH7jatNmSS62B88tC0jVgNljhxslOo=";
+  };
+
+  hardeningDisable = [ "pic" "format" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  extraConfig = ''
+    CONFIG_RTC_HCTOSYS yes
+  '';
+
+  makeFlags = kernel.makeFlags ++ [
+    "DEPMOD=echo"
+    "INSTALL_MOD_PATH=$(out)"
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  meta = with lib; {
+    description =
+      "Experimental implementation of a kvmclock-derived clocksource for Linux guests under OpenBSD's hypervisor";
+    homepage = "https://github.com/voutilad/vmm_clock";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ qbit ];
+    platforms = [ "i686-linux" "x86_64-linux" ];
+  };
+
+  enableParallelBuilding = true;
+}
diff --git a/pkgs/os-specific/linux/vmware/default.nix b/pkgs/os-specific/linux/vmware/default.nix
new file mode 100644
index 00000000000..7c1994687ae
--- /dev/null
+++ b/pkgs/os-specific/linux/vmware/default.nix
@@ -0,0 +1,47 @@
+{ lib, stdenv, fetchFromGitHub, kernel, kmod, gnugrep }:
+
+stdenv.mkDerivation rec {
+  pname = "vmware-modules";
+  version = "workstation-17.0.2-2023-09-29-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "mkubecek";
+    repo = "vmware-host-modules";
+    # Developer no longer provides tags for kernel compatibility fixes
+    # Commit hash for branch workstation-17.0.2 as of 2023-09-29
+    rev = "29de7e2bd45d32e6983106d6f15810c70ba3e654";
+    hash = "sha256-l0QJbjySINM/7EyNhZl6UnUonwPoGnCnsQeC8YtI15c=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  enableParallelBuilding = true;
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace '/lib/modules/$(VM_UNAME)/misc' "$out/lib/modules/${kernel.modDirVersion}/misc" \
+      --replace /sbin/modinfo "${kmod}/bin/modinfo" \
+      --replace 'test -z "$(DESTDIR)"' "0"
+
+    for module in "vmmon-only" "vmnet-only"; do
+      substituteInPlace "./$module/Makefile" \
+        --replace '/lib/modules/' "${kernel.dev}/lib/modules/" \
+        --replace /bin/grep "${gnugrep}/bin/grep"
+    done
+  '';
+
+  preInstall = ''
+    mkdir -p "$out/lib/modules/${kernel.modDirVersion}/misc"
+  '';
+
+  meta = with lib; {
+    description = "Kernel modules needed for VMware hypervisor";
+    homepage = "https://github.com/mkubecek/vmware-host-modules";
+    license = licenses.gpl2Only;
+    platforms = [ "x86_64-linux" ];
+    broken = (kernel.kernelOlder "5.5" && kernel.isHardened);
+    maintainers = with maintainers; [ deinferno ];
+  };
+}
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
new file mode 100644
index 00000000000..2cf6e0c47e4
--- /dev/null
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -0,0 +1,88 @@
+{ lib
+, fetchFromGitHub
+, python3Packages
+, dnsmasq
+, gawk
+, getent
+, gobject-introspection
+, gtk3
+, kmod
+, lxc
+, iproute2
+, iptables
+, util-linux
+, wrapGAppsHook
+, xclip
+, runtimeShell
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "waydroid";
+  version = "1.4.1";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-0AkNzMIumvgnVcLKX72E2+Eg54Y9j7tdIYPsroOTLWA=";
+  };
+
+  buildInputs = [
+    gtk3
+  ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    dbus-python
+    gbinder-python
+    pyclip
+    pygobject3
+  ];
+
+  dontUseSetuptoolsBuild = true;
+  dontUsePipInstall = true;
+  dontUseSetuptoolsCheck = true;
+  dontWrapPythonPrograms = true;
+  dontWrapGApps = true;
+
+  installPhase = ''
+    make install PREFIX=$out USE_SYSTEMD=0
+  '';
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+
+    patchShebangs --host $out/lib/waydroid/data/scripts
+    wrapProgram $out/lib/waydroid/data/scripts/waydroid-net.sh \
+      --prefix PATH ":" ${lib.makeBinPath [ dnsmasq getent iproute2 iptables ]}
+
+    wrapPythonProgramsIn $out/lib/waydroid/ "${lib.concatStringsSep " " [
+      "$out"
+      python3Packages.dbus-python
+      python3Packages.gbinder-python
+      python3Packages.pygobject3
+      python3Packages.pyclip
+      gawk
+      kmod
+      lxc
+      util-linux
+      xclip
+    ]}"
+
+    substituteInPlace $out/lib/waydroid/tools/helpers/*.py \
+      --replace '"sh"' '"${runtimeShell}"'
+  '';
+
+  meta = with lib; {
+    description = "Waydroid is a container-based approach to boot a full Android system on a regular GNU/Linux system like Ubuntu";
+    homepage = "https://github.com/waydroid/waydroid";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mcaju ];
+  };
+}
diff --git a/pkgs/os-specific/linux/wireguard/default.nix b/pkgs/os-specific/linux/wireguard/default.nix
index e183b4ac5d4..8d8342cce98 100644
--- a/pkgs/os-specific/linux/wireguard/default.nix
+++ b/pkgs/os-specific/linux/wireguard/default.nix
@@ -1,17 +1,15 @@
 { lib, stdenv, fetchzip, kernel, perl, wireguard-tools, bc }:
 
-# module requires Linux >= 3.10 https://www.wireguard.io/install/#kernel-requirements
-assert lib.versionAtLeast kernel.version "3.10";
 # wireguard upstreamed since 5.6 https://lists.zx2c4.com/pipermail/wireguard/2019-December/004704.html
 assert lib.versionOlder kernel.version "5.6";
 
 stdenv.mkDerivation rec {
   pname = "wireguard";
-  version = "1.0.20210606";
+  version = "1.0.20220627";
 
   src = fetchzip {
     url = "https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${version}.tar.xz";
-    sha256 = "sha256-ha7x6+41oPRRhuRwEb1ojRWLF1dlEMoJtqXrzRKQ408=";
+    sha256 = "sha256-skbho3e49lZ/GLp/JDQpf/yXIEjes86aYtw/dn6e0Uo=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -22,6 +20,11 @@ stdenv.mkDerivation rec {
 
   preBuild = "cd src";
   buildFlags = [ "module" ];
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.linuxArch}"
+  ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
 
   INSTALL_MOD_PATH = placeholder "out";
   installFlags = [ "DEPMOD=true" ];
@@ -36,6 +39,10 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     inherit (wireguard-tools.meta) homepage license maintainers;
     description = "Kernel module for the WireGuard secure network tunnel";
+    longDescription = ''
+      Backport of WireGuard for kernels 3.10 to 5.5, as an out of tree module.
+      (as WireGuard was merged into the Linux kernel for 5.6)
+    '';
     downloadPage = "https://git.zx2c4.com/wireguard-linux-compat/refs/";
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/wireless-tools/default.nix b/pkgs/os-specific/linux/wireless-tools/default.nix
index fbe5d95e2a6..e95506461a4 100644
--- a/pkgs/os-specific/linux/wireless-tools/default.nix
+++ b/pkgs/os-specific/linux/wireless-tools/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "30.pre9";
 
   src = fetchurl {
-    url = "http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.${version}.tar.gz";
+    url = "https://hewlettpackard.github.io/wireless-tools/wireless_tools.${version}.tar.gz";
     sha256 = "0qscyd44jmhs4k32ggp107hlym1pcyjzihiai48xs7xzib4wbndb";
   };
 
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
+    description = "Wireless tools for Linux";
+    homepage = "https://hewlettpackard.github.io/wireless-tools/Tools.html";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2;
   };
diff --git a/pkgs/os-specific/linux/wiringpi/default.nix b/pkgs/os-specific/linux/wiringpi/default.nix
new file mode 100644
index 00000000000..bc80e2a3354
--- /dev/null
+++ b/pkgs/os-specific/linux/wiringpi/default.nix
@@ -0,0 +1,84 @@
+{ lib
+, stdenv
+, symlinkJoin
+, fetchFromGitHub
+, libxcrypt
+}:
+
+let
+  version = "2.61-1";
+  mkSubProject = { subprj # The only mandatory argument
+  , buildInputs ? []
+  , src ? fetchFromGitHub {
+    owner = "WiringPi";
+    repo = "WiringPi";
+    rev = version;
+    sha256 = "sha256-VxAaPhaPXd9xYt663Ju6SLblqiSLizauhhuFqCqbO5M=";
+  }
+  }: stdenv.mkDerivation (finalAttrs: {
+    pname = "wiringpi-${subprj}";
+    inherit version src;
+    sourceRoot = "${src.name}/${subprj}";
+    inherit buildInputs;
+    # Remove (meant for other OSs) lines from Makefiles
+    preInstall = ''
+      sed -i "/chown root/d" Makefile
+      sed -i "/chmod/d" Makefile
+    '';
+    makeFlags = [
+      "DESTDIR=${placeholder "out"}"
+      "PREFIX=/."
+      # On NixOS we don't need to run ldconfig during build:
+      "LDCONFIG=echo"
+    ];
+  });
+  passthru = {
+    inherit mkSubProject;
+    wiringPi = mkSubProject {
+      subprj = "wiringPi";
+      buildInputs = [
+        libxcrypt
+      ];
+    };
+    devLib = mkSubProject {
+      subprj = "devLib";
+      buildInputs = [
+        passthru.wiringPi
+      ];
+    };
+    wiringPiD = mkSubProject {
+      subprj = "wiringPiD";
+      buildInputs = [
+        libxcrypt
+        passthru.wiringPi
+        passthru.devLib
+      ];
+    };
+    gpio = mkSubProject {
+      subprj = "gpio";
+      buildInputs = [
+        libxcrypt
+        passthru.wiringPi
+        passthru.devLib
+      ];
+    };
+  };
+in
+
+symlinkJoin {
+  name = "wiringpi-${version}";
+  inherit passthru;
+  paths = [
+    passthru.wiringPi
+    passthru.devLib
+    passthru.wiringPiD
+    passthru.gpio
+  ];
+  meta = with lib; {
+    description = "Gordon's Arduino wiring-like WiringPi Library for the Raspberry Pi (Unofficial Mirror for WiringPi bindings)";
+    homepage = "https://github.com/WiringPi/WiringPi";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ doronbehar ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/os-specific/linux/wlgreet/default.nix b/pkgs/os-specific/linux/wlgreet/default.nix
deleted file mode 100644
index 4758945e41a..00000000000
--- a/pkgs/os-specific/linux/wlgreet/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, rustPlatform
-, fetchFromSourcehut
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "wlgreet";
-  version = "0.3";
-
-  src = fetchFromSourcehut {
-    owner = "~kennylevinsen";
-    repo = pname;
-    rev = version;
-    sha256 = "0n0lzg3y1z5s9s6kfkdj5q8w67bqpw08hqfccc5kz0ninzy9j0cc";
-  };
-
-  cargoSha256 = "1lwy8xmkl9n3fj3wlf80wp728nn9p5rjnbgmm2cbpqxklcgbmxhm";
-
-  meta = with lib; {
-    description = "Raw wayland greeter for greetd, to be run under sway or similar";
-    homepage = "https://git.sr.ht/~kennylevinsen/wlgreet";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/wooting-udev-rules/default.nix b/pkgs/os-specific/linux/wooting-udev-rules/default.nix
index f1ae2069235..8231e3e3ea3 100644
--- a/pkgs/os-specific/linux/wooting-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/wooting-udev-rules/default.nix
@@ -2,9 +2,9 @@
 
 stdenv.mkDerivation rec {
   pname = "wooting-udev-rules";
-  version = "20190601";
+  version = "unstable-2023-03-31";
 
-  # Source: https://wooting.helpscoutdocs.com/article/68-wootility-configuring-device-access-for-wootility-under-linux-udev-rules
+  # Source: https://help.wooting.io/en/article/wootility-configuring-device-access-for-wootility-under-linux-udev-rules-r6lb2o/
   src = [ ./wooting.rules ];
 
   dontUnpack = true;
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://wooting.helpscoutdocs.com/article/34-linux-udev-rules";
+    homepage = "https://help.wooting.io/en/article/wootility-configuring-device-access-for-wootility-under-linux-udev-rules-r6lb2o/";
     description = "udev rules that give NixOS permission to communicate with Wooting keyboards";
     platforms = platforms.linux;
     license = "unknown";
diff --git a/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules b/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
index d906df3d4c6..365627fa1ae 100644
--- a/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
+++ b/pkgs/os-specific/linux/wooting-udev-rules/wooting.rules
@@ -1,9 +1,96 @@
-# Wooting One
+# Wooting One Legacy
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff01", MODE:="0660", GROUP="input"
 # Wooting One update mode
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2402", MODE:="0660", GROUP="input"
 
-# Wooting Two
+# Wooting Two Legacy
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="ff02", MODE:="0660", GROUP="input"
 # Wooting Two update mode
 SUBSYSTEM=="hidraw", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2403", MODE:="0660", GROUP="input"
+
+# Wooting One
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1100", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1100", MODE:="0660", GROUP="input"
+# Wooting One Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1101", MODE:="0660", GROUP="input"
+# Wooting One 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1102", MODE:="0660", GROUP="input"
+
+# Wooting Two
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1200", MODE:="0660", GROUP="input"
+# Wooting Two Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1201", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1201", MODE:="0660", GROUP="input"
+# Wooting Two 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1202", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1202", MODE:="0660", GROUP="input"
+
+# Wooting Lekker
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1210", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1210", MODE:="0660", GROUP="input"
+# Wooting Lekker Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1211", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1211", MODE:="0660", GROUP="input"
+# Wooting Lekker 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1212", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1212", MODE:="0660", GROUP="input"
+
+# Wooting Lekker update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="121f", MODE:="0660", GROUP="input"
+
+# Wooting Two HE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1220", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1220", MODE:="0660", GROUP="input"
+# Wooting Two HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1221", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1221", MODE:="0660", GROUP="input"
+# Wooting Two HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1222", MODE:="0660", GROUP="input"
+
+# Wooting Two HE update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="122f", MODE:="0660", GROUP="input"
+
+# Wooting Two HE (ARM)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1230", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1230", MODE:="0660", GROUP="input"
+# Wooting Two HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1231", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1231", MODE:="0660", GROUP="input"
+# Wooting Two HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1232", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1232", MODE:="0660", GROUP="input"
+
+# Wooting Two HE (ARM) update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="123f", MODE:="0660", GROUP="input"
+
+# Wooting 60HE
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1300", MODE:="0660", GROUP="input"
+# Wooting 60HE Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1301", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1301", MODE:="0660", GROUP="input"
+# Wooting 60HE 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1302", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1302", MODE:="0660", GROUP="input"
+
+# Wooting 60HE update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="130f", MODE:="0660", GROUP="input"
+
+# Wooting 60HE (ARM)
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1310", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1310", MODE:="0660", GROUP="input"
+# Wooting 60HE (ARM) Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1311", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1311", MODE:="0660", GROUP="input"
+# Wooting 60HE (ARM) 2nd Alt-gamepad mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1312", MODE:="0660", GROUP="input"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="1312", MODE:="0660", GROUP="input"
+
+# Wooting 60HE (ARM) update mode
+SUBSYSTEM=="hidraw", ATTRS{idVendor}=="31e3", ATTRS{idProduct}=="131f", MODE:="0660", GROUP="input"
diff --git a/pkgs/os-specific/linux/wpa_supplicant/Use-unique-IDs-for-networks-and-credentials.patch b/pkgs/os-specific/linux/wpa_supplicant/Use-unique-IDs-for-networks-and-credentials.patch
new file mode 100644
index 00000000000..09e5b3673ac
--- /dev/null
+++ b/pkgs/os-specific/linux/wpa_supplicant/Use-unique-IDs-for-networks-and-credentials.patch
@@ -0,0 +1,32 @@
+The id and cred_id variables are reset to 0 every time the
+wpa_config_read function is called, which is fine as long as it is only
+called once. However, this is not the case when using both the -c and -I
+options to specify two config files.
+
+This is a problem because the GUI, since eadfeb0e93748eb396ae62012b92d21a7f533646,
+relies on the network IDs being unique (and increasing), and might get
+into an infinite loop otherwise.
+
+This is solved by simply making the variables static.
+---
+ wpa_supplicant/config_file.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/wpa_supplicant/config_file.c b/wpa_supplicant/config_file.c
+index 6db5010db..c996e3916 100644
+--- a/wpa_supplicant/config_file.c
++++ b/wpa_supplicant/config_file.c
+@@ -297,8 +297,8 @@ struct wpa_config * wpa_config_read(const char *name, struct wpa_config *cfgp)
+ 	struct wpa_ssid *ssid, *tail, *head;
+ 	struct wpa_cred *cred, *cred_tail, *cred_head;
+ 	struct wpa_config *config;
+-	int id = 0;
+-	int cred_id = 0;
++	static int id = 0;
++	static int cred_id = 0;
+
+ 	if (name == NULL)
+ 		return NULL;
+--
+2.34.1
+
diff --git a/pkgs/os-specific/linux/wpa_supplicant/default.nix b/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 1dbe281e096..621cd5d79a2 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -1,51 +1,25 @@
-{ lib, stdenv, fetchurl, fetchpatch, openssl, pkg-config, libnl
-, withDbus ? true, dbus
+{ lib, stdenv, fetchurl, openssl, pkg-config, libnl
+, nixosTests, wpa_supplicant_gui
+, dbusSupport ? !stdenv.hostPlatform.isStatic, dbus
 , withReadline ? true, readline
-, withPcsclite ? true, pcsclite
+, withPcsclite ? !stdenv.hostPlatform.isStatic, pcsclite
 , readOnlyModeSSIDs ? false
 }:
 
 with lib;
 stdenv.mkDerivation rec {
-  version = "2.9";
+  version = "2.10";
 
   pname = "wpa_supplicant";
 
   src = fetchurl {
     url = "https://w1.fi/releases/${pname}-${version}.tar.gz";
-    sha256 = "05qzak1mssnxcgdrafifxh9w86a4ha69qabkg4bsigk499xyxggw";
+    sha256 = "sha256-IN965RVLODA1X4q0JpEjqHr/3qWf50/pKSqR0Nfhey8=";
   };
 
   patches = [
-    (fetchurl {
-      name = "CVE-2019-16275.patch";
-      url = "https://w1.fi/security/2019-7/0001-AP-Silently-ignore-management-frame-from-unexpected-.patch";
-      sha256 = "15xjyy7crb557wxpx898b5lnyblxghlij0xby5lmj9hpwwss34dz";
-    })
-    (fetchpatch {
-      # Expose OWE key management capability over DBus, remove >= 2.10
-      name = "dbus-Export-OWE-capability-and-OWE-BSS-key_mgmt.patch";
-      url = "https://w1.fi/cgit/hostap/patch/?id=7800725afb27397f7d6033d4969e2aeb61af4737";
-      sha256 = "0c1la7inf4m5y9gzdjjdnhpkx32pm8vi6m5knih8p77q4mbrdgg8";
-    })
-    # P2P: Fix copying of secondary device types for P2P group client (https://w1.fi/security/2020-2/)
-    (fetchurl {
-      name = "CVE-2021-0326.patch";
-      url = "https://w1.fi/security/2020-2/0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch";
-      sha256 = "19f4hx0p547mdx8y8arb3vclwyy4w9c8a6a40ryj7q33730mrmn4";
-    })
-    # P2P: Fix a corner case in peer addition based on PD Request (https://w1.fi/security/2021-1/)
-    (fetchurl {
-      name = "CVE-2021-27803.patch";
-      url = "https://w1.fi/security/2021-1/0001-P2P-Fix-a-corner-case-in-peer-addition-based-on-PD-R.patch";
-      sha256 = "04cnds7hmbqc44jasabjvrdnh66i5hwvk2h2m5z94pmgbzncyh3z";
-    })
-    # In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c.
-    (fetchpatch {
-      name = "CVE-2021-30004.patch";
-      url = "https://w1.fi/cgit/hostap/patch/?id=a0541334a6394f8237a4393b7372693cd7e96f15";
-      sha256 = "1gbhlz41x1ar1hppnb76pqxj6vimiypy7c4kq6h658637s4am3xg";
-    })
+    # Fix a bug when using two config files
+    ./Use-unique-IDs-for-networks-and-credentials.patch
   ] ++ lib.optionals readOnlyModeSSIDs [
     # Allow read-only networks
     ./0001-Implement-read-only-mode-for-ssids.patch
@@ -54,49 +28,62 @@ stdenv.mkDerivation rec {
   # TODO: Patch epoll so that the dbus actually responds
   # TODO: Figure out how to get privsep working, currently getting SIGBUS
   extraConfig = ''
+    #CONFIG_ELOOP_EPOLL=y
+    #CONFIG_PRIVSEP=y
+    #CONFIG_TLSV12=y see #8332
     CONFIG_AP=y
-    CONFIG_LIBNL32=y
+    CONFIG_BGSCAN_LEARN=y
+    CONFIG_BGSCAN_SIMPLE=y
+    CONFIG_DEBUG_SYSLOG=y
+    CONFIG_EAP_EKE=y
     CONFIG_EAP_FAST=y
-    CONFIG_EAP_PWD=y
-    CONFIG_EAP_PAX=y
-    CONFIG_EAP_SAKE=y
     CONFIG_EAP_GPSK=y
     CONFIG_EAP_GPSK_SHA256=y
-    CONFIG_OWE=y
-    CONFIG_WPS=y
-    CONFIG_WPS_ER=y
-    CONFIG_WPS_NFS=y
     CONFIG_EAP_IKEV2=y
-    CONFIG_EAP_EKE=y
-    CONFIG_HT_OVERRIDES=y
-    CONFIG_VHT_OVERRIDES=y
+    CONFIG_EAP_PAX=y
+    CONFIG_EAP_PWD=y
+    CONFIG_EAP_SAKE=y
     CONFIG_ELOOP=eloop
-    #CONFIG_ELOOP_EPOLL=y
-    CONFIG_L2_PACKET=linux
-    CONFIG_IEEE80211W=y
-    CONFIG_TLS=openssl
-    CONFIG_TLSV11=y
-    #CONFIG_TLSV12=y see #8332
-    CONFIG_IEEE80211R=y
-    CONFIG_DEBUG_SYSLOG=y
-    #CONFIG_PRIVSEP=y
-    CONFIG_IEEE80211N=y
+    CONFIG_EXT_PASSWORD_FILE=y
+    CONFIG_HS20=y
+    CONFIG_HT_OVERRIDES=y
     CONFIG_IEEE80211AC=y
+    CONFIG_IEEE80211AX=y
+    CONFIG_IEEE80211N=y
+    CONFIG_IEEE80211R=y
+    CONFIG_IEEE80211W=y
     CONFIG_INTERNETWORKING=y
-    CONFIG_HS20=y
+    CONFIG_L2_PACKET=linux
+    CONFIG_LIBNL32=y
+    CONFIG_OWE=y
     CONFIG_P2P=y
+    CONFIG_SAE_PK=y
     CONFIG_TDLS=y
-    CONFIG_BGSCAN_SIMPLE=y
-    CONFIG_BGSCAN_LEARN=y
+    CONFIG_TLS=openssl
+    CONFIG_TLSV11=y
+    CONFIG_VHT_OVERRIDES=y
+    CONFIG_WNM=y
+    CONFIG_WPS=y
+    CONFIG_WPS_ER=y
+    CONFIG_WPS_NFS=y
   '' + optionalString withPcsclite ''
     CONFIG_EAP_SIM=y
     CONFIG_EAP_AKA=y
     CONFIG_EAP_AKA_PRIME=y
     CONFIG_PCSC=y
-  '' + optionalString withDbus ''
+  '' + optionalString dbusSupport ''
     CONFIG_CTRL_IFACE_DBUS=y
     CONFIG_CTRL_IFACE_DBUS_NEW=y
     CONFIG_CTRL_IFACE_DBUS_INTRO=y
+  ''
+    # Upstream uses conditionals based on ifdef, so opposite of =y is
+    # not =n, as one may expect, but undefine.
+    #
+    # This config is sourced into makefile.
+    + optionalString (!dbusSupport) ''
+    undefine CONFIG_CTRL_IFACE_DBUS
+    undefine CONFIG_CTRL_IFACE_DBUS_NEW
+    undefine CONFIG_CTRL_IFACE_DBUS_INTRO
   '' + (if withReadline then ''
     CONFIG_READLINE=y
   '' else ''
@@ -118,7 +105,7 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [ openssl libnl ]
-    ++ optional withDbus dbus
+    ++ optional dbusSupport dbus
     ++ optional withReadline readline
     ++ optional withPcsclite pcsclite;
 
@@ -128,17 +115,24 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share/man/man5 $out/share/man/man8
     cp -v "doc/docbook/"*.5 $out/share/man/man5/
     cp -v "doc/docbook/"*.8 $out/share/man/man8/
-
+  ''
+  + lib.optionalString dbusSupport ''
     mkdir -p $out/share/dbus-1/system.d $out/share/dbus-1/system-services $out/etc/systemd/system
     cp -v "dbus/"*service $out/share/dbus-1/system-services
     sed -e "s@/sbin/wpa_supplicant@$out&@" -i "$out/share/dbus-1/system-services/"*
     cp -v dbus/dbus-wpa_supplicant.conf $out/share/dbus-1/system.d
     cp -v "systemd/"*.service $out/etc/systemd/system
-
+  ''
+  + ''
     rm $out/share/man/man8/wpa_priv.8
     install -Dm444 wpa_supplicant.conf $out/share/doc/wpa_supplicant/wpa_supplicant.conf.example
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) wpa_supplicant;
+    inherit wpa_supplicant_gui; # inherits the src+version updates
+  };
+
   meta = with lib; {
     homepage = "https://w1.fi/wpa_supplicant/";
     description = "A tool for connecting to WPA and WPA2-protected wireless networks";
diff --git a/pkgs/os-specific/linux/wpa_supplicant/gui.nix b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
index d2d59ba21a5..82e104cac3a 100644
--- a/pkgs/os-specific/linux/wpa_supplicant/gui.nix
+++ b/pkgs/os-specific/linux/wpa_supplicant/gui.nix
@@ -1,18 +1,8 @@
 { lib, mkDerivation, fetchpatch, qtbase, qmake, inkscape, imagemagick, wpa_supplicant }:
 
 mkDerivation {
-  name = "wpa_gui-${wpa_supplicant.version}";
-
-  inherit (wpa_supplicant) src;
-
-  patches = [
-    # Fix build with Inkscape 1.0
-    # https://github.com/NixOS/nixpkgs/issues/86930
-    (fetchpatch {
-      url = "https://w1.fi/cgit/hostap/patch/?id=0388992905a5c2be5cba9497504eaea346474754";
-      sha256 = "05hs74qawa433adripzhycm45g7yvxr6074nd4zcl4gabzp9hd30";
-    })
-  ];
+  pname = "wpa_gui";
+  inherit (wpa_supplicant) version src;
 
   buildInputs = [ qtbase ];
   nativeBuildInputs = [ qmake inkscape imagemagick ];
diff --git a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
index 4b57ed4ceae..d636f928f24 100644
--- a/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
+++ b/pkgs/os-specific/linux/x86_energy_perf_policy/default.nix
@@ -1,7 +1,8 @@
 { lib, stdenv, kernel }:
 
 stdenv.mkDerivation {
-  name = "x86_energy_perf_policy-${kernel.version}";
+  pname = "x86_energy_perf_policy";
+  version = kernel.version;
 
   src = kernel.src;
 
diff --git a/pkgs/os-specific/linux/x86info/default.nix b/pkgs/os-specific/linux/x86info/default.nix
index dbda35670f6..f330fbbe6c7 100644
--- a/pkgs/os-specific/linux/x86info/default.nix
+++ b/pkgs/os-specific/linux/x86info/default.nix
@@ -1,32 +1,48 @@
-{lib, stdenv, fetchurl, pciutils, python}:
+{ lib
+, stdenv
+, fetchFromGitHub
+, pciutils
+, pkg-config
+, python3
+}:
 
 stdenv.mkDerivation rec {
-  version = "1.30";
   pname = "x86info";
+  version = "unstable-2021-08-07";
 
-  src = fetchurl {
-    url = "http://codemonkey.org.uk/projects/x86info/${pname}-${version}.tgz";
-    sha256 = "0a4lzka46nabpsrg3n7akwr46q38f96zfszd73xcback1s2hjc7y";
+  src = fetchFromGitHub {
+    owner = "kernelslacker";
+    repo = pname;
+    rev = "061ea35ecb0697761b6260998fa2045b8bb0be68";
+    hash = "sha256-/qWioC4dV1bQkU4SiTR8duYqoGIMIH7s8vuAXi75juo=";
   };
 
-  preConfigure = ''
-    patchShebangs .
+  nativeBuildInputs = [
+    pkg-config
+    python3
+  ];
 
-    # ignore warnings
-    sed -i 's/-Werror -Wall//' Makefile
-  '';
+  buildInputs = [
+    pciutils
+  ];
+
+  # causes redefinition of _FORTIFY_SOURCE
+  hardeningDisable = [ "fortify3" ];
 
-  buildInputs = [ pciutils python ];
+  postBuild = ''
+    patchShebangs lsmsr/createheader.py
+    make -C lsmsr
+  '';
 
   installPhase = ''
     mkdir -p $out/bin
-    cp x86info lsmsr $out/bin
+    cp x86info $out/bin
+    cp lsmsr/lsmsr $out/bin
   '';
 
   meta = {
     description = "Identification utility for the x86 series of processors";
-    longDescription =
-    ''
+    longDescription = ''
       x86info will identify all Intel/AMD/Centaur/Cyrix/VIA CPUs. It leverages
       the cpuid kernel module where possible.  it supports parsing model specific
       registers (MSRs) via the msr kernel module.  it will approximate processor
@@ -34,7 +50,7 @@ stdenv.mkDerivation rec {
     '';
     platforms = [ "i686-linux" "x86_64-linux" ];
     license = lib.licenses.gpl2;
-    homepage = "http://codemonkey.org.uk/projects/x86info/";
-    maintainers = with lib.maintainers; [jcumming];
+    homepage = "https://github.com/kernelslacker/x86info";
+    maintainers = with lib.maintainers; [ jcumming ];
   };
 }
diff --git a/pkgs/os-specific/linux/xf86-input-wacom/default.nix b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
index 4ebc4ed7663..614831c057d 100644
--- a/pkgs/os-specific/linux/xf86-input-wacom/default.nix
+++ b/pkgs/os-specific/linux/xf86-input-wacom/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xf86-input-wacom";
-  version = "0.40.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "linuxwacom";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-0U4pAB5vsIlBewCBqQ4SLHDrwqtr9nh7knZpXZMkzck=";
+    sha256 = "sha256-PuIfeHlkcoin7w2v822P8uhWBNhYQGuOA7yD62L3qto=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
@@ -52,9 +52,9 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    maintainers = with maintainers; [ goibhniu fortuneteller2k ];
+    maintainers = with maintainers; [ goibhniu moni ];
     description = "Wacom digitizer driver for X11";
-    homepage = "http://linuxwacom.sourceforge.net";
+    homepage = "https://linuxwacom.sourceforge.net";
     license = licenses.gpl2Only;
     platforms = platforms.linux; # Probably, works with other unixes as well
   };
diff --git a/pkgs/os-specific/linux/xf86-video-nested/default.nix b/pkgs/os-specific/linux/xf86-video-nested/default.nix
index 7c93fa91854..4092e3797c2 100644
--- a/pkgs/os-specific/linux/xf86-video-nested/default.nix
+++ b/pkgs/os-specific/linux/xf86-video-nested/default.nix
@@ -3,7 +3,8 @@
 }:
 
 stdenv.mkDerivation {
-  name = "xf86-video-nested-2017-06-12";
+  pname = "xf86-video-nested";
+  version = "unstable-2017-06-12";
 
   src = fetchgit {
     url = "git://anongit.freedesktop.org/xorg/driver/xf86-video-nested";
@@ -11,9 +12,11 @@ stdenv.mkDerivation {
     sha256 = "133rd2kvr2q2wmwpx82bb93qbi8wm8qp1vlmbhgc7aslz0j4cqqv";
   };
 
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+
   buildInputs =
-    [ autoreconfHook xorgproto libX11 libXext pixman
-      pkg-config utilmacros xorgserver
+    [ xorgproto libX11 libXext pixman
+      utilmacros xorgserver
     ];
 
   hardeningDisable = [ "fortify" ];
diff --git a/pkgs/os-specific/linux/xmm7360-pci/default.nix b/pkgs/os-specific/linux/xmm7360-pci/default.nix
deleted file mode 100644
index 115299ff50b..00000000000
--- a/pkgs/os-specific/linux/xmm7360-pci/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, kernel, perl, bc, breakpointHook }:
-
-stdenv.mkDerivation rec {
-  pname = "xmm7360-pci";
-  version = "unstable-2021-07-19";
-
-  src = fetchFromGitHub {
-    owner = "xmm7360";
-    repo = "xmm7360-pci";
-    rev = "7086b80bb609180b1b89fb478751e5e8414ab64f";
-    sha256 = "1wdb0phqg9rj9g9ycqdya0m7lx24kzjlh25yw0ifp898ddxrrr0c";
-  };
-
-  makeFlags = [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ];
-
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-  INSTALL_MOD_PATH = placeholder "out";
-  installFlags = [ "DEPMOD=true" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/xmm7360/xmm7360-pci";
-    description = "PCI driver for Fibocom L850-GL modem based on Intel XMM7360 modem";
-    downloadPage = "https://github.com/xmm7360/xmm7360-pci";
-    license = licenses.isc;
-    maintainers = with maintainers; [ flokli hexa ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/pkgs/os-specific/linux/xone/default.nix b/pkgs/os-specific/linux/xone/default.nix
new file mode 100644
index 00000000000..104b7952f2b
--- /dev/null
+++ b/pkgs/os-specific/linux/xone/default.nix
@@ -0,0 +1,48 @@
+{ stdenv, lib, fetchFromGitHub, kernel, fetchurl, fetchpatch }:
+
+stdenv.mkDerivation rec {
+  pname = "xone";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "medusalix";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-h+j4xCV9R6hp9trsv1NByh9m0UBafOz42ZuYUjclILE=";
+  };
+
+  patches = [
+    # Fix build on kernel 6.3
+    (fetchpatch {
+      name = "kernel-6.3.patch";
+      url = "https://github.com/medusalix/xone/commit/bbf0dcc484c3f5611f4e375da43e0e0ef08f3d18.patch";
+      hash = "sha256-A2OzRRk4XT++rS6k6EIyiPy/LJptvVRUxoP7CIGrPWU=";
+    })
+  ];
+
+  setSourceRoot = ''
+    export sourceRoot=$(pwd)/${src.name}
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(sourceRoot)"
+    "VERSION=${version}"
+  ];
+
+  buildFlags = [ "modules" ];
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  meta = with lib; {
+    description = "Linux kernel driver for Xbox One and Xbox Series X|S accessories";
+    homepage = "https://github.com/medusalix/xone";
+    license = licenses.gpl2;
+    maintainers = with lib.maintainers; [ rhysmdnz ];
+    platforms = platforms.linux;
+  };
+}
+
diff --git a/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix b/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
new file mode 100644
index 00000000000..8ae426269a8
--- /dev/null
+++ b/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
@@ -0,0 +1,83 @@
+{ lib
+, stdenv
+, fetchzip
+, libusb1
+, glibc
+, libGL
+, xorg
+, makeWrapper
+, qtx11extras
+, wrapQtAppsHook
+, autoPatchelfHook
+, libX11
+, libXtst
+, libXi
+, libXrandr
+, libXinerama
+}:
+
+let
+  dataDir = "var/lib/xppend1v2";
+in
+stdenv.mkDerivation rec {
+  pname = "xp-pen-deco-01-v2-driver";
+  version = "3.2.3.230215-1";
+
+  src = fetchzip {
+    url = "https://download01.xp-pen.com/file/2023/03/XPPen-pentablet-${version}.x86_64.tar.gz";
+    name = "xp-pen-deco-01-v2-driver-${version}.tar.gz";
+    sha256 = "sha256-CV4ZaGCFFcfy2J0O8leYgcyzFVwJQFQJsShOv9B7jfI=";
+  };
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+    autoPatchelfHook
+    makeWrapper
+  ];
+
+  dontBuild = true;
+
+  dontWrapQtApps = true; # this is done manually
+
+  buildInputs = [
+    libusb1
+    libX11
+    libXtst
+    libXi
+    libXrandr
+    libXinerama
+    glibc
+    libGL
+    stdenv.cc.cc.lib
+    qtx11extras
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{opt,bin}
+    cp -r App/usr/lib/pentablet/{pentablet,resource.rcc,conf} $out/opt
+    chmod +x $out/opt/pentablet
+    cp -r App/lib $out/lib
+    sed -i 's#usr/lib/pentablet#${dataDir}#g' $out/opt/pentablet
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper $out/opt/pentablet $out/bin/xp-pen-deco-01-v2-driver \
+      "''${qtWrapperArgs[@]}" \
+      --run 'if [ "$EUID" -ne 0 ]; then echo "Please run as root."; exit 1; fi' \
+      --run 'if [ ! -d /${dataDir} ]; then mkdir -p /${dataDir}; cp -r '$out'/opt/conf /${dataDir}; chmod u+w -R /${dataDir}; fi'
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.xp-pen.com/product/461.html";
+    description = "Drivers for the XP-PEN Deco 01 v2 drawing tablet";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    maintainers = with maintainers; [ virchau13 ];
+    license = licenses.unfree;
+  };
+}
+
diff --git a/pkgs/os-specific/linux/xp-pen-drivers/g430/default.nix b/pkgs/os-specific/linux/xp-pen-drivers/g430/default.nix
new file mode 100644
index 00000000000..ad983662109
--- /dev/null
+++ b/pkgs/os-specific/linux/xp-pen-drivers/g430/default.nix
@@ -0,0 +1,39 @@
+{ lib, stdenv, mkDerivation, fetchzip, autoPatchelfHook, libusb1, libX11, libXtst, qtbase, libglvnd }:
+
+mkDerivation rec {
+  pname = "xp-pen-g430-driver";
+  version = "1.2.13.1";
+
+  src = fetchzip {
+    url = "https://download01.xp-pen.com/file/2020/04/Linux_Pentablet_V${version}.tar.gz(20200428).zip";
+    sha256 = "1r423hcpi26v82pzl59br1zw5vablikclqsy6mcqi0v5p84hfrdd";
+  } + /Linux_Pentablet_V1.2.13.1.tar.gz;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    libusb1
+    libX11
+    libXtst
+    qtbase
+    libglvnd
+    stdenv.cc.cc.lib
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp Pentablet_Driver $out/bin/pentablet-driver
+    cp config.xml $out/bin/config.xml
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.xp-pen.com/download-46.html";
+    description = "Driver for XP-PEN Pentablet drawing tablets";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ ivar ];
+  };
+}
diff --git a/pkgs/os-specific/linux/xpadneo/default.nix b/pkgs/os-specific/linux/xpadneo/default.nix
index c1874877620..e470fa66adf 100644
--- a/pkgs/os-specific/linux/xpadneo/default.nix
+++ b/pkgs/os-specific/linux/xpadneo/default.nix
@@ -1,39 +1,49 @@
-{ lib, stdenv, fetchFromGitHub, kernel, bluez }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, kernel
+, bluez
+, nixosTests
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xpadneo";
-  version = "0.9.1";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "atar-axis";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-VUcS4OzvPj0o627ZWIOBqEAQJ4JuMCMjgaZoMkL/IHc=";
+    repo = "xpadneo";
+    rev = "refs/tags/v${finalAttrs.version}";
+    sha256 = "sha256-rT2Mq40fE055FemDG7PBjt+cxgIHJG9tTjtw2nW6B98=";
   };
 
   setSourceRoot = ''
-    export sourceRoot=$(pwd)/source/hid-xpadneo/src
+    export sourceRoot=$(pwd)/${finalAttrs.src.name}/hid-xpadneo/src
   '';
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
   buildInputs = [ bluez ];
 
-  makeFlags = [
+  makeFlags = kernel.makeFlags ++ [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(sourceRoot)"
-    "VERSION=${version}"
+    "VERSION=${finalAttrs.version}"
   ];
 
   buildFlags = [ "modules" ];
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
+  passthru.tests = {
+    xpadneo = nixosTests.xpadneo;
+  };
+
   meta = with lib; {
     description = "Advanced Linux driver for Xbox One wireless controllers";
     homepage = "https://atar-axis.github.io/xpadneo";
-    license = licenses.gpl3Plus;
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ kira-bruneau ];
     platforms = platforms.linux;
   };
-}
+})
diff --git a/pkgs/os-specific/linux/xsensors/default.nix b/pkgs/os-specific/linux/xsensors/default.nix
index 02ce560d8a9..e3639fefffa 100644
--- a/pkgs/os-specific/linux/xsensors/default.nix
+++ b/pkgs/os-specific/linux/xsensors/default.nix
@@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/os-specific/linux/xsos/default.nix b/pkgs/os-specific/linux/xsos/default.nix
new file mode 100644
index 00000000000..56516aee8b7
--- /dev/null
+++ b/pkgs/os-specific/linux/xsos/default.nix
@@ -0,0 +1,52 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, makeWrapper
+, installShellFiles
+, dmidecode
+, ethtool
+, pciutils
+, multipath-tools
+, iproute2
+, sysvinit
+}:
+let
+  binPath = [
+    iproute2
+    dmidecode
+    ethtool
+    pciutils
+    multipath-tools
+    iproute2
+    sysvinit
+  ];
+in
+
+stdenv.mkDerivation rec {
+  pname = "xsos";
+  version = "0.7.19";
+
+  src = fetchFromGitHub {
+    owner = "ryran";
+    repo = "xsos";
+    rev = "v${version}";
+    sha256 = "11cc8z3pz4gl0mwl2fc701mn4cgx50fybygx0rvs9bhvb0jnphay";
+  };
+
+  nativeBuildInputs = [ makeWrapper installShellFiles ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -a xsos $out/bin
+    wrapProgram "$out/bin/xsos" --prefix PATH : ${lib.makeBinPath binPath}
+    installShellCompletion --bash --name xsos.bash xsos-bash-completion.bash
+  '';
+
+  meta = with lib; {
+    description = "Summarize system info from sosreports";
+    homepage = "https://github.com/ryran/xsos";
+    license = licenses.gpl3;
+    platforms = [ "i686-linux" "x86_64-linux" ];
+    maintainers = [ maintainers.nixinator ];
+  };
+}
diff --git a/pkgs/os-specific/linux/zenmonitor/default.nix b/pkgs/os-specific/linux/zenmonitor/default.nix
index 43cfd87cba5..8414ac7a1e1 100644
--- a/pkgs/os-specific/linux/zenmonitor/default.nix
+++ b/pkgs/os-specific/linux/zenmonitor/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "zenmonitor";
-  version = "1.4.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
-    owner = "ocerman";
-    repo = "zenmonitor";
+    owner = "Ta180m";
+    repo = "zenmonitor3";
     rev = "v${version}";
-    sha256 = "0smv94vi36hziw42gasivyw25h5n1sgwwk1cv78id5g85w0kw246";
+    sha256 = "sha256-2EsuSMXnnMg0e0JD1TXJplsi7sOg9em0qqge2WlC6ro=";
   };
 
   buildInputs = [ gtk3 ];
@@ -18,9 +18,9 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Monitoring software for AMD Zen-based CPUs";
-    homepage = "https://github.com/ocerman/zenmonitor";
+    homepage = "https://github.com/Ta180m/zenmonitor3";
     license = licenses.mit;
     platforms = [ "i686-linux" "x86_64-linux" ];
-    maintainers = with maintainers; [ alexbakker ];
+    maintainers = with maintainers; [ alexbakker artturin ];
   };
 }
diff --git a/pkgs/os-specific/linux/zenpower/default.nix b/pkgs/os-specific/linux/zenpower/default.nix
index af59ec8e37b..bf1240610f8 100644
--- a/pkgs/os-specific/linux/zenpower/default.nix
+++ b/pkgs/os-specific/linux/zenpower/default.nix
@@ -1,14 +1,15 @@
-{ lib, stdenv, kernel, fetchFromGitHub, fetchpatch }:
+{ lib, stdenv, kernel, fetchFromGitea }:
 
 stdenv.mkDerivation rec {
   pname = "zenpower";
-  version = "0.1.12";
+  version = "unstable-2022-11-04";
 
-  src = fetchFromGitHub {
-    owner = "ocerman";
-    repo = "zenpower";
-    rev = "v${version}";
-    sha256 = "116yrw4ygh3fqwhniaqq0nps29pq87mi2q1375f1ylkfiak8n63a";
+  src = fetchFromGitea {
+    domain = "git.exozy.me";
+    owner = "a";
+    repo = "zenpower3";
+    rev = "c176fdb0d5bcba6ba2aba99ea36812e40f47751f";
+    sha256 = "sha256-d2WH8Zv7F0phZmEKcDiaak9On+Mo9bAFhMulT/N5FWI=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -22,10 +23,10 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    inherit (src.meta) homepage;
     description = "Linux kernel driver for reading temperature, voltage(SVI2), current(SVI2) and power(SVI2) for AMD Zen family CPUs.";
-    homepage = "https://github.com/ocerman/zenpower";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ alexbakker ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ alexbakker artturin ];
     platforms = [ "x86_64-linux" ];
     broken = versionOlder kernel.version "4.14";
   };
diff --git a/pkgs/os-specific/linux/zenstates/default.nix b/pkgs/os-specific/linux/zenstates/default.nix
index a56337cfef2..8e31073151b 100644
--- a/pkgs/os-specific/linux/zenstates/default.nix
+++ b/pkgs/os-specific/linux/zenstates/default.nix
@@ -35,8 +35,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ python3 ];
 
-  phases = [ "installPhase" ];
-
   installPhase = ''
     mkdir -p $out/bin
     cp $src/zenstates.py $out/bin/zenstates
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
deleted file mode 100644
index 7784aa8e03f..00000000000
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ /dev/null
@@ -1,217 +0,0 @@
-{ lib, stdenv, fetchFromGitHub
-, autoreconfHook269, util-linux, nukeReferences, coreutils
-, perl, nixosTests
-, configFile ? "all"
-
-# Userspace dependencies
-, zlib, libuuid, python3, attr, openssl
-, libtirpc
-, nfs-utils, samba
-, gawk, gnugrep, gnused, systemd
-, smartmontools, enableMail ? false
-, sysstat, pkg-config
-
-# Kernel dependencies
-, kernel ? null
-, enablePython ? true
-}:
-
-with lib;
-let
-  smartmon = smartmontools.override { inherit enableMail; };
-
-  buildKernel = any (n: n == configFile) [ "kernel" "all" ];
-  buildUser = any (n: n == configFile) [ "user" "all" ];
-
-  common = { version
-    , sha256
-    , extraPatches ? []
-    , rev ? "zfs-${version}"
-    , isUnstable ? false
-    , kernelCompatible ? null }:
-
-    stdenv.mkDerivation {
-      name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
-
-      src = fetchFromGitHub {
-        owner = "zfsonlinux";
-        repo = "zfs";
-        inherit rev sha256;
-      };
-
-      patches = extraPatches;
-
-      postPatch = optionalString buildKernel ''
-        patchShebangs scripts
-        # The arrays must remain the same length, so we repeat a flag that is
-        # already part of the command and therefore has no effect.
-        substituteInPlace ./module/os/linux/zfs/zfs_ctldir.c \
-          --replace '"/usr/bin/env", "umount"' '"${util-linux}/bin/umount", "-n"' \
-          --replace '"/usr/bin/env", "mount"'  '"${util-linux}/bin/mount", "-n"'
-      '' + optionalString buildUser ''
-        substituteInPlace ./lib/libshare/os/linux/nfs.c --replace "/usr/sbin/exportfs" "${
-          # We don't *need* python support, but we set it like this to minimize closure size:
-          # If it's disabled by default, no need to enable it, even if we have python enabled
-          # And if it's enabled by default, only change that if we explicitly disable python to remove python from the closure
-          nfs-utils.override (old: { enablePython = old.enablePython or true && enablePython; })
-        }/bin/exportfs"
-        substituteInPlace ./lib/libshare/smb.h        --replace "/usr/bin/net"            "${samba}/bin/net"
-        substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
-        substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
-                                                      --replace "/etc/default"            "$out/etc/default"
-        substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
-
-        substituteInPlace ./contrib/initramfs/hooks/Makefile.am \
-          --replace "/usr/share/initramfs-tools/hooks" "$out/usr/share/initramfs-tools/hooks"
-        substituteInPlace ./contrib/initramfs/Makefile.am \
-          --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
-        substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
-        substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
-        substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
-        substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
-        substituteInPlace ./etc/systemd/system/Makefile.am \
-          --replace '$(DESTDIR)$(systemdunitdir)' "$out"'$(DESTDIR)$(systemdunitdir)'
-
-        substituteInPlace ./contrib/initramfs/conf.d/Makefile.am \
-          --replace "/usr/share/initramfs-tools/conf.d" "$out/usr/share/initramfs-tools/conf.d"
-        substituteInPlace ./contrib/initramfs/conf-hooks.d/Makefile.am \
-          --replace "/usr/share/initramfs-tools/conf-hooks.d" "$out/usr/share/initramfs-tools/conf-hooks.d"
-
-        substituteInPlace ./cmd/vdev_id/vdev_id \
-          --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
-          "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
-      '';
-
-      nativeBuildInputs = [ autoreconfHook269 nukeReferences ]
-        ++ optionals buildKernel (kernel.moduleBuildDependencies ++ [ perl ])
-        ++ optional buildUser pkg-config;
-      buildInputs = optionals buildUser [ zlib libuuid attr libtirpc ]
-        ++ optional buildUser openssl
-        ++ optional (buildUser && enablePython) python3;
-
-      # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
-      NIX_CFLAGS_LINK = "-lgcc_s";
-
-      hardeningDisable = [ "fortify" "stackprotector" "pic" ];
-
-      configureFlags = [
-        "--with-config=${configFile}"
-        "--with-tirpc=1"
-        (withFeatureAs (buildUser && enablePython) "python" python3.interpreter)
-      ] ++ optionals buildUser [
-        "--with-dracutdir=$(out)/lib/dracut"
-        "--with-udevdir=$(out)/lib/udev"
-        "--with-systemdunitdir=$(out)/etc/systemd/system"
-        "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
-        "--with-systemdgeneratordir=$(out)/lib/systemd/system-generator"
-        "--with-mounthelperdir=$(out)/bin"
-        "--libexecdir=$(out)/libexec"
-        "--sysconfdir=/etc"
-        "--localstatedir=/var"
-        "--enable-systemd"
-      ] ++ optionals buildKernel ([
-        "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-        "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-      ] ++ kernel.makeFlags);
-
-      makeFlags = optionals buildKernel kernel.makeFlags;
-
-      enableParallelBuilding = true;
-
-      installFlags = [
-        "sysconfdir=\${out}/etc"
-        "DEFAULT_INITCONF_DIR=\${out}/default"
-        "INSTALL_MOD_PATH=\${out}"
-      ];
-
-      postInstall = optionalString buildKernel ''
-        # Add reference that cannot be detected due to compressed kernel module
-        mkdir -p "$out/nix-support"
-        echo "${util-linux}" >> "$out/nix-support/extra-refs"
-      '' + optionalString buildUser ''
-        # Remove provided services as they are buggy
-        rm $out/etc/systemd/system/zfs-import-*.service
-
-        sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
-
-        for i in $out/etc/systemd/system/*; do
-        substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
-        done
-
-        # Remove tests because they add a runtime dependency on gcc
-        rm -rf $out/share/zfs/zfs-tests
-
-        # Add Bash completions.
-        install -v -m444 -D -t $out/share/bash-completion/completions contrib/bash_completion.d/zfs
-        (cd $out/share/bash-completion/completions; ln -s zfs zpool)
-      '';
-
-      postFixup = let
-        path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmon sysstat ]}:$PATH";
-      in ''
-        for i in $out/libexec/zfs/zpool.d/*; do
-          sed -i '2i${path}' $i
-        done
-      '';
-
-      outputs = [ "out" ] ++ optionals buildUser [ "dev" ];
-
-      passthru = {
-        inherit enableMail;
-
-        tests =
-          if isUnstable then [
-            nixosTests.zfs.unstable
-          ] else [
-            nixosTests.zfs.installer
-            nixosTests.zfs.stable
-          ];
-      };
-
-      meta = {
-        description = "ZFS Filesystem Linux Kernel module";
-        longDescription = ''
-          ZFS is a filesystem that combines a logical volume manager with a
-          Copy-On-Write filesystem with data integrity detection and repair,
-          snapshotting, cloning, block devices, deduplication, and more.
-        '';
-        homepage = "https://github.com/openzfs/zfs";
-        changelog = "https://github.com/openzfs/zfs/releases/tag/zfs-${version}";
-        license = licenses.cddl;
-        platforms = platforms.linux;
-        maintainers = with maintainers; [ hmenke jcumming jonringer wizeman fpletz globin mic92 ];
-        # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
-        # On NixOS set the option boot.zfs.enableUnstable.
-        broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
-      };
-    };
-in {
-  # also check if kernel version constraints in
-  # ./nixos/modules/tasks/filesystems/zfs.nix needs
-  # to be adapted
-  zfsStable = common {
-    # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.14";
-
-    # this package should point to the latest release.
-    version = "2.1.0";
-
-    sha256 = "sha256-YdY4SStXZGBBdAHdM3R/unco7ztxI3s0/buPSNSeh5o=";
-  };
-
-  zfsUnstable = common {
-    # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.14";
-
-    # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.1.0";
-
-    sha256 = "sha256-YdY4SStXZGBBdAHdM3R/unco7ztxI3s0/buPSNSeh5o=";
-
-    isUnstable = true;
-  };
-}
diff --git a/pkgs/os-specific/linux/zfs/generic.nix b/pkgs/os-specific/linux/zfs/generic.nix
new file mode 100644
index 00000000000..8adbb8cab8f
--- /dev/null
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@@ -0,0 +1,222 @@
+{ pkgs, lib, stdenv, fetchFromGitHub, fetchpatch
+, autoreconfHook269, util-linux, nukeReferences, coreutils
+, perl, nixosTests
+, configFile ? "all"
+
+# Userspace dependencies
+, zlib, libuuid, python3, attr, openssl
+, libtirpc
+, nfs-utils, samba
+, gawk, gnugrep, gnused, systemd
+, smartmontools, enableMail ? false
+, sysstat, pkg-config
+, curl
+, pam
+
+# Kernel dependencies
+, kernel ? null
+, enablePython ? true
+, ...
+}:
+
+{ version
+, sha256
+, extraPatches ? []
+, rev ? "zfs-${version}"
+, isUnstable ? false
+, latestCompatibleLinuxPackages
+, kernelCompatible ? null
+}:
+
+let
+  inherit (lib) any optionalString optionals optional makeBinPath;
+
+  smartmon = smartmontools.override { inherit enableMail; };
+
+  buildKernel = any (n: n == configFile) [ "kernel" "all" ];
+  buildUser = any (n: n == configFile) [ "user" "all" ];
+
+  # XXX: You always want to build kernel modules with the same stdenv as the
+  # kernel was built with. However, since zfs can also be built for userspace we
+  # need to correctly pick between the provided/default stdenv, and the one used
+  # by the kernel.
+  # If you don't do this your ZFS builds will fail on any non-standard (e.g.
+  # clang-built) kernels.
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+
+stdenv'.mkDerivation {
+  name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
+
+  src = fetchFromGitHub {
+    owner = "openzfs";
+    repo = "zfs";
+    inherit rev sha256;
+  };
+
+  patches = extraPatches;
+
+  postPatch = optionalString buildKernel ''
+    patchShebangs scripts
+    # The arrays must remain the same length, so we repeat a flag that is
+    # already part of the command and therefore has no effect.
+    substituteInPlace ./module/os/linux/zfs/zfs_ctldir.c \
+      --replace '"/usr/bin/env", "umount"' '"${util-linux}/bin/umount", "-n"' \
+      --replace '"/usr/bin/env", "mount"'  '"${util-linux}/bin/mount", "-n"'
+  '' + optionalString buildUser ''
+    substituteInPlace ./lib/libshare/os/linux/nfs.c --replace "/usr/sbin/exportfs" "${
+      # We don't *need* python support, but we set it like this to minimize closure size:
+      # If it's disabled by default, no need to enable it, even if we have python enabled
+      # And if it's enabled by default, only change that if we explicitly disable python to remove python from the closure
+      nfs-utils.override (old: { enablePython = old.enablePython or true && enablePython; })
+    }/bin/exportfs"
+    substituteInPlace ./lib/libshare/smb.h        --replace "/usr/bin/net"            "${samba}/bin/net"
+    # Disable dynamic loading of libcurl
+    substituteInPlace ./config/user-libfetch.m4   --replace "curl-config --built-shared" "true"
+    substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
+    substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
+                                                  --replace "/etc/default"            "$out/etc/default"
+    substituteInPlace ./contrib/initramfs/Makefile.am \
+      --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
+    substituteInPlace ./udev/vdev_id \
+      --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
+       "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
+    substituteInPlace ./config/zfs-build.m4 \
+      --replace "bashcompletiondir=/etc/bash_completion.d" \
+        "bashcompletiondir=$out/share/bash-completion/completions"
+  '';
+
+  nativeBuildInputs = [ autoreconfHook269 nukeReferences ]
+    ++ optionals buildKernel (kernel.moduleBuildDependencies ++ [ perl ])
+    ++ optional buildUser pkg-config;
+  buildInputs = optionals buildUser [ zlib libuuid attr libtirpc pam ]
+    ++ optional buildUser openssl
+    ++ optional buildUser curl
+    ++ optional (buildUser && enablePython) python3;
+
+  # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
+  NIX_CFLAGS_LINK = "-lgcc_s";
+
+  hardeningDisable = [ "fortify" "stackprotector" "pic" ];
+
+  configureFlags = [
+    "--with-config=${configFile}"
+    "--with-tirpc=1"
+    (lib.withFeatureAs (buildUser && enablePython) "python" python3.interpreter)
+  ] ++ optionals buildUser [
+    "--with-dracutdir=$(out)/lib/dracut"
+    "--with-udevdir=$(out)/lib/udev"
+    "--with-systemdunitdir=$(out)/etc/systemd/system"
+    "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
+    "--with-systemdgeneratordir=$(out)/lib/systemd/system-generator"
+    "--with-mounthelperdir=$(out)/bin"
+    "--libexecdir=$(out)/libexec"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--enable-systemd"
+    "--enable-pam"
+  ] ++ optionals buildKernel ([
+    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ] ++ kernel.makeFlags);
+
+  makeFlags = optionals buildKernel kernel.makeFlags;
+
+  enableParallelBuilding = true;
+
+  installFlags = [
+    "sysconfdir=\${out}/etc"
+    "DEFAULT_INITCONF_DIR=\${out}/default"
+    "INSTALL_MOD_PATH=\${out}"
+  ];
+
+  preConfigure = ''
+    # The kernel module builds some tests during the configurePhase, this envvar controls their parallelism
+    export TEST_JOBS=$NIX_BUILD_CORES
+    if [ -z "$enableParallelBuilding" ]; then
+      export TEST_JOBS=1
+    fi
+  '';
+
+  # Enabling BTF causes zfs to be build with debug symbols.
+  # Since zfs compress kernel modules on installation, our strip hooks skip stripping them.
+  # Hence we strip modules prior to compression.
+  postBuild = optionalString buildKernel ''
+     find . -name "*.ko" -print0 | xargs -0 -P$NIX_BUILD_CORES ${stdenv.cc.targetPrefix}strip --strip-debug
+  '';
+
+  postInstall = optionalString buildKernel ''
+    # Add reference that cannot be detected due to compressed kernel module
+    mkdir -p "$out/nix-support"
+    echo "${util-linux}" >> "$out/nix-support/extra-refs"
+  '' + optionalString buildUser ''
+    # Remove provided services as they are buggy
+    rm $out/etc/systemd/system/zfs-import-*.service
+
+    for i in $out/etc/systemd/system/*; do
+       if [ -L $i ]; then
+         continue
+       fi
+       sed -i '/zfs-import-scan.service/d' $i
+       substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
+    done
+
+    # Remove tests because they add a runtime dependency on gcc
+    rm -rf $out/share/zfs/zfs-tests
+
+    # Add Bash completions.
+    install -v -m444 -D -t $out/share/bash-completion/completions contrib/bash_completion.d/zfs
+    (cd $out/share/bash-completion/completions; ln -s zfs zpool)
+  '';
+
+  postFixup = let
+    path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmon sysstat ]}:$PATH";
+  in ''
+    for i in $out/libexec/zfs/zpool.d/*; do
+      sed -i '2i${path}' $i
+    done
+  '';
+
+  outputs = [ "out" ] ++ optionals buildUser [ "dev" ];
+
+  passthru = {
+    inherit enableMail latestCompatibleLinuxPackages;
+
+    tests =
+      if isUnstable then [
+        nixosTests.zfs.unstable
+      ] else [
+        nixosTests.zfs.installer
+        nixosTests.zfs.stable
+      ];
+  };
+
+  meta = {
+    description = "ZFS Filesystem Linux Kernel module";
+    longDescription = ''
+      ZFS is a filesystem that combines a logical volume manager with a
+      Copy-On-Write filesystem with data integrity detection and repair,
+      snapshotting, cloning, block devices, deduplication, and more.
+    '';
+    homepage = "https://github.com/openzfs/zfs";
+    changelog = "https://github.com/openzfs/zfs/releases/tag/zfs-${version}";
+    license = lib.licenses.cddl;
+
+    # The case-block for TARGET_CPU has branches for only some CPU families,
+    # which prevents ZFS from building on any other platform.  Since the NixOS
+    # `boot.zfs.enabled` property is `readOnly`, excluding platforms where ZFS
+    # does not build is the only way to produce a NixOS installer on such
+    # platforms.
+    # https://github.com/openzfs/zfs/blob/6723d1110f6daf93be93db74d5ea9f6b64c9bce5/config/always-arch.m4#L12
+    platforms =
+      with lib.systems.inspect.patterns;
+      map (p: p // isLinux) ([ isx86_32 isx86_64 isPower isAarch64 isSparc ] ++ isArmv7);
+
+    maintainers = with lib.maintainers; [ jcumming jonringer globin raitobezarius ];
+    mainProgram = "zfs";
+    # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
+    # On NixOS set the option boot.zfs.enableUnstable.
+    broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
+  };
+}
+
diff --git a/pkgs/os-specific/linux/zfs/stable.nix b/pkgs/os-specific/linux/zfs/stable.nix
new file mode 100644
index 00000000000..3e53ba902cb
--- /dev/null
+++ b/pkgs/os-specific/linux/zfs/stable.nix
@@ -0,0 +1,28 @@
+{ callPackage
+, kernel ? null
+, stdenv
+, linuxKernel
+, removeLinuxDRM ? false
+, fetchpatch
+, ...
+} @ args:
+
+let
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+callPackage ./generic.nix args {
+  # check the release notes for compatible kernels
+  kernelCompatible =
+    if stdenv'.isx86_64 || removeLinuxDRM
+    then kernel.kernelOlder "6.6"
+    else kernel.kernelOlder "6.2";
+
+  latestCompatibleLinuxPackages = if stdenv'.isx86_64 || removeLinuxDRM
+    then linuxKernel.packages.linux_6_5
+    else linuxKernel.packages.linux_6_1;
+
+  # this package should point to the latest release.
+  version = "2.2.0";
+
+  sha256 = "sha256-s1sdXSrLu6uSOmjprbUa4cFsE2Vj7JX5i75e4vRnlvg=";
+}
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
new file mode 100644
index 00000000000..9c7e14c31bf
--- /dev/null
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -0,0 +1,32 @@
+{ callPackage
+, kernel ? null
+, stdenv
+, linuxKernel
+, removeLinuxDRM ? false
+, ...
+} @ args:
+
+let
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+callPackage ./generic.nix args {
+  # check the release notes for compatible kernels
+  kernelCompatible = if stdenv'.isx86_64 || removeLinuxDRM
+    then kernel.kernelOlder "6.6"
+    else kernel.kernelOlder "6.2";
+
+  latestCompatibleLinuxPackages = if stdenv'.isx86_64 || removeLinuxDRM
+    then linuxKernel.packages.linux_6_5
+    else linuxKernel.packages.linux_6_1;
+
+  # this package should point to a version / git revision compatible with the latest kernel release
+  # IMPORTANT: Always use a tagged release candidate or commits from the
+  # zfs-<version>-staging branch, because this is tested by the OpenZFS
+  # maintainers.
+  version = "2.2.1-unstable-2023-10-21";
+  rev = "95785196f26e92d82cf4445654ba84e4a9671c57";
+
+  sha256 = "sha256-s1sdXSrLu6uSOmjprbUa4cFsE2Vj7JX5i75e4vRnlvg=";
+
+  isUnstable = true;
+}
diff --git a/pkgs/os-specific/linux/zsa-udev-rules/default.nix b/pkgs/os-specific/linux/zsa-udev-rules/default.nix
index ac69dc13b47..c015da7456a 100644
--- a/pkgs/os-specific/linux/zsa-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/zsa-udev-rules/default.nix
@@ -1,18 +1,17 @@
 { lib, stdenv, fetchFromGitHub }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "zsa-udev-rules";
-  version = "unstable-2020-12-16";
+  version = "unstable-2022-10-26";
 
-  # TODO: use version and source from nixpkgs/pkgs/development/tools/wally-cli/default.nix after next release
   src = fetchFromGitHub {
     owner = "zsa";
     repo = "wally";
-    rev = "e5dde3c700beab39fb941c6941e55535bf9b2af6";
-    sha256 = "0pkybi32r1hrmpa1mc8qlzhv7xy5n5rr5ah25lbr0cipp1bda417";
+    rev = "623a50d0e0b90486e42ad8ad42b0a7313f7a37b3";
+    hash = "sha256-meR2V7T4hrJFXFPLENHoAgmOILxxynDBk0BLqzsAZvQ=";
   };
 
-  # it only installs files
+  # Only copies udevs rules
   dontConfigure = true;
   dontBuild = true;
   dontFixup = true;