summary refs log tree commit diff
path: root/pkgs/os-specific/linux
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific/linux')
-rw-r--r--pkgs/os-specific/linux/cpuid/default.nix4
-rw-r--r--pkgs/os-specific/linux/cpustat/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-manager/default.nix10
-rw-r--r--pkgs/os-specific/linux/firmware/firmware-updater/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/source.nix6
-rw-r--r--pkgs/os-specific/linux/firmware/sof-firmware/default.nix4
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix3
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json60
-rw-r--r--pkgs/os-specific/linux/kernel/linux-5.15.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.1.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.2.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-6.3.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.15.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.4.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-testing.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/make-maple-state-reusable-after-mas_empty_area.patch21
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix2
-rw-r--r--pkgs/os-specific/linux/kernel/patches.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix2
-rw-r--r--pkgs/os-specific/linux/kvdo/default.nix11
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/linux/libcap/default.nix4
-rw-r--r--pkgs/os-specific/linux/microcode/intel.nix4
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/default.nix11
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix10
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix8
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix7
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix346
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix14
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix4
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix4
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix18
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix94
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix156
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix13
-rw-r--r--pkgs/os-specific/linux/minimal-bootstrap/utils.nix48
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix42
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/generic.nix3
-rw-r--r--pkgs/os-specific/linux/odp-dpdk/default.nix39
-rw-r--r--pkgs/os-specific/linux/pam_p11/default.nix11
-rw-r--r--pkgs/os-specific/linux/power-profiles-daemon/default.nix4
-rw-r--r--pkgs/os-specific/linux/vdo/default.nix2
-rw-r--r--pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix8
-rw-r--r--pkgs/os-specific/linux/zfs/default.nix270
-rw-r--r--pkgs/os-specific/linux/zfs/generic.nix234
-rw-r--r--pkgs/os-specific/linux/zfs/stable.nix26
-rw-r--r--pkgs/os-specific/linux/zfs/unstable.nix34
51 files changed, 904 insertions, 707 deletions
diff --git a/pkgs/os-specific/linux/cpuid/default.nix b/pkgs/os-specific/linux/cpuid/default.nix
index 57b03ba8bdb..381576492af 100644
--- a/pkgs/os-specific/linux/cpuid/default.nix
+++ b/pkgs/os-specific/linux/cpuid/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "cpuid";
-  version = "20230406";
+  version = "20230505";
 
   src = fetchurl {
     url = "http://etallen.com/cpuid/${pname}-${version}.src.tar.gz";
-    sha256 = "sha256-9ARd5TXzDjTowBKwVM5m9ArDmRRNbjw4lr2AwN7u8bA=";
+    sha256 = "sha256-VdMEAM1rq5rPNZft/JpSeiWOOntcQMzJuLMrENPimzA=";
   };
 
   # For pod2man during the build process.
diff --git a/pkgs/os-specific/linux/cpustat/default.nix b/pkgs/os-specific/linux/cpustat/default.nix
index c37c191d8c5..e5bbd388081 100644
--- a/pkgs/os-specific/linux/cpustat/default.nix
+++ b/pkgs/os-specific/linux/cpustat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpustat";
-  version = "0.02.17";
+  version = "0.02.19";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-4HDXRtklzQSsywCGCTKdz6AtZta9R1mx7qkT7skX6Kc=";
+    hash = "sha256-MujdgA+rFLrRc/N9yN7udnarA1TCzX//95hoXTUHG8Q=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
index bb7033e8774..2e059e74a37 100644
--- a/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-manager/default.nix
@@ -2,7 +2,9 @@
 , stdenv
 , rustPlatform
 , fetchFromGitHub
+, cargo
 , pkg-config
+, rustc
 , openssl
 , udev
 , gtk3
@@ -32,11 +34,11 @@ stdenv.mkDerivation rec {
     substituteInPlace Makefile --replace '$(DESTDIR)/etc' '$(DESTDIR)$(prefix)/etc'
   '';
 
-  nativeBuildInputs = with rustPlatform; [
-    rust.cargo
-    rust.rustc
+  nativeBuildInputs = [
+    cargo
+    rustc
     pkg-config
-    cargoSetupHook
+    rustPlatform.cargoSetupHook
     wrapGAppsHook
   ];
 
diff --git a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
index 8520d69908c..54b370415bc 100644
--- a/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
+++ b/pkgs/os-specific/linux/firmware/firmware-updater/default.nix
@@ -1,9 +1,9 @@
 { lib
-, flutter
+, flutter37
 , fetchFromGitHub
 }:
 
-flutter.buildFlutterApplication {
+flutter37.buildFlutterApplication {
   pname = "firmware-updater";
   version = "unstable-2023-04-30";
 
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
index eb917fc68de..e1d77a03200 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
@@ -1,6 +1,6 @@
 # This file is autogenerated! Run ./update.sh to regenerate.
 {
-  version = "20230310";
-  sourceHash = "sha256-a0Or/ov+YDbDbyUy65j95wgW1ZBo2LIxYWR7L6z6Usw=";
-  outputHash = "sha256-BL1dSTAjg5F1JWhoVYelMJRv+lMZNA8S7FbGIQWemMo=";
+  version = "20230515";
+  sourceHash = "sha256-VcA873r9jVYqDqEcvz/PVGfCAhLXr0sMXQincWNLEIs=";
+  outputHash = "sha256-h3KDK3KiD88dvTvLlLL2XczY1ZeEVnYEzh9sqbo1dZ8=";
 }
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index 9823e8c7ad5..60fa6dea9ec 100644
--- a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "2.2.4";
+  version = "2.2.5";
 
   src = fetchurl {
     url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-v${version}.tar.gz";
-    sha256 = "sha256-zoquuhA6pWqCZiVSsPM/M6hZqhAI2L+8LCLwzPyMazo=";
+    sha256 = "sha256-V39FCHW9gzr5uLcW42jYc6rJE6Nd2ZbHqg9Srd3vku4=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index da382581ed5..59f9d368f2f 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.369";
+  version = "0.370";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    sha256 = "sha256-0AyWRir2pT4wBf2/06zVDIUWru8oGaIHoKXVz/3CiSc=";
+    sha256 = "sha256-fqhYPKqtuI+7h/SgdWI4i7jBTgluy/hI8Q6pq4LKtY4=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index 7a1f8199961..18b31406796 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.2.0";
+  version = "6.3.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-TXJzAgDsWyqrqhovIFU8Z0gpLwZdmhVMfV4iVZ35/WI=";
+    sha256 = "sha256-37KpjbluemU8/8ZpMzWhpGbimjS2rFKL5I814dJ2ZzI=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index f1cba771ed1..3520f1bd5cf 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -315,6 +315,7 @@ let
       DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
       DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
       DRM_AMD_DC_DCN = whenBetween "5.11" "6.4" yes;
+      DRM_AMD_DC_FP = whenAtLeast "6.4" yes;
       DRM_AMD_DC_HDCP = whenBetween "5.5" "6.4" yes;
       DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
@@ -1024,6 +1025,8 @@ let
       CROS_EC_ISHTP = module;
 
       CROS_KBD_LED_BACKLIGHT = module;
+
+      TCG_TIS_SPI_CR50 = whenAtLeast "5.5" yes;
     } // optionalAttrs (versionAtLeast version "5.4" && stdenv.hostPlatform.system == "x86_64-linux") {
       CHROMEOS_LAPTOP = module;
       CHROMEOS_PSTORE = module;
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index ae97f9dd60d..14bb13c463b 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,61 +2,61 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.313-hardened1.patch",
-            "sha256": "0qpf9chiydj6dcka1lf6qdx462wq0salxac3kkl32l33karax292",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.313-hardened1/linux-hardened-4.14.313-hardened1.patch"
+            "name": "linux-hardened-4.14.314-hardened1.patch",
+            "sha256": "08d0mkkc22apdy0m0z5qkkl4xb8d9is0ip3v8rb47bqybmxx879h",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.314-hardened1/linux-hardened-4.14.314-hardened1.patch"
         },
-        "sha256": "0k2j856niappvkp9m1wxr87xvbwdzdy03mbcj827kmpjd9gdca76",
-        "version": "4.14.313"
+        "sha256": "0lwiykv2ci7lrjvvykbiqavzzizdkf8xxqlybixi9l1as7q02v47",
+        "version": "4.14.314"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.281-hardened1.patch",
-            "sha256": "0qhf0835zwmj0z2654bhyc6zww68g8ng4ghg5ivw2zcfv6yssv17",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.281-hardened1/linux-hardened-4.19.281-hardened1.patch"
+            "name": "linux-hardened-4.19.282-hardened1.patch",
+            "sha256": "1zy3hk5aykyw8nngzjb46i6q1i4sll5qhskycdhji9ga3wbl4z97",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.282-hardened1/linux-hardened-4.19.282-hardened1.patch"
         },
-        "sha256": "13nwzsh3h634450k37pxdca5j8vr3qswx7k79bs2999xp2js9pf0",
-        "version": "4.19.281"
+        "sha256": "02z20879xl4ya957by1p35vi1a7myzxwiqd9cnvm541sgnci99a3",
+        "version": "4.19.282"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.178-hardened1.patch",
-            "sha256": "142ym9z6c9bcq2hpv2ik6xsjlvyyvw3vx8ggp4a67zwv6apg48v3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.178-hardened1/linux-hardened-5.10.178-hardened1.patch"
+            "name": "linux-hardened-5.10.179-hardened1.patch",
+            "sha256": "0mjfk6b6wvr6646sbl47rhs5jjbmnhfx9wkw44apy92l7mnk983r",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.179-hardened1/linux-hardened-5.10.179-hardened1.patch"
         },
-        "sha256": "1bx8wws9gvksg1c1af29nm03jjz2f5a5sq9hzc00ymjyf7isvkqs",
-        "version": "5.10.178"
+        "sha256": "0abylcqbzpxxh45kmvd9i2cig64aajz87j5c8vm3w1ab2mf49g8v",
+        "version": "5.10.179"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.108-hardened1.patch",
-            "sha256": "1qfmx640b2s10q3sz0lcn1fsfbhklg8l4bzahrsdq6gkvsy9lyxn",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.108-hardened1/linux-hardened-5.15.108-hardened1.patch"
+            "name": "linux-hardened-5.15.110-hardened1.patch",
+            "sha256": "1kfad446bnkmsssvhn5w30v3qi4ysja6vgfa01jzwvlnvzizfy0c",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.110-hardened1/linux-hardened-5.15.110-hardened1.patch"
         },
-        "sha256": "1fj38bvsyr9g89qr8pcjrp0kaq44g301x46gyjibq73gljnnkswb",
-        "version": "5.15.108"
+        "sha256": "0nqbhgafl513pdfn55j608829bsw8kn0v616gblxqy4rgg3zqacq",
+        "version": "5.15.110"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.241-hardened1.patch",
-            "sha256": "1nksqvc1ql42v92bfp26yyczvzslzl73mhnfc83j6cayqx8dw59z",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.241-hardened1/linux-hardened-5.4.241-hardened1.patch"
+            "name": "linux-hardened-5.4.242-hardened1.patch",
+            "sha256": "1g2szikq3ac3gshvglvda6chirv2al43sq6byach1hg2sddbxsx0",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.242-hardened1/linux-hardened-5.4.242-hardened1.patch"
         },
-        "sha256": "0z7api3qcjrd6w7fva7k6fj4zx17mg5ibn28a6qbgy27dyny1h7z",
-        "version": "5.4.241"
+        "sha256": "0a7wfi84p74qsnbj1vamz4qxzp94v054jp1csyfl0blz3knrlbql",
+        "version": "5.4.242"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.25-hardened1.patch",
-            "sha256": "1s9fx4nznmabg7b19qm7nwhpgdvin4f2gxd8f27zh7anbv9na4x7",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.25-hardened1/linux-hardened-6.1.25-hardened1.patch"
+            "name": "linux-hardened-6.1.27-hardened1.patch",
+            "sha256": "0bg149qx7nwpxhajn6283cfgrp151477xpbl5rqhcfk47w3alnk4",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.27-hardened1/linux-hardened-6.1.27-hardened1.patch"
         },
-        "sha256": "149h95r5msvqah868zd36y92ls9h41cr1rb5vzinl20mxdn46wnb",
-        "version": "6.1.25"
+        "sha256": "01grx5y48scyyihpj176knn5yvgpxv2gfkli03rwj31xvnb4pdy2",
+        "version": "6.1.27"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-5.15.nix b/pkgs/os-specific/linux/kernel/linux-5.15.nix
index 64f8c167cc6..dea4afa7010 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.15.110";
+  version = "5.15.111";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0nqbhgafl513pdfn55j608829bsw8kn0v616gblxqy4rgg3zqacq";
+    sha256 = "1hmfvii77w70dx1lsfigc7nmjblvs1q131q48didsn01khjymkkp";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.1.nix b/pkgs/os-specific/linux/kernel/linux-6.1.nix
index 9b9c772b643..a36ab40a8b8 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.1.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.27";
+  version = "6.1.28";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,8 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "01grx5y48scyyihpj176knn5yvgpxv2gfkli03rwj31xvnb4pdy2";
+    sha256 = "1w56qgf1vgk3dmh4xw6699kjm5pdqvyfzr19ah5yy3xj50a4q2bs";
   };
-  # TODO: possible to remove after any rebuild, e.g. after update.
-  extraConfig = lib.optionalString (buildPackages.stdenv.system == "x86_64-linux") "\n";
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.2.nix b/pkgs/os-specific/linux/kernel/linux-6.2.nix
index 2756beace07..9c20adac9fe 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.2.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.2.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.2.14";
+  version = "6.2.15";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0ab756x6baza5wmi0r836g7z0hkvby65g0k6n1sd95nl16irzg0f";
+    sha256 = "1hcgxmwp1977wkj2ylxzbfqj5qwjc6czvd9yvdm0qrj422939ylz";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-6.3.nix b/pkgs/os-specific/linux/kernel/linux-6.3.nix
index 4df0241a9d8..007eed0fa0a 100644
--- a/pkgs/os-specific/linux/kernel/linux-6.3.nix
+++ b/pkgs/os-specific/linux/kernel/linux-6.3.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.3.1";
+  version = "6.3.2";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0aizkgwdmdjrgab67yjfaqcmvfh7wb3b3mdq9qfxpq6mlys0yqkq";
+    sha256 = "0a2kki763lrlafh6kf9ca8nxrdrk5043k7vdzy4pjgyahbrfq4mn";
   };
 } // (args.argsOverride or { }))
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index d5d83fb2370..6ffe60b4ee1 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.15.107-rt62"; # updated by ./update-rt.sh
+  version = "5.15.111-rt63"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1a5gqpxmzls5mp4a0cw10ldrps4pvbn19nzfri91ys25j1v0wdqr";
+    sha256 = "1hmfvii77w70dx1lsfigc7nmjblvs1q131q48didsn01khjymkkp";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0w7ksdv3xpzqiwfxc007k496ghklblb7kglswxhn7y1yqn6pgqzs";
+      sha256 = "1jixgqzyns56804dsjkg9n04mbaqrgwvsbgv5jxi2mip1p8spm8s";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 0bf720edfaa..821e11802e5 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.230-rt80"; # updated by ./update-rt.sh
+  version = "5.4.242-rt81"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0bz6hfhsahymys2g9s4nzf862z0zfq4346577cpvf98hrhnd6kx7";
+    sha256 = "0a7wfi84p74qsnbj1vamz4qxzp94v054jp1csyfl0blz3knrlbql";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "19vcalg76vi66g3rk56ky873276is4r67sz2i4vympjq9bskrwrz";
+      sha256 = "1wszhzw9ic018x3jiz8x1ffxxg30wpy4db7hja44b661p9fjm1dc";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index c13857ab28f..68eb8711056 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.19-rt8"; # updated by ./update-rt.sh
+  version = "6.1.26-rt8"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "0iw6b9gmhpk6r1asds5kfg6drqvaxy15xicqx9ga873cbxp1r6cy";
+    sha256 = "0461ckgh9qm1pj9xyi61cvawqpavn2sb44wjx5g4mmkrm11w3p6z";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1nd3x7rgssf3f9vxsplnp5zg0cbixm9lf6sswlnl6pcvj4adagg1";
+      sha256 = "1nwbj6cx2sa74f772wxmm5czd6c8v3s2f6919qri19xpm6kndkda";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-testing.nix b/pkgs/os-specific/linux/kernel/linux-testing.nix
index 59be4a08e2e..6736dd18cdc 100644
--- a/pkgs/os-specific/linux/kernel/linux-testing.nix
+++ b/pkgs/os-specific/linux/kernel/linux-testing.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4-rc1";
+  version = "6.4-rc2";
   extraMeta.branch = lib.versions.majorMinor version;
 
   # modDirVersion needs to be x.y.z, will always add .0
@@ -11,7 +11,7 @@ buildLinux (args // rec {
 
   src = fetchzip {
     url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
-    hash = "sha256-ayKzQNYfm8UjGZc8fy6sJF8xnkTxCCKpDv2TwdtKuKo=";
+    hash = "sha256-CQwSN5LQxGO900QLMAXcjGhB2o+6rZgXHQ+gCJtVaeU=";
   };
 
   # Should the testing kernels ever be built on Hydra?
diff --git a/pkgs/os-specific/linux/kernel/make-maple-state-reusable-after-mas_empty_area.patch b/pkgs/os-specific/linux/kernel/make-maple-state-reusable-after-mas_empty_area.patch
new file mode 100644
index 00000000000..47e1bbbd5a6
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/make-maple-state-reusable-after-mas_empty_area.patch
@@ -0,0 +1,21 @@
+--- a/lib/maple_tree.c
++++ b/lib/maple_tree.c
+@@ -5317,15 +5317,9 @@
+ 
+ 	mt = mte_node_type(mas->node);
+ 	pivots = ma_pivots(mas_mn(mas), mt);
+-	if (offset)
+-		mas->min = pivots[offset - 1] + 1;
+-
+-	if (offset < mt_pivots[mt])
+-		mas->max = pivots[offset];
+-
+-	if (mas->index < mas->min)
+-		mas->index = mas->min;
+-
++	min = mas_safe_min(mas, pivots, offset);
++	if (mas->index < min)
++		mas->index = min;
+ 	mas->last = mas->index + size - 1;
+ 	return 0;
+ }
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 656ca708631..6d1ad766d68 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -141,7 +141,7 @@ stdenv.mkDerivation ({
   postPatch = ''
     sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
 
-    # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
+    # fixup for pre-4.15 kernels using the $(cd $foo && /bin/pwd) pattern
     # FIXME: remove when no longer needed
     substituteInPlace Makefile tools/scripts/Makefile.include --replace /bin/pwd pwd
 
diff --git a/pkgs/os-specific/linux/kernel/patches.nix b/pkgs/os-specific/linux/kernel/patches.nix
index f2225096dd5..2330db4e68c 100644
--- a/pkgs/os-specific/linux/kernel/patches.nix
+++ b/pkgs/os-specific/linux/kernel/patches.nix
@@ -58,6 +58,12 @@
     patch = ./export-rt-sched-migrate.patch;
   };
 
+  # https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git/patch/?id=39bf07d812b888b23983a9443ad967ca9b61551d
+  make-maple-state-reusable-after-mas_empty_area = {
+    name = "make-maple-state-reusable-after-mas_empty_area";
+    patch = ./make-maple-state-reusable-after-mas_empty_area.patch;
+  };
+
   fix-em-ice-bonding = {
     name = "fix-em-ice-bonding";
     patch = ./fix-em-ice-bonding.patch;
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 360daf0a465..64d01c9f168 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -3,14 +3,14 @@
 let
   # These names are how they are designated in https://xanmod.org.
   ltsVariant = {
-    version = "6.1.25";
-    hash = "sha256-Cn8NAVdfL2VJIPuZ3tANxB3VyQI0X2/YZG0/4r/ccYg=";
+    version = "6.1.27";
+    hash = "sha256-Wq95e0UEwbm1nOQNOdUuxTWGfYz/UXvSbfl3P1AEnw0=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.2.12";
-    hash = "sha256-K/s1nSLOrzZ/A3pnv9qFs8SkI9R6keG0WGV1o7K6jUQ=";
+    version = "6.3.1";
+    hash = "sha256-ofCL8LxSndjj2pg8tphe58n51+TbSDcLDrCFGFSoLhg=";
     variant = "main";
   };
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 7401748c221..b48c9de08a3 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -32,7 +32,7 @@ let
 
     extraMeta = {
       branch = lib.versions.majorMinor version + "/master";
-      maintainers = with lib.maintainers; [ pedrohlc ];
+      maintainers = with lib.maintainers; [ ];
       description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads." +
         lib.optionalString isLqx " (Same as linux_zen but less aggressive release schedule)";
     };
diff --git a/pkgs/os-specific/linux/kvdo/default.nix b/pkgs/os-specific/linux/kvdo/default.nix
index 7e7c765bd81..e2390b68a5c 100644
--- a/pkgs/os-specific/linux/kvdo/default.nix
+++ b/pkgs/os-specific/linux/kvdo/default.nix
@@ -1,16 +1,19 @@
 { stdenv, lib, fetchFromGitHub, vdo, kernel }:
 
 stdenv.mkDerivation rec {
-  inherit (vdo) version;
+  inherit (vdo);
   pname = "kvdo";
+  version = "8.2.1.6"; # bump this version with vdo
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
     repo = "kvdo";
     rev = version;
-    hash = "sha256-4FYTFUIvGjea3bh2GbQYG7hSswVDdNS3S+jWQ9+inpg=";
+    hash = "sha256-S5r2Rgx5pWk4IsdIwmfZkuGL/oEQ3prquyVqxjR3cO0=";
   };
 
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
   dontConfigure = true;
   enableParallelBuilding = true;
 
@@ -19,7 +22,7 @@ stdenv.mkDerivation rec {
 
   preBuild = ''
     makeFlags="$makeFlags -C ${KSRC} M=$(pwd)"
-'';
+  '';
   installTargets = [ "modules_install" ];
 
   meta = with lib; {
@@ -27,6 +30,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/dm-vdo/kvdo";
     description = "A pair of kernel modules which provide pools of deduplicated and/or compressed block storage";
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "5.15" || kernel.kernelAtLeast "5.17";
+    broken = kernel.kernelOlder "5.15";
   };
 }
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index d6bb9d4a431..be1a1453e87 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-/vt6IA1o0gjFtXUWhEKIZ1DUWIN2LOvrhLfFzJBACGY=";
+    sha256 = "sha256-NimK4pdYcai21hZHdP1mBX1MOlNY61iDJ+PDYwpRuVE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/libcap/default.nix b/pkgs/os-specific/linux/libcap/default.nix
index fcd42e3279a..553331ab599 100644
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@@ -7,11 +7,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.67";
+  version = "2.68";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    sha256 = "sha256-zpsi/cJxvrba51Q9pfdM8ky4LmhIz9CIpaBp3sXqUZg=";
+    sha256 = "sha256-kL47bUG+X4GuSwPsdgErDSfIKSk2hPbAW2XV+cznJLI=";
   };
 
   outputs = [ "out" "dev" "lib" "man" "doc" ]
diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix
index 83ad98d1b1d..cd11bcb9e21 100644
--- a/pkgs/os-specific/linux/microcode/intel.nix
+++ b/pkgs/os-specific/linux/microcode/intel.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "microcode-intel";
-  version = "20230214";
+  version = "20230512";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "Intel-Linux-Processor-Microcode-Data-Files";
     rev = "microcode-${version}";
-    hash = "sha256-SwdE1c7OEg5nncs5QqaTKCL77KddeHw7ZilctQ4L9RA=";
+    hash = "sha256-Ay907cXbT+LlE4foK4TODcDB5Rx/Zo7HY17erem71rw=";
   };
 
   nativeBuildInputs = [ iucode-tool libarchive ];
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index 97c9a26b53f..5907cdb4cda 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -20,11 +20,18 @@ lib.makeScope
     mes = callPackage ./mes { };
     mes-libc = callPackage ./mes/libc.nix { };
 
-    inherit (callPackage ./stage0-posix { }) kaem m2libc mescc-tools mescc-tools-extra;
+    stage0-posix = callPackage ./stage0-posix { };
+
+    inherit (self.stage0-posix) kaem m2libc mescc-tools mescc-tools-extra;
 
     tinycc-bootstrappable = callPackage ./tinycc/bootstrappable.nix { };
     tinycc-mes = callPackage ./tinycc/mes.nix { };
 
-    inherit (callPackage ./utils.nix { }) fetchurl derivationWithMeta writeTextFile writeText runCommand;
+    inherit (callPackage ./utils.nix { }) fetchurl derivationWithMeta writeTextFile writeText;
 
+    test = kaem.runCommand "minimal-bootstrap-test" {} ''
+      echo ${mes.compiler.tests.get-version}
+      echo ${tinycc-mes.compiler.tests.chain}
+      mkdir ''${out}
+    '';
   })
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
index 0db52e28742..7a467ce4487 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnumake/default.nix
@@ -1,6 +1,6 @@
 { lib
-, runCommand
 , fetchurl
+, kaem
 , tinycc
 , gnupatch
 }:
@@ -45,7 +45,7 @@ let
         ./configure \
           --build i686-pc-linux-gnu \
           --host i686-pc-linux-gnu \
-          CC="${tinycc-mes}/bin/tcc -static" \
+          CC="${tinycc.compiler}/bin/tcc -B ${tinycc.libs}/lib -static" \
           ac_cv_func_dup=no
     - `ac_cv_func_dup` disabled as mes-libc doesn't implement tmpfile()
 
@@ -145,10 +145,10 @@ let
 
   objects = map (x: lib.replaceStrings [".c"] [".o"] (builtins.baseNameOf x)) sources;
 in
-runCommand "${pname}-${version}" {
+kaem.runCommand "${pname}-${version}" {
   inherit pname version;
 
-  nativeBuildInputs = [ tinycc gnupatch ];
+  nativeBuildInputs = [ tinycc.compiler gnupatch ];
 
   meta = with lib; {
     description = "A tool to control the generation of non-source files from sources";
@@ -174,7 +174,7 @@ runCommand "${pname}-${version}" {
   cp lib/fnmatch.in.h lib/fnmatch.h
 
   # Compile
-  alias CC="tcc ${lib.concatStringsSep " " CFLAGS}"
+  alias CC="tcc -B ${tinycc.libs}/lib ${lib.concatStringsSep " " CFLAGS}"
   ${lib.concatMapStringsSep "\n" (f: "CC -c ${f}") sources}
 
   # Link
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix
index 2a44f3805d4..6cb9d23cafa 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gnupatch/default.nix
@@ -1,6 +1,6 @@
 { lib
-, runCommand
 , fetchurl
+, kaem
 , tinycc
 }:
 let
@@ -67,10 +67,10 @@ let
 
   objects = map (x: lib.replaceStrings [".c"] [".o"] (builtins.baseNameOf x)) sources;
 in
-runCommand "${pname}-${version}" {
+kaem.runCommand "${pname}-${version}" {
   inherit pname version;
 
-  nativeBuildInputs = [ tinycc ];
+  nativeBuildInputs = [ tinycc.compiler ];
 
   meta = with lib; {
     description = "GNU Patch, a program to apply differences to files";
@@ -91,7 +91,7 @@ runCommand "${pname}-${version}" {
   catm config.h
 
   # Build
-  alias CC="tcc ${lib.concatStringsSep " " CFLAGS}"
+  alias CC="tcc -B ${tinycc.libs}/lib ${lib.concatStringsSep " " CFLAGS}"
   ${lib.concatMapStringsSep "\n" (f: "CC -c ${f}") sources}
 
   # Link
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
index 23c634421cb..46cd06e53b2 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/ln-boot/default.nix
@@ -1,5 +1,5 @@
 { lib
-, runCommand
+, kaem
 , mes
 }:
 let
@@ -8,7 +8,7 @@ let
 
   src = ./ln.c;
 in
-runCommand "${pname}-${version}" {
+kaem.runCommand "${pname}-${version}" {
   inherit pname version;
 
   meta = with lib; {
@@ -20,7 +20,8 @@ runCommand "${pname}-${version}" {
   };
 } ''
   mkdir -p ''${out}/bin
-  ${mes}/bin/mes --no-auto-compile -e main ${mes}/bin/mescc.scm -- \
+  ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+    -L ${mes.libs}/lib \
     -lc+tcc \
     -o ''${out}/bin/ln \
     ${src}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
index abf3955eb2d..9d28de47189 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/default.nix
@@ -1,11 +1,17 @@
 { lib
-, runCommand
 , fetchurl
 , writeText
 , callPackage
+, kaem
 , m2libc
 , mescc-tools
 }:
+
+# Maintenance note:
+# Build steps have been adapted from build-aux/bootstrap.sh.in
+# as well as the live-bootstrap project
+# https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/mes-0.24.2/mes-0.24.2.kaem
+
 let
   pname = "mes";
   version = "0.24.2";
@@ -28,26 +34,6 @@ let
   # add symlink() to libc+tcc so we can use it in ln-boot
   libc_tcc_SOURCES = sources.libc_tcc_SOURCES ++ [ "lib/linux/symlink.c" ];
 
-  compile = sources:
-    lib.concatMapStringsSep
-      "\n"
-      (f: ''CC -c ''${MES_PREFIX}/${f}'')
-      sources;
-  replaceExt = ext: source:
-    lib.replaceStrings
-      [ ".c" ]
-      [ ext ]
-      (builtins.baseNameOf source);
-  archive = out: sources:
-    "catm ${out} ${lib.concatMapStringsSep " " (replaceExt ".o") sources}";
-  sourceArchive = out: sources:
-    "catm ${out} ${lib.concatMapStringsSep " " (replaceExt ".s") sources}";
-in
-runCommand "${pname}-${version}" {
-  inherit pname version;
-
-  passthru = { inherit src nyacc; };
-
   meta = with lib; {
     description = "Scheme interpreter and C compiler for bootstrapping";
     homepage = "https://www.gnu.org/software/mes";
@@ -55,135 +41,199 @@ runCommand "${pname}-${version}" {
     maintainers = with maintainers; [ emilytrau ];
     platforms = [ "i686-linux" ];
   };
-}
-# Maintenance note:
-# Build steps have been adapted from build-aux/bootstrap.sh.in
-# as well as the live-bootstrap project
-# https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/mes-0.24.2/mes-0.24.2.kaem
-''
-  # Unpack source
-  ungz --file ${src} --output mes.tar
-  mkdir ''${out} ''${out}/bin ''${out}/share
-  cd ''${out}/share
-  untar --non-strict --file ''${NIX_BUILD_TOP}/mes.tar # ignore symlinks
-
-  MES_PREFIX=''${out}/share/mes-${version}
-  LIBDIR=''${MES_PREFIX}/lib
-
-  cd ''${MES_PREFIX}
-
-  cp ${config_h} include/mes/config.h
-
-  mkdir include/arch
-  cp include/linux/x86/syscall.h include/arch/syscall.h
-  cp include/linux/x86/kernel-stat.h include/arch/kernel-stat.h
-
-  # Remove pregenerated files
-  rm mes/module/mes/psyntax.pp mes/module/mes/psyntax.pp.header
-
-  # These files are symlinked in the repo
-  cp mes/module/srfi/srfi-9-struct.mes mes/module/srfi/srfi-9.mes
-  cp mes/module/srfi/srfi-9/gnu-struct.mes mes/module/srfi/srfi-9/gnu.mes
-
-  # Fixes to support newer M2-Planet
-  catm x86_defs.M1 ${m2libc}/x86/x86_defs.M1 lib/m2/x86/x86_defs.M1
-  cp x86_defs.M1 lib/m2/x86/x86_defs.M1
-  rm x86_defs.M1
-
-  # Remove environment impurities
-  __GUILE_LOAD_PATH="\"''${MES_PREFIX}/mes/module:''${MES_PREFIX}/module:${nyacc.guilePath}\""
-  boot0_scm=mes/module/mes/boot-0.scm
-  guile_mes=mes/module/mes/guile.mes
-  replace --file ''${boot0_scm} --output ''${boot0_scm} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
-  replace --file ''${guile_mes} --output ''${guile_mes} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
-
-  module_mescc_scm=module/mescc/mescc.scm
-  replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"M1\")" --replace-with "\"${mescc-tools}/bin/M1\""
-  replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"HEX2\")" --replace-with "\"${mescc-tools}/bin/hex2\""
-  replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"BLOOD_ELF\")" --replace-with "\"${mescc-tools}/bin/blood-elf\""
-  replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
-
-  mes_c=src/mes.c
-  replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
-  replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
-
-  # Increase runtime resource limits
-  gc_c=src/gc.c
-  replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_ARENA\")" --replace-with "\"100000000\""
-  replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_MAX_ARENA\")" --replace-with "\"100000000\""
-  replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_STACK\")" --replace-with "\"6000000\""
-
-  # Create mescc.scm
-  mescc_in=scripts/mescc.scm.in
-  replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
-  replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"includedir\")" --replace-with "\"''${MES_PREFIX}/include\""
-  replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"libdir\")" --replace-with "\"''${MES_PREFIX}/lib\""
-  replace --file ''${mescc_in} --output ''${mescc_in} --match-on @prefix@ --replace-with ''${MES_PREFIX}
-  replace --file ''${mescc_in} --output ''${mescc_in} --match-on @VERSION@ --replace-with ${version}
-  replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_cpu@ --replace-with x86
-  replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_kernel@ --replace-with linux
-  cp ''${mescc_in} ''${out}/bin/mescc.scm
-
-  # Build mes-m2
-  mes_cpu=x86
-  stage0_cpu=x86
-  kaem --verbose --strict --file kaem.run
-  cp bin/mes-m2 ''${out}/bin/mes-m2
-  chmod 555 ''${out}/bin/mes-m2
 
+  srcPost = kaem.runCommand "${pname}-src-${version}" {
+    outputs = [ "out" "bin" ];
+    inherit meta;
+  } ''
+    # Unpack source
+    ungz --file ${src} --output mes.tar
+    mkdir ''${out}
+    cd ''${out}
+    untar --non-strict --file ''${NIX_BUILD_TOP}/mes.tar # ignore symlinks
+
+    MES_PREFIX=''${out}/mes-${version}
+
+    cd ''${MES_PREFIX}
+
+    cp ${config_h} include/mes/config.h
+
+    mkdir include/arch
+    cp include/linux/x86/syscall.h include/arch/syscall.h
+    cp include/linux/x86/kernel-stat.h include/arch/kernel-stat.h
+
+    # Remove pregenerated files
+    rm mes/module/mes/psyntax.pp mes/module/mes/psyntax.pp.header
+
+    # These files are symlinked in the repo
+    cp mes/module/srfi/srfi-9-struct.mes mes/module/srfi/srfi-9.mes
+    cp mes/module/srfi/srfi-9/gnu-struct.mes mes/module/srfi/srfi-9/gnu.mes
+
+    # Fixes to support newer M2-Planet
+    catm x86_defs.M1 ${m2libc}/x86/x86_defs.M1 lib/m2/x86/x86_defs.M1
+    cp x86_defs.M1 lib/m2/x86/x86_defs.M1
+    rm x86_defs.M1
+
+    # Remove environment impurities
+    __GUILE_LOAD_PATH="\"''${MES_PREFIX}/mes/module:''${MES_PREFIX}/module:${nyacc.guilePath}\""
+    boot0_scm=mes/module/mes/boot-0.scm
+    guile_mes=mes/module/mes/guile.mes
+    replace --file ''${boot0_scm} --output ''${boot0_scm} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
+    replace --file ''${guile_mes} --output ''${guile_mes} --match-on "(getenv \"GUILE_LOAD_PATH\")" --replace-with ''${__GUILE_LOAD_PATH}
+
+    module_mescc_scm=module/mescc/mescc.scm
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"M1\")" --replace-with "\"${mescc-tools}/bin/M1\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"HEX2\")" --replace-with "\"${mescc-tools}/bin/hex2\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"BLOOD_ELF\")" --replace-with "\"${mescc-tools}/bin/blood-elf\""
+    replace --file ''${module_mescc_scm} --output ''${module_mescc_scm} --match-on "(getenv \"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
+
+    mes_c=src/mes.c
+    replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
+    replace --file ''${mes_c} --output ''${mes_c} --match-on "getenv (\"srcdest\")" --replace-with "\"''${MES_PREFIX}\""
+
+    # Increase runtime resource limits
+    gc_c=src/gc.c
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_ARENA\")" --replace-with "\"100000000\""
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_MAX_ARENA\")" --replace-with "\"100000000\""
+    replace --file ''${gc_c} --output ''${gc_c} --match-on "getenv (\"MES_STACK\")" --replace-with "\"6000000\""
+
+    # Create mescc.scm
+    mescc_in=scripts/mescc.scm.in
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"MES_PREFIX\")" --replace-with "\"''${MES_PREFIX}\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"includedir\")" --replace-with "\"''${MES_PREFIX}/include\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on "(getenv \"libdir\")" --replace-with "\"''${MES_PREFIX}/lib\""
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @prefix@ --replace-with ''${MES_PREFIX}
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @VERSION@ --replace-with ${version}
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_cpu@ --replace-with x86
+    replace --file ''${mescc_in} --output ''${mescc_in} --match-on @mes_kernel@ --replace-with linux
+    mkdir -p ''${bin}/bin
+    cp ''${mescc_in} ''${bin}/bin/mescc.scm
+
+    # Build mes-m2
+    mes_cpu=x86
+    stage0_cpu=x86
+    kaem --verbose --strict --file kaem.run
+    cp bin/mes-m2 ''${bin}/bin/mes-m2
+    chmod 555 ''${bin}/bin/mes-m2
+  '';
+
+  srcPrefix = "${srcPost.out}/mes-${version}";
+
+  cc = "${srcPost.bin}/bin/mes-m2";
+  ccArgs = [
+    "-e" "main"
+    "${srcPost.bin}/bin/mescc.scm"
+    "--"
+    "-D" "HAVE_CONFIG_H=1"
+    "-I" "${srcPrefix}/include"
+    "-I" "${srcPrefix}/include/linux/x86"
+  ];
+
+  CC = toString ([ cc ] ++ ccArgs);
+
+  stripExt = source:
+    lib.replaceStrings
+      [ ".c" ]
+      [ "" ]
+      (builtins.baseNameOf source);
+
+  compile = source: kaem.runCommand (stripExt source) {} ''
+    mkdir ''${out}
+    cd ''${out}
+    ${CC} -c ${srcPrefix}/${source}
+  '';
+
+  crt1 = compile "/lib/linux/x86-mes-mescc/crt1.c";
+
+  getRes = suffix: res: "${res}/${res.name}${suffix}";
+
+  archive = out: sources:
+    "catm ${out} ${lib.concatMapStringsSep " " (getRes ".o") sources}";
+  sourceArchive = out: sources:
+    "catm ${out} ${lib.concatMapStringsSep " " (getRes ".s") sources}";
+
+  mkLib = libname: sources: let
+    os = map compile sources;
+  in kaem.runCommand "${pname}-${libname}-${version}" {
+    inherit meta;
+  } ''
+    LIBDIR=''${out}/lib
+    mkdir -p ''${LIBDIR}
+    cd ''${LIBDIR}
+
+    ${archive "${libname}.a" os}
+    ${sourceArchive "${libname}.s" os}
+  '';
+
+  libc-mini = mkLib "libc-mini" libc_mini_SOURCES;
+  libmescc = mkLib "libmescc" libmescc_SOURCES;
+  libc = mkLib "libc" libc_SOURCES;
+  libc_tcc = mkLib "libc+tcc" libc_tcc_SOURCES;
 
   # Recompile Mes and Mes C library using mes-m2 bootstrapped Mes
-  cd ''${NIX_BUILD_TOP}
-  alias CC="''${out}/bin/mes-m2 -e main ''${out}/bin/mescc.scm -- -D HAVE_CONFIG_H=1 -I ''${MES_PREFIX}/include -I ''${MES_PREFIX}/include/linux/x86"
-  mkdir -p ''${LIBDIR}/x86-mes
-
-  # crt1.o
-  CC -c ''${MES_PREFIX}/lib/linux/x86-mes-mescc/crt1.c
-  cp crt1.o ''${LIBDIR}/x86-mes
-  cp crt1.s ''${LIBDIR}/x86-mes
-
-  # libc-mini.a
-  ${compile libc_mini_SOURCES}
-  ${archive "libc-mini.a" libc_mini_SOURCES}
-  ${sourceArchive "libc-mini.s" libc_mini_SOURCES}
-  cp libc-mini.a ''${LIBDIR}/x86-mes
-  cp libc-mini.s ''${LIBDIR}/x86-mes
-
-  # libmescc.a
-  ${compile libmescc_SOURCES}
-  ${archive "libmescc.a" libmescc_SOURCES}
-  ${sourceArchive "libmescc.s" libmescc_SOURCES}
-  cp libmescc.a ''${LIBDIR}/x86-mes
-  cp libmescc.s ''${LIBDIR}/x86-mes
-
-  # libc.a
-  ${compile libc_SOURCES}
-  ${archive "libc.a" libc_SOURCES}
-  ${sourceArchive "libc.s" libc_SOURCES}
-  cp libc.a ''${LIBDIR}/x86-mes
-  cp libc.s ''${LIBDIR}/x86-mes
-
-  # libc+tcc.a
-  # optimisation: don't recompile common libc sources
-  ${compile (lib.subtractLists libc_SOURCES libc_tcc_SOURCES)}
-  ${archive "libc+tcc.a" libc_tcc_SOURCES}
-  ${sourceArchive "libc+tcc.s" libc_tcc_SOURCES}
-  cp libc+tcc.a ''${LIBDIR}/x86-mes
-  cp libc+tcc.s ''${LIBDIR}/x86-mes
+  libs = kaem.runCommand "${pname}-m2-libs-${version}" {
+    inherit pname version;
+
+    passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/mes --version
+      mkdir ''${out}
+    '';
+
+    inherit meta;
+  }
+  ''
+    LIBDIR=''${out}/lib
+    mkdir -p ''${out} ''${LIBDIR}
+
+    mkdir -p ''${LIBDIR}/x86-mes
+
+    # crt1.o
+    cp ${crt1}/crt1.o ''${LIBDIR}/x86-mes
+    cp ${crt1}/crt1.s ''${LIBDIR}/x86-mes
+
+    # libc-mini.a
+    cp ${libc-mini}/lib/libc-mini.a ''${LIBDIR}/x86-mes
+    cp ${libc-mini}/lib/libc-mini.s ''${LIBDIR}/x86-mes
+
+    # libmescc.a
+    cp ${libmescc}/lib/libmescc.a ''${LIBDIR}/x86-mes
+    cp ${libmescc}/lib/libmescc.s ''${LIBDIR}/x86-mes
+
+    # libc.a
+    cp ${libc}/lib/libc.a ''${LIBDIR}/x86-mes
+    cp ${libc}/lib/libc.s ''${LIBDIR}/x86-mes
+
+    # libc+tcc.a
+    cp ${libc_tcc}/lib/libc+tcc.a ''${LIBDIR}/x86-mes
+    cp ${libc_tcc}/lib/libc+tcc.s ''${LIBDIR}/x86-mes
+  '';
 
   # Build mes itself
-  ${compile mes_SOURCES}
-  ''${out}/bin/mes-m2 -e main ''${out}/bin/mescc.scm -- \
-    --base-address 0x08048000 \
-    -L ''${MES_PREFIX}/lib \
-    -L . \
-    -lc \
-    -lmescc \
-    -nostdlib \
-    -o ''${out}/bin/mes \
-    crt1.o \
-    ${lib.concatMapStringsSep " " (replaceExt ".o") mes_SOURCES}
-
-  # Check
-  ''${out}/bin/mes --version
-''
+  compiler = kaem.runCommand "${pname}-${version}" {
+    inherit pname version;
+
+    passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/mes --version
+      mkdir ''${out}
+    '';
+
+    inherit meta;
+  }
+  ''
+    mkdir -p ''${out}/bin
+
+    ${srcPost.bin}/bin/mes-m2 -e main ${srcPost.bin}/bin/mescc.scm -- \
+      --base-address 0x08048000 \
+      -L ''${srcPrefix}/lib \
+      -L ${libs}/lib \
+      -lc \
+      -lmescc \
+      -nostdlib \
+      -o ''${out}/bin/mes \
+      ${libs}/lib/x86-mes/crt1.o \
+      ${lib.concatMapStringsSep " " (getRes ".o") (map compile mes_SOURCES)}
+  '';
+in {
+  inherit srcPost srcPrefix nyacc;
+  inherit compiler libs;
+}
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
index 06cd95de87e..b21bd744e5f 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/libc.nix
@@ -1,18 +1,16 @@
 { lib
-, runCommand
+, kaem
 , ln-boot
 , mes
 , mes-libc
 }:
 let
   pname = "mes-libc";
-  inherit (mes) version;
+  inherit (mes.compiler) version;
 
   sources = (import ./sources.nix).x86.linux.gcc;
   inherit (sources) libtcc1_SOURCES libc_gnu_SOURCES;
 
-  prefix = "${mes}/share/mes-${version}";
-
   # Concatenate all source files into a convenient bundle
   # "gcc" variants of source files (eg. "lib/linux/x86-mes-gcc") can also be
   # compiled by tinycc
@@ -21,7 +19,8 @@ let
   # the operation in two
   firstLibc = lib.take 100 libc_gnu_SOURCES;
   lastLibc = lib.drop 100 libc_gnu_SOURCES;
-in runCommand "${pname}-${version}" {
+in
+kaem.runCommand "${pname}-${version}" {
   inherit pname version;
 
   nativeBuildInputs = [ ln-boot ];
@@ -36,11 +35,10 @@ in runCommand "${pname}-${version}" {
     platforms = [ "i686-linux" ];
   };
 } ''
-  cd ${prefix}
+  cd ${mes.srcPrefix}
 
   # mescc compiled libc.a
   mkdir -p ''${out}/lib/x86-mes
-  cp lib/x86-mes/libc.a ''${out}/lib/x86-mes
 
   # libc.c
   catm ''${TMPDIR}/first.c ${lib.concatStringsSep " " firstLibc}
@@ -58,5 +56,5 @@ in runCommand "${pname}-${version}" {
   cp lib/posix/getopt.c ''${out}/lib/libgetopt.c
 
   # Install headers
-  ln -s ${prefix}/include ''${out}/include
+  ln -s ${mes.srcPrefix}/include ''${out}/include
 ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix b/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
index 7a196fd5ef9..220b9b66730 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/mes/nyacc.nix
@@ -1,6 +1,6 @@
 { lib
-, runCommand
 , fetchurl
+, kaem
 , nyacc
 }:
 let
@@ -15,7 +15,7 @@ let
     sha256 = "065ksalfllbdrzl12dz9d9dcxrv97wqxblslngsc6kajvnvlyvpk";
   };
 in
-runCommand "${pname}-${version}" {
+kaem.runCommand "${pname}-${version}" {
   inherit pname version;
 
   passthru.guilePath = "${nyacc}/share/${pname}-${version}/module";
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
index 650644f6ef0..2b41261add3 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/default.nix
@@ -12,7 +12,9 @@ lib.makeScope newScope (self: with self; {
   kaem = callPackage ./kaem { };
   kaem-minimal = callPackage ./kaem/minimal.nix { };
 
-  inherit (callPackage ./stage0-posix-x86.nix { }) blood-elf-0 hex2 kaem-unwrapped M1 M2;
+  stage0-posix-x86 = callPackage ./stage0-posix-x86.nix { };
+
+  inherit (self.stage0-posix-x86) blood-elf-0 hex2 kaem-unwrapped M1 M2;
 
   mescc-tools = callPackage ./mescc-tools { };
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
index 2af660ad7a4..969dd35845e 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/kaem/default.nix
@@ -1,6 +1,9 @@
 { lib
 , derivationWithMeta
+, writeText
+, kaem
 , kaem-unwrapped
+, mescc-tools
 , mescc-tools-extra
 , version
 }:
@@ -23,6 +26,21 @@ derivationWithMeta {
   ];
   PATH = lib.makeBinPath [ mescc-tools-extra ];
 
+  passthru.runCommand = name: env: buildCommand:
+    derivationWithMeta ({
+      inherit name;
+
+      builder = "${kaem}/bin/kaem";
+      args = [
+        "--verbose"
+        "--strict"
+        "--file"
+        (writeText "${name}-builder" buildCommand)
+      ];
+
+      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [ kaem mescc-tools mescc-tools-extra ]);
+    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
+
   meta = with lib; {
     description = "Minimal build tool for running scripts on systems that lack any shell";
     homepage = "https://github.com/oriansj/mescc-tools";
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
index bb0e058906c..1f30b63cbd0 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/bootstrappable.nix
@@ -8,14 +8,14 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 { lib
-, runCommand
 , callPackage
 , fetchurl
+, kaem
 , mes
 , mes-libc
 }:
 let
-  inherit (callPackage ./common.nix { }) buildTinyccMes;
+  inherit (callPackage ./common.nix { }) buildTinyccMes recompileLibc;
 
   version = "unstable-2023-04-20";
   rev = "80114c4da6b17fbaabb399cc29f427e368309bc8";
@@ -24,7 +24,7 @@ let
     url = "https://gitlab.com/janneke/tinycc/-/archive/${rev}/tinycc-${rev}.tar.gz";
     sha256 = "1a0cw9a62qc76qqn5sjmp3xrbbvsz2dxrw21lrnx9q0s74mwaxbq";
   };
-  src = (runCommand "tinycc-bootstrappable-${version}-source" {} ''
+  src = (kaem.runCommand "tinycc-bootstrappable-${version}-source" {} ''
     ungz --file ${tarball} --output tinycc.tar
     mkdir -p ''${out}
     cd ''${out}
@@ -39,50 +39,54 @@ let
     platforms = [ "i686-linux" ];
   };
 
-  tinycc-boot-mes = runCommand "tinycc-boot-mes-${version}" {} ''
-    catm config.h
-    ${mes}/bin/mes --no-auto-compile -e main ${mes}/bin/mescc.scm -- \
-      -S \
-      -o tcc.s \
-      -I . \
-      -D BOOTSTRAP=1 \
-      -I ${src} \
-      -D TCC_TARGET_I386=1 \
-      -D inline= \
-      -D CONFIG_TCCDIR=\"''${out}/lib\" \
-      -D CONFIG_SYSROOT=\"\" \
-      -D CONFIG_TCC_CRTPREFIX=\"''${out}/lib\" \
-      -D CONFIG_TCC_ELFINTERP=\"/mes/loader\" \
-      -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
-      -D TCC_LIBGCC=\"${mes-libc}/lib/x86-mes/libc.a\" \
-      -D CONFIG_TCC_LIBTCC1_MES=0 \
-      -D CONFIG_TCCBOOT=1 \
-      -D CONFIG_TCC_STATIC=1 \
-      -D CONFIG_USE_LIBGCC=1 \
-      -D TCC_MES_LIBC=1 \
-      -D TCC_VERSION=\"${version}\" \
-      -D ONE_SOURCE=1 \
-      ${src}/tcc.c
-    mkdir -p ''${out}/bin
-    ${mes}/bin/mes --no-auto-compile -e main ${mes}/bin/mescc.scm -- \
-      -l c+tcc \
-      -o ''${out}/bin/tcc \
-      tcc.s
+  pname = "tinycc-boot-mes";
 
-    ''${out}/bin/tcc -version
+  tinycc-boot-mes = rec {
+    compiler = kaem.runCommand "${pname}-${version}" {
+      passthru.tests.get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+        ${result}/bin/tcc -version
+        mkdir ''${out}
+      '';
+    } ''
+      catm config.h
+      ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+        -S \
+        -o tcc.s \
+        -I . \
+        -D BOOTSTRAP=1 \
+        -I ${src} \
+        -D TCC_TARGET_I386=1 \
+        -D inline= \
+        -D CONFIG_TCCDIR=\"\" \
+        -D CONFIG_SYSROOT=\"\" \
+        -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+        -D CONFIG_TCC_ELFINTERP=\"/mes/loader\" \
+        -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+        -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
+        -D TCC_LIBGCC=\"${mes-libc}/lib/x86-mes/libc.a\" \
+        -D CONFIG_TCC_LIBTCC1_MES=0 \
+        -D CONFIG_TCCBOOT=1 \
+        -D CONFIG_TCC_STATIC=1 \
+        -D CONFIG_USE_LIBGCC=1 \
+        -D TCC_MES_LIBC=1 \
+        -D TCC_VERSION=\"${version}\" \
+        -D ONE_SOURCE=1 \
+        ${src}/tcc.c
+      mkdir -p ''${out}/bin
+      ${mes.compiler}/bin/mes --no-auto-compile -e main ${mes.srcPost.bin}/bin/mescc.scm -- \
+        -L ${mes.libs}/lib \
+        -l c+tcc \
+        -o ''${out}/bin/tcc \
+        tcc.s
+    '';
 
-    # Recompile libc: crt{1,n,i}, libtcc.a, libc.a, libgetopt.a
-    mkdir -p ''${out}/lib
-    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crt1.o ${mes-libc}/lib/crt1.c
-    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crtn.o ${mes-libc}/lib/crtn.c
-    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crti.o ${mes-libc}/lib/crti.c
-    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libc.o ${mes-libc}/lib/libc.c
-    ''${out}/bin/tcc -ar cr ''${out}/lib/libc.a libc.o
-    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libtcc1.o ${mes-libc}/lib/libtcc1.c
-    ''${out}/bin/tcc -ar cr ''${out}/lib/libtcc1.a libtcc1.o
-    ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libgetopt.o ${mes-libc}/lib/libgetopt.c
-    ''${out}/bin/tcc -ar cr ''${out}/lib/libgetopt.a libgetopt.o
-  '';
+    libs = recompileLibc {
+      inherit pname version;
+      tcc = compiler;
+      src = mes-libc;
+      libtccOptions = mes-libc.CFLAGS;
+    };
+  };
 
   # Bootstrap stage build flags obtained from
   # https://gitlab.com/janneke/tinycc/-/blob/80114c4da6b17fbaabb399cc29f427e368309bc8/boot.sh
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
index 84f4bcc0ed5..d05ac35a6d9 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/common.nix
@@ -1,69 +1,107 @@
 { lib
-, runCommand
+, kaem
 , mes-libc
 , ln-boot
 }:
-{
-  buildTinyccMes = {
-    pname,
-    version,
-    src,
-    prev,
-    buildOptions,
-    libtccBuildOptions,
-    meta
-  }:
-    let
-      options = lib.strings.concatStringsSep " " buildOptions;
-      libtccOptions = lib.strings.concatStringsSep " " libtccBuildOptions;
-    in
-    runCommand "${pname}-${version}" {
-      inherit pname version meta;
-      nativeBuildInputs = [ ln-boot ];
-    } ''
-      catm config.h
-      mkdir -p ''${out}/bin
-      ${prev}/bin/tcc \
-        -g \
-        -v \
-        -static \
-        -o ''${out}/bin/tcc \
-        -D BOOTSTRAP=1 \
-        ${options} \
-        -I . \
-        -I ${src} \
-        -D TCC_TARGET_I386=1 \
-        -D CONFIG_TCCDIR=\"''${out}/lib\" \
-        -D CONFIG_TCC_CRTPREFIX=\"''${out}/lib\" \
-        -D CONFIG_TCC_ELFINTERP=\"\" \
-        -D CONFIG_TCC_LIBPATHS=\"''${out}/lib\" \
-        -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include:${src}/include\" \
-        -D TCC_LIBGCC=\"libc.a\" \
-        -D TCC_LIBTCC1=\"libtcc1.a\" \
-        -D CONFIG_TCCBOOT=1 \
-        -D CONFIG_TCC_STATIC=1 \
-        -D CONFIG_USE_LIBGCC=1 \
-        -D TCC_MES_LIBC=1 \
-        -D TCC_VERSION=\"${version}\" \
-        -D ONE_SOURCE=1 \
-        -L ${prev}/lib \
-        ${src}/tcc.c
 
-      ''${out}/bin/tcc -v
+rec {
 
-      # Recompile libc: crt{1,n,i}, libtcc.a, libc.a, libgetopt.a
+  # Recompile libc: crt{1,n,i}, libtcc.a, libc.a, libgetopt.a
+  recompileLibc =
+    { tcc
+    , pname
+    , version
+    , src
+    , libtccOptions
+    }:
+    let
+
+    crt = kaem.runCommand "crt" {} ''
       mkdir -p ''${out}/lib
-      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crt1.o ${mes-libc}/lib/crt1.c
-      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crtn.o ${mes-libc}/lib/crtn.c
-      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crti.o ${mes-libc}/lib/crti.c
-      ''${out}/bin/tcc -c -D TCC_TARGET_I386=1 ${libtccOptions} -o libtcc1.o ${src}/lib/libtcc1.c
-      ''${out}/bin/tcc -ar cr ''${out}/lib/libtcc1.a libtcc1.o
-      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libc.o ${mes-libc}/lib/libc.c
-      ''${out}/bin/tcc -ar cr ''${out}/lib/libc.a libc.o
-      ''${out}/bin/tcc ${mes-libc.CFLAGS} -c -o libgetopt.o ${mes-libc}/lib/libgetopt.c
-      ''${out}/bin/tcc -ar cr ''${out}/lib/libgetopt.a libgetopt.o
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crt1.o ${mes-libc}/lib/crt1.c
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crtn.o ${mes-libc}/lib/crtn.c
+      ${tcc}/bin/tcc ${mes-libc.CFLAGS} -c -o ''${out}/lib/crti.o ${mes-libc}/lib/crti.c
+    '';
 
-      # Install headers
-      ln -s ${mes-libc}/include ''${out}/include
+    library = lib: options: source: kaem.runCommand "${lib}.a" {} ''
+      ${tcc}/bin/tcc ${options} -c -o ${lib}.o ${source}
+      ${tcc}/bin/tcc -ar cr ''${out} ${lib}.o
     '';
+
+    libtcc1 = library "libtcc1" libtccOptions "${src}/lib/libtcc1.c";
+    libc = library "libc" mes-libc.CFLAGS "${mes-libc}/lib/libc.c";
+    libgetopt = library "libgetopt" mes-libc.CFLAGS "${mes-libc}/lib/libgetopt.c";
+  in
+  kaem.runCommand "${pname}-libs-${version}" {} ''
+    mkdir -p ''${out}/lib
+    cp ${crt}/lib/crt1.o ''${out}/lib
+    cp ${crt}/lib/crtn.o ''${out}/lib
+    cp ${crt}/lib/crti.o ''${out}/lib
+    cp ${libtcc1} ''${out}/lib/libtcc1.a
+    cp ${libc} ''${out}/lib/libc.a
+    cp ${libgetopt} ''${out}/lib/libgetopt.a
+  '';
+
+  buildTinyccMes =
+    { pname
+    , version
+    , src
+    , prev
+    , buildOptions
+    , libtccBuildOptions
+    , meta
+    }:
+    let
+      options = lib.strings.concatStringsSep " " buildOptions;
+      libtccOptions = lib.strings.concatStringsSep " "
+        (["-c" "-D" "TCC_TARGET_I386=1" ] ++ libtccBuildOptions);
+      compiler =  kaem.runCommand "${pname}-${version}" {
+        inherit pname version meta;
+        nativeBuildInputs = [ ln-boot ];
+        passthru.tests = rec {
+          get-version = result: kaem.runCommand "${pname}-get-version-${version}" {} ''
+            ${result}/bin/tcc -version
+            mkdir ''${out}
+          '';
+          chain = result: kaem.runCommand "${pname}-chain-${version}" {} ''
+            echo ${prev.compiler.tests.chain or prev.compiler.tests.get-version};
+            ${result}/bin/tcc -version
+            mkdir ''${out}
+          '';
+        };
+      } ''
+        catm config.h
+        mkdir -p ''${out}/bin
+        ${prev.compiler}/bin/tcc \
+          -B ${prev.libs}/lib \
+          -g \
+          -v \
+          -static \
+          -o ''${out}/bin/tcc \
+          -D BOOTSTRAP=1 \
+          ${options} \
+          -I . \
+          -I ${src} \
+          -D TCC_TARGET_I386=1 \
+          -D CONFIG_TCCDIR=\"\" \
+          -D CONFIG_SYSROOT=\"\" \
+          -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+          -D CONFIG_TCC_ELFINTERP=\"\" \
+          -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+          -D CONFIG_TCC_SYSINCLUDEPATHS=\"${mes-libc}/include\" \
+          -D TCC_LIBGCC=\"libc.a\" \
+          -D TCC_LIBTCC1=\"libtcc1.a\" \
+          -D CONFIG_TCCBOOT=1 \
+          -D CONFIG_TCC_STATIC=1 \
+          -D CONFIG_USE_LIBGCC=1 \
+          -D TCC_MES_LIBC=1 \
+          -D TCC_VERSION=\"${version}\" \
+          -D ONE_SOURCE=1 \
+          ${src}/tcc.c
+      '';
+    libs = recompileLibc {
+      inherit pname version src libtccOptions;
+      tcc = compiler;
+    };
+  in { inherit prev compiler libs; };
 }
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
index 81674893ead..229d794cf35 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/tinycc/mes.nix
@@ -5,9 +5,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 
 { lib
-, runCommand
 , fetchurl
 , callPackage
+, kaem
 , tinycc-bootstrappable
 }:
 let
@@ -20,7 +20,7 @@ let
     url = "https://repo.or.cz/tinycc.git/snapshot/${rev}.tar.gz";
     sha256 = "11idrvbwfgj1d03crv994mpbbbyg63j1k64lw1gjy7mkiifw2xap";
   };
-  src = (runCommand "tinycc-${version}-source" {} ''
+  src = (kaem.runCommand "tinycc-${version}-source" {} ''
     ungz --file ${tarball} --output tinycc.tar
     mkdir -p ''${out}
     cd ''${out}
@@ -35,9 +35,14 @@ let
     platforms = [ "i686-linux" ];
   };
 
-  tccdefs = runCommand "tccdefs-${version}" {} ''
+  tccdefs = kaem.runCommand "tccdefs-${version}" {} ''
     mkdir ''${out}
-    ${tinycc-bootstrappable}/bin/tcc -static -DC2STR -o c2str ${src}/conftest.c
+    ${tinycc-bootstrappable.compiler}/bin/tcc \
+      -B ${tinycc-bootstrappable.libs}/lib \
+      -static \
+      -DC2STR \
+      -o c2str \
+      ${src}/conftest.c
     ./c2str ${src}/include/tccdefs.h ''${out}/tccdefs_.h
   '';
 
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
index 1cc56654d7b..e710c34aa6a 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/utils.nix
@@ -2,7 +2,6 @@
 , buildPlatform
 , callPackage
 , kaem
-, mescc-tools
 , mescc-tools-extra
 }:
 
@@ -19,14 +18,18 @@ rec {
       passthru = attrs.passthru or {};
       validity = checkMeta.assertValidity { inherit meta attrs; };
       meta = checkMeta.commonMeta { inherit validity attrs; };
+      baseDrv = derivation ({
+        inherit (buildPlatform) system;
+        inherit (meta) name;
+      } // (builtins.removeAttrs attrs [ "meta" "passthru" ]));
+      passthru' = passthru // lib.optionalAttrs (passthru ? tests) {
+        tests = lib.mapAttrs (_: f: f baseDrv) passthru.tests;
+      };
     in
     lib.extendDerivation
       validity.handled
-      ({ inherit meta passthru; } // passthru)
-      (derivation ({
-        inherit (buildPlatform) system;
-        inherit (meta) name;
-      } // (builtins.removeAttrs attrs [ "meta" "passthru" ])));
+      ({ inherit meta; passthru = passthru'; } // passthru')
+      baseDrv;
 
   writeTextFile =
     { name # the name of the derivation
@@ -37,7 +40,7 @@ rec {
     , preferLocalBuild ? true
     }:
     derivationWithMeta {
-      inherit name text executable allowSubstitutes preferLocalBuild;
+      inherit name text allowSubstitutes preferLocalBuild;
       passAsFile = [ "text" ];
 
       builder = "${kaem}/bin/kaem";
@@ -45,39 +48,22 @@ rec {
         "--verbose"
         "--strict"
         "--file"
-        (builtins.toFile "write-text-file.kaem" ''
+        (builtins.toFile "write-text-file.kaem" (''
           target=''${out}''${destination}
-          if match x''${mkdirDestination} x1; then
-            mkdir -p ''${out}''${destinationDir}
-          fi
+        '' + lib.optionalString (builtins.dirOf destination == ".") ''
+          mkdir -p ''${out}''${destinationDir}
+        '' + ''
           cp ''${textPath} ''${target}
-          if match x''${executable} x1; then
-            chmod 555 ''${target}
-          fi
-        '')
+        '' + lib.optionalString executable ''
+          chmod 555 ''${target}
+        ''))
       ];
 
       PATH = lib.makeBinPath [ mescc-tools-extra ];
-      mkdirDestination = if builtins.dirOf destination == "." then "0" else "1";
       destinationDir = builtins.dirOf destination;
       inherit destination;
     };
 
   writeText = name: text: writeTextFile {inherit name text;};
 
-  runCommand = name: env: buildCommand:
-    derivationWithMeta ({
-      inherit name;
-
-      builder = "${kaem}/bin/kaem";
-      args = [
-        "--verbose"
-        "--strict"
-        "--file"
-        (writeText "${name}-builder" buildCommand)
-      ];
-
-      PATH = lib.makeBinPath ((env.nativeBuildInputs or []) ++ [ kaem mescc-tools mescc-tools-extra ]);
-    } // (builtins.removeAttrs env [ "nativeBuildInputs" ]));
-
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 6d8b80dd1c9..db00d4e4e98 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -42,6 +42,15 @@ rec {
     openSha256 = "sha256-etbtw6LMRUcFoZC9EDDRrTDekV8JFRYmkp3idLaMk5g=";
     settingsSha256 = "sha256-8KB6T9f+gWl8Ni+uOyrJKiiH5mNx9eyfCcW/RjPTQQA=";
     persistencedSha256 = "sha256-zrstlt/0YVGnsPGUuBbR9ULutywi2wNDVxh7OhJM7tM=";
+
+    patchFlags = [ "-p1" "-d" "kernel" ];
+    patches = [
+      # source: https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c
+      (fetchpatch {
+        url = "https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c/raw/688b612624945926676de28059fe749203b4b549/nvidia-470xx-fix-linux-6.4.patch";
+        hash = "sha256-OyRmezyzqAi7mSJHDjsWQVocSsgJPTW5DvHDFVNX7Dk=";
+      })
+    ];
   });
 
   beta = selectHighestVersion latest (generic {
@@ -56,13 +65,13 @@ rec {
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "525.47.22";
-    persistencedVersion = "525.85.05";
-    settingsVersion = "525.85.05";
-    sha256_64bit = "sha256-y8XgeGljiR2q/Wzp2btCQ8Wa+9KvWsWxZHb+NIqfCYQ=";
-    openSha256 = "sha256-Y8XL8BJWSV2K1p4VR8T9Z2DOqySgQqkB4Dvf6E6vcxI=";
-    settingsSha256 = "sha256-ck6ra8y8nn5kA3L9/VcRR2W2RaWvfVbgBiOh2dRJr/8=";
-    persistencedSha256 = "sha256-dt/Tqxp7ZfnbLel9BavjWDoEdLJvdJRwFjTFOBYYKLI=";
+    version = "525.47.24";
+    persistencedVersion = "525.116.04";
+    settingsVersion = "525.116.04";
+    sha256_64bit = "sha256-T0yIX1I3p+QcvFvq0VkbzjyLuCZuX7oeOqtt/aNZ3WI=";
+    openSha256 = "sha256-I9MNN2f0eMWFLNtb/8MjjrB1fGv4FeBm/RcCHjAhmAM=";
+    settingsSha256 = "sha256-qNjfsT9NGV151EHnG4fgBonVFSKc4yFEVomtXg9uYD4=";
+    persistencedSha256 = "sha256-ci86XGlno6DbHw6rkVSzBpopaapfJvk0+lHcR4LDq50=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
   };
 
@@ -78,15 +87,18 @@ rec {
     settingsSha256 = "sha256-TRKQ4brLnCbBZt1smGSIHTfwW+wEFPWWPEwDxjVXN7s=";
     persistencedSha256 = "sha256-fSJMx49z9trdNxx0iPI45oG57smvvhaqVNxsRnfXKCI=";
 
-    prePatch = "pushd kernel";
-    postPatch = "popd";
-
+    patchFlags = [ "-p1" "-d" "kernel" ];
     patches = [
       # source: https://gist.github.com/joanbm/d10e9cbbbb8e245b6e7e27b2db338faf
       (fetchpatch {
         url = "https://gist.github.com/joanbm/d10e9cbbbb8e245b6e7e27b2db338faf/raw/f5d5238bdbaa16cd4008658a0f82b9dd84f1b38f/nvidia-470xx-fix-linux-6.3.patch";
         hash = "sha256-mR+vXDHgVhWC0JeLgGlbNVCH8XTs7XnhEJS6BV75tI8=";
       })
+      # source: https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c
+      (fetchpatch {
+        url = "https://gist.github.com/joanbm/77f0650d45747b9a4dc8e330ade2bf5c/raw/688b612624945926676de28059fe749203b4b549/nvidia-470xx-fix-linux-6.4.patch";
+        hash = "sha256-OyRmezyzqAi7mSJHDjsWQVocSsgJPTW5DvHDFVNX7Dk=";
+      })
     ];
   };
 
@@ -97,6 +109,8 @@ rec {
     sha256_64bit = "sha256-W+u8puj+1da52BBw+541HxjtxTSVJVPL3HHo/QubMoo=";
     settingsSha256 = "sha256-uJZO4ak/w/yeTQ9QdXJSiaURDLkevlI81de0q4PpFpw=";
     persistencedSha256 = "sha256-NuqUQbVt80gYTXgIcu0crAORfsj9BCRooyH3Gp1y1ns=";
+
+    broken = kernel.kernelAtLeast "6.2";
   };
 
   legacy_340 = let
@@ -104,8 +118,8 @@ rec {
     aurPatches = fetchFromGitHub {
       owner = "archlinux-jerry";
       repo = "nvidia-340xx";
-      rev = "fe2b38e66f2199777bcede6eb35c5df0210f15dc";
-      hash = "sha256-hPFfzWGo2jF/DLm1OkP+BBnRY69N8kKUZ1EGkoHJlKA=";
+      rev = "f472f9297fe2ae285b954cd3f88abd8e2e255e4f";
+      hash = "sha256-tMA69Wlhi14DMS3O3nfwMX3EiT8pKa6McLxFpAayoEI=";
     };
     patchset = [
       "0001-kernel-5.7.patch"
@@ -119,6 +133,8 @@ rec {
       "0009-kernel-5.17.patch"
       "0010-kernel-5.18.patch"
       "0011-kernel-6.0.patch"
+      "0012-kernel-6.2.patch"
+      "0013-kernel-6.3.patch"
     ];
   in generic {
     version = "340.108";
@@ -128,7 +144,7 @@ rec {
     persistencedSha256 = "1ax4xn3nmxg1y6immq933cqzw6cj04x93saiasdc0kjlv0pvvnkn";
     useGLVND = false;
 
-    broken = kernel.kernelAtLeast "6.2";
+    broken = kernel.kernelAtLeast "6.4";
     patches = map (patch: "${aurPatches}/${patch}") patchset;
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index 3f87974b776..6455010d988 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -16,6 +16,7 @@
 
 , prePatch ? ""
 , postPatch ? null
+, patchFlags ? null
 , patches ? []
 , broken ? false
 , brokenOpen ? broken
@@ -85,7 +86,7 @@ let
       else throw "nvidia-x11 does not support platform ${stdenv.hostPlatform.system}";
 
     patches = if libsOnly then null else patches;
-    inherit prePatch postPatch;
+    inherit prePatch postPatch patchFlags;
     inherit version useGLVND useProfiles;
     inherit (stdenv.hostPlatform) system;
     inherit i686bundled;
diff --git a/pkgs/os-specific/linux/odp-dpdk/default.nix b/pkgs/os-specific/linux/odp-dpdk/default.nix
index b6f27c5b3c2..5c8cd9efc98 100644
--- a/pkgs/os-specific/linux/odp-dpdk/default.nix
+++ b/pkgs/os-specific/linux/odp-dpdk/default.nix
@@ -1,25 +1,28 @@
-{ lib, stdenv, fetchurl, autoreconfHook, pkg-config
-, dpdk, libbpf, libconfig, libpcap, numactl, openssl, zlib, libbsd, libelf, jansson
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, pkg-config
+, dpdk
+, libbpf
+, libconfig
+, libpcap
+, numactl
+, openssl
+, zlib
+, libbsd
+, libelf
+, jansson
 , libnl
-}: let
-  dpdk_19_11 = dpdk.overrideAttrs (old: rec {
-    version = "19.11.12";
-    src = fetchurl {
-      url = "https://fast.dpdk.org/rel/dpdk-${version}.tar.xz";
-      sha256 = "sha256-F9m2+MZi3n0psPIwjWwhiIbbNkoGlxqtru2OlV7TbzQ=";
-    };
-    mesonFlags = old.mesonFlags ++ [
-      "-Denable_docs=false"
-    ];
-  });
-
-in stdenv.mkDerivation rec {
+}:
+
+stdenv.mkDerivation rec {
   pname = "odp-dpdk";
-  version = "1.37.0.0_DPDK_19.11";
+  version = "1.41.0.0_DPDK_22.11";
 
   src = fetchurl {
     url = "https://git.linaro.org/lng/odp-dpdk.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Ai6+6eZJeG0BrwNboBPfgDGkUbCC8lcj7+oxmWjWP2k=";
+    hash = "sha256-4p+R+7IeDKQFqBzQTvXfR407exxhoS8pnKxF9Qnr8tw=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +31,7 @@ in stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    dpdk_19_11
+    dpdk
     libconfig
     libpcap
     numactl
diff --git a/pkgs/os-specific/linux/pam_p11/default.nix b/pkgs/os-specific/linux/pam_p11/default.nix
index e7537205443..8970f7ed628 100644
--- a/pkgs/os-specific/linux/pam_p11/default.nix
+++ b/pkgs/os-specific/linux/pam_p11/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libp11, pam, libintl }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libp11, pam, libintl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "pam_p11";
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
     sha256 = "1caidy18rq5zk82d51x8vwidmkhwmanf3qm25x1yrdlbhxv6m7lk";
   };
 
+  patches = [
+    # fix with openssl 3.x
+    (fetchpatch {
+      url = "https://github.com/OpenSC/pam_p11/pull/22.patch";
+      excludes = [ ".github/build.sh" ];
+      hash = "sha256-bm/agnBgvrr8L8yoGK4gzBqOGgsNWf9NIgcNJG7proE=";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ pam libp11.passthru.openssl libp11 ]
     ++ lib.optionals stdenv.isDarwin [ libintl ];
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index 648442ad757..991c2ae0b50 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation rec {
   pname = "power-profiles-daemon";
-  version = "0.12";
+  version = "0.13";
 
   outputs = [ "out" "devdoc" ];
 
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     owner = "hadess";
     repo = "power-profiles-daemon";
     rev = version;
-    sha256 = "sha256-2eMFPGVLwTBIlaB1zM3BzHrhydgBEm+kvx+VIZdUDPM=";
+    sha256 = "sha256-ErHy+shxZQ/aCryGhovmJ6KmAMt9OZeQGDbHIkC0vUE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/vdo/default.nix b/pkgs/os-specific/linux/vdo/default.nix
index d9033e65876..ec953d25ec1 100644
--- a/pkgs/os-specific/linux/vdo/default.nix
+++ b/pkgs/os-specific/linux/vdo/default.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vdo";
-  version = "8.2.0.2";  # kvdo uses this!
+  version = "8.2.0.2";  # bump this version with kvdo
 
   src = fetchFromGitHub {
     owner = "dm-vdo";
diff --git a/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix b/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
index 46a5bca7903..8ae426269a8 100644
--- a/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
+++ b/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
@@ -5,6 +5,7 @@
 , glibc
 , libGL
 , xorg
+, makeWrapper
 , qtx11extras
 , wrapQtAppsHook
 , autoPatchelfHook
@@ -20,17 +21,18 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "xp-pen-deco-01-v2-driver";
-  version = "3.3.9.230222-1";
+  version = "3.2.3.230215-1";
 
   src = fetchzip {
-    url = "https://www.xp-pen.com/download/file/id/1936/pid/440/ext/gz.html#.tar.gz";
+    url = "https://download01.xp-pen.com/file/2023/03/XPPen-pentablet-${version}.x86_64.tar.gz";
     name = "xp-pen-deco-01-v2-driver-${version}.tar.gz";
-    sha256 = "sha256-xrRDxH7e00dISXb+lTtrnui+fNFpX7bLke2o+aTjJNk=";
+    sha256 = "sha256-CV4ZaGCFFcfy2J0O8leYgcyzFVwJQFQJsShOv9B7jfI=";
   };
 
   nativeBuildInputs = [
     wrapQtAppsHook
     autoPatchelfHook
+    makeWrapper
   ];
 
   dontBuild = true;
diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
deleted file mode 100644
index de4f531a2f2..00000000000
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ /dev/null
@@ -1,270 +0,0 @@
-{ pkgs, lib, stdenv, fetchFromGitHub, fetchpatch
-, autoreconfHook269, util-linux, nukeReferences, coreutils
-, perl, nixosTests
-, configFile ? "all"
-
-# Userspace dependencies
-, zlib, libuuid, python3, attr, openssl
-, libtirpc
-, nfs-utils, samba
-, gawk, gnugrep, gnused, systemd
-, smartmontools, enableMail ? false
-, sysstat, pkg-config
-, curl
-
-# Kernel dependencies
-, kernel ? null
-, enablePython ? true
-
-# for determining the latest compatible linuxPackages
-, linuxPackages_6_1 ? pkgs.linuxKernel.packages.linux_6_1
-, linuxPackages_6_2 ? pkgs.linuxKernel.packages.linux_6_2
-}:
-
-let
-  inherit (lib) any optionalString optionals optional makeBinPath;
-
-  smartmon = smartmontools.override { inherit enableMail; };
-
-  buildKernel = any (n: n == configFile) [ "kernel" "all" ];
-  buildUser = any (n: n == configFile) [ "user" "all" ];
-
-  # XXX: You always want to build kernel modules with the same stdenv as the
-  # kernel was built with. However, since zfs can also be built for userspace we
-  # need to correctly pick between the provided/default stdenv, and the one used
-  # by the kernel.
-  # If you don't do this your ZFS builds will fail on any non-standard (e.g.
-  # clang-built) kernels.
-  stdenv' = if kernel == null then stdenv else kernel.stdenv;
-
-  common = { version
-    , sha256
-    , extraPatches ? []
-    , rev ? "zfs-${version}"
-    , isUnstable ? false
-    , latestCompatibleLinuxPackages
-    , kernelCompatible ? null }:
-
-    stdenv'.mkDerivation {
-      name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
-
-      src = fetchFromGitHub {
-        owner = "openzfs";
-        repo = "zfs";
-        inherit rev sha256;
-      };
-
-      patches = [
-        (fetchpatch {
-          name = "musl.patch";
-          url = "https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a.patch";
-          sha256 = "XEaK227ubfOwlB2s851UvZ6xp/QOtYUWYsKTkEHzmo0=";
-        })
-      ] ++ extraPatches;
-
-      postPatch = optionalString buildKernel ''
-        patchShebangs scripts
-        # The arrays must remain the same length, so we repeat a flag that is
-        # already part of the command and therefore has no effect.
-        substituteInPlace ./module/os/linux/zfs/zfs_ctldir.c \
-          --replace '"/usr/bin/env", "umount"' '"${util-linux}/bin/umount", "-n"' \
-          --replace '"/usr/bin/env", "mount"'  '"${util-linux}/bin/mount", "-n"'
-      '' + optionalString buildUser ''
-        substituteInPlace ./lib/libshare/os/linux/nfs.c --replace "/usr/sbin/exportfs" "${
-          # We don't *need* python support, but we set it like this to minimize closure size:
-          # If it's disabled by default, no need to enable it, even if we have python enabled
-          # And if it's enabled by default, only change that if we explicitly disable python to remove python from the closure
-          nfs-utils.override (old: { enablePython = old.enablePython or true && enablePython; })
-        }/bin/exportfs"
-        substituteInPlace ./lib/libshare/smb.h        --replace "/usr/bin/net"            "${samba}/bin/net"
-        # Disable dynamic loading of libcurl
-        substituteInPlace ./config/user-libfetch.m4   --replace "curl-config --built-shared" "true"
-        substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
-        substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
-                                                      --replace "/etc/default"            "$out/etc/default"
-        substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
-
-        substituteInPlace ./contrib/initramfs/hooks/Makefile.am \
-          --replace "/usr/share/initramfs-tools/hooks" "$out/usr/share/initramfs-tools/hooks"
-        substituteInPlace ./contrib/initramfs/Makefile.am \
-          --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
-        substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
-        substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
-        substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
-        substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
-          --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
-        substituteInPlace ./etc/systemd/system/Makefile.am \
-          --replace '$(DESTDIR)$(systemdunitdir)' "$out"'$(DESTDIR)$(systemdunitdir)'
-
-        substituteInPlace ./contrib/initramfs/conf.d/Makefile.am \
-          --replace "/usr/share/initramfs-tools/conf.d" "$out/usr/share/initramfs-tools/conf.d"
-        substituteInPlace ./contrib/initramfs/conf-hooks.d/Makefile.am \
-          --replace "/usr/share/initramfs-tools/conf-hooks.d" "$out/usr/share/initramfs-tools/conf-hooks.d"
-
-        substituteInPlace ./cmd/vdev_id/vdev_id \
-          --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
-          "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
-      '';
-
-      nativeBuildInputs = [ autoreconfHook269 nukeReferences ]
-        ++ optionals buildKernel (kernel.moduleBuildDependencies ++ [ perl ])
-        ++ optional buildUser pkg-config;
-      buildInputs = optionals buildUser [ zlib libuuid attr libtirpc ]
-        ++ optional buildUser openssl
-        ++ optional buildUser curl
-        ++ optional (buildUser && enablePython) python3;
-
-      # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
-      NIX_CFLAGS_LINK = "-lgcc_s";
-
-      hardeningDisable = [ "fortify" "stackprotector" "pic" ];
-
-      configureFlags = [
-        "--with-config=${configFile}"
-        "--with-tirpc=1"
-        (lib.withFeatureAs (buildUser && enablePython) "python" python3.interpreter)
-      ] ++ optionals buildUser [
-        "--with-dracutdir=$(out)/lib/dracut"
-        "--with-udevdir=$(out)/lib/udev"
-        "--with-systemdunitdir=$(out)/etc/systemd/system"
-        "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
-        "--with-systemdgeneratordir=$(out)/lib/systemd/system-generator"
-        "--with-mounthelperdir=$(out)/bin"
-        "--libexecdir=$(out)/libexec"
-        "--sysconfdir=/etc"
-        "--localstatedir=/var"
-        "--enable-systemd"
-      ] ++ optionals buildKernel ([
-        "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
-        "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-      ] ++ kernel.makeFlags);
-
-      makeFlags = optionals buildKernel kernel.makeFlags;
-
-      enableParallelBuilding = true;
-
-      installFlags = [
-        "sysconfdir=\${out}/etc"
-        "DEFAULT_INITCONF_DIR=\${out}/default"
-        "INSTALL_MOD_PATH=\${out}"
-      ];
-
-      # Enabling BTF causes zfs to be build with debug symbols.
-      # Since zfs compress kernel modules on installation, our strip hooks skip stripping them.
-      # Hence we strip modules prior to compression.
-      postBuild = optionalString buildKernel ''
-         find . -name "*.ko" -print0 | xargs -0 -P$NIX_BUILD_CORES ${stdenv.cc.targetPrefix}strip --strip-debug
-      '';
-
-      postInstall = optionalString buildKernel ''
-        # Add reference that cannot be detected due to compressed kernel module
-        mkdir -p "$out/nix-support"
-        echo "${util-linux}" >> "$out/nix-support/extra-refs"
-      '' + optionalString buildUser ''
-        # Remove provided services as they are buggy
-        rm $out/etc/systemd/system/zfs-import-*.service
-
-        sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
-
-        for i in $out/etc/systemd/system/*; do
-        substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
-        done
-
-        # Remove tests because they add a runtime dependency on gcc
-        rm -rf $out/share/zfs/zfs-tests
-
-        # Add Bash completions.
-        install -v -m444 -D -t $out/share/bash-completion/completions contrib/bash_completion.d/zfs
-        (cd $out/share/bash-completion/completions; ln -s zfs zpool)
-      '';
-
-      postFixup = let
-        path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmon sysstat ]}:$PATH";
-      in ''
-        for i in $out/libexec/zfs/zpool.d/*; do
-          sed -i '2i${path}' $i
-        done
-      '';
-
-      outputs = [ "out" ] ++ optionals buildUser [ "dev" ];
-
-      passthru = {
-        inherit enableMail latestCompatibleLinuxPackages;
-
-        tests =
-          if isUnstable then [
-            nixosTests.zfs.unstable
-          ] else [
-            nixosTests.zfs.installer
-            nixosTests.zfs.stable
-          ];
-      };
-
-      meta = {
-        description = "ZFS Filesystem Linux Kernel module";
-        longDescription = ''
-          ZFS is a filesystem that combines a logical volume manager with a
-          Copy-On-Write filesystem with data integrity detection and repair,
-          snapshotting, cloning, block devices, deduplication, and more.
-        '';
-        homepage = "https://github.com/openzfs/zfs";
-        changelog = "https://github.com/openzfs/zfs/releases/tag/zfs-${version}";
-        license = lib.licenses.cddl;
-        platforms = lib.platforms.linux;
-        maintainers = with lib.maintainers; [ jcumming jonringer globin raitobezarius ];
-        mainProgram = "zfs";
-        # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
-        # On NixOS set the option boot.zfs.enableUnstable.
-        broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
-      };
-    };
-in {
-  # also check if kernel version constraints in
-  # ./nixos/modules/tasks/filesystems/zfs.nix needs
-  # to be adapted
-  zfsStable = common {
-    # check the release notes for compatible kernels
-    kernelCompatible =
-      if stdenv'.isx86_64
-      then kernel.kernelOlder "6.3"
-      else kernel.kernelOlder "6.2";
-    latestCompatibleLinuxPackages =
-      if stdenv'.isx86_64
-      then linuxPackages_6_2
-      else linuxPackages_6_1;
-
-    # this package should point to the latest release.
-    version = "2.1.11";
-
-    sha256 = "tJLwyqUj1l5F0WKZDeMGrEFa8fc/axKqm31xtN51a5M=";
-  };
-
-  zfsUnstable = common {
-    # check the release notes for compatible kernels
-    # NOTE:
-    #   zfs-2.1.9<=x<=2.1.10 is broken with aarch64-linux-6.2
-    #   for future releases, please delete this condition.
-    kernelCompatible =
-      if stdenv'.isx86_64
-      then kernel.kernelOlder "6.3"
-      else kernel.kernelOlder "6.2";
-    latestCompatibleLinuxPackages =
-      if stdenv'.isx86_64
-      then linuxPackages_6_2
-      else linuxPackages_6_1;
-
-    # this package should point to a version / git revision compatible with the latest kernel release
-    # IMPORTANT: Always use a tagged release candidate or commits from the
-    # zfs-<version>-staging branch, because this is tested by the OpenZFS
-    # maintainers.
-    version = "2.1.12-staging-2023-04-18";
-    rev = "e25f9131d679692704c11dc0c1df6d4585b70c35";
-
-    sha256 = "tJLwyqUj1l5F0WKZDeMGrEFa8fc/axKqm31xtN51a5M=";
-
-    isUnstable = true;
-  };
-}
diff --git a/pkgs/os-specific/linux/zfs/generic.nix b/pkgs/os-specific/linux/zfs/generic.nix
new file mode 100644
index 00000000000..347b4a29971
--- /dev/null
+++ b/pkgs/os-specific/linux/zfs/generic.nix
@@ -0,0 +1,234 @@
+{ pkgs, lib, stdenv, fetchFromGitHub, fetchpatch
+, autoreconfHook269, util-linux, nukeReferences, coreutils
+, perl, nixosTests
+, configFile ? "all"
+
+# Userspace dependencies
+, zlib, libuuid, python3, attr, openssl
+, libtirpc
+, nfs-utils, samba
+, gawk, gnugrep, gnused, systemd
+, smartmontools, enableMail ? false
+, sysstat, pkg-config
+, curl
+, pam
+
+# Kernel dependencies
+, kernel ? null
+, enablePython ? true
+, ...
+}:
+
+{ version
+, sha256
+, extraPatches ? []
+, rev ? "zfs-${version}"
+, isUnstable ? false
+, latestCompatibleLinuxPackages
+, kernelCompatible ? null
+}:
+
+let
+  inherit (lib) any optionalString optionals optional makeBinPath;
+
+  smartmon = smartmontools.override { inherit enableMail; };
+
+  buildKernel = any (n: n == configFile) [ "kernel" "all" ];
+  buildUser = any (n: n == configFile) [ "user" "all" ];
+
+  # XXX: You always want to build kernel modules with the same stdenv as the
+  # kernel was built with. However, since zfs can also be built for userspace we
+  # need to correctly pick between the provided/default stdenv, and the one used
+  # by the kernel.
+  # If you don't do this your ZFS builds will fail on any non-standard (e.g.
+  # clang-built) kernels.
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+
+stdenv'.mkDerivation {
+  name = "zfs-${configFile}-${version}${optionalString buildKernel "-${kernel.version}"}";
+
+  src = fetchFromGitHub {
+    owner = "openzfs";
+    repo = "zfs";
+    inherit rev sha256;
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "musl.patch";
+      url = "https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a.patch";
+      sha256 = "XEaK227ubfOwlB2s851UvZ6xp/QOtYUWYsKTkEHzmo0=";
+    })
+  ] ++ extraPatches;
+
+  postPatch = optionalString buildKernel ''
+    patchShebangs scripts
+    # The arrays must remain the same length, so we repeat a flag that is
+    # already part of the command and therefore has no effect.
+    substituteInPlace ./module/os/linux/zfs/zfs_ctldir.c \
+      --replace '"/usr/bin/env", "umount"' '"${util-linux}/bin/umount", "-n"' \
+      --replace '"/usr/bin/env", "mount"'  '"${util-linux}/bin/mount", "-n"'
+  '' + optionalString buildUser ''
+    substituteInPlace ./lib/libshare/os/linux/nfs.c --replace "/usr/sbin/exportfs" "${
+      # We don't *need* python support, but we set it like this to minimize closure size:
+      # If it's disabled by default, no need to enable it, even if we have python enabled
+      # And if it's enabled by default, only change that if we explicitly disable python to remove python from the closure
+      nfs-utils.override (old: { enablePython = old.enablePython or true && enablePython; })
+    }/bin/exportfs"
+    substituteInPlace ./lib/libshare/smb.h        --replace "/usr/bin/net"            "${samba}/bin/net"
+    # Disable dynamic loading of libcurl
+    substituteInPlace ./config/user-libfetch.m4   --replace "curl-config --built-shared" "true"
+    substituteInPlace ./config/user-systemd.m4    --replace "/usr/lib/modules-load.d" "$out/etc/modules-load.d"
+    substituteInPlace ./config/zfs-build.m4       --replace "\$sysconfdir/init.d"     "$out/etc/init.d" \
+                                                  --replace "/etc/default"            "$out/etc/default"
+    substituteInPlace ./etc/zfs/Makefile.am       --replace "\$(sysconfdir)"          "$out/etc"
+
+    substituteInPlace ./contrib/initramfs/hooks/Makefile.am \
+      --replace "/usr/share/initramfs-tools/hooks" "$out/usr/share/initramfs-tools/hooks"
+    substituteInPlace ./contrib/initramfs/Makefile.am \
+      --replace "/usr/share/initramfs-tools" "$out/usr/share/initramfs-tools"
+    substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
+      --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
+    substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
+      --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
+    substituteInPlace ./contrib/initramfs/scripts/Makefile.am \
+      --replace "/usr/share/initramfs-tools/scripts" "$out/usr/share/initramfs-tools/scripts"
+    substituteInPlace ./contrib/initramfs/scripts/local-top/Makefile.am \
+      --replace "/usr/share/initramfs-tools/scripts/local-top" "$out/usr/share/initramfs-tools/scripts/local-top"
+    substituteInPlace ./etc/systemd/system/Makefile.am \
+      --replace '$(DESTDIR)$(systemdunitdir)' "$out"'$(DESTDIR)$(systemdunitdir)'
+
+    substituteInPlace ./contrib/initramfs/conf.d/Makefile.am \
+      --replace "/usr/share/initramfs-tools/conf.d" "$out/usr/share/initramfs-tools/conf.d"
+    substituteInPlace ./contrib/initramfs/conf-hooks.d/Makefile.am \
+      --replace "/usr/share/initramfs-tools/conf-hooks.d" "$out/usr/share/initramfs-tools/conf-hooks.d"
+
+    substituteInPlace ./cmd/vdev_id/vdev_id \
+      --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
+      "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
+  '';
+
+  nativeBuildInputs = [ autoreconfHook269 nukeReferences ]
+    ++ optionals buildKernel (kernel.moduleBuildDependencies ++ [ perl ])
+    ++ optional buildUser pkg-config;
+  buildInputs = optionals buildUser [ zlib libuuid attr libtirpc pam ]
+    ++ optional buildUser openssl
+    ++ optional buildUser curl
+    ++ optional (buildUser && enablePython) python3;
+
+  # for zdb to get the rpath to libgcc_s, needed for pthread_cancel to work
+  NIX_CFLAGS_LINK = "-lgcc_s";
+
+  hardeningDisable = [ "fortify" "stackprotector" "pic" ];
+
+  configureFlags = [
+    "--with-config=${configFile}"
+    "--with-tirpc=1"
+    (lib.withFeatureAs (buildUser && enablePython) "python" python3.interpreter)
+  ] ++ optionals buildUser [
+    "--with-dracutdir=$(out)/lib/dracut"
+    "--with-udevdir=$(out)/lib/udev"
+    "--with-systemdunitdir=$(out)/etc/systemd/system"
+    "--with-systemdpresetdir=$(out)/etc/systemd/system-preset"
+    "--with-systemdgeneratordir=$(out)/lib/systemd/system-generator"
+    "--with-mounthelperdir=$(out)/bin"
+    "--libexecdir=$(out)/libexec"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--enable-systemd"
+    "--enable-pam"
+  ] ++ optionals buildKernel ([
+    "--with-linux=${kernel.dev}/lib/modules/${kernel.modDirVersion}/source"
+    "--with-linux-obj=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ] ++ kernel.makeFlags);
+
+  makeFlags = optionals buildKernel kernel.makeFlags;
+
+  enableParallelBuilding = true;
+
+  installFlags = [
+    "sysconfdir=\${out}/etc"
+    "DEFAULT_INITCONF_DIR=\${out}/default"
+    "INSTALL_MOD_PATH=\${out}"
+  ];
+
+  # Enabling BTF causes zfs to be build with debug symbols.
+  # Since zfs compress kernel modules on installation, our strip hooks skip stripping them.
+  # Hence we strip modules prior to compression.
+  postBuild = optionalString buildKernel ''
+     find . -name "*.ko" -print0 | xargs -0 -P$NIX_BUILD_CORES ${stdenv.cc.targetPrefix}strip --strip-debug
+  '';
+
+  postInstall = optionalString buildKernel ''
+    # Add reference that cannot be detected due to compressed kernel module
+    mkdir -p "$out/nix-support"
+    echo "${util-linux}" >> "$out/nix-support/extra-refs"
+  '' + optionalString buildUser ''
+    # Remove provided services as they are buggy
+    rm $out/etc/systemd/system/zfs-import-*.service
+
+    sed -i '/zfs-import-scan.service/d' $out/etc/systemd/system/*
+
+    for i in $out/etc/systemd/system/*; do
+    substituteInPlace $i --replace "zfs-import-cache.service" "zfs-import.target"
+    done
+
+    # Remove tests because they add a runtime dependency on gcc
+    rm -rf $out/share/zfs/zfs-tests
+
+    # Add Bash completions.
+    install -v -m444 -D -t $out/share/bash-completion/completions contrib/bash_completion.d/zfs
+    (cd $out/share/bash-completion/completions; ln -s zfs zpool)
+  '';
+
+  postFixup = let
+    path = "PATH=${makeBinPath [ coreutils gawk gnused gnugrep util-linux smartmon sysstat ]}:$PATH";
+  in ''
+    for i in $out/libexec/zfs/zpool.d/*; do
+      sed -i '2i${path}' $i
+    done
+  '';
+
+  outputs = [ "out" ] ++ optionals buildUser [ "dev" ];
+
+  passthru = {
+    inherit enableMail latestCompatibleLinuxPackages;
+
+    tests =
+      if isUnstable then [
+        nixosTests.zfs.unstable
+      ] else [
+        nixosTests.zfs.installer
+        nixosTests.zfs.stable
+      ];
+  };
+
+  meta = {
+    description = "ZFS Filesystem Linux Kernel module";
+    longDescription = ''
+      ZFS is a filesystem that combines a logical volume manager with a
+      Copy-On-Write filesystem with data integrity detection and repair,
+      snapshotting, cloning, block devices, deduplication, and more.
+    '';
+    homepage = "https://github.com/openzfs/zfs";
+    changelog = "https://github.com/openzfs/zfs/releases/tag/zfs-${version}";
+    license = lib.licenses.cddl;
+
+    # The case-block for TARGET_CPU has branches for only five CPU families,
+    # which prevents ZFS from building on any other platform.  Since the NixOS
+    # `boot.zfs.enabled` property is `readOnly`, excluding platforms where ZFS
+    # does not build is the only way to produce a NixOS installer on such
+    # platforms.
+    # https://github.com/openzfs/zfs/blob/6a6bd493988c75331deab06e5352a9bed035a87d/config/always-arch.m4#L16
+    platforms =
+      with lib.systems.inspect.patterns;
+      map (p: p // isLinux) [ isx86_32 isx86_64 isPower isAarch64 isSparc ];
+
+    maintainers = with lib.maintainers; [ jcumming jonringer globin raitobezarius ];
+    mainProgram = "zfs";
+    # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
+    # On NixOS set the option boot.zfs.enableUnstable.
+    broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
+  };
+}
diff --git a/pkgs/os-specific/linux/zfs/stable.nix b/pkgs/os-specific/linux/zfs/stable.nix
new file mode 100644
index 00000000000..48c58874cfe
--- /dev/null
+++ b/pkgs/os-specific/linux/zfs/stable.nix
@@ -0,0 +1,26 @@
+{ callPackage
+, kernel ? null
+, stdenv
+, linuxKernel
+, ...
+} @ args:
+
+let
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+callPackage ./generic.nix args {
+  # check the release notes for compatible kernels
+  kernelCompatible =
+    if stdenv'.isx86_64
+    then kernel.kernelOlder "6.3"
+    else kernel.kernelOlder "6.2";
+  latestCompatibleLinuxPackages =
+    if stdenv'.isx86_64
+    then linuxKernel.packages.linux_6_1
+    else linuxKernel.packages.linux_6_2;
+
+  # this package should point to the latest release.
+  version = "2.1.11";
+
+  sha256 = "tJLwyqUj1l5F0WKZDeMGrEFa8fc/axKqm31xtN51a5M=";
+}
diff --git a/pkgs/os-specific/linux/zfs/unstable.nix b/pkgs/os-specific/linux/zfs/unstable.nix
new file mode 100644
index 00000000000..3953b5ed8d9
--- /dev/null
+++ b/pkgs/os-specific/linux/zfs/unstable.nix
@@ -0,0 +1,34 @@
+{ callPackage
+, kernel ? null
+, stdenv
+, linuxKernel
+, ...
+} @ args:
+
+let
+  stdenv' = if kernel == null then stdenv else kernel.stdenv;
+in
+callPackage ./generic.nix args {
+  # check the release notes for compatible kernels
+  # NOTE:
+  #   zfs-2.1.9<=x<=2.1.10 is broken with aarch64-linux-6.2
+  #   for future releases, please delete this condition.
+  kernelCompatible = if stdenv'.isx86_64
+    then kernel.kernelOlder "6.3"
+    else kernel.kernelOlder "6.2";
+  latestCompatibleLinuxPackages =
+    if stdenv'.isx86_64
+    then linuxKernel.packages.linux_6_2
+    else linuxKernel.packages.linux_6_1;
+
+  # this package should point to a version / git revision compatible with the latest kernel release
+  # IMPORTANT: Always use a tagged release candidate or commits from the
+  # zfs-<version>-staging branch, because this is tested by the OpenZFS
+  # maintainers.
+  version = "2.1.12-staging-2023-04-18";
+  rev = "e25f9131d679692704c11dc0c1df6d4585b70c35";
+
+  sha256 = "tJLwyqUj1l5F0WKZDeMGrEFa8fc/axKqm31xtN51a5M=";
+
+  isUnstable = true;
+}