about summary refs log tree commit diff
path: root/nixpkgs/pkgs/os-specific
diff options
context:
space:
mode:
authorAlyssa Ross <hi@alyssa.is>2023-10-20 22:09:03 +0000
committerAlyssa Ross <hi@alyssa.is>2023-10-20 22:09:03 +0000
commit50c21d167f7114fa1dbd95e5c4fb30eeb1a2d02e (patch)
treef2556b911180125ccbb7ed0e78a54e92da89adce /nixpkgs/pkgs/os-specific
parent4c16d4548a98563c9d9ad76f4e5b2202864ccd54 (diff)
parentcfc75eec4603c06503ae750f88cf397e00796ea8 (diff)
downloadnixlib-50c21d167f7114fa1dbd95e5c4fb30eeb1a2d02e.tar
nixlib-50c21d167f7114fa1dbd95e5c4fb30eeb1a2d02e.tar.gz
nixlib-50c21d167f7114fa1dbd95e5c4fb30eeb1a2d02e.tar.bz2
nixlib-50c21d167f7114fa1dbd95e5c4fb30eeb1a2d02e.tar.lz
nixlib-50c21d167f7114fa1dbd95e5c4fb30eeb1a2d02e.tar.xz
nixlib-50c21d167f7114fa1dbd95e5c4fb30eeb1a2d02e.tar.zst
nixlib-50c21d167f7114fa1dbd95e5c4fb30eeb1a2d02e.zip
Merge commit 'cfc75eec4603c06503ae750f88cf397e00796ea8'
Conflicts:
	nixpkgs/pkgs/build-support/rust/build-rust-package/default.nix
Diffstat (limited to 'nixpkgs/pkgs/os-specific')
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/ios-deploy/default.nix71
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/raycast/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/utm/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/darwin/yabai/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix17
-rw-r--r--nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bolt/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/conky/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/cpufrequtils/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dcgm/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/device-tree/default.nix25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/dpdk/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/esdm/default.nix78
-rw-r--r--nixpkgs/pkgs/os-specific/linux/eudev/default.nix66
-rw-r--r--nixpkgs/pkgs/os-specific/linux/eventstat/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch48
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch31
-rw-r--r--nixpkgs/pkgs/os-specific/linux/freeipa/default.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iomelt/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/iproute/default.nix20
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ipset/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix114
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.11.patch784
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md21
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/default.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json80
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py23
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json34
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix41
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/mainline.nix25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/patches.nix2
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/kernel/update-mainline.py76
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix20
-rw-r--r--nixpkgs/pkgs/os-specific/linux/klibc/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix35
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/mksignames-flush.patch10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix80
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix29
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix74
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix145
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix33
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix37
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix140
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix140
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix56
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/8.nix141
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix137
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/libstdc++-target.patch32
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/no-system-headers.patch11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix121
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix82
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/common.nix12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix71
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/mes.nix59
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/latest.nix71
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix (renamed from nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/default.nix)0
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix70
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix116
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/always-flush.patch12
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix28
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix5
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-duplicate-symbols.patch13
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-static-inside-array.patch21
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix155
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/static-link.patch10
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix36
-rw-r--r--nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/stubs.h25
-rw-r--r--nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/net-tools/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.88
-rwxr-xr-xnixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh38
-rw-r--r--nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix18
-rw-r--r--nixpkgs/pkgs/os-specific/linux/oxtools/default.nix14
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix9
-rw-r--r--nixpkgs/pkgs/os-specific/linux/pipework/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/projecteur/default.nix38
-rw-r--r--nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix3
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/sssd/default.nix27
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch45
-rw-r--r--nixpkgs/pkgs/os-specific/linux/systemd/default.nix16
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tailor-gui/default.nix60
-rw-r--r--nixpkgs/pkgs/os-specific/linux/tuxedo-rs/default.nix47
-rw-r--r--nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix141
-rw-r--r--nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix6
-rw-r--r--nixpkgs/pkgs/os-specific/linux/upower/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/vmware/default.nix8
-rw-r--r--nixpkgs/pkgs/os-specific/linux/wireless-tools/default.nix4
-rw-r--r--nixpkgs/pkgs/os-specific/linux/xsensors/default.nix2
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/generic.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/stable.nix11
-rw-r--r--nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix10
121 files changed, 2188 insertions, 2185 deletions
diff --git a/nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix b/nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix
index 69302baa92eb..4850b2b4c04e 100644
--- a/nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/coconutbattery/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "coconutbattery";
-  version = "3.9.12";
+  version = "3.9.14";
 
   src = fetchzip {
     url = "https://coconut-flavour.com/downloads/coconutBattery_${builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version}.zip";
-    hash = "sha256-8WxGjZbxUqchSIfvpK2RLifn7/TD5nau5hgMzLUiV2o=";
+    hash = "sha256-zKSPKwDBwxlyNJFurCLLGtba9gpizJCjOOAd81vdD5Q=";
   };
 
   dontPatch = true;
diff --git a/nixpkgs/pkgs/os-specific/darwin/ios-deploy/default.nix b/nixpkgs/pkgs/os-specific/darwin/ios-deploy/default.nix
index 6567093700df..c405ac8e1c8b 100644
--- a/nixpkgs/pkgs/os-specific/darwin/ios-deploy/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/ios-deploy/default.nix
@@ -1,35 +1,62 @@
-{ lib, stdenvNoCC, rsync, fetchFromGitHub }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, darwin
+, testers
+}:
 
-# Note this is impure, using system XCode to build ios-deploy. We
-# should have a special flag for users to enable this.
-
-let version = "1.11.0";
-in stdenvNoCC.mkDerivation {
+let
+  privateFrameworks = "/Library/Apple/System/Library/PrivateFrameworks";
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "ios-deploy";
-  inherit version;
+  version = "1.12.2";
+
   src = fetchFromGitHub {
     owner = "ios-control";
     repo = "ios-deploy";
-    rev = version;
-    sha256 = "0hqwikdrcnslx4kkw9b0n7n443gzn2gbrw15pp2fnkcw5s0698sc";
+    rev = finalAttrs.version;
+    hash = "sha256-TVGC+f+1ow3b93CK3PhIL70le5SZxxb2ug5OkIg8XCA=";
   };
-  nativeBuildInputs = [ rsync ];
+
+  buildInputs = [
+    darwin.apple_sdk.frameworks.Foundation
+  ];
+
   buildPhase = ''
-    LD=$CC
-    tmp=$(mktemp -d)
-    ln -s /usr/bin/xcodebuild $tmp
-    export PATH="$PATH:$tmp"
-    xcodebuild -configuration Release SYMROOT=build OBJROOT=$tmp
-  '';
-  checkPhase = ''
-    xcodebuild test -scheme ios-deploy-tests -configuration Release SYMROOT=build
+    runHook preBuild
+
+    awk '{ print "\""$0"\\n\""}' src/scripts/lldb.py >> src/ios-deploy/lldb.py.h
+    clang src/ios-deploy/ios-deploy.m \
+      -framework Foundation \
+      -F${privateFrameworks} -framework MobileDevice \
+      -o ios-deploy
+
+    runHook postBuild
   '';
+
   installPhase = ''
-    install -D build/Release/ios-deploy $out/bin/ios-deploy
+    runHook preInstall
+
+    install -Dm755 ios-deploy $out/bin/ios-deploy
+
+    runHook postInstall
   '';
+
+  __impureHostDeps = [
+    privateFrameworks
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+  };
+
   meta = {
+    description = "Install and debug iPhone apps from the command line, without using Xcode";
+    homepage = "https://github.com/ios-control/ios-deploy";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "ios-deploy";
+    maintainers = with lib.maintainers; [ wegank ];
     platforms = lib.platforms.darwin;
-    description = "Install and debug iOS apps from the command line. Designed to work on un-jailbroken devices";
-    license = lib.licenses.gpl3;
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix b/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
index 4824bcff4f85..30fc882f0090 100644
--- a/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/raycast/default.nix
@@ -6,12 +6,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.57.1";
+  version = "1.59.0";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-ePHaNujW39LjMc+R2TZ1favJXeroHpbeuRNwmv8HgXc=";
+    hash = "sha256-EA8DzfJtd1lM0/N1bQ8x9GQ8KiILwRKPIFKk6XlaBhg=";
   };
 
   dontPatch = true;
diff --git a/nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix b/nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix
index b59c6051de72..6ea01f7c64d9 100644
--- a/nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/rectangle/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "rectangle";
-  version = "0.71";
+  version = "0.73";
 
   src = fetchurl {
     url = "https://github.com/rxhanson/Rectangle/releases/download/v${version}/Rectangle${version}.dmg";
-    hash = "sha256-QsvEBTuLh5GyVzNTKaJAVwPNtYCc/3yH+U8VgXE4nk0=";
+    hash = "sha256-D+heCrJVo2xsKY9XtEuhrG/59yFIJTGhKJIfN9Vhc+M=";
   };
 
   sourceRoot = ".";
diff --git a/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix b/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
index 069fac3d59f1..8dd2fb77cb98 100644
--- a/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/sketchybar/default.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sketchybar";
-  version = "2.16.3";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "FelixKratz";
     repo = "SketchyBar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PCAGIcO7lvIAEFXlJn/e9zG5kxvDABshxFbu/bXWX7o=";
+    hash = "sha256-FntWC180wpUyxP5iYdo/p2LbP0dbv1y6CXersfBT5b4=";
   };
 
   buildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/darwin/utm/default.nix b/nixpkgs/pkgs/os-specific/darwin/utm/default.nix
index d3aea9209727..7ab35aee0b43 100644
--- a/nixpkgs/pkgs/os-specific/darwin/utm/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/utm/default.nix
@@ -7,11 +7,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "utm";
-  version = "4.3.5";
+  version = "4.4.3";
 
   src = fetchurl {
     url = "https://github.com/utmapp/UTM/releases/download/v${version}/UTM.dmg";
-    hash = "sha256-aDIjf4TqhSIgYaJulI5FgXxlNiZ1qcNY+Typ7+S5Hc8=";
+    hash = "sha256-U1HB8uP8OzHX8LzBE8u7YSDI4vlY9vlMRE+JI+x9rvk=";
   };
 
   nativeBuildInputs = [ undmg makeWrapper ];
diff --git a/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix b/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
index 14d3ccbc0469..5474e8345c1a 100644
--- a/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
+++ b/nixpkgs/pkgs/os-specific/darwin/yabai/default.nix
@@ -17,7 +17,7 @@
 
 let
   pname = "yabai";
-  version = "5.0.8";
+  version = "6.0.0";
 
   test-version = testers.testVersion {
     package = yabai;
@@ -53,7 +53,7 @@ in
 
     src = fetchzip {
       url = "https://github.com/koekeishiya/yabai/releases/download/v${version}/yabai-v${version}.tar.gz";
-      hash = "sha256-w4MTHHYWwBq0/WkemYIeV49aA/DzFxXITD8gF5St0Yo=";
+      hash = "sha256-KeZ5srx9dfQN9u6Fgg9BtIhLhFWp975iz72m78bWINo=";
     };
 
     nativeBuildInputs = [
@@ -89,7 +89,7 @@ in
       owner = "koekeishiya";
       repo = "yabai";
       rev = "v${version}";
-      hash = "sha256-VahfeKYz/cATb0RF9QykngMtRpCh392jY8aJuggpqMU=";
+      hash = "sha256-BQhFTn9KDBv9oG8kT2TFFpPZGHARg7DfN+IeQNNDE84=";
     };
 
     nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
index 07705f568a1d..da559b5fcc1c 100644
--- a/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/alsa-project/alsa-utils/default.nix
@@ -1,13 +1,24 @@
-{lib, stdenv, fetchurl, alsa-lib, gettext, makeWrapper, ncurses, libsamplerate, pciutils, which, fftw}:
+{lib, stdenv, fetchurl, fetchpatch, alsa-lib, gettext, makeWrapper, ncurses, libsamplerate, pciutils, which, fftw}:
 
 stdenv.mkDerivation rec {
   pname = "alsa-utils";
-  version = "1.2.9";
+  version = "1.2.10";
 
   src = fetchurl {
     url = "mirror://alsa/utils/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-52I9RSVZX5LhHOJe6al/IEChTG5NzQJ6qW4Gy854F70=";
+    sha256 = "sha256-EEti7H8Cp84WynefSBVhbfHMIZM1A3g6kQe1lE+DBjo=";
   };
+  patches = [
+    # Backport fixes for musl libc. Remove on next release
+    (fetchpatch {
+      url = "https://github.com/alsa-project/alsa-utils/commit/8c229270f6bae83b705a03714c46067a7aa57b02.patch";
+      hash = "sha256-sUaBHY8EHf4805nF6tyNV5jYXcJf3O+r04VXFu4dUCE=";
+    })
+    (fetchpatch {
+      url = "https://github.com/alsa-project/alsa-utils/commit/0925ad7f09b2dc77015784f9ac2f5e34dd0dd5c3.patch";
+      hash = "sha256-bgGU9On82AUbOjo+KN6WfuhqUAWM87OHnKN7plpG284=";
+    })
+  ];
 
   nativeBuildInputs = [ gettext makeWrapper ];
   buildInputs = [ alsa-lib ncurses libsamplerate fftw ];
diff --git a/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix b/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix
index e0a4b9a0860d..200021024aab 100644
--- a/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix
@@ -5,13 +5,15 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "autosuspend";
-  version = "4.3.0";
+  version = "6.0.0";
+
+  disabled = python3.pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "languitar";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-gS8NNks4GaIGl7cEqWSP53I4/tIV4LypkmZ5vNOjspY=";
+    hash = "sha256-gS8NNks4GaIGl7cEqWSP53I4/tIV4LypkmZ5vNOjspY=";
   };
 
   postPatch = ''
@@ -50,11 +52,13 @@ python3.pkgs.buildPythonApplication rec {
 
   doCheck = true;
 
-  meta = with lib ; {
+  meta = with lib; {
     description = "A daemon to automatically suspend and wake up a system";
     homepage = "https://autosuspend.readthedocs.io";
+    changelog = "https://github.com/languitar/autosuspend/releases/tag/v${version}";
     license = licenses.gpl2Only;
-    maintainers = [ maintainers.bzizou ];
+    maintainers = with maintainers; [ bzizou anthonyroussel ];
+    mainProgram = "autosuspend";
     platforms = platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/bolt/default.nix b/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
index 2765b6647a7f..748db1a62b5b 100644
--- a/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
@@ -21,14 +21,14 @@
 
 stdenv.mkDerivation rec {
   pname = "bolt";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "bolt";
     repo = "bolt";
     rev = version;
-    sha256 = "sha256-j1UO8lkVoS56hwPQXH8aIr1UegM6PdtaBXKZn50GP60=";
+    sha256 = "sha256-sJBY/pXUX5InLynsvAmapW54UF/WGn9eDlluWXjhubQ=";
   };
 
   patches = [
diff --git a/nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix b/nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix
index e1fcf832f315..ecb34c373b74 100644
--- a/nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bpftrace/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "iovisor";
     repo  = "bpftrace";
     rev   = "v${version}";
-    hash  = "sha256-+aU27mxK4R0SHSsdGQzv02fK0L/m9uCIv7AkLyLSGQY=";
+    hash  = "sha256-JyMogqyntSm2IDXzsOIjcUkf2YwG2oXKpqPpdx/eMNI=";
   };
 
 
diff --git a/nixpkgs/pkgs/os-specific/linux/conky/default.nix b/nixpkgs/pkgs/os-specific/linux/conky/default.nix
index 39425f265e9b..0cd37f262cd3 100644
--- a/nixpkgs/pkgs/os-specific/linux/conky/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/conky/default.nix
@@ -67,13 +67,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "conky";
-  version = "1.19.4";
+  version = "1.19.5";
 
   src = fetchFromGitHub {
     owner = "brndnmtthws";
     repo = "conky";
     rev = "v${version}";
-    hash = "sha256-XptnokBWtBx0W2k2C9jVwIYH8pOrDUbuQLvh8JrW/w8=";
+    hash = "sha256-m8tI68PUEkO+tWbcq8CF5TAiKqFU9kcXMbi6NszS7NE=";
   };
 
   postPatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
index 18a0b9972275..42741fae5b6c 100644
--- a/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/conntrack-tools/default.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "conntrack-tools";
-  version = "1.4.7";
+  version = "1.4.8";
 
   src = fetchurl {
-    url = "https://www.netfilter.org/projects/conntrack-tools/files/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-CZ3rz1foFpDO1X9Ra0k1iKc1GPSMFNZW+COym0/CS10=";
+    url = "https://www.netfilter.org/projects/conntrack-tools/files/${pname}-${version}.tar.xz";
+    hash = "sha256-BnZ39MX2VkgZ547TqdSomAk16pJz86uyKkIOowq13tY=";
   };
 
   buildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/cpufrequtils/default.nix b/nixpkgs/pkgs/os-specific/linux/cpufrequtils/default.nix
index d64996c4961e..f62d8463714e 100644
--- a/nixpkgs/pkgs/os-specific/linux/cpufrequtils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/cpufrequtils/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/cpufrequtils-${version}.tar.gz";
-    sha256 = "127i38d4w1hv2dzdy756gmbhq25q3k34nqb2s0xlhsfhhdqs0lq0";
+    hash = "sha256-AFOgcYPQaUg70GJhS8YcuAgMV32mHN9+ExsGThoa8Yg=";
   };
 
   patches = [
@@ -27,5 +27,6 @@ stdenv.mkDerivation rec {
     homepage = "http://ftp.be.debian.org/pub/linux/utils/kernel/cpufreq/cpufrequtils.html";
     license = licenses.gpl2Only;
     platforms = [ "x86_64-linux" ];
+    mainProgram = "cpufreq-set";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/dcgm/default.nix b/nixpkgs/pkgs/os-specific/linux/dcgm/default.nix
index 32842a8eea0e..f3ebdf1427eb 100644
--- a/nixpkgs/pkgs/os-specific/linux/dcgm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dcgm/default.nix
@@ -1,8 +1,6 @@
 { lib
-, callPackage
 , gcc11Stdenv
 , fetchFromGitHub
-, addOpenGLRunpath
 , catch2
 , cmake
 , cudaPackages_10_2
@@ -87,13 +85,13 @@ let
 # C.f. https://github.com/NVIDIA/DCGM/blob/7e1012302679e4bb7496483b32dcffb56e528c92/dcgmbuild/build.sh#L22
 in gcc11Stdenv.mkDerivation rec {
   pname = "dcgm";
-  version = "3.1.8";
+  version = "3.2.5"; # N.B: If you change this, be sure prometheus-dcgm-exporter supports this version.
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "DCGM";
     rev = "refs/tags/v${version}";
-    hash = "sha256-OXqXkP2ZUNPzafGIgJ0MKa39xB84keVFFYl+JsHgnks=";
+    hash = "sha256-iMyYOr3dSpdRV2S/TlB/tEOAWYhK09373ZRbd5vzogQ=";
   };
 
   # Add our paths to the CUDA paths so FindCuda.cmake can find them.
diff --git a/nixpkgs/pkgs/os-specific/linux/device-tree/default.nix b/nixpkgs/pkgs/os-specific/linux/device-tree/default.nix
index fb8e92f23306..1a50d799b4b1 100644
--- a/nixpkgs/pkgs/os-specific/linux/device-tree/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/device-tree/default.nix
@@ -1,6 +1,29 @@
-{ lib, stdenvNoCC, dtc }:
+{ lib, stdenv, stdenvNoCC, dtc }:
 
 with lib; {
+  # Compile single Device Tree overlay source
+  # file (.dts) into its compiled variant (.dtb)
+  compileDTS = ({
+    name,
+    dtsFile,
+    includePaths ? [],
+    extraPreprocessorFlags ? []
+  }: stdenv.mkDerivation {
+    inherit name;
+
+    nativeBuildInputs = [ dtc ];
+
+    buildCommand =
+      let
+        includeFlagsStr = lib.concatMapStringsSep " " (includePath: "-I${includePath}") includePaths;
+        extraPreprocessorFlagsStr = lib.concatStringsSep " " extraPreprocessorFlags;
+      in
+      ''
+        $CC -E -nostdinc ${includeFlagsStr} -undef -D__DTS__ -x assembler-with-cpp ${extraPreprocessorFlagsStr} ${dtsFile} | \
+        dtc -I dts -O dtb -@ -o $out
+      '';
+  });
+
   applyOverlays = (base: overlays': stdenvNoCC.mkDerivation {
     name = "device-tree-overlays";
     nativeBuildInputs = [ dtc ];
diff --git a/nixpkgs/pkgs/os-specific/linux/dpdk/default.nix b/nixpkgs/pkgs/os-specific/linux/dpdk/default.nix
index 78acb45bb3c7..c3bd0c64a4ba 100644
--- a/nixpkgs/pkgs/os-specific/linux/dpdk/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dpdk/default.nix
@@ -68,7 +68,7 @@ in stdenv.mkDerivation rec {
   ]
   # kni kernel driver is currently not compatble with 5.11
   ++ lib.optional (mod && kernel.kernelOlder "5.11") "-Ddisable_drivers=kni"
-  ++ lib.optional (!shared) "-Ddefault_library=static"
+  ++ [(if shared then "-Ddefault_library=shared" else "-Ddefault_library=static")]
   ++ lib.optional (machine != null) "-Dmachine=${machine}"
   ++ lib.optional mod "-Dkernel_dir=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
   ++ lib.optional (withExamples != []) "-Dexamples=${builtins.concatStringsSep "," withExamples}";
diff --git a/nixpkgs/pkgs/os-specific/linux/esdm/default.nix b/nixpkgs/pkgs/os-specific/linux/esdm/default.nix
index 42e20981872f..150e3b95b4f1 100644
--- a/nixpkgs/pkgs/os-specific/linux/esdm/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/esdm/default.nix
@@ -9,67 +9,109 @@
 , ninja
 , libselinux
 , jitterentropy
-  # A more detailed explaination of the following meson build options can be found
-  # in the source code of esdm.
-  # A brief explanation is given:
+, botan3
+, openssl
+, libkcapi
+
+# A more detailed explaination of the following meson build options can be found
+# in the source code of esdm.
+# A brief explanation is given.
+
+# general options
 , selinux ? false # enable selinux support
 , drngHashDrbg ? true  # set the default drng callback
 , drngChaCha20 ? false # set the default drng callback
 , ais2031 ? false # set the seeding strategy to be compliant with AIS 20/31
+, sp80090c ? false # set compliance with NIST SP800-90C
+, cryptoBackend ? "botan" # set backend for hash and drbg operations
 , linuxDevFiles ? true # enable linux /dev/random and /dev/urandom support
 , linuxGetRandom ? true # enable linux getrandom support
-, esJitterRng ? true # enable support for the entropy source: jitter rng
+, hashSha512 ? false # set the conditioning hash: SHA2-512
+, hashSha3_512 ? true # set the conditioning hash: SHA3-512
+, openSSLRandProvider ? true # build ESDM provider for OpenSSL 3.x
+, botanRng ? true # build ESDM class for Botan 3.x
+
+# client-related options (handle with care, consult source code and meson options)
+# leave as is if in doubt
+, connectTimeoutExponent ? 28 # (1 << EXPONENT nanoseconds)
+, rxTxTimeoutExponent ? 28 # (1 << EXPONENT nanoseconds)
+, reconnectAttempts ? 10 # how often to attempt unix socket connection before giving up
+
+# entropy sources
+, esJitterRng ? true # enable support for the entropy source: jitter rng (running in user space)
+, esJitterRngEntropyRate ? 256 # amount of entropy to account for jitter rng source
+, esJitterRngKernel ? true # enable support for the entropy source: jitter rng (running in kernel space)
+, esJitterRngKernelEntropyRate ? 256 # amount of entropy to account for kernel jitter rng source
 , esCPU ? true # enable support for the entropy source: cpu-based entropy
+, esCPUEntropyRate ? 8 # amount of entropy to account for cpu rng source
 , esKernel ? true # enable support for the entropy source: kernel-based entropy
+, esKernelEntropyRate ? 128 # amount of entropy to account for kernel-based source
 , esIRQ ? false # enable support for the entropy source: interrupt-based entropy
+, esIRQEntropyRate ? 256 # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
 , esSched ? false # enable support for the entropy source: scheduler-based entropy
+, esSchedEntropyRate ? 0 # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
 , esHwrand ? true # enable support for the entropy source: /dev/hwrng
-, hashSha512 ? false # set the conditioning hash: SHA2-512
-, hashSha3_512 ? true # set the conditioning hash: SHA3-512
+, esHwrandEntropyRate ? 128 # amount of entropy to account for /dev/hwrng-based sources
 }:
 
 assert drngHashDrbg != drngChaCha20;
 assert hashSha512 != hashSha3_512;
+assert cryptoBackend == "openssl" || cryptoBackend == "botan" || cryptoBackend == "builtin" "Unsupported ESDM crypto backend";
 
 stdenv.mkDerivation rec {
   pname = "esdm";
-  version = "0.6.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "esdm";
     rev = "v${version}";
-    sha256 = "sha256-swBKVb5gnND76w2ULT+5hR/jVOqxEe4TAB1gyaLKE9Q=";
+    sha256 = "sha256-q6TGL1agltV9CFfcA6hZszVwGIBBngs22ZqhQgc9FeM=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "arm64.patch";
-      url = "https://github.com/smuellerDD/esdm/commit/86b93a0ddf684448aba152c8f1b3baf40a6d41c0.patch";
-      sha256 = "sha256-gjp13AEsDNj23fcGanAAn2KCbYKA0cphhf4mCxek9Yg=";
-    })
-  ];
-
   nativeBuildInputs = [ meson pkg-config ninja ];
-  buildInputs = [ protobufc fuse3 jitterentropy ]
-    ++ lib.optional selinux libselinux;
+  buildInputs = [ protobufc ]
+    ++ lib.optional (cryptoBackend == "botan" || botanRng) botan3
+    ++ lib.optional (cryptoBackend == "openssl" || openSSLRandProvider) openssl
+    ++ lib.optional selinux libselinux
+    ++ lib.optional esJitterRng jitterentropy
+    ++ lib.optional linuxDevFiles fuse3
+    ++ lib.optional esJitterRngKernel libkcapi;
 
   mesonFlags = [
     (lib.mesonBool "b_lto" false)
+    (lib.mesonBool "fips140" false)
     (lib.mesonBool "ais2031" ais2031)
+    (lib.mesonBool "sp80090c" sp80090c)
+    (lib.mesonEnable "node" true) # multiple DRNGs
+    (lib.mesonOption "threading_max_threads" (toString 64))
+    (lib.mesonOption "crypto_backend" cryptoBackend)
     (lib.mesonEnable "linux-devfiles" linuxDevFiles)
     (lib.mesonEnable "linux-getrandom" linuxGetRandom)
+    (lib.mesonOption "client-connect-timeout-exponent" (toString connectTimeoutExponent))
+    (lib.mesonOption "client-rx-tx-timeout-exponent" (toString rxTxTimeoutExponent))
+    (lib.mesonOption "client-reconnect-attempts" (toString reconnectAttempts))
     (lib.mesonEnable "es_jent" esJitterRng)
+    (lib.mesonOption "es_jent_entropy_rate" (toString esJitterRngEntropyRate))
+    (lib.mesonEnable "es_jent_kernel" esJitterRngKernel)
+    (lib.mesonOption "es_jent_kernel_entropy_rate" (toString esJitterRngKernelEntropyRate))
     (lib.mesonEnable "es_cpu" esCPU)
+    (lib.mesonOption "es_cpu_entropy_rate" (toString esCPUEntropyRate))
     (lib.mesonEnable "es_kernel" esKernel)
+    (lib.mesonOption "es_kernel_entropy_rate" (toString esKernelEntropyRate))
     (lib.mesonEnable "es_irq" esIRQ)
+    (lib.mesonOption "es_irq_entropy_rate" (toString esIRQEntropyRate))
     (lib.mesonEnable "es_sched" esSched)
+    (lib.mesonOption "es_sched_entropy_rate" (toString esSchedEntropyRate))
     (lib.mesonEnable "es_hwrand" esHwrand)
+    (lib.mesonOption "es_hwrand_entropy_rate" (toString esHwrandEntropyRate))
     (lib.mesonEnable "hash_sha512" hashSha512)
     (lib.mesonEnable "hash_sha3_512" hashSha3_512)
     (lib.mesonEnable "selinux" selinux)
     (lib.mesonEnable "drng_hash_drbg" drngHashDrbg)
     (lib.mesonEnable "drng_chacha20" drngChaCha20)
+    (lib.mesonEnable "openssl-rand-provider" openSSLRandProvider)
+    (lib.mesonEnable "botan-rng" botanRng)
   ];
 
   doCheck = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/eudev/default.nix b/nixpkgs/pkgs/os-specific/linux/eudev/default.nix
deleted file mode 100644
index 4d3c9e785229..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/eudev/default.nix
+++ /dev/null
@@ -1,66 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, autoreconfHook
-, gperf
-, kmod
-, pkg-config
-, util-linux
-}:
-
-stdenv.mkDerivation rec {
-  pname = "eudev";
-  version = "3.2.12";
-
-  src = fetchFromGitHub {
-    owner = "eudev-project";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-x9l+W8zuFYwG0m9JOIDbEf1x6yeBW36HnJws/buc7HI=";
-  };
-
-  nativeBuildInputs = [
-    autoreconfHook
-    gperf
-    pkg-config
-  ];
-
-  buildInputs = [
-    kmod
-    util-linux
-  ];
-
-  configureFlags = [
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-  ];
-
-  makeFlags = [
-    "hwdb_bin=/var/lib/udev/hwdb.bin"
-    "udevrulesdir=/etc/udev/rules.d"
-    ];
-
-  preInstall = ''
-    # Disable install-exec-hook target,
-    # as it conflicts with our move-sbin setup-hook
-
-    sed -i 's;$(MAKE) $(AM_MAKEFLAGS) install-exec-hook;$(MAKE) $(AM_MAKEFLAGS);g' src/udev/Makefile
-  '';
-
-  installFlags = [
-    "localstatedir=$(TMPDIR)/var"
-    "sysconfdir=$(out)/etc"
-    "udevconfdir=$(out)/etc/udev"
-    "udevhwdbbin=$(out)/var/lib/udev/hwdb.bin"
-    "udevhwdbdir=$(out)/var/lib/udev/hwdb.d"
-    "udevrulesdir=$(out)/var/lib/udev/rules.d"
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/eudev-project/eudev";
-    description = "A fork of udev with the aim of isolating it from init";
-    license = licenses.gpl2Plus ;
-    maintainers = with maintainers; [ raskin AndersonTorres ];
-    platforms = platforms.linux;
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/eventstat/default.nix b/nixpkgs/pkgs/os-specific/linux/eventstat/default.nix
index 88ac5add34a7..2c139cd3c865 100644
--- a/nixpkgs/pkgs/os-specific/linux/eventstat/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/eventstat/default.nix
@@ -23,6 +23,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/ColinIanKing/eventstat";
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
index c5c0ebb00021..4e95ccea8dc1 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
@@ -1,5 +1,5 @@
 diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
-index b0ff5b10..13ac380d 100644
+index b0ff5b106..13ac380d0 100644
 --- a/data/bios-settings.d/meson.build
 +++ b/data/bios-settings.d/meson.build
 @@ -1,5 +1,5 @@
@@ -10,7 +10,7 @@ index b0ff5b10..13ac380d 100644
  )
  endif
 diff --git a/data/meson.build b/data/meson.build
-index 8999ee57..b57174dc 100644
+index e13da4adf..6858c240f 100644
 --- a/data/meson.build
 +++ b/data/meson.build
 @@ -26,7 +26,7 @@ endif
@@ -23,7 +23,7 @@ index 8999ee57..b57174dc 100644
    )
    plugin_quirks += files([
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 3649fece..c3462744 100644
+index 3649fecea..c3462744b 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
 @@ -12,13 +12,13 @@ install_data([
@@ -57,7 +57,7 @@ index 3649fece..c3462744 100644
  )
  endif
 diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index c20a1a05..5354bac7 100644
+index c20a1a05e..5354bac7f 100644
 --- a/data/remotes.d/meson.build
 +++ b/data/remotes.d/meson.build
 @@ -15,14 +15,14 @@ if build_standalone and get_option('lvfs') != 'false'
@@ -93,10 +93,10 @@ index c20a1a05..5354bac7 100644
 +  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index fa7a5599..5b53a407 100644
+index ca6ccdf92..0a3097d90 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -191,6 +191,12 @@ endif
+@@ -195,6 +195,12 @@ endif
  mandir = join_paths(prefix, get_option('mandir'))
  localedir = join_paths(prefix, get_option('localedir'))
 
@@ -107,32 +107,24 @@ index fa7a5599..5b53a407 100644
 +endif
 +
  diffcmd = find_program('diff')
- gio = dependency('gio-2.0', version: '>= 2.45.8')
- giounix = dependency('gio-unix-2.0', version: '>= 2.45.8', required: false)
+ gio = dependency('gio-2.0', version: '>= 2.68.0')
+ giounix = dependency('gio-unix-2.0', version: '>= 2.68.0', required: false)
 
 diff --git a/meson_options.txt b/meson_options.txt
-index 81d373f8..d214cf64 100644
+index 877891126..986d0ee31 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -1,3 +1,4 @@
-+option('sysconfdir_install', type: 'string', value: '', description: 'sysconfdir to use during installation')
- option('build', type : 'combo', choices : ['all', 'standalone', 'library'], value : 'all', description : 'build type')
- option('consolekit', type : 'feature', description : 'ConsoleKit support', deprecated: {'true': 'enabled', 'false': 'disabled'})
- option('static_analysis', type : 'boolean', value : false, description : 'enable GCC static analysis support')
-diff --git a/plugins/dell-esrt/meson.build b/plugins/dell-esrt/meson.build
-index 88c039f8..62a7691f 100644
---- a/plugins/dell-esrt/meson.build
-+++ b/plugins/dell-esrt/meson.build
-@@ -27,6 +27,6 @@ configure_file(
-   output: 'dell-esrt.conf',
-   configuration: con2,
-   install: true,
--  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
- )
- endif
+@@ -1,3 +1,8 @@
++option('sysconfdir_install',
++  type: 'string',
++  value: '',
++  description: 'sysconfdir to use during installation'
++)
+ option('build',
+   type: 'combo',
+   choices: [
 diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
-index f4657a6a..28ca0653 100644
+index eb196c21e..c9a29f680 100644
 --- a/plugins/uefi-capsule/meson.build
 +++ b/plugins/uefi-capsule/meson.build
 @@ -20,7 +20,7 @@ if host_machine.system() == 'linux'
@@ -144,5 +136,3 @@ index f4657a6a..28ca0653 100644
    )
  elif host_machine.system() == 'freebsd'
    backend_srcs += 'fu-uefi-backend-freebsd.c'
---
-2.40.1
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
index 5472cce05656..3def168d2fa9 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/default.nix
@@ -124,7 +124,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.9.5";
+  version = "1.9.6";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -135,7 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-dqbFgVgG2RQM5ZHIEIIJOmrjtwlaRXEyY+2OdDs4PGo=";
+    hash = "sha256-9mA6gETnOmmkI+cdF0kP1moPV6DDvASq1JXarupM/tU=";
   };
 
   patches = [
@@ -213,6 +213,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dplugin_dummy=true"
     # We are building the official releases.
     "-Dsupported_build=enabled"
+    "-Dlaunchd=disabled"
     "-Dudevdir=lib/udev"
     "-Dsystemd_root_prefix=${placeholder "out"}"
     "-Dinstalled_test_prefix=${placeholder "installedTests"}"
@@ -226,7 +227,6 @@ stdenv.mkDerivation (finalAttrs: {
   ] ++ lib.optionals (!enablePassim) [
     "-Dpassim=disabled"
   ] ++ lib.optionals (!haveDell) [
-    "-Dplugin_dell=disabled"
     "-Dplugin_synaptics_mst=disabled"
   ] ++ lib.optionals (!haveRedfish) [
     "-Dplugin_redfish=disabled"
@@ -350,8 +350,6 @@ stdenv.mkDerivation (finalAttrs: {
       "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
       "pki/fwupd-metadata/LVFS-CA.pem"
       "grub.d/35_fwupd"
-    ] ++ lib.optionals haveDell [
-      "fwupd/remotes.d/dell-esrt.conf"
     ];
 
     # DisabledPlugins key in fwupd/daemon.conf
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
index a914f56c66db..2954f89e14c3 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
@@ -1,8 +1,8 @@
 diff --git a/data/installed-tests/meson.build b/data/installed-tests/meson.build
-index be3d5c6d9..14d45dcaf 100644
+index dfce86b1c..5e34c4fa6 100644
 --- a/data/installed-tests/meson.build
 +++ b/data/installed-tests/meson.build
-@@ -83,5 +83,5 @@ configure_file(
+@@ -86,5 +86,5 @@ configure_file(
    output: 'fwupd-tests.conf',
    configuration: con2,
    install: true,
@@ -10,10 +10,10 @@ index be3d5c6d9..14d45dcaf 100644
 +  install_dir: join_paths(get_option('installed_test_prefix'), 'etc', 'fwupd', 'remotes.d'),
  )
 diff --git a/meson.build b/meson.build
-index 30011f548..7ac8c937a 100644
+index ca6ccdf92..36b1b47b0 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -186,8 +186,8 @@ else
+@@ -188,8 +188,8 @@ else
    datadir = join_paths(prefix, get_option('datadir'))
    sysconfdir = join_paths(prefix, get_option('sysconfdir'))
    localstatedir = join_paths(prefix, get_option('localstatedir'))
@@ -24,7 +24,7 @@ index 30011f548..7ac8c937a 100644
    daemon_dir = join_paths(libexecdir, 'fwupd')
  endif
  mandir = join_paths(prefix, get_option('mandir'))
-@@ -498,6 +498,7 @@ gnome = import('gnome')
+@@ -497,6 +497,7 @@ gnome = import('gnome')
  i18n = import('i18n')
  
  conf.set_quoted('FWUPD_PREFIX', prefix)
@@ -33,14 +33,17 @@ index 30011f548..7ac8c937a 100644
  conf.set_quoted('FWUPD_LIBDIR', libdir)
  conf.set_quoted('FWUPD_LIBEXECDIR', libexecdir)
 diff --git a/meson_options.txt b/meson_options.txt
-index 6fc7e8437..29832fd08 100644
+index 877891126..bfc5d1afd 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -57,6 +57,7 @@ option('systemd', type : 'feature', description : 'systemd support', deprecated:
- option('systemd_unit_user', type : 'string', description : 'User account to use for fwupd-refresh.service (empty for DynamicUser)')
- option('systemd_root_prefix', type: 'string', value: '', description: 'Directory to base systemd’s installation directories on')
- option('elogind', type : 'feature', description : 'elogind support', deprecated: {'true': 'enabled', 'false': 'disabled'})
-+option('installed_test_prefix', type: 'string', description: 'Prefix for installed tests')
- option('tests', type : 'boolean', value : true, description : 'enable tests')
- option('soup_session_compat', type : 'boolean', value : true, description : 'enable SoupSession runtime compatibility support')
- option('curl', type : 'feature', description : 'libcurl support', deprecated: {'true': 'enabled', 'false': 'disabled'})
+@@ -452,6 +452,10 @@ option('elogind',
+     'false': 'disabled',
+   },
+ )
++option('installed_test_prefix',
++  type: 'string',
++  description: 'Prefix for installed tests'
++)
+ option('tests',
+   type: 'boolean',
+   value: true,
diff --git a/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix b/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix
index c7d7d5af09b8..99d8527fc1d8 100644
--- a/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/freeipa/default.nix
@@ -64,11 +64,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "freeipa";
-  version = "4.10.2";
+  version = "4.11.0";
 
   src = fetchurl {
     url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
-    sha256 = "sha256-9DbfxJeEUGnBE7pULTPrVgqRePILUFk4Kn0WFNmcFVg=";
+    sha256 = "sha256-l/e2Dq/ako41QWEZyJCD+PA44PzTnzC8B7jYAm/Tt6Q=";
   };
 
   nativeBuildInputs = [
@@ -167,5 +167,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.s1341 ];
     platforms = platforms.linux;
+    mainProgram = "ipa";
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 1615ae39f7a3..dacfb76eb9af 100644
--- a/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, patchelf
 , cmake
 , pkg-config
 , intel-gmmlib
@@ -12,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "23.22.26516.18";
+  version = "23.30.26918.20";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "sha256-SeNmCXqoUqTo1F3ia+4fAMHWJgdEz/PsNFEkrqM+0k4=";
+    hash = "sha256-dEznHRgAcJa/BBTD/AWJHlA7fNj2IXHHrYcKM4M+/1o=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/iomelt/default.nix b/nixpkgs/pkgs/os-specific/linux/iomelt/default.nix
index 860a7b446328..0084a397d075 100644
--- a/nixpkgs/pkgs/os-specific/linux/iomelt/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iomelt/default.nix
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "A simple yet effective way to benchmark disk IO in Linux systems";
     homepage    = "http://www.iomelt.com";
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
     license = licenses.artistic2;
     platforms   = platforms.linux;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix b/nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix
index 2917ace349fb..016651deb492 100644
--- a/nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iotop-c/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iotop-c";
-  version = "1.23";
+  version = "1.24";
 
   src = fetchFromGitHub {
     owner = "Tomas-M";
     repo = "iotop";
     rev = "v${version}";
-    sha256 = "sha256-4DTYtUltmZ+nkm4ZLac+6JbBW3z+qby7sP33LwEXtcQ=";
+    sha256 = "sha256-oSKNP/WY0Ivhj5LgyeerzZbleMcUn8ho0aqsiunqvyU=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/iproute/default.nix b/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
index 64749e209ba6..a86af7e6db26 100644
--- a/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/iproute/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch
+{ lib, stdenv, fetchurl
 , buildPackages, bison, flex, pkg-config
 , db, iptables, libelf, libmnl
 , gitUpdater
@@ -6,27 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.4.0";
+  version = "6.5.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-TFG43svH5NoVn/sGb1kM+5Pb+a9/+GsWR85Ct8F5onI=";
+    hash = "sha256-pwF5CF+huW08M7BAyAm3XitXVjrcUFpK0F4mCd83NGM=";
   };
 
-  patches = [
-    # To avoid ./configure failing due to invalid arguments:
-    (fetchpatch { # configure: restore backward compatibility
-      url = "https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/patch/?id=a3272b93725a406bc98b67373da67a4bdf6fcdb0";
-      sha256 = "0hyagh2lf6rrfss4z7ca8q3ydya6gg7vfhh25slhpgcn6lnk0xbv";
-    })
-
-    # fix build on musl. applied anywhere to prevent patchrot.
-    (fetchpatch {
-      url = "https://git.alpinelinux.org/aports/plain/main/iproute2/include.patch?id=bd46efb8a8da54948639cebcfa5b37bd608f1069";
-      sha256 = "sha256-NpNnSXQntuzzpjswE42yzo7nqmrQgI5YcHR2kp9NEwA=";
-    })
-  ];
-
   postPatch = ''
     # Don't try to create /var/lib/arpd:
     sed -e '/ARPDDIR/d' -i Makefile
diff --git a/nixpkgs/pkgs/os-specific/linux/ipset/default.nix b/nixpkgs/pkgs/os-specific/linux/ipset/default.nix
index 6aa369e4eb4a..8326ef1c4614 100644
--- a/nixpkgs/pkgs/os-specific/linux/ipset/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ipset/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ipset";
-  version = "7.17";
+  version = "7.19";
 
   src = fetchurl {
     url = "https://ipset.netfilter.org/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-vknJ/0id1mEMrWVB50PDOE6slunyRwfaezkp2PKsZNg=";
+    sha256 = "sha256-m8H7pI1leG4+C2Pca2aahmgj13hAxpkMDGsjB47CxNY=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
index 2e5582677369..ceb34fe0c76f 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/common-config.nix
@@ -146,7 +146,7 @@ let
     scheduler = {
       IOSCHED_CFQ = whenOlder "5.0" yes; # Removed in 5.0-RC1
       BLK_CGROUP  = yes; # required by CFQ"
-      BLK_CGROUP_IOLATENCY = whenAtLeast "4.19" yes;
+      BLK_CGROUP_IOLATENCY = yes;
       BLK_CGROUP_IOCOST = whenAtLeast "5.4" yes;
       IOSCHED_DEADLINE = whenOlder "5.0" yes; # Removed in 5.0-RC1
       MQ_IOSCHED_DEADLINE = yes;
@@ -183,8 +183,8 @@ let
       BPF_JIT            = whenPlatformHasEBPFJit yes;
       BPF_JIT_ALWAYS_ON  = whenPlatformHasEBPFJit no; # whenPlatformHasEBPFJit yes; # see https://github.com/NixOS/nixpkgs/issues/79304
       HAVE_EBPF_JIT      = whenPlatformHasEBPFJit yes;
-      BPF_STREAM_PARSER  = whenAtLeast "4.19" yes;
-      XDP_SOCKETS        = whenAtLeast "4.19" yes;
+      BPF_STREAM_PARSER  = yes;
+      XDP_SOCKETS        = yes;
       XDP_SOCKETS_DIAG   = whenAtLeast "5.1" yes;
       WAN                = yes;
       TCP_CONG_ADVANCED  = yes;
@@ -208,7 +208,7 @@ let
       IPV6_FOU_TUNNEL             = module;
       IPV6_SEG6_LWTUNNEL          = yes;
       IPV6_SEG6_HMAC              = yes;
-      IPV6_SEG6_BPF               = whenAtLeast "4.18" yes;
+      IPV6_SEG6_BPF               = yes;
       NET_CLS_BPF                 = module;
       NET_ACT_BPF                 = module;
       NET_SCHED                   = yes;
@@ -237,22 +237,17 @@ let
       NF_CONNTRACK_TIMEOUT        = yes;
       NF_CONNTRACK_TIMESTAMP      = yes;
       NETFILTER_NETLINK_GLUE_CT   = yes;
-      NF_TABLES_INET              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
-      NF_TABLES_NETDEV            = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_INET              = yes;
+      NF_TABLES_NETDEV            = yes;
       NFT_REJECT_NETDEV           = whenAtLeast "5.11" module;
 
       # IP: Netfilter Configuration
-      NF_TABLES_IPV4              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
-      NF_TABLES_ARP               = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_IPV4              = yes;
+      NF_TABLES_ARP               = yes;
       # IPv6: Netfilter Configuration
-      NF_TABLES_IPV6              = mkMerge [ (whenOlder "4.17" module)
-                                              (whenAtLeast "4.17" yes) ];
+      NF_TABLES_IPV6              = yes;
       # Bridge Netfilter Configuration
-      NF_TABLES_BRIDGE            = mkMerge [ (whenBetween "4.19" "5.3" yes)
+      NF_TABLES_BRIDGE            = mkMerge [ (whenOlder "5.3" yes)
                                               (whenAtLeast "5.3" module) ];
 
       # needed for `dropwatch`
@@ -274,7 +269,7 @@ let
 
       # Kernel TLS
       TLS         = module;
-      TLS_DEVICE  = whenAtLeast "4.18" yes;
+      TLS_DEVICE  = yes;
 
       # infiniband
       INFINIBAND = module;
@@ -323,7 +318,7 @@ let
       FB_3DFX_ACCEL       = yes;
       FB_VESA             = yes;
       FRAMEBUFFER_CONSOLE = yes;
-      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = whenAtLeast "4.19" yes;
+      FRAMEBUFFER_CONSOLE_DEFERRED_TAKEOVER = yes;
       FRAMEBUFFER_CONSOLE_ROTATION = yes;
       FB_GEODE            = mkIf (stdenv.hostPlatform.system == "i686-linux") yes;
       # On 5.14 this conflicts with FB_SIMPLE.
@@ -357,8 +352,7 @@ let
       # Allow device firmware updates
       DRM_DP_AUX_CHARDEV = yes;
       # amdgpu display core (DC) support
-      DRM_AMD_DC_DCN1_0 = whenBetween "4.15" "5.6" yes;
-      DRM_AMD_DC_PRE_VEGA = whenBetween "4.15" "4.18" yes;
+      DRM_AMD_DC_DCN1_0 = whenOlder "5.6" yes;
       DRM_AMD_DC_DCN2_0 = whenBetween "5.3" "5.6" yes;
       DRM_AMD_DC_DCN2_1 = whenBetween "5.4" "5.6" yes;
       DRM_AMD_DC_DCN3_0 = whenBetween "5.9" "5.11" yes;
@@ -368,8 +362,8 @@ let
       DRM_AMD_DC_SI = whenAtLeast "5.10" yes;
     } // optionalAttrs (stdenv.hostPlatform.system == "x86_64-linux") {
       # Intel GVT-g graphics virtualization supports 64-bit only
-      DRM_I915_GVT = whenAtLeast "4.16" yes;
-      DRM_I915_GVT_KVMGT = whenAtLeast "4.16" module;
+      DRM_I915_GVT = yes;
+      DRM_I915_GVT_KVMGT = module;
       # Enable Hyper-V Synthetic DRM Driver
       DRM_HYPERV = whenAtLeast "5.14" module;
     } // optionalAttrs (stdenv.hostPlatform.system == "aarch64-linux") {
@@ -425,25 +419,9 @@ let
 
     usb-serial = {
       USB_SERIAL_GENERIC          = yes; # USB Generic Serial Driver
-    } // optionalAttrs (versionOlder version "4.16") {
-      # Include firmware for various USB serial devices.
-      # Only applicable for kernels below 4.16, after that no firmware is shipped in the kernel tree.
-      USB_SERIAL_KEYSPAN_MPR      = yes;
-      USB_SERIAL_KEYSPAN_USA28    = yes;
-      USB_SERIAL_KEYSPAN_USA28X   = yes;
-      USB_SERIAL_KEYSPAN_USA28XA  = yes;
-      USB_SERIAL_KEYSPAN_USA28XB  = yes;
-      USB_SERIAL_KEYSPAN_USA19    = yes;
-      USB_SERIAL_KEYSPAN_USA18X   = yes;
-      USB_SERIAL_KEYSPAN_USA19W   = yes;
-      USB_SERIAL_KEYSPAN_USA19QW  = yes;
-      USB_SERIAL_KEYSPAN_USA19QI  = yes;
-      USB_SERIAL_KEYSPAN_USA49W   = yes;
-      USB_SERIAL_KEYSPAN_USA49WLC = yes;
     };
 
     usb = {
-      USB_DEBUG = { optional = true; tristate = whenOlder "4.18" "n";};
       USB_EHCI_ROOT_HUB_TT = yes; # Root Hub Transaction Translators
       USB_EHCI_TT_NEWSCHED = yes; # Improved transaction translator scheduling
       USB_HIDDEV = yes; # USB Raw HID Devices (like monitor controls and Uninterruptable Power Supplies)
@@ -514,7 +492,6 @@ let
       CIFS_XATTR        = yes;
       CIFS_POSIX        = option yes;
       CIFS_FSCACHE      = yes;
-      CIFS_STATS        = whenOlder "4.19" yes;
       CIFS_WEAK_PW_HASH = whenOlder "5.15" yes;
       CIFS_UPCALL       = yes;
       CIFS_ACL          = whenOlder "5.3" yes;
@@ -569,7 +546,7 @@ let
       SECURITY_APPARMOR                = yes;
       DEFAULT_SECURITY_APPARMOR        = yes;
 
-      RANDOM_TRUST_CPU                 = whenOlder "6.2" (whenAtLeast "4.19" yes); # allow RDRAND to seed the RNG
+      RANDOM_TRUST_CPU                 = whenOlder "6.2" yes; # allow RDRAND to seed the RNG
       RANDOM_TRUST_BOOTLOADER          = whenOlder "6.2" (whenAtLeast "5.4" yes); # allow the bootloader to seed the RNG
 
       MODULE_SIG            = no; # r13y, generates a random key during build and bakes it in
@@ -581,10 +558,6 @@ let
       PERSISTENT_KEYRINGS              = yes;
       # enable temporary caching of the last request_key() result
       KEYS_REQUEST_CACHE               = whenAtLeast "5.3" yes;
-    } // optionalAttrs (!stdenv.hostPlatform.isAarch32) {
-
-      # Detect buffer overflows on the stack
-      CC_STACKPROTECTOR_REGULAR = {optional = true; tristate = whenOlder "4.18" "y";};
     } // optionalAttrs stdenv.hostPlatform.isx86_64 {
       # Enable Intel SGX
       X86_SGX     = whenAtLeast "5.11" yes;
@@ -596,7 +569,7 @@ let
       # AMD SME
       AMD_MEM_ENCRYPT = yes;
       # AMD SEV and AMD SEV-SE
-      KVM_AMD_SEV     = whenAtLeast "4.16" yes;
+      KVM_AMD_SEV     = yes;
       # AMD SEV-SNP
       SEV_GUEST       = whenAtLeast "5.19" module;
     };
@@ -702,7 +675,6 @@ let
       XEN_PVH                     = option yes;
       XEN_PVHVM                   = option yes;
       XEN_SAVE_RESTORE            = option yes;
-      XEN_SCRUB_PAGES             = whenOlder "4.19" yes;
       XEN_SELFBALLOONING          = whenOlder "5.3" yes;
 
       # Enable device detection on virtio-mmio hypervisors
@@ -756,40 +728,11 @@ let
     tests = {
       # This menu disables all/most of them on >= 4.16
       RUNTIME_TESTING_MENU = option no;
-    } // optionalAttrs (versionOlder version "4.16") {
-      # For older kernels, painstakingly disable each symbol.
-      ARM_KPROBES_TEST    = option no;
-      ASYNC_RAID6_TEST    = option no;
-      ATOMIC64_SELFTEST   = option no;
-      BACKTRACE_SELF_TEST = option no;
-      INTERVAL_TREE_TEST  = option no;
-      PERCPU_TEST         = option no;
-      RBTREE_TEST         = option no;
-      TEST_BITMAP         = option no;
-      TEST_BPF            = option no;
-      TEST_FIRMWARE       = option no;
-      TEST_HASH           = option no;
-      TEST_HEXDUMP        = option no;
-      TEST_KMOD           = option no;
-      TEST_KSTRTOX        = option no;
-      TEST_LIST_SORT      = option no;
-      TEST_LKM            = option no;
-      TEST_PARMAN         = option no;
-      TEST_PRINTF         = option no;
-      TEST_RHASHTABLE     = option no;
-      TEST_SORT           = option no;
-      TEST_STATIC_KEYS    = option no;
-      TEST_STRING_HELPERS = option no;
-      TEST_UDELAY         = option no;
-      TEST_USER_COPY      = option no;
-      TEST_UUID           = option no;
     } // {
       CRC32_SELFTEST           = option no;
       CRYPTO_TEST              = option no;
       EFI_TEST                 = option no;
       GLOB_SELFTEST            = option no;
-      DRM_DEBUG_MM_SELFTEST    = { optional = true; tristate = whenOlder "4.18" "n";};
-      LNET_SELFTEST            = { optional = true; tristate = whenOlder "4.18" "n";};
       LOCK_TORTURE_TEST        = option no;
       MTD_TESTS                = option no;
       NOTIFIER_ERROR_INJECTION = option no;
@@ -801,23 +744,11 @@ let
       XZ_DEC_TEST              = option no;
     };
 
-    criu = if (versionAtLeast version "4.19") then {
+    criu = {
       # Unconditionally enabled, because it is required for CRIU and
       # it provides the kcmp() system call that Mesa depends on.
       CHECKPOINT_RESTORE  = yes;
-    } else optionalAttrs (features.criu or false) ({
-      # For older kernels, CHECKPOINT_RESTORE is hidden behind EXPERT.
-      EXPERT              = yes;
-      CHECKPOINT_RESTORE  = yes;
-    } // optionalAttrs (features.criu_revert_expert or true) {
-      RFKILL_INPUT          = option yes;
-      HID_PICOLCD_FB        = option yes;
-      HID_PICOLCD_BACKLIGHT = option yes;
-      HID_PICOLCD_LCD       = option yes;
-      HID_PICOLCD_LEDS      = option yes;
-      HID_PICOLCD_CIR       = option yes;
-      DEBUG_MEMORY_INIT     = option yes;
-    });
+    };
 
     misc = let
       # Use zstd for kernel compression if 64-bit and newer than 5.9, otherwise xz.
@@ -861,7 +792,6 @@ let
       PM_TRACE_RTC         = no; # Disable some expensive (?) features.
       ACCESSIBILITY        = yes; # Accessibility support
       AUXDISPLAY           = yes; # Auxiliary Display support
-      DONGLE               = whenOlder "4.17" yes; # Serial dongle support
       HIPPI                = yes;
       MTD_COMPLEX_MAPPINGS = yes; # needed for many devices
 
@@ -917,7 +847,6 @@ let
       FUSION              = yes; # Fusion MPT device support
       IDE                 = whenOlder "5.14" no; # deprecated IDE support, removed in 5.14
       IDLE_PAGE_TRACKING  = yes;
-      IRDA_ULTRA          = whenOlder "4.17" yes; # Ultra (connectionless) protocol
 
       JOYSTICK_IFORCE_232 = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force Serial joysticks and wheels
       JOYSTICK_IFORCE_USB = { optional = true; tristate = whenOlder "5.3" "y"; }; # I-Force USB joysticks and wheels
@@ -939,7 +868,7 @@ let
 
       MLX5_CORE_EN       = option yes;
 
-      NVME_MULTIPATH = whenAtLeast "4.15" yes;
+      NVME_MULTIPATH = yes;
 
       PSI = whenAtLeast "4.20" yes;
 
@@ -1012,8 +941,9 @@ let
 
       X86_AMD_PLATFORM_DEVICE = yes;
       X86_PLATFORM_DRIVERS_DELL = whenAtLeast "5.12" yes;
+      X86_PLATFORM_DRIVERS_HP = whenAtLeast "6.1" yes;
 
-      LIRC = mkMerge [ (whenOlder "4.16" module) (whenAtLeast "4.17" yes) ];
+      LIRC = yes;
 
       SCHED_CORE = whenAtLeast "5.14" yes;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.11.patch b/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.11.patch
deleted file mode 100644
index 4e247e432891..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/4.11.patch
+++ /dev/null
@@ -1,784 +0,0 @@
-commit 827b86ad1dd21feed4c0b99faf6059f245f7dadb
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Misc preps for cgroup unified hierarchy interface
-    
-    Make the following changes in preparation for the cpu controller
-    interface implementation for the unified hierarchy.  This patch
-    doesn't cause any functional differences.
-    
-    * s/cpu_stats_show()/cpu_cfs_stats_show()/
-    
-    * s/cpu_files/cpu_legacy_files/
-    
-    * Separate out cpuacct_stats_read() from cpuacct_stats_show().  While
-      at it, make the @val array u64 for consistency.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 3b31fc05a0f1..a1b95e83fa87 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -7174,7 +7174,7 @@ static int __cfs_schedulable(struct task_group *tg, u64 period, u64 quota)
- 	return ret;
- }
- 
--static int cpu_stats_show(struct seq_file *sf, void *v)
-+static int cpu_cfs_stats_show(struct seq_file *sf, void *v)
- {
- 	struct task_group *tg = css_tg(seq_css(sf));
- 	struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-@@ -7214,7 +7214,7 @@ static u64 cpu_rt_period_read_uint(struct cgroup_subsys_state *css,
- }
- #endif /* CONFIG_RT_GROUP_SCHED */
- 
--static struct cftype cpu_files[] = {
-+static struct cftype cpu_legacy_files[] = {
- #ifdef CONFIG_FAIR_GROUP_SCHED
- 	{
- 		.name = "shares",
-@@ -7235,7 +7235,7 @@ static struct cftype cpu_files[] = {
- 	},
- 	{
- 		.name = "stat",
--		.seq_show = cpu_stats_show,
-+		.seq_show = cpu_cfs_stats_show,
- 	},
- #endif
- #ifdef CONFIG_RT_GROUP_SCHED
-@@ -7261,7 +7261,7 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.fork		= cpu_cgroup_fork,
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
--	.legacy_cftypes	= cpu_files,
-+	.legacy_cftypes	= cpu_legacy_files,
- 	.early_init	= true,
- };
- 
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index f95ab29a45d0..6151c23f722f 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -276,26 +276,33 @@ static int cpuacct_all_seq_show(struct seq_file *m, void *V)
- 	return 0;
- }
- 
--static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+static void cpuacct_stats_read(struct cpuacct *ca,
-+			       u64 (*val)[CPUACCT_STAT_NSTATS])
- {
--	struct cpuacct *ca = css_ca(seq_css(sf));
--	s64 val[CPUACCT_STAT_NSTATS];
- 	int cpu;
--	int stat;
- 
--	memset(val, 0, sizeof(val));
-+	memset(val, 0, sizeof(*val));
-+
- 	for_each_possible_cpu(cpu) {
- 		u64 *cpustat = per_cpu_ptr(ca->cpustat, cpu)->cpustat;
- 
--		val[CPUACCT_STAT_USER]   += cpustat[CPUTIME_USER];
--		val[CPUACCT_STAT_USER]   += cpustat[CPUTIME_NICE];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SYSTEM];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_IRQ];
--		val[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SOFTIRQ];
-+		(*val)[CPUACCT_STAT_USER]   += cpustat[CPUTIME_USER];
-+		(*val)[CPUACCT_STAT_USER]   += cpustat[CPUTIME_NICE];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SYSTEM];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_IRQ];
-+		(*val)[CPUACCT_STAT_SYSTEM] += cpustat[CPUTIME_SOFTIRQ];
- 	}
-+}
-+
-+static int cpuacct_stats_show(struct seq_file *sf, void *v)
-+{
-+	u64 val[CPUACCT_STAT_NSTATS];
-+	int stat;
-+
-+	cpuacct_stats_read(css_ca(seq_css(sf)), &val);
- 
- 	for (stat = 0; stat < CPUACCT_STAT_NSTATS; stat++) {
--		seq_printf(sf, "%s %lld\n",
-+		seq_printf(sf, "%s %llu\n",
- 			   cpuacct_stat_desc[stat],
- 			   (long long)nsec_to_clock_t(val[stat]));
- 	}
-
-commit fdb64d002b3a223ce4bb11aa4448a42050470052
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Mar 11 07:31:23 2016 -0500
-
-    sched: Implement interface for cgroup unified hierarchy
-    
-    While the cpu controller doesn't have any functional problems, there
-    are a couple interface issues which can be addressed in the v2
-    interface.
-    
-    * cpuacct being a separate controller.  This separation is artificial
-      and rather pointless as demonstrated by most use cases co-mounting
-      the two controllers.  It also forces certain information to be
-      accounted twice.
-    
-    * Use of different time units.  Writable control knobs use
-      microseconds, some stat fields use nanoseconds while other cpuacct
-      stat fields use centiseconds.
-    
-    * Control knobs which can't be used in the root cgroup still show up
-      in the root.
-    
-    * Control knob names and semantics aren't consistent with other
-      controllers.
-    
-    This patchset implements cpu controller's interface on the unified
-    hierarchy which adheres to the controller file conventions described
-    in Documentation/cgroups/unified-hierarchy.txt.  Overall, the
-    following changes are made.
-    
-    * cpuacct is implictly enabled and disabled by cpu and its information
-      is reported through "cpu.stat" which now uses microseconds for all
-      time durations.  All time duration fields now have "_usec" appended
-      to them for clarity.  While this doesn't solve the double accounting
-      immediately, once majority of users switch to v2, cpu can directly
-      account and report the relevant stats and cpuacct can be disabled on
-      the unified hierarchy.
-    
-      Note that cpuacct.usage_percpu is currently not included in
-      "cpu.stat".  If this information is actually called for, it can be
-      added later.
-    
-    * "cpu.shares" is replaced with "cpu.weight" and operates on the
-      standard scale defined by CGROUP_WEIGHT_MIN/DFL/MAX (1, 100, 10000).
-      The weight is scaled to scheduler weight so that 100 maps to 1024
-      and the ratio relationship is preserved - if weight is W and its
-      scaled value is S, W / 100 == S / 1024.  While the mapped range is a
-      bit smaller than the orignal scheduler weight range, the dead zones
-      on both sides are relatively small and covers wider range than the
-      nice value mappings.  This file doesn't make sense in the root
-      cgroup and isn't create on root.
-    
-    * "cpu.cfs_quota_us" and "cpu.cfs_period_us" are replaced by "cpu.max"
-      which contains both quota and period.
-    
-    * "cpu.rt_runtime_us" and "cpu.rt_period_us" are replaced by
-      "cpu.rt.max" which contains both runtime and period.
-    
-    v2: cpu_stats_show() was incorrectly using CONFIG_FAIR_GROUP_SCHED for
-        CFS bandwidth stats and also using raw division for u64.  Use
-        CONFIG_CFS_BANDWITH and do_div() instead.
-    
-        The semantics of "cpu.rt.max" is not fully decided yet.  Dropped
-        for now.
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-    Cc: Ingo Molnar <mingo@redhat.com>
-    Cc: Peter Zijlstra <peterz@infradead.org>
-    Cc: Li Zefan <lizefan@huawei.com>
-    Cc: Johannes Weiner <hannes@cmpxchg.org>
-
-diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index a1b95e83fa87..f01d56e58a1b 100644
---- a/kernel/sched/core.c
-+++ b/kernel/sched/core.c
-@@ -7253,6 +7253,139 @@ static struct cftype cpu_legacy_files[] = {
- 	{ }	/* Terminate */
- };
- 
-+static int cpu_stats_show(struct seq_file *sf, void *v)
-+{
-+	cpuacct_cpu_stats_show(sf);
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		struct task_group *tg = css_tg(seq_css(sf));
-+		struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
-+		u64 throttled_usec;
-+
-+		throttled_usec = cfs_b->throttled_time;
-+		do_div(throttled_usec, NSEC_PER_USEC);
-+
-+		seq_printf(sf, "nr_periods %d\n"
-+			   "nr_throttled %d\n"
-+			   "throttled_usec %llu\n",
-+			   cfs_b->nr_periods, cfs_b->nr_throttled,
-+			   throttled_usec);
-+	}
-+#endif
-+	return 0;
-+}
-+
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+static u64 cpu_weight_read_u64(struct cgroup_subsys_state *css,
-+			       struct cftype *cft)
-+{
-+	struct task_group *tg = css_tg(css);
-+	u64 weight = scale_load_down(tg->shares);
-+
-+	return DIV_ROUND_CLOSEST_ULL(weight * CGROUP_WEIGHT_DFL, 1024);
-+}
-+
-+static int cpu_weight_write_u64(struct cgroup_subsys_state *css,
-+				struct cftype *cftype, u64 weight)
-+{
-+	/*
-+	 * cgroup weight knobs should use the common MIN, DFL and MAX
-+	 * values which are 1, 100 and 10000 respectively.  While it loses
-+	 * a bit of range on both ends, it maps pretty well onto the shares
-+	 * value used by scheduler and the round-trip conversions preserve
-+	 * the original value over the entire range.
-+	 */
-+	if (weight < CGROUP_WEIGHT_MIN || weight > CGROUP_WEIGHT_MAX)
-+		return -ERANGE;
-+
-+	weight = DIV_ROUND_CLOSEST_ULL(weight * 1024, CGROUP_WEIGHT_DFL);
-+
-+	return sched_group_set_shares(css_tg(css), scale_load(weight));
-+}
-+#endif
-+
-+static void __maybe_unused cpu_period_quota_print(struct seq_file *sf,
-+						  long period, long quota)
-+{
-+	if (quota < 0)
-+		seq_puts(sf, "max");
-+	else
-+		seq_printf(sf, "%ld", quota);
-+
-+	seq_printf(sf, " %ld\n", period);
-+}
-+
-+/* caller should put the current value in *@periodp before calling */
-+static int __maybe_unused cpu_period_quota_parse(char *buf,
-+						 u64 *periodp, u64 *quotap)
-+{
-+	char tok[21];	/* U64_MAX */
-+
-+	if (!sscanf(buf, "%s %llu", tok, periodp))
-+		return -EINVAL;
-+
-+	*periodp *= NSEC_PER_USEC;
-+
-+	if (sscanf(tok, "%llu", quotap))
-+		*quotap *= NSEC_PER_USEC;
-+	else if (!strcmp(tok, "max"))
-+		*quotap = RUNTIME_INF;
-+	else
-+		return -EINVAL;
-+
-+	return 0;
-+}
-+
-+#ifdef CONFIG_CFS_BANDWIDTH
-+static int cpu_max_show(struct seq_file *sf, void *v)
-+{
-+	struct task_group *tg = css_tg(seq_css(sf));
-+
-+	cpu_period_quota_print(sf, tg_get_cfs_period(tg), tg_get_cfs_quota(tg));
-+	return 0;
-+}
-+
-+static ssize_t cpu_max_write(struct kernfs_open_file *of,
-+			     char *buf, size_t nbytes, loff_t off)
-+{
-+	struct task_group *tg = css_tg(of_css(of));
-+	u64 period = tg_get_cfs_period(tg);
-+	u64 quota;
-+	int ret;
-+
-+	ret = cpu_period_quota_parse(buf, &period, &quota);
-+	if (!ret)
-+		ret = tg_set_cfs_bandwidth(tg, period, quota);
-+	return ret ?: nbytes;
-+}
-+#endif
-+
-+static struct cftype cpu_files[] = {
-+	{
-+		.name = "stat",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_stats_show,
-+	},
-+#ifdef CONFIG_FAIR_GROUP_SCHED
-+	{
-+		.name = "weight",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.read_u64 = cpu_weight_read_u64,
-+		.write_u64 = cpu_weight_write_u64,
-+	},
-+#endif
-+#ifdef CONFIG_CFS_BANDWIDTH
-+	{
-+		.name = "max",
-+		.flags = CFTYPE_NOT_ON_ROOT,
-+		.seq_show = cpu_max_show,
-+		.write = cpu_max_write,
-+	},
-+#endif
-+	{ }	/* terminate */
-+};
-+
- struct cgroup_subsys cpu_cgrp_subsys = {
- 	.css_alloc	= cpu_cgroup_css_alloc,
- 	.css_online	= cpu_cgroup_css_online,
-@@ -7262,7 +7395,15 @@ struct cgroup_subsys cpu_cgrp_subsys = {
- 	.can_attach	= cpu_cgroup_can_attach,
- 	.attach		= cpu_cgroup_attach,
- 	.legacy_cftypes	= cpu_legacy_files,
-+	.dfl_cftypes	= cpu_files,
- 	.early_init	= true,
-+#ifdef CONFIG_CGROUP_CPUACCT
-+	/*
-+	 * cpuacct is enabled together with cpu on the unified hierarchy
-+	 * and its stats are reported through "cpu.stat".
-+	 */
-+	.depends_on	= 1 << cpuacct_cgrp_id,
-+#endif
- };
- 
- #endif	/* CONFIG_CGROUP_SCHED */
-diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c
-index 6151c23f722f..fc1cf13c3af1 100644
---- a/kernel/sched/cpuacct.c
-+++ b/kernel/sched/cpuacct.c
-@@ -347,6 +347,31 @@ static struct cftype files[] = {
- 	{ }	/* terminate */
- };
- 
-+/* used to print cpuacct stats in cpu.stat on the unified hierarchy */
-+void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+	struct cgroup_subsys_state *css;
-+	u64 usage, val[CPUACCT_STAT_NSTATS];
-+
-+	css = cgroup_get_e_css(seq_css(sf)->cgroup, &cpuacct_cgrp_subsys);
-+
-+	usage = cpuusage_read(css, seq_cft(sf));
-+	cpuacct_stats_read(css_ca(css), &val);
-+
-+	val[CPUACCT_STAT_USER] *= TICK_NSEC;
-+	val[CPUACCT_STAT_SYSTEM] *= TICK_NSEC;
-+	do_div(usage, NSEC_PER_USEC);
-+	do_div(val[CPUACCT_STAT_USER], NSEC_PER_USEC);
-+	do_div(val[CPUACCT_STAT_SYSTEM], NSEC_PER_USEC);
-+
-+	seq_printf(sf, "usage_usec %llu\n"
-+		   "user_usec %llu\n"
-+		   "system_usec %llu\n",
-+		   usage, val[CPUACCT_STAT_USER], val[CPUACCT_STAT_SYSTEM]);
-+
-+	css_put(css);
-+}
-+
- /*
-  * charge this task's execution time to its accounting group.
-  *
-diff --git a/kernel/sched/cpuacct.h b/kernel/sched/cpuacct.h
-index ba72807c73d4..ddf7af466d35 100644
---- a/kernel/sched/cpuacct.h
-+++ b/kernel/sched/cpuacct.h
-@@ -2,6 +2,7 @@
- 
- extern void cpuacct_charge(struct task_struct *tsk, u64 cputime);
- extern void cpuacct_account_field(struct task_struct *tsk, int index, u64 val);
-+extern void cpuacct_cpu_stats_show(struct seq_file *sf);
- 
- #else
- 
-@@ -14,4 +15,8 @@ cpuacct_account_field(struct task_struct *tsk, int index, u64 val)
- {
- }
- 
-+static inline void cpuacct_cpu_stats_show(struct seq_file *sf)
-+{
-+}
-+
- #endif
-
-commit 8dde150866b8c433216105c50b7e889d5242d583
-Author: Tejun Heo <tj@kernel.org>
-Date:   Fri Aug 5 12:41:01 2016 -0400
-
-    cgroup: add documentation regarding CPU controller cgroup v2 support
-    
-    Signed-off-by: Tejun Heo <tj@kernel.org>
-
-diff --git a/Documentation/cgroup-v2-cpu.txt b/Documentation/cgroup-v2-cpu.txt
-new file mode 100644
-index 000000000000..1ed7032d4472
---- /dev/null
-+++ b/Documentation/cgroup-v2-cpu.txt
-@@ -0,0 +1,368 @@
-+
-+
-+CPU Controller on Control Group v2
-+
-+August, 2016		Tejun Heo <tj@kernel.org>
-+
-+
-+While most controllers have support for cgroup v2 now, the CPU
-+controller support is not upstream yet due to objections from the
-+scheduler maintainers on the basic designs of cgroup v2.  This
-+document explains the current situation as well as an interim
-+solution, and details the disagreements and arguments.  The latest
-+version of this document can be found at the following URL.
-+
-+ https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/tree/Documentation/cgroup-v2-cpu.txt?h=cgroup-v2-cpu
-+
-+This document was posted to the linux-kernel and cgroup mailing lists.
-+Unfortunately, no consensus was reached as of Oct, 2016.  The thread
-+can be found at the following URL.
-+
-+ http://lkml.kernel.org/r/20160805170752.GK2542@mtj.duckdns.org
-+
-+
-+CONTENTS
-+
-+1. Current Situation and Interim Solution
-+2. Disagreements and Arguments
-+  2-1. Contentious Restrictions
-+    2-1-1. Process Granularity
-+    2-1-2. No Internal Process Constraint
-+  2-2. Impact on CPU Controller
-+    2-2-1. Impact of Process Granularity
-+    2-2-2. Impact of No Internal Process Constraint
-+  2-3. Arguments for cgroup v2
-+3. Way Forward
-+4. References
-+
-+
-+1. Current Situation and Interim Solution
-+
-+All objections from the scheduler maintainers apply to cgroup v2 core
-+design, and there are no known objections to the specifics of the CPU
-+controller cgroup v2 interface.  The only blocked part is changes to
-+expose the CPU controller interface on cgroup v2, which comprises the
-+following two patches:
-+
-+ [1] sched: Misc preps for cgroup unified hierarchy interface
-+ [2] sched: Implement interface for cgroup unified hierarchy
-+
-+The necessary changes are superficial and implement the interface
-+files on cgroup v2.  The combined diffstat is as follows.
-+
-+ kernel/sched/core.c    |  149 +++++++++++++++++++++++++++++++++++++++++++++++--
-+ kernel/sched/cpuacct.c |   57 ++++++++++++------
-+ kernel/sched/cpuacct.h |    5 +
-+ 3 files changed, 189 insertions(+), 22 deletions(-)
-+
-+The patches are easy to apply and forward-port.  The following git
-+branch will always carry the two patches on top of the latest release
-+of the upstream kernel.
-+
-+ git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/cgroup-v2-cpu
-+
-+There also are versioned branches going back to v4.4.
-+
-+ git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/cgroup-v2-cpu-$KERNEL_VER
-+
-+While it's difficult to tell whether the CPU controller support will
-+be merged, there are crucial resource control features in cgroup v2
-+that are only possible due to the design choices that are being
-+objected to, and every effort will be made to ease enabling the CPU
-+controller cgroup v2 support out-of-tree for parties which choose to.
-+
-+
-+2. Disagreements and Arguments
-+
-+There have been several lengthy discussion threads [3][4] on LKML
-+around the structural constraints of cgroup v2.  The two that affect
-+the CPU controller are process granularity and no internal process
-+constraint.  Both arise primarily from the need for common resource
-+domain definition across different resources.
-+
-+The common resource domain is a powerful concept in cgroup v2 that
-+allows controllers to make basic assumptions about the structural
-+organization of processes and controllers inside the cgroup hierarchy,
-+and thus solve problems spanning multiple types of resources.  The
-+prime example for this is page cache writeback: dirty page cache is
-+regulated through throttling buffered writers based on memory
-+availability, and initiating batched write outs to the disk based on
-+IO capacity.  Tracking and controlling writeback inside a cgroup thus
-+requires the direct cooperation of the memory and the IO controller.
-+
-+This easily extends to other areas, such as CPU cycles consumed while
-+performing memory reclaim or IO encryption.
-+
-+
-+2-1. Contentious Restrictions
-+
-+For controllers of different resources to work together, they must
-+agree on a common organization.  This uniform model across controllers
-+imposes two contentious restrictions on the CPU controller: process
-+granularity and the no-internal-process constraint.
-+
-+
-+  2-1-1. Process Granularity
-+
-+  For memory, because an address space is shared between all threads
-+  of a process, the terminal consumer is a process, not a thread.
-+  Separating the threads of a single process into different memory
-+  control domains doesn't make semantical sense.  cgroup v2 ensures
-+  that all controller can agree on the same organization by requiring
-+  that threads of the same process belong to the same cgroup.
-+
-+  There are other reasons to enforce process granularity.  One
-+  important one is isolating system-level management operations from
-+  in-process application operations.  The cgroup interface, being a
-+  virtual filesystem, is very unfit for multiple independent
-+  operations taking place at the same time as most operations have to
-+  be multi-step and there is no way to synchronize multiple accessors.
-+  See also [5] Documentation/cgroup-v2.txt, "R-2. Thread Granularity"
-+
-+
-+  2-1-2. No Internal Process Constraint
-+
-+  cgroup v2 does not allow processes to belong to any cgroup which has
-+  child cgroups when resource controllers are enabled on it (the
-+  notable exception being the root cgroup itself).  This is because,
-+  for some resources, a resource domain (cgroup) is not directly
-+  comparable to the terminal consumer (process/task) of said resource,
-+  and so putting the two into a sibling relationship isn't meaningful.
-+
-+  - Differing Control Parameters and Capabilities
-+
-+    A cgroup controller has different resource control parameters and
-+    capabilities from a terminal consumer, be that a task or process.
-+    There are a couple cases where a cgroup control knob can be mapped
-+    to a per-task or per-process API but they are exceptions and the
-+    mappings aren't obvious even in those cases.
-+
-+    For example, task priorities (also known as nice values) set
-+    through setpriority(2) are mapped to the CPU controller
-+    "cpu.shares" values.  However, how exactly the two ranges map and
-+    even the fact that they map to each other at all are not obvious.
-+
-+    The situation gets further muddled when considering other resource
-+    types and control knobs.  IO priorities set through ioprio_set(2)
-+    cannot be mapped to IO controller weights and most cgroup resource
-+    control knobs including the bandwidth control knobs of the CPU
-+    controller don't have counterparts in the terminal consumers.
-+
-+  - Anonymous Resource Consumption
-+
-+    For CPU, every time slice consumed from inside a cgroup, which
-+    comprises most but not all of consumed CPU time for the cgroup,
-+    can be clearly attributed to a specific task or process.  Because
-+    these two types of entities are directly comparable as consumers
-+    of CPU time, it's theoretically possible to mix tasks and cgroups
-+    on the same tree levels and let them directly compete for the time
-+    quota available to their common ancestor.
-+
-+    However, the same can't be said for resource types like memory or
-+    IO: the memory consumed by the page cache, for example, can be
-+    tracked on a per-cgroup level, but due to mismatches in lifetimes
-+    of involved objects (page cache can persist long after processes
-+    are gone), shared usages and the implementation overhead of
-+    tracking persistent state, it can no longer be attributed to
-+    individual processes after instantiation.  Consequently, any IO
-+    incurred by page cache writeback can be attributed to a cgroup,
-+    but not to the individual consumers inside the cgroup.
-+
-+  For memory and IO, this makes a resource domain (cgroup) an object
-+  of a fundamentally different type than a terminal consumer
-+  (process).  A process can't be a first class object in the resource
-+  distribution graph as its total resource consumption can't be
-+  described without the containing resource domain.
-+
-+  Disallowing processes in internal cgroups avoids competition between
-+  cgroups and processes which cannot be meaningfully defined for these
-+  resources.  All resource control takes place among cgroups and a
-+  terminal consumer interacts with the containing cgroup the same way
-+  it would with the system without cgroup.
-+
-+  Root cgroup is exempt from this constraint, which is in line with
-+  how root cgroup is handled in general - it's excluded from cgroup
-+  resource accounting and control.
-+
-+
-+Enforcing process granularity and no internal process constraint
-+allows all controllers to be on the same footing in terms of resource
-+distribution hierarchy.
-+
-+
-+2-2. Impact on CPU Controller
-+
-+As indicated earlier, the CPU controller's resource distribution graph
-+is the simplest.  Every schedulable resource consumption can be
-+attributed to a specific task.  In addition, for weight based control,
-+the per-task priority set through setpriority(2) can be translated to
-+and from a per-cgroup weight.  As such, the CPU controller can treat a
-+task and a cgroup symmetrically, allowing support for any tree layout
-+of cgroups and tasks.  Both process granularity and the no internal
-+process constraint restrict how the CPU controller can be used.
-+
-+
-+  2-2-1. Impact of Process Granularity
-+
-+  Process granularity prevents tasks belonging to the same process to
-+  be assigned to different cgroups.  It was pointed out [6] that this
-+  excludes the valid use case of hierarchical CPU distribution within
-+  processes.
-+
-+  To address this issue, the rgroup (resource group) [7][8][9]
-+  interface, an extension of the existing setpriority(2) API, was
-+  proposed, which is in line with other programmable priority
-+  mechanisms and eliminates the risk of in-application configuration
-+  and system configuration stepping on each other's toes.
-+  Unfortunately, the proposal quickly turned into discussions around
-+  cgroup v2 design decisions [4] and no consensus could be reached.
-+
-+
-+  2-2-2. Impact of No Internal Process Constraint
-+
-+  The no internal process constraint disallows tasks from competing
-+  directly against cgroups.  Here is an excerpt from Peter Zijlstra
-+  pointing out the issue [10] - R, L and A are cgroups; t1, t2, t3 and
-+  t4 are tasks:
-+
-+
-+          R
-+        / | \
-+       t1 t2 A
-+           /   \
-+          t3   t4
-+
-+
-+    Is fundamentally different from:
-+
-+
-+               R
-+             /   \
-+           L       A
-+         /   \   /   \
-+        t1  t2  t3   t4
-+
-+
-+    Because if in the first hierarchy you add a task (t5) to R, all of
-+    its A will run at 1/4th of total bandwidth where before it had
-+    1/3rd, whereas with the second example, if you add our t5 to L, A
-+    doesn't get any less bandwidth.
-+
-+
-+  It is true that the trees are semantically different from each other
-+  and the symmetric handling of tasks and cgroups is aesthetically
-+  pleasing.  However, it isn't clear what the practical usefulness of
-+  a layout with direct competition between tasks and cgroups would be,
-+  considering that number and behavior of tasks are controlled by each
-+  application, and cgroups primarily deal with system level resource
-+  distribution; changes in the number of active threads would directly
-+  impact resource distribution.  Real world use cases of such layouts
-+  could not be established during the discussions.
-+
-+
-+2-3. Arguments for cgroup v2
-+
-+There are strong demands for comprehensive hierarchical resource
-+control across all major resources, and establishing a common resource
-+hierarchy is an essential step.  As with most engineering decisions,
-+common resource hierarchy definition comes with its trade-offs.  With
-+cgroup v2, the trade-offs are in the form of structural constraints
-+which, among others, restrict the CPU controller's space of possible
-+configurations.
-+
-+However, even with the restrictions, cgroup v2, in combination with
-+rgroup, covers most of identified real world use cases while enabling
-+new important use cases of resource control across multiple resource
-+types that were fundamentally broken previously.
-+
-+Furthermore, for resource control, treating resource domains as
-+objects of a different type from terminal consumers has important
-+advantages - it can account for resource consumptions which are not
-+tied to any specific terminal consumer, be that a task or process, and
-+allows decoupling resource distribution controls from in-application
-+APIs.  Even the CPU controller may benefit from it as the kernel can
-+consume significant amount of CPU cycles in interrupt context or tasks
-+shared across multiple resource domains (e.g. softirq).
-+
-+Finally, it's important to note that enabling cgroup v2 support for
-+the CPU controller doesn't block use cases which require the features
-+which are not available on cgroup v2.  Unlikely, but should anybody
-+actually rely on the CPU controller's symmetric handling of tasks and
-+cgroups, backward compatibility is and will be maintained by being
-+able to disconnect the controller from the cgroup v2 hierarchy and use
-+it standalone.  This also holds for cpuset which is often used in
-+highly customized configurations which might be a poor fit for common
-+resource domains.
-+
-+The required changes are minimal, the benefits for the target use
-+cases are critical and obvious, and use cases which have to use v1 can
-+continue to do so.
-+
-+
-+3. Way Forward
-+
-+cgroup v2 primarily aims to solve the problem of comprehensive
-+hierarchical resource control across all major computing resources,
-+which is one of the core problems of modern server infrastructure
-+engineering.  The trade-offs that cgroup v2 took are results of
-+pursuing that goal and gaining a better understanding of the nature of
-+resource control in the process.
-+
-+I believe that real world usages will prove cgroup v2's model right,
-+considering the crucial pieces of comprehensive resource control that
-+cannot be implemented without common resource domains.  This is not to
-+say that cgroup v2 is fixed in stone and can't be updated; if there is
-+an approach which better serves both comprehensive resource control
-+and the CPU controller's flexibility, we will surely move towards
-+that.  It goes without saying that discussions around such approach
-+should consider practical aspects of resource control as a whole
-+rather than absolutely focusing on a particular controller.
-+
-+Until such consensus can be reached, the CPU controller cgroup v2
-+support will be maintained out of the mainline kernel in an easily
-+accessible form.  If there is anything cgroup developers can do to
-+ease the pain, please feel free to contact us on the cgroup mailing
-+list at cgroups@vger.kernel.org.
-+
-+
-+4. References
-+
-+[1]  http://lkml.kernel.org/r/20160105164834.GE5995@mtj.duckdns.org
-+     [PATCH 1/2] sched: Misc preps for cgroup unified hierarchy interface
-+     Tejun Heo <tj@kernel.org>
-+
-+[2]  http://lkml.kernel.org/r/20160105164852.GF5995@mtj.duckdns.org
-+     [PATCH 2/2] sched: Implement interface for cgroup unified hierarchy
-+     Tejun Heo <tj@kernel.org>
-+
-+[3]  http://lkml.kernel.org/r/1438641689-14655-4-git-send-email-tj@kernel.org
-+     [PATCH 3/3] sched: Implement interface for cgroup unified hierarchy
-+     Tejun Heo <tj@kernel.org>
-+
-+[4]  http://lkml.kernel.org/r/20160407064549.GH3430@twins.programming.kicks-ass.net
-+     Re: [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource group and PRIO_RGRP
-+     Peter Zijlstra <peterz@infradead.org>
-+
-+[5]  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/cgroup-v2.txt
-+     Control Group v2
-+     Tejun Heo <tj@kernel.org>
-+
-+[6]  http://lkml.kernel.org/r/CAPM31RJNy3jgG=DYe6GO=wyL4BPPxwUm1f2S6YXacQmo7viFZA@mail.gmail.com
-+     Re: [PATCH 3/3] sched: Implement interface for cgroup unified hierarchy
-+     Paul Turner <pjt@google.com>
-+
-+[7]  http://lkml.kernel.org/r/20160105154503.GC5995@mtj.duckdns.org
-+     [RFD] cgroup: thread granularity support for cpu controller
-+     Tejun Heo <tj@kernel.org>
-+
-+[8]  http://lkml.kernel.org/r/1457710888-31182-1-git-send-email-tj@kernel.org
-+     [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource group and PRIO_RGRP
-+     Tejun Heo <tj@kernel.org>
-+
-+[9]  http://lkml.kernel.org/r/20160311160522.GA24046@htj.duckdns.org
-+     Example program for PRIO_RGRP
-+     Tejun Heo <tj@kernel.org>
-+
-+[10] http://lkml.kernel.org/r/20160407082810.GN3430@twins.programming.kicks-ass.net
-+     Re: [PATCHSET RFC cgroup/for-4.6] cgroup, sched: implement resource
-+     Peter Zijlstra <peterz@infradead.org>
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md b/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md
deleted file mode 100644
index b454e14801db..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md
+++ /dev/null
@@ -1,21 +0,0 @@
-Patches for CPU Controller on Control Group v2
-===============================================
-
-See Tejun Heo's [explanation][1] for why these patches are currently
-out-of-tree.
-
-Generating the patches
------------------------
-
-In a linux checkout, with remote tc-cgroup pointing to
-git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git, your
-nixpkgs checkout in the same directory as your linux checkout (or
-modify the command accordingly), and setting `ver` to the appropriate
-version:
-
-```shell
-$ ver=4.7
-$ git log --reverse --patch v$ver..remotes/tc-cgroup/cgroup-v2-cpu-v$ver > ../nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/$ver.patch
-```
-
-[1]: https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git/tree/Documentation/cgroup-v2-cpu.txt?h=cgroup-v2-cpu
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/default.nix b/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/default.nix
deleted file mode 100644
index 5bef5633aa03..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/default.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-let
-  ents = builtins.readDir ./.;
-in builtins.listToAttrs (builtins.filter (x: x != null) (map (name: let
-  match = builtins.match "(.*)\\.patch" name;
-in if match == null then null else {
-  name = builtins.head match;
-  value = {
-    name = "cpu-cgroup-v2-${name}";
-    patch = ./. + "/${name}";
-  };
-}) (builtins.attrNames ents)))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
index c7893abad213..cadef31334df 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,81 +2,71 @@
     "4.14": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.14.325-hardened1.patch",
-            "sha256": "1mc1pyjjksg2f4189wyas55ax8czzhai2i3jc6n7l9jmfwj7xr9q",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.325-hardened1/linux-hardened-4.14.325-hardened1.patch"
+            "name": "linux-hardened-4.14.327-hardened1.patch",
+            "sha256": "0183jgdvp20mk6vmmn62mdmy75xp816lm3gg5dlpvg4aw9n5hiz9",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.327-hardened1/linux-hardened-4.14.327-hardened1.patch"
         },
-        "sha256": "117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav",
-        "version": "4.14.325"
+        "sha256": "0nharfyxlr17yan86zrhlbq7idm0g3zvvvmy2zbw7m9dhgc8bw5z",
+        "version": "4.14.327"
     },
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.294-hardened1.patch",
-            "sha256": "1s70vz8rai1z440rmwzipwpq7wa7p2bvri43zmkbisrfggm1lz2r",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.294-hardened1/linux-hardened-4.19.294-hardened1.patch"
+            "name": "linux-hardened-4.19.296-hardened1.patch",
+            "sha256": "0yzxnh2gdrbz9dspw3xbsrqhcdsk0pl938w229kccps9klg9s7lb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.296-hardened1/linux-hardened-4.19.296-hardened1.patch"
         },
-        "sha256": "03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc",
-        "version": "4.19.294"
+        "sha256": "1bk051canr4fb00j6x9ff2wam2f20whw4h4z767x2cn2kmv6cqb3",
+        "version": "4.19.296"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.195-hardened1.patch",
-            "sha256": "15liin3i9wh7hwr97pyc8rl79ri7frsprssl50si9z810zvc9chb",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.195-hardened1/linux-hardened-5.10.195-hardened1.patch"
+            "name": "linux-hardened-5.10.198-hardened1.patch",
+            "sha256": "0xvpq41nslrdz7w39glswibj6aywny06rvxwqks2sgcbwbggldi6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.198-hardened1/linux-hardened-5.10.198-hardened1.patch"
         },
-        "sha256": "0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1",
-        "version": "5.10.195"
+        "sha256": "01gsw96anw44nh8ii3zipp6vh61m1n8yf0bv2fzznr23k771y51b",
+        "version": "5.10.198"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.132-hardened1.patch",
-            "sha256": "06wkcbhkdm8vnk1cqwngy9gdknqm4pb4za9lbh2q5j1f2nkcn7pq",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.132-hardened1/linux-hardened-5.15.132-hardened1.patch"
+            "name": "linux-hardened-5.15.135-hardened1.patch",
+            "sha256": "0ld2apj2nc6y5c8h60cczjpi2vdz3askmpsjv7glfrqfqlw1a680",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.135-hardened1/linux-hardened-5.15.135-hardened1.patch"
         },
-        "sha256": "1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1",
-        "version": "5.15.132"
+        "sha256": "0w3i8jvzqvfnlarcvg89k1144ln96fszv16lzrn16zr3kri5x0ql",
+        "version": "5.15.135"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.256-hardened1.patch",
-            "sha256": "1rsp30g5xry5y95mz0i6walkcxj6abyrsaq3fwhz0ka6nq6g7w82",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.256-hardened1/linux-hardened-5.4.256-hardened1.patch"
+            "name": "linux-hardened-5.4.258-hardened1.patch",
+            "sha256": "1c6m65m3cjx1nbaqilkiqhwb143rd2zwy8mkxxdrm1916cs5hvbk",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.258-hardened1/linux-hardened-5.4.258-hardened1.patch"
         },
-        "sha256": "0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967",
-        "version": "5.4.256"
+        "sha256": "0gk2xav1ng565l1qsqlr8ja6m4j5g8rfj66vad1fmdd1lwaihw1r",
+        "version": "5.4.258"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.54-hardened1.patch",
-            "sha256": "0c8dmgciwc02pzhnx2mj5xlhds7mmicm8r6668di2zfw772rjgr4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.54-hardened1/linux-hardened-6.1.54-hardened1.patch"
+            "name": "linux-hardened-6.1.58-hardened1.patch",
+            "sha256": "0xca1pf6hkipci7blly111cchfw58cj22b73nr38dks0xvyb4rx6",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.58-hardened1/linux-hardened-6.1.58-hardened1.patch"
         },
-        "sha256": "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653",
-        "version": "6.1.54"
-    },
-    "6.4": {
-        "patch": {
-            "extra": "-hardened1",
-            "name": "linux-hardened-6.4.16-hardened1.patch",
-            "sha256": "10lydnnhhq9ynng1gfaqh1mncsb0dmr27zzcbygs1xigy2bl70n9",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.16-hardened1/linux-hardened-6.4.16-hardened1.patch"
-        },
-        "sha256": "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln",
-        "version": "6.4.16"
+        "sha256": "1b913ina3rcw4dx2s7n37kynv8rqsmrqa2ialsib6h7nsb9px66f",
+        "version": "6.1.58"
     },
     "6.5": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.5.4-hardened1.patch",
-            "sha256": "0r411dgp17am2bnfpk8lbzmymp6w9d5raz7hni0mw0kpcq6z996n",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.4-hardened1/linux-hardened-6.5.4-hardened1.patch"
+            "name": "linux-hardened-6.5.7-hardened1.patch",
+            "sha256": "0l0psja9zaw8b1bqw19nf1pjf4syxzh0gqjrfppyv40wbf5lsgjn",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.5.7-hardened1/linux-hardened-6.5.7-hardened1.patch"
         },
-        "sha256": "0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx",
-        "version": "6.5.4"
+        "sha256": "135v3y2vgc83dca4xi7q52wqi4dkfal74k1y73jwzj85h12fl28d",
+        "version": "6.5.7"
     }
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py
index 5d6a2eba966a..ce54c2980758 100755
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -193,21 +193,14 @@ with open(HARDENED_PATCHES_PATH) as patches_file:
 
 # Get the set of currently packaged kernel versions.
 kernel_versions = {}
-for filename in os.listdir(NIXPKGS_KERNEL_PATH):
-    filename_match = re.fullmatch(r"linux-(\d+)\.(\d+)\.nix", filename)
-    if filename_match:
-        nix_version_expr = f"""
-            with import {NIXPKGS_PATH} {{}};
-            (callPackage {NIXPKGS_KERNEL_PATH / filename} {{}}).version
-        """
-        kernel_version_json = run(
-            "nix-instantiate", "--eval", "--system", "x86_64-linux", "--json", "--expr", nix_version_expr,
-        ).stdout
-        kernel_version = parse_version(json.loads(kernel_version_json))
-        if kernel_version < MIN_KERNEL_VERSION:
-            continue
-        kernel_key = major_kernel_version_key(kernel_version)
-        kernel_versions[kernel_key] = kernel_version
+with open(NIXPKGS_KERNEL_PATH / "kernels-org.json") as kernel_versions_json:
+    kernel_versions = json.load(kernel_versions_json)
+    for kernel_branch_str in kernel_versions:
+        if kernel_branch_str == "testing": continue
+        kernel_branch = [int(i) for i in kernel_branch_str.split(".")]
+        if kernel_branch < MIN_KERNEL_VERSION: continue
+        kernel_version = [int(i) for i in kernel_versions[kernel_branch_str]["version"].split(".")]
+        kernel_versions[kernel_branch_str] = kernel_version
 
 # Remove patches for unpackaged kernel versions.
 for kernel_key in sorted(patches.keys() - kernel_versions.keys()):
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json b/nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json
index b2d4b1fa83b8..94c383ff8dbd 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,38 +1,38 @@
 {
     "testing": {
-        "version": "6.6-rc1",
-        "hash": "02zh3dnikyhhlas9xccia963d4yqmzq0m4b8s10x8mjng3na45hd"
+        "version": "6.6-rc6",
+        "hash": "sha256:1yzzf0bswqqarmbkw17vqcrkghivin7ca84x919aa2i8z7fyg2hw"
     },
     "6.5": {
-        "version": "6.5.4",
-        "hash": "0s8nzd8yaq06bq8byk7aakbk95gh0rhlif26h1biw94v48anrxxx"
+        "version": "6.5.8",
+        "hash": "sha256:05zpdh4dxaadq52hlczdmwb7bsqfm3q45v7bdqbsmplhgn4wm719"
     },
     "6.4": {
         "version": "6.4.16",
-        "hash": "0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
+        "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.54",
-        "hash": "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653"
+        "version": "6.1.59",
+        "hash": "sha256:1860r1aan258yi2jq68bp1kdbcyy7ygc7d8g54wnc0vmqqj7fzv2"
     },
     "5.15": {
-        "version": "5.15.132",
-        "hash": "1b0qjsaqjw2rk86shmmrj2aasblkn27acjmc761vnjg7sv2baxs1"
+        "version": "5.15.136",
+        "hash": "sha256:1f5cxrair8qycjcc931kcdsarbrph32ypdyhrws8sw74gvzbj966"
     },
     "5.10": {
-        "version": "5.10.195",
-        "hash": "0n4vg2i9sq89wnz85arlyvwysh9s83cgzs5bk2wh98bivi5fwfs1"
+        "version": "5.10.198",
+        "hash": "sha256:01gsw96anw44nh8ii3zipp6vh61m1n8yf0bv2fzznr23k771y51b"
     },
     "5.4": {
-        "version": "5.4.256",
-        "hash": "0fim5q9xakwnjfg48bpsic9r2r8dvrjlalqqkm9vh1rml9mhi967"
+        "version": "5.4.258",
+        "hash": "sha256:0gk2xav1ng565l1qsqlr8ja6m4j5g8rfj66vad1fmdd1lwaihw1r"
     },
     "4.19": {
-        "version": "4.19.294",
-        "hash": "03x0xsb8a369zdr81hg6xdl5n5v48k6iwnhj6r29725777lvvbfc"
+        "version": "4.19.296",
+        "hash": "sha256:1bk051canr4fb00j6x9ff2wam2f20whw4h4z767x2cn2kmv6cqb3"
     },
     "4.14": {
-        "version": "4.14.325",
-        "hash": "117p1mdha57f6d3kdwac9jrbmib7g77q4xhir8ghl6fmrs1f2sav"
+        "version": "4.14.327",
+        "hash": "sha256:0nharfyxlr17yan86zrhlbq7idm0g3zvvvmy2zbw7m9dhgc8bw5z"
     }
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix
deleted file mode 100644
index 69bbdf648d22..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-hardkernel-4.14.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{ buildPackages, fetchFromGitHub, fetchurl, perl, buildLinux, libelf, util-linux, kernelPatches ? [], ... } @ args:
-
-buildLinux (args // rec {
-  version = "4.14.180-176";
-
-  # modDirVersion needs to be x.y.z.
-  modDirVersion = "4.14.180";
-
-  # branchVersion needs to be x.y.
-  extraMeta.branch = "4.14";
-
-  src = fetchFromGitHub {
-    owner = "hardkernel";
-    repo = "linux";
-    rev = version;
-    sha256 = "0n7i7a2bkrm9p1wfr20h54cqm32fbjvwyn703r6zm1f6ivqhk43v";
-  };
-
-  kernelPatches = args.kernelPatches ++ [{
-    name = "usbip-tools-fno-common";
-    patch = fetchurl {
-      url = "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/patch/?id=d5efc2e6b98fe661dbd8dd0d5d5bfb961728e57a";
-      hash = "sha256-1CXYCV5zMLA4YdbCr8cO2N4CHEDzQChS9qbKYHPm3U4=";
-    };
-  }];
-
-  defconfig = "odroidxu4_defconfig";
-
-  # This extraConfig is (only) required because the gator module fails to build as-is.
-  extraConfig = ''
-
-    GATOR n
-
-    # This attempted fix applies correctly but does not fix the build.
-    #GATOR_MALI_MIDGARD_PATH ${src}/drivers/gpu/arm/midgard
-
-  '' + (args.extraConfig or "");
-
-  extraMeta.platforms = [ "armv7l-linux" ];
-
-} // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index 19b46d873086..3f2efbb87e83 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.186-rt91"; # updated by ./update-rt.sh
+  version = "5.10.197-rt96"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1qqv91r13akgik1q4jybf8czskxxizk6lpv4rsvjn9sx2dm2jq0y";
+    sha256 = "1awkm7lln5gf6kld9z5h4mg39bd778jsdswwlwb7iv7bn03lafhq";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1h5p0p3clq0gmaszvddmfll17adv02wfp2bfrd5x3aigvigwfmjb";
+      sha256 = "0pd1yhr154zl5jfmchzdfv27cbnn8h23x7am0dmqwr1ylwg4bvbi";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index 6d3955f20128..0050e77bb565 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.15.129-rt67"; # updated by ./update-rt.sh
+  version = "5.15.133-rt69"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0ribh1jalbnapfrjzjk5kqg6nypalkn5ayin5cwkwiziwiycj3km";
+    sha256 = "1paxzzcagc7s8i491zjny43rxhfamafyly438kj8hyw96iwmx17g";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1qh2v8i2sa334mkfwx9k8jjvqpp21bj2wmvvdib8wfxbnjnj3vzy";
+      sha256 = "0iikbpb1wcf7fm18j230cd4p4cksr0k6041c8w0gvznws8mr3dww";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index cd1249605ec3..22e07bfd0f56 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.254-rt85"; # updated by ./update-rt.sh
+  version = "5.4.257-rt87"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -14,14 +14,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1iyrm2xql15ifhy2b939ywrrc44yd41b79sjjim4vqxmc6lqsq2i";
+    sha256 = "1w1x91slzg9ggakqhyxnmvz77v2cwfk8bz0knrpgz9qya9q5jxrf";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0vq5lrqqy7yspznbbkla2cjakz7w1n8qvg31a856qs6abynwrw6x";
+      sha256 = "0rgkk5ibagsyz9in12clzn7szsw1i3m96s8wy5yxwa26aaa2wki7";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index d599c3bda311..f45926020b5b 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.46-rt14"; # updated by ./update-rt.sh
+  version = "6.1.54-rt15"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "15m228bllks2p8gpsmvplx08yxzp7bij9fnmnafqszylrk7ppxpm";
+    sha256 = "09sfrq2l8f777mx2n9mhb6bgz1064bl04921byqnmk87si31w653";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0mrpsy175iz0b51hwgqbj15w83lm3m57il3gqwb489gln7mpzy17";
+      sha256 = "0ihdid1ihg26kjini66j87vh4220gl8xm9dai7zignha2zh238kh";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/mainline.nix b/nixpkgs/pkgs/os-specific/linux/kernel/mainline.nix
index 50053e620e46..4e1d5b8a9e87 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/mainline.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/mainline.nix
@@ -1,18 +1,27 @@
-{ branch, lib, fetchurl, buildLinux, ... } @ args:
+{ branch, lib, fetchurl, fetchzip, buildLinux, ... } @ args:
 
 let
   allKernels = builtins.fromJSON (builtins.readFile ./kernels-org.json);
   thisKernel = allKernels.${branch};
+  inherit (thisKernel) version;
+
+  src =
+    # testing kernels are a special case because they don't have tarballs on the CDN
+    if branch == "testing"
+      then fetchzip {
+        url = "https://git.kernel.org/torvalds/t/linux-${version}.tar.gz";
+        inherit (thisKernel) hash;
+      }
+      else fetchurl {
+        url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
+        inherit (thisKernel) hash;
+      };
+
+  args' = (builtins.removeAttrs args ["branch"]) // {
+    inherit src version;
 
-  args' = (builtins.removeAttrs args ["branch"]) // rec {
-    inherit (thisKernel) version;
     modDirVersion = lib.versions.pad 3 version;
     extraMeta.branch = branch;
-
-    src = fetchurl {
-      url = "mirror://kernel/linux/kernel/v${lib.versions.major version}.x/linux-${version}.tar.xz";
-      sha256 = thisKernel.hash;
-    };
   } // (args.argsOverride or {});
 in
 buildLinux args'
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
index 7c3084d7ebdb..d5b67b5efbe3 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -117,7 +117,8 @@ let
           });
 
       postPatch = ''
-        sed -i Makefile -e 's|= depmod|= ${buildPackages.kmod}/bin/depmod|'
+        # Ensure that depmod gets resolved through PATH
+        sed -i Makefile -e 's|= /sbin/depmod|= depmod|'
 
         # fixup for pre-5.4 kernels using the $(cd $foo && /bin/pwd) pattern
         # FIXME: remove when no longer needed
@@ -332,9 +333,6 @@ let
 
         # Delete empty directories
         find -empty -type d -delete
-
-        # Remove reference to kmod
-        sed -i Makefile -e 's|= ${buildPackages.kmod}/bin/depmod|= depmod|'
       '';
 
       requiredSystemFeatures = [ "big-parallel" ];
@@ -370,13 +368,12 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
   enableParallelBuilding = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal ]
+  nativeBuildInputs = [ perl bc nettools openssl rsync gmp libmpc mpfr zstd python3Minimal kmod ]
       ++ optional  (stdenv.hostPlatform.linux-kernel.target == "uImage") buildPackages.ubootTools
       ++ optional  (lib.versionOlder version "5.8") libelf
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
       ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
       ++ optional  (lib.versionAtLeast version "5.8")  elfutils
-      ++ optional  (lib.versionAtLeast version "6.6")  kmod
       ;
 
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix b/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
index ab3b4e56066e..5d4ebc214dc7 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/patches.nix
@@ -44,8 +44,6 @@
       patch = ./modinst-arg-list-too-long.patch;
     };
 
-  cpu-cgroup-v2 = import ./cpu-cgroup-v2-patches;
-
   hardened = let
     mkPatch = kernelVersion: { version, sha256, patch }: let src = patch; in {
       name = lib.removeSuffix ".patch" src.name;
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/update-mainline.py b/nixpkgs/pkgs/os-specific/linux/kernel/update-mainline.py
index e7c37e9ab999..30b9ebec984c 100755
--- a/nixpkgs/pkgs/os-specific/linux/kernel/update-mainline.py
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/update-mainline.py
@@ -1,61 +1,83 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i python3 -p "python3.withPackages (ps: [ ps.beautifulsoup4 ps.lxml ])"
-from enum import Enum
-from bs4 import BeautifulSoup, NavigableString, Tag
-from dataclasses import dataclass
 import json
+import os
 import pathlib
-import re
 import subprocess
-import urllib.request
 import sys
+import urllib.request
+from dataclasses import dataclass
+from enum import Enum
 
+from bs4 import BeautifulSoup, NavigableString, Tag
 
 HERE = pathlib.Path(__file__).parent
 ROOT = HERE.parent.parent.parent.parent
 VERSIONS_FILE = HERE / "kernels-org.json"
 
+
 class KernelNature(Enum):
     MAINLINE = 1
     STABLE = 2
     LONGTERM = 3
 
+
 @dataclass
 class KernelRelease:
     nature: KernelNature
     version: str
+    branch: str
     date: str
     link: str
     eol: bool = False
 
+
 def parse_release(release: Tag) -> KernelRelease | None:
-    columns: list[Tag] = list(release.find_all('td'))
+    columns: list[Tag] = list(release.find_all("td"))
     try:
-        nature = KernelNature[columns[0].get_text().rstrip(':').upper()]
+        nature = KernelNature[columns[0].get_text().rstrip(":").upper()]
     except KeyError:
         return None
 
-    version = columns[1].get_text().rstrip(' [EOL]')
+    version = columns[1].get_text().rstrip(" [EOL]")
     date = columns[2].get_text()
-    link = columns[3].find('a')
+    link = columns[3].find("a")
     if link is not None and isinstance(link, Tag):
-        link = link.attrs.get('href')
-    assert link is not None, f'link for kernel {version} is non-existent'
-    eol = bool(release.find(class_='eolkernel'))
+        link = link.attrs.get("href")
+    assert link is not None, f"link for kernel {version} is non-existent"
+    eol = bool(release.find(class_="eolkernel"))
+
+    return KernelRelease(
+        nature=nature,
+        branch=get_branch(version),
+        version=version,
+        date=date,
+        link=link,
+        eol=eol,
+    )
 
-    return KernelRelease(nature=nature, version=version, date=date, link=link, eol=eol)
 
 def get_branch(version: str):
     # This is a testing kernel.
-    if 'rc' in version:
-        return 'testing'
+    if "rc" in version:
+        return "testing"
     else:
         major, minor, *_ = version.split(".")
         return f"{major}.{minor}"
 
 
-def get_hash(url: str):
-    return subprocess.check_output(["nix-prefetch-url", url]).decode().strip()
+def get_hash(kernel: KernelRelease):
+    if kernel.branch == "testing":
+        args = ["--unpack"]
+    else:
+        args = []
+
+    hash = (
+        subprocess.check_output(["nix-prefetch-url", kernel.link] + args)
+        .decode()
+        .strip()
+    )
+    return f"sha256:{hash}"
 
 
 def commit(message):
@@ -65,19 +87,19 @@ def commit(message):
 def main():
     kernel_org = urllib.request.urlopen("https://kernel.org/")
     soup = BeautifulSoup(kernel_org.read().decode(), "lxml")
-    release_table = soup.find(id='releases')
+    release_table = soup.find(id="releases")
     if not release_table or isinstance(release_table, NavigableString):
-        print(release_table)
-        print('Failed to find the release table on https://kernel.org')
+        print(release_table, file=sys.stderr)
+        print("Failed to find the release table on https://kernel.org", file=sys.stderr)
         sys.exit(1)
 
-    releases = release_table.find_all('tr')
+    releases = release_table.find_all("tr")
     parsed_releases = filter(None, [parse_release(release) for release in releases])
     all_kernels = json.load(VERSIONS_FILE.open())
 
     for kernel in parsed_releases:
         branch = get_branch(kernel.version)
-        nixpkgs_branch = branch.replace('.', '_')
+        nixpkgs_branch = branch.replace(".", "_")
 
         old_version = all_kernels.get(branch, {}).get("version")
         if old_version == kernel.version:
@@ -89,15 +111,19 @@ def main():
         else:
             message = f"linux_{nixpkgs_branch}: {old_version} -> {kernel.version}"
 
-        print(message)
+        print(message, file=sys.stderr)
 
-        all_kernels[branch] = {"version": kernel.version, "hash": get_hash(kernel.link)}
+        all_kernels[branch] = {
+            "version": kernel.version,
+            "hash": get_hash(kernel),
+        }
 
         with VERSIONS_FILE.open("w") as fd:
             json.dump(all_kernels, fd, indent=4)
             fd.write("\n")  # makes editorconfig happy
 
-        commit(message)
+        if os.environ.get("COMMIT") == "1":
+            commit(message)
 
 
 if __name__ == "__main__":
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index c3fd01670a2a..d938f361c857 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -3,14 +3,14 @@
 let
   # These names are how they are designated in https://xanmod.org.
   ltsVariant = {
-    version = "6.1.53";
-    hash = "sha256-+70dp+zVOvfKJv9hEy3FpEs2ldrxHiWbokaUnXrNj5o=";
+    version = "6.1.57";
+    hash = "sha256-ZzZj1Ij9L6WtjEJRcOdNtZ18oFRybNPV4uID6umC2Zg=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.5.3";
-    hash = "sha256-2giaFyN3kWzQ9cl1mTM9ecSlwoQS+dm3/LvbTAHjZ/A=";
+    version = "6.5.7";
+    hash = "sha256-D4DMyBSaBZXHScmpkC3/fKlDylO1xVSZhar2F5bMjkY=";
     variant = "main";
   };
 
@@ -52,7 +52,7 @@ let
 
     extraMeta = {
       branch = lib.versions.majorMinor version;
-      maintainers = with lib.maintainers; [ fortuneteller2k lovesegfault atemu shawn8901 ];
+      maintainers = with lib.maintainers; [ fortuneteller2k lovesegfault atemu shawn8901 zzzsy ];
       description = "Built with custom settings and new features built to provide a stable, responsive and smooth desktop experience";
       broken = stdenv.isAarch64;
     };
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix b/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 0d73b00d1205..716a45820ca5 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.5.4"; #zen
+    version = "6.5.7"; #zen
     suffix = "zen2"; #zen
-    sha256 = "0p67v2rhkf0q61cvf310nkg08dpwgmkabid71qp01ig3sdp6rcsy"; #zen
+    sha256 = "0qy3xn7kr16crm7iw1zhm3kpgxpmn66xc4g1yalvghwn6si0n81l"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.5.4"; #lqx
-    suffix = "lqx2"; #lqx
-    sha256 = "0zz7jn2fic7llppv4ih91jfz0k0q6c04xsyqljhiw6279dsv8h7c"; #lqx
+    version = "6.5.7"; #lqx
+    suffix = "lqx1"; #lqx
+    sha256 = "1c4093xhfnzx6h8frqcigdlikgy1n0vv34ajs0237v3w7psw99d7"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
@@ -74,10 +74,10 @@ let
       HZ = freeform "1000";
       HZ_1000 = yes;
     } // lib.optionalAttrs (isLqx) {
-      # Google's BBRv2 TCP congestion Control
-      TCP_CONG_BBR2 = yes;
-      DEFAULT_BBR2 = yes;
-      DEFAULT_TCP_CONG = freeform "bbr2";
+      # Google's BBRv3 TCP congestion Control
+      TCP_CONG_BBR = yes;
+      DEFAULT_BBR = yes;
+      DEFAULT_TCP_CONG = freeform "bbr";
 
       # PDS Process Scheduler
       SCHED_ALT = yes;
@@ -102,7 +102,7 @@ let
 
     extraMeta = {
       branch = lib.versions.majorMinor version + "/master";
-      maintainers = with lib.maintainers; [ thiagokokada ];
+      maintainers = with lib.maintainers; [ thiagokokada jerrysm64 ];
       description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads." +
         lib.optionalString isLqx " (Same as linux_zen, but less aggressive release schedule and additional extra config)";
       broken = stdenv.isAarch64;
diff --git a/nixpkgs/pkgs/os-specific/linux/klibc/default.nix b/nixpkgs/pkgs/os-specific/linux/klibc/default.nix
index 36128a081a24..3a044cf9d84d 100644
--- a/nixpkgs/pkgs/os-specific/linux/klibc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/klibc/default.nix
@@ -9,11 +9,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "klibc";
-  version = "2.0.12";
+  version = "2.0.13";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/klibc/2.0/klibc-${version}.tar.xz";
-    hash = "sha256-cfgWoNOr46uotGMZrlyhR+eno4QBs/XiYgJfTcCMR10=";
+    hash = "sha256-1nOilPdC1ZNoIi/1w4Ri2BCYxVBjeZ3m+4p7o9SvBDY=";
   };
 
   patches = [ ./no-reinstall-kernel-headers.patch ];
diff --git a/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix b/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
index 683448cbe41b..0dab09de4c1c 100644
--- a/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libpsm2/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libpsm2";
-  version = "11.2.230";
+  version = "12.0.1";
 
   preConfigure= ''
     export UDEVDIR=$out/etc/udev
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "intel";
     repo = "opa-psm2";
     rev = "PSM2_${version}";
-    sha256 = "sha256-dMfGq067TqstGAWNSZZaZCwvChTyPUsvaPVjFGGzp64=";
+    sha256 = "sha256-MzocxY+X2a5rJvTo+gFU0U10YzzazR1IxzgEporJyhI=";
   };
 
   postInstall = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix b/nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix
index 9a56249de39a..50fc74d7fa0a 100644
--- a/nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mbpfan/default.nix
@@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/dgraziotin/mbpfan";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
index dea5ad9f017f..35c4da7acf93 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/default.nix
@@ -4,15 +4,14 @@
 , fetchurl
 , bootBash
 , gnumake
+, gnupatch
 , gnused
 , gnugrep
 , gnutar
 , gawk
 , gzip
-, gcc
-, glibc
-, binutils
-, linux-headers
+, diffutils
+, tinycc
 , derivationWithMeta
 , bash
 , coreutils
@@ -25,19 +24,26 @@ let
     url = "mirror://gnu/bash/bash-${version}.tar.gz";
     sha256 = "132qng0jy600mv1fs95ylnlisx2wavkkgpb19c6kmz7lnmjhjwhk";
   };
+
+  patches = [
+    # flush output for generated code
+    ./mksignames-flush.patch
+  ];
 in
 bootBash.runCommand "${pname}-${version}" {
   inherit pname version;
 
   nativeBuildInputs = [
-    gcc
-    binutils
+    coreutils
+    tinycc.compiler
     gnumake
+    gnupatch
     gnused
     gnugrep
     gnutar
     gawk
     gzip
+    diffutils
   ];
 
   passthru.runCommand = name: env: buildCommand:
@@ -78,22 +84,23 @@ bootBash.runCommand "${pname}-${version}" {
   tar xzf ${src}
   cd bash-${version}
 
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
   # Configure
-  export CC="gcc -I${glibc}/include -I${linux-headers}/include"
-  export LIBRARY_PATH="${glibc}/lib"
-  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
-  export ac_cv_func_dlopen=no
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export LD=tcc
   bash ./configure \
     --prefix=$out \
     --build=${buildPlatform.config} \
     --host=${hostPlatform.config} \
-    --disable-nls \
-    --disable-net-redirections
+    --without-bash-malloc
 
   # Build
-  make SHELL=bash
+  make -j $NIX_BUILD_CORES SHELL=bash
 
   # Install
-  make install
+  make -j $NIX_BUILD_CORES install
   ln -s bash $out/bin/sh
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/mksignames-flush.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/mksignames-flush.patch
new file mode 100644
index 000000000000..6e64dfa7fa3a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bash/mksignames-flush.patch
@@ -0,0 +1,10 @@
+--- a/support/mksignames.c
++++ b/support/mksignames.c
+@@ -68,6 +68,7 @@ write_signames (stream)
+   fprintf (stream, "};\n\n");
+   fprintf (stream, "#define initialize_signames()\n\n");
+ #endif
++  fflush(stream);
+ }
+ 
+ int
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
index f386ebbaf8e9..71e391efb550 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/binutils/default.nix
@@ -3,35 +3,29 @@
 , hostPlatform
 , fetchurl
 , bash
+, coreutils
 , gnumake
 , gnupatch
+, gnused
 , gnugrep
-, gnutar
 , gawk
-, bzip2
-, sed
-, mesBootstrap ? false, tinycc ? null
-, gcc ? null, glibc ? null, binutils ? null, linux-headers
+, diffutils
+, gnutar
+, xz
+, tinycc
 }:
-assert mesBootstrap -> tinycc != null;
-assert !mesBootstrap -> gcc != null && glibc != null && binutils != null;
+
 let
-  pname = "binutils" + lib.optionalString mesBootstrap "-mes";
-  version = "2.20.1";
-  rev = "a";
+  # Based on https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a1-static-binutils.nix
+  pname = "binutils";
+  version = "2.41";
 
   src = fetchurl {
-    url = "mirror://gnu/binutils/binutils-${version}${rev}.tar.bz2";
-    sha256 = "0r7dr0brfpchh5ic0z9r4yxqn4ybzmlh25sbp30cacqk8nb7rlvi";
+    url = "mirror://gnu/binutils/binutils-${version}.tar.xz";
+    hash = "sha256-rppXieI0WeWWBuZxRyPy0//DHAMXQZHvDQFb3wYAdFA=";
   };
 
   patches = [
-    # Enables building binutils using TCC and Mes C Library
-    (fetchurl {
-      url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/binutils-boot-2.20.1a.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
-      sha256 = "086sf6an2k56axvs4jlky5n3hs2l3rq8zq5d37h0b69cdyh7igpn";
-    })
-
     # Make binutils output deterministic by default.
     ./deterministic.patch
   ];
@@ -40,10 +34,10 @@ let
     "--prefix=${placeholder "out"}"
     "--build=${buildPlatform.config}"
     "--host=${hostPlatform.config}"
-    "--disable-nls"
-    "--disable-shared"
-    "--disable-werror"
     "--with-sysroot=/"
+    "--enable-deterministic-archives"
+    # depends on bison
+    "--disable-gprofng"
 
     # Turn on --enable-new-dtags by default to make the linker set
     # RUNPATH instead of RPATH on binaries.  This is important because
@@ -60,15 +54,16 @@ bash.runCommand "${pname}-${version}" {
   inherit pname version;
 
   nativeBuildInputs = [
-    (if mesBootstrap then tinycc.compiler else gcc)
+    tinycc.compiler
     gnumake
     gnupatch
+    gnused
     gnugrep
-    gnutar
     gawk
-    bzip2
-    sed
-  ] ++ lib.optional (!mesBootstrap) binutils;
+    diffutils
+    gnutar
+    xz
+  ];
 
   passthru.tests.get-version = result:
     bash.runCommand "${pname}-get-version-${version}" {} ''
@@ -85,32 +80,35 @@ bash.runCommand "${pname}-${version}" {
   };
 } ''
   # Unpack
-  cp ${src} binutils.tar.bz2
-  bunzip2 binutils.tar.bz2
+  cp ${src} binutils.tar.xz
+  unxz binutils.tar.xz
   tar xf binutils.tar
   rm binutils.tar
   cd binutils-${version}
 
   # Patch
   ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+  sed -i 's|/bin/sh|${bash}/bin/bash|' \
+    missing install-sh mkinstalldirs
+  # see libtool's 74c8993c178a1386ea5e2363a01d919738402f30
+  sed -i 's/| \$NL2SP/| sort | $NL2SP/' ltmain.sh
+  # alias makeinfo to true
+  mkdir aliases
+  ln -s ${coreutils}/bin/true aliases/makeinfo
+  export PATH="$(pwd)/aliases/:$PATH"
 
   # Configure
-  ${if mesBootstrap then ''
-    export CC="tcc -B ${tinycc.libs}/lib -D __GLIBC_MINOR__=6 -D MES_BOOTSTRAP=1"
-    export AR="tcc -ar"
-  '' else ''
-    export CC="gcc -B ${glibc}/lib -I${glibc}/include -I${linux-headers}/include"
-    export CPP="gcc -E -I${glibc}/include -I${linux-headers}/include"
-    export AR="ar"
-    export LIBRARY_PATH="${glibc}/lib"
-    export LIBS="-lc -lnss_files -lnss_dns -lresolv"
-  ''}
-  export SED=sed
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export lt_cv_sys_max_cmd_len=32768
+  export CFLAGS="-D__LITTLE_ENDIAN__=1"
   bash ./configure ${lib.concatStringsSep " " configureFlags}
 
   # Build
-  make
+  make -j $NIX_BUILD_CORES all-libiberty all-gas all-bfd all-libctf all-zlib all-gprof
+  make all-ld # race condition on ld/.deps/ldwrite.Po, serialize
+  make -j $NIX_BUILD_CORES
 
   # Install
-  make install
+  make -j $NIX_BUILD_CORES install
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix
index 84fb7a0a1b73..05da061ac263 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/bzip2/default.nix
@@ -3,7 +3,7 @@
 , bash
 , tinycc
 , gnumake
-, gnupatch
+, gnutar
 , gzip
 }:
 let
@@ -14,16 +14,6 @@ let
     url = "https://sourceware.org/pub/bzip2/bzip2-${version}.tar.gz";
     sha256 = "0s92986cv0p692icqlw1j42y9nld8zd83qwhzbqd61p1dqbh6nmb";
   };
-
-  patches = [
-    # mes libc has no time support, so we remove that.
-    # It also does not have fch{own,mod}, which we don't care about in the bootstrap
-    # anyway, so we can null-op those calls.
-    (fetchurl {
-      url = "https://github.com/fosslinux/live-bootstrap/raw/87e9d7db9d22b400d1c05247254ac39ee2577e80/sysa/bzip2-1.0.8/patches/mes-libc.patch";
-      sha256 = "14dciwib28h413skzfkh7samzh8x87dmwhldyxxphff04pvl1j3c";
-    })
-  ];
 in
 bash.runCommand "${pname}-${version}" {
   inherit pname version;
@@ -31,13 +21,13 @@ bash.runCommand "${pname}-${version}" {
   nativeBuildInputs = [
     tinycc.compiler
     gnumake
-    gnupatch
+    gnutar
     gzip
   ];
 
   passthru.tests.get-version = result:
     bash.runCommand "${pname}-get-version-${version}" {} ''
-      ${result}/bin/bzip2 --version --help
+      ${result}/bin/bzip2 --help
       mkdir $out
     '';
 
@@ -50,21 +40,16 @@ bash.runCommand "${pname}-${version}" {
   };
 } ''
   # Unpack
-  cp ${src} bzip2.tar.gz
-  gunzip bzip2.tar.gz
-  untar --file bzip2.tar
-  rm bzip2.tar
+  tar xzf ${src}
   cd bzip2-${version}
 
-  # Patch
-  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
-
   # Build
   make \
-    CC="tcc -B ${tinycc.libs}/lib -I ." \
+    -j $NIX_BUILD_CORES \
+    CC="tcc -B ${tinycc.libs}/lib" \
     AR="tcc -ar" \
     bzip2 bzip2recover
 
   # Install
-  make install PREFIX=$out
+  make install -j $NIX_BUILD_CORES PREFIX=$out
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
index eb4fe9bcf993..9d7480d239f2 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/default.nix
@@ -6,7 +6,7 @@
 , gnupatch
 }:
 let
-  pname = "coreutils";
+  pname = "bootstrap-coreutils";
   version = "5.0";
 
   src = fetchurl {
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
new file mode 100644
index 000000000000..14584e0a7e6d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/coreutils/musl.nix
@@ -0,0 +1,74 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnugrep
+, gnused
+, gawk
+, gnutar
+, gzip
+}:
+let
+  pname = "bootstrap-coreutils-musl";
+  version = "9.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/coreutils/coreutils-${version}.tar.gz";
+    hash = "sha256-X2ANkJOXOwr+JTk9m8GMRPIjJlf0yg2V6jHHAutmtzk=";
+  };
+
+  configureFlags = [
+    "--prefix=${placeholder "out"}"
+    "--build=${buildPlatform.config}"
+    "--host=${hostPlatform.config}"
+    # musl 1.1.x doesn't use 64bit time_t
+    "--disable-year2038"
+    # libstdbuf.so fails in static builds
+    "--enable-no-install-program=stdbuf"
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/cat --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "The GNU Core Utilities";
+    homepage = "https://www.gnu.org/software/coreutils";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd coreutils-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
+  bash ./configure ${lib.concatStringsSep " " configureFlags}
+
+  # Build
+  make -j $NIX_BUILD_CORES AR="tcc -ar" MAKEINFO="true"
+
+  # Install
+  make -j $NIX_BUILD_CORES install MAKEINFO="true"
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index 55900f86d21c..11b7f5b11a6f 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -17,46 +17,46 @@ lib.makeScope
 
     bash = callPackage ./bash {
       bootBash = bash_2_05;
-      gcc = gcc2;
-      glibc = glibc22;
-      gawk = gawk-mes;
+      tinycc = tinycc-musl;
+      coreutils = coreutils-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
     };
 
     binutils = callPackage ./binutils {
       bash = bash_2_05;
-      gcc = gcc2;
-      binutils = binutils-mes;
-      glibc = glibc22;
-      sed = heirloom.sed;
-      gawk = gawk-mes;
-    };
-    binutils-mes = callPackage ./binutils {
-      bash = bash_2_05;
-      tinycc = tinycc-mes;
-      sed = heirloom.sed;
-      gawk = gawk-mes;
-      mesBootstrap = true;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
     };
 
     bzip2 = callPackage ./bzip2 {
       bash = bash_2_05;
-      tinycc = tinycc-mes;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
     };
 
     coreutils = callPackage ./coreutils { tinycc = tinycc-mes; };
+    coreutils-musl = callPackage ./coreutils/musl.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+    };
 
     diffutils = callPackage ./diffutils {
       bash = bash_2_05;
-      gcc = gcc2;
-      glibc = glibc22;
-      gawk = gawk-mes;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
     };
 
     findutils = callPackage ./findutils {
       bash = bash_2_05;
-      gcc = gcc2;
-      glibc = glibc22;
-      gawk = gawk-mes;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
     };
 
     gawk-mes = callPackage ./gawk/mes.nix {
@@ -67,35 +67,42 @@ lib.makeScope
 
     gawk = callPackage ./gawk {
       bash = bash_2_05;
-      gcc = gcc2;
-      glibc = glibc22;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
       bootGawk = gawk-mes;
     };
 
-    gcc2 = callPackage ./gcc/2.nix {
-      bash = bash_2_05;
-      gcc = gcc2-mes;
-      binutils = binutils-mes;
-      glibc = glibc22;
+    gcc46 = callPackage ./gcc/4.6.nix {
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+      # FIXME: not sure why new gawk doesn't work
+      gawk = gawk-mes;
     };
-    gcc2-mes = callPackage ./gcc/2.nix {
-      bash = bash_2_05;
-      tinycc = tinycc-mes;
-      binutils = binutils-mes;
-      mesBootstrap = true;
+    gcc46-cxx = callPackage ./gcc/4.6.cxx.nix {
+      gcc = gcc46;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
+      # FIXME: not sure why new gawk doesn't work
+      gawk = gawk-mes;
     };
 
-    gcc46 = callPackage ./gcc/4.6.nix {
-      gcc = gcc2;
-      glibc = glibc22;
+    gcc8 = callPackage ./gcc/8.nix {
+      gcc = gcc46-cxx;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-latest;
+      # FIXME: not sure why new gawk doesn't work
       gawk = gawk-mes;
     };
 
-    inherit (callPackage ./glibc {
-      bash = bash_2_05;
-      gnused = gnused-mes;
+    gcc-latest = callPackage ./gcc/latest.nix {
+      gcc = gcc8;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-latest;
+      # FIXME: not sure why new gawk doesn't work
       gawk = gawk-mes;
-    }) glibc22;
+    };
 
     gnugrep = callPackage ./gnugrep {
       bash = bash_2_05;
@@ -104,26 +111,44 @@ lib.makeScope
 
     gnumake = callPackage ./gnumake { tinycc = tinycc-mes; };
 
+    gnumake-musl = callPackage ./gnumake/musl.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gawk = gawk-mes;
+      gnumakeBoot = gnumake;
+    };
+
     gnupatch = callPackage ./gnupatch { tinycc = tinycc-mes; };
 
     gnused = callPackage ./gnused {
       bash = bash_2_05;
-      gcc = gcc2;
-      glibc = glibc22;
+      tinycc = tinycc-musl;
       gnused = gnused-mes;
     };
-    gnused-mes = callPackage ./gnused {
+    gnused-mes = callPackage ./gnused/mes.nix {
       bash = bash_2_05;
       tinycc = tinycc-mes;
-      mesBootstrap = true;
     };
 
-    gnutar = callPackage ./gnutar {
+    gnutar = callPackage ./gnutar/mes.nix {
       bash = bash_2_05;
       tinycc = tinycc-mes;
       gnused = gnused-mes;
     };
 
+    gnutar-musl = callPackage ./gnutar/musl.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-musl;
+      gnused = gnused-mes;
+    };
+
+    # FIXME: better package naming scheme
+    gnutar-latest = callPackage ./gnutar/latest.nix {
+      gcc = gcc46;
+      gnumake = gnumake-musl;
+      gnutarBoot = gnutar-musl;
+    };
+
     gzip = callPackage ./gzip {
       bash = bash_2_05;
       tinycc = tinycc-mes;
@@ -144,9 +169,15 @@ lib.makeScope
     mes = lib.recurseIntoAttrs (callPackage ./mes { });
     mes-libc = callPackage ./mes/libc.nix { };
 
+    musl11 = callPackage ./musl/1.1.nix {
+      bash = bash_2_05;
+      tinycc = tinycc-mes;
+      gnused = gnused-mes;
+    };
+
     musl = callPackage ./musl {
       gcc = gcc46;
-      gawk = gawk-mes;
+      gnumake = gnumake-musl;
     };
 
     stage0-posix = callPackage ./stage0-posix { };
@@ -155,12 +186,16 @@ lib.makeScope
 
     tinycc-bootstrappable = lib.recurseIntoAttrs (callPackage ./tinycc/bootstrappable.nix { });
     tinycc-mes = lib.recurseIntoAttrs (callPackage ./tinycc/mes.nix { });
+    tinycc-musl = lib.recurseIntoAttrs (callPackage ./tinycc/musl.nix {
+      bash = bash_2_05;
+      musl = musl11;
+    });
 
     xz = callPackage ./xz {
       bash = bash_2_05;
-      tinycc = tinycc-mes;
-      gawk = gawk-mes;
-      inherit (heirloom) sed;
+      tinycc = tinycc-musl;
+      gnumake = gnumake-musl;
+      gnutar = gnutar-musl;
     };
 
     inherit (callPackage ./utils.nix { }) derivationWithMeta writeTextFile writeText;
@@ -169,24 +204,28 @@ lib.makeScope
       echo ${bash.tests.get-version}
       echo ${bash_2_05.tests.get-version}
       echo ${binutils.tests.get-version}
-      echo ${binutils-mes.tests.get-version}
       echo ${bzip2.tests.get-version}
+      echo ${coreutils-musl.tests.get-version}
       echo ${diffutils.tests.get-version}
       echo ${findutils.tests.get-version}
       echo ${gawk-mes.tests.get-version}
       echo ${gawk.tests.get-version}
-      echo ${gcc2.tests.get-version}
-      echo ${gcc2-mes.tests.get-version}
       echo ${gcc46.tests.get-version}
+      echo ${gcc46-cxx.tests.hello-world}
+      echo ${gcc8.tests.hello-world}
+      echo ${gcc-latest.tests.hello-world}
       echo ${gnugrep.tests.get-version}
       echo ${gnused.tests.get-version}
       echo ${gnused-mes.tests.get-version}
       echo ${gnutar.tests.get-version}
+      echo ${gnutar-musl.tests.get-version}
+      echo ${gnutar-latest.tests.get-version}
       echo ${gzip.tests.get-version}
       echo ${heirloom.tests.get-version}
       echo ${mes.compiler.tests.get-version}
       echo ${musl.tests.hello-world}
       echo ${tinycc-mes.compiler.tests.chain}
+      echo ${tinycc-musl.compiler.tests.hello-world}
       echo ${xz.tests.get-version}
       mkdir ''${out}
     '';
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
index 7545a52524a3..24cd643b3497 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/diffutils/default.nix
@@ -3,38 +3,35 @@
 , hostPlatform
 , fetchurl
 , bash
-, gcc
-, glibc
-, binutils
-, linux-headers
+, tinycc
 , gnumake
 , gnugrep
 , gnused
 , gawk
 , gnutar
-, gzip
+, xz
 }:
 let
   pname = "diffutils";
-  version = "2.8.1";
+  # last version that can be built by tinycc-musl 0.9.27
+  version = "3.8";
 
   src = fetchurl {
-    url = "mirror://gnu/diffutils/diffutils-${version}.tar.gz";
-    sha256 = "0nizs9r76aiymzasmj1jngl7s71jfzl9xfziigcls8k9n141f065";
+    url = "mirror://gnu/diffutils/diffutils-${version}.tar.xz";
+    hash = "sha256-pr3X0bMSZtEcT03mwbdI1GB6sCMa9RiPwlM9CuJDj+w=";
   };
 in
 bash.runCommand "${pname}-${version}" {
   inherit pname version;
 
   nativeBuildInputs = [
-    gcc
-    binutils
+    tinycc.compiler
     gnumake
     gnused
     gnugrep
     gawk
     gnutar
-    gzip
+    xz
   ];
 
   passthru.tests.get-version = result:
@@ -52,21 +49,23 @@ bash.runCommand "${pname}-${version}" {
   };
 } ''
   # Unpack
-  tar xzf ${src}
+  cp ${src} diffutils.tar.xz
+  unxz diffutils.tar.xz
+  tar xf diffutils.tar
+  rm diffutils.tar
   cd diffutils-${version}
 
   # Configure
-  export C_INCLUDE_PATH="${glibc}/include:${linux-headers}/include"
-  export LIBRARY_PATH="${glibc}/lib"
-  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
   bash ./configure \
     --prefix=$out \
     --build=${buildPlatform.config} \
     --host=${hostPlatform.config}
 
   # Build
-  make
+  make -j $NIX_BUILD_CORES AR="tcc -ar"
 
   # Install
-  make install
+  make -j $NIX_BUILD_CORES install
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
index cf26abd21383..97418d218fb9 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/findutils/default.nix
@@ -3,38 +3,34 @@
 , hostPlatform
 , fetchurl
 , bash
-, gcc
-, glibc
-, binutils
-, linux-headers
+, tinycc
 , gnumake
 , gnugrep
 , gnused
 , gawk
 , gnutar
-, gzip
+, xz
 }:
 let
   pname = "findutils";
-  version = "4.4.2";
+  version = "4.9.0";
 
   src = fetchurl {
-    url = "mirror://gnu/findutils/findutils-${version}.tar.gz";
-    sha256 = "0amn0bbwqvsvvsh6drfwz20ydc2czk374lzw5kksbh6bf78k4ks3";
+    url = "mirror://gnu/findutils/findutils-${version}.tar.xz";
+    hash = "sha256-or+4wJ1DZ3DtxZ9Q+kg+eFsWGjt7nVR1c8sIBl/UYv4=";
   };
 in
 bash.runCommand "${pname}-${version}" {
   inherit pname version;
 
   nativeBuildInputs = [
-    gcc
-    binutils
+    tinycc.compiler
     gnumake
     gnused
     gnugrep
     gawk
     gnutar
-    gzip
+    xz
   ];
 
   passthru.tests.get-version = result:
@@ -52,21 +48,28 @@ bash.runCommand "${pname}-${version}" {
   };
 } ''
   # Unpack
-  tar xzf ${src}
+  cp ${src} findutils.tar.xz
+  unxz findutils.tar.xz
+  tar xf findutils.tar
+  rm findutils.tar
   cd findutils-${version}
 
+  # Patch
+  # configure fails to accurately detect PATH_MAX support
+  sed -i 's/chdir_long/chdir/' gl/lib/save-cwd.c
+
   # Configure
-  export C_INCLUDE_PATH="${glibc}/include:${linux-headers}/include"
-  export LIBRARY_PATH="${glibc}/lib"
-  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export LD=tcc
   bash ./configure \
     --prefix=$out \
     --build=${buildPlatform.config} \
     --host=${hostPlatform.config}
 
   # Build
-  make
+  make -j $NIX_BUILD_CORES
 
   # Install
-  make install
+  make -j $NIX_BUILD_CORES install
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
index 935414f21760..879b98bf00c5 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gawk/default.nix
@@ -3,10 +3,7 @@
 , hostPlatform
 , fetchurl
 , bash
-, gcc
-, glibc
-, binutils
-, linux-headers
+, tinycc
 , gnumake
 , gnugrep
 , gnused
@@ -17,21 +14,18 @@
 let
   inherit (import ./common.nix { inherit lib; }) meta;
   pname = "gawk";
-  # >= 4.2.0 fails to cleanly build. may be worth investigating in the future.
-  # for now this version is sufficient to build glibc 2.16
-  version = "4.1.4";
+  version = "5.2.2";
 
   src = fetchurl {
     url = "mirror://gnu/gawk/gawk-${version}.tar.gz";
-    sha256 = "0dadjkpyyizmyd0l098qps8lb39r0vrz3xl3hwz2cmjs5c70h0wc";
+    hash = "sha256-lFrvfM/xAfILIqEIArwAXplKsrjqPnJMwaGXxi9B9lA=";
   };
 in
 bash.runCommand "${pname}-${version}" {
   inherit pname version meta;
 
   nativeBuildInputs = [
-    gcc
-    binutils
+    tinycc.compiler
     gnumake
     gnused
     gnugrep
@@ -51,18 +45,17 @@ bash.runCommand "${pname}-${version}" {
   cd gawk-${version}
 
   # Configure
-  export C_INCLUDE_PATH="${glibc}/include:${linux-headers}/include"
-  export LIBRARY_PATH="${glibc}/lib"
-  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export AR="tcc -ar"
+  export LD=tcc
   bash ./configure \
     --prefix=$out \
     --build=${buildPlatform.config} \
     --host=${hostPlatform.config}
 
   # Build
-  make gawk
+  make -j $NIX_BUILD_CORES
 
   # Install
-  install -D gawk $out/bin/gawk
-  ln -s gawk $out/bin/awk
+  make -j $NIX_BUILD_CORES install
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix
deleted file mode 100644
index c879fd30aaf6..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/2.nix
+++ /dev/null
@@ -1,140 +0,0 @@
-{ lib
-, buildPlatform
-, hostPlatform
-, fetchurl
-, bash
-, gnumake
-, gnupatch
-, gnugrep
-, gnutar
-, gzip
-, heirloom
-, binutils
-, mesBootstrap ? false, tinycc ? null, mes-libc
-, gcc ? null, glibc ? null, linux-headers
-}:
-assert mesBootstrap -> tinycc != null;
-assert !mesBootstrap -> gcc != null && glibc != null;
-let
-  # Gcc-2.95.3 is the most recent GCC that is supported by what the Mes C
-  # Library v0.16 offers.  Gcc-3.x (and 4.x) place higher demands on a C
-  # library, such as dir.h/struct DIR/readdir, locales, signals...  Also,
-  # with gcc-2.95.3, binutils (2.14.0, 2.20.1a) and glibc-2.2.5 we found a
-  # GNU toolchain triplet "that works".
-  #   - from guix/gnu/packages/commencement.scm
-  pname = "gcc" + lib.optionalString mesBootstrap "-mes";
-  version = "2.95.3";
-
-  src = fetchurl {
-    url = "mirror://gnu/gcc/gcc-${version}/gcc-core-${version}.tar.gz";
-    sha256 = "1xvfy4pqhrd5v2cv8lzf63iqg92k09g6z9n2ah6ndd4h17k1x0an";
-  };
-
-  patches = [
-    # This patch enables building gcc-2.95.3 using TCC and Mes C Library.
-    #   * Disable building DOC
-    #   * Avoid running `fixproto'.
-    #   * Force running `fixinc'.
-    #   * Replace Makefile trickery of creating an libgcc1.a archive, then
-    #     extracting the .o files later to create a new libgcc2.a archive.
-    #     Instead, keep temporary .o files.
-    (fetchurl {
-      url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/gcc-boot-2.95.3.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
-      sha256 = "03l3jaxch6d76mx4zkn6ky64paj58jk0biddck01qd4bnw9z8hiw";
-    })
-  ];
-
-  makeFlags = [
-    "LANGUAGES=c"
-  ] ++ lib.optionals mesBootstrap [
-    "LIBGCC2_INCLUDES=\"-I ${mes-libc}/include\""
-    "BOOT_LDFLAGS=\" -B ${tinycc.libs}/lib\""
-  ] ++ lib.optionals (!mesBootstrap) [
-    "LIBGCC2_INCLUDES=\"-I ${glibc}/include -I ${linux-headers}/include\""
-  ];
-in
-bash.runCommand "${pname}-${version}" {
-  inherit pname version;
-
-  nativeBuildInputs = [
-    (if mesBootstrap then tinycc.compiler else gcc)
-    gnumake
-    gnupatch
-    gnugrep
-    gnutar
-    gzip
-    heirloom.sed
-    binutils
-  ];
-
-  passthru.tests.get-version = result:
-    bash.runCommand "${pname}-get-version-${version}" {} ''
-      ${result}/bin/gcc --version
-      mkdir $out
-    '';
-
-  meta = with lib; {
-    description = "GNU Compiler Collection, version ${version}";
-    homepage = "https://gcc.gnu.org";
-    license = licenses.gpl3Plus;
-    maintainers = teams.minimal-bootstrap.members;
-    platforms = platforms.unix;
-  };
-} ''
-  # Unpack
-  tar xzf ${src}
-  cd gcc-${version}
-
-  # Patch
-  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
-  # /build/glibc-2.2.5/intl/loadmsgcat.c:334: multiple definition of `_nl_load_domain'
-  # ../intl/libintl.a(loadmsgcat.o):/build/gcc-2.95.3/texinfo/intl/loadmsgcat.c:66: first defined here
-  rm -R texinfo
-  mkdir -p texinfo
-  echo 'all:'>texinfo/Makefile.in
-  echo 'install:'>>texinfo/Makefile.in
-
-  # Configure
-  ${if mesBootstrap then ''
-    export CC="tcc -B ${tinycc.libs}/lib -D __GLIBC_MINOR__=6"
-    export CPP="tcc -E"
-    export ac_cv_func_setlocale=no
-  '' else ''
-    export CC="gcc -I${glibc}/include -I${linux-headers}/include -I${gcc}/lib/gcc-lib/${hostPlatform.config}/${version}/include"
-    export CPP="gcc -E -I${glibc}/include -I${linux-headers}/include -I${gcc}/lib/gcc-lib/${hostPlatform.config}/${version}/include"
-    export LIBRARY_PATH="${glibc}/lib"
-    export LIBS="-lc -lnss_files -lnss_dns -lresolv"
-  ''}
-  export OLDCC="$CC"
-  export CC_FOR_BUILD="$CC"
-  export AR=ar
-  export RANLIB=ranlib
-  export ac_cv_c_float_format='IEEE (little-endian)'
-  bash ./configure \
-    --build=${buildPlatform.config} \
-    --host=${hostPlatform.config} \
-    --enable-static \
-    --disable-shared \
-    --disable-werror \
-    --prefix=$out
-  # no info at this stage
-  touch gcc/cpp.info gcc/gcc.info
-
-  # Build
-  make ${lib.concatStringsSep " " makeFlags}
-
-  # Install
-  make install
-  mkdir tmp
-  cd tmp
-  ar x ../gcc/libgcc2.a
-  ${lib.optionalString mesBootstrap "ar x ${tinycc.libs}/lib/libtcc1.a"}
-  ar r $out/lib/gcc-lib/${hostPlatform.config}/${version}/libgcc.a *.o
-  cd ..
-  cp gcc/libgcc2.a $out/lib/libgcc2.a
-  ${lib.optionalString mesBootstrap ''
-    ar x ${tinycc.libs}/lib/libtcc1.a
-    ar x ${tinycc.libs}/lib/libc.a
-    ar r $out/lib/gcc-lib/${hostPlatform.config}/${version}/libc.a libc.o libtcc1.o
-  ''}
-''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
new file mode 100644
index 000000000000..277c5e82cc3d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.cxx.nix
@@ -0,0 +1,140 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, coreutils
+, gcc
+, musl
+, binutils
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gawk
+, diffutils
+, findutils
+, gnutar
+, gzip
+}:
+let
+  pname = "gcc-cxx";
+  version = "4.6.4";
+
+  src = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-core-${version}.tar.gz";
+    sha256 = "173kdb188qg79pcz073cj9967rs2vzanyjdjyxy9v0xb0p5sad75";
+  };
+
+  ccSrc = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-g++-${version}.tar.gz";
+    sha256 = "1fqqk5zkmdg4vmqzdmip9i42q6b82i3f6yc0n86n9021cr7ms2k9";
+  };
+
+  gmpVersion = "4.3.2";
+  gmp = fetchurl {
+    url = "mirror://gnu/gmp/gmp-${gmpVersion}.tar.gz";
+    sha256 = "15rwq54fi3s11izas6g985y9jklm3xprfsmym3v1g6xr84bavqvv";
+  };
+
+  mpfrVersion = "2.4.2";
+  mpfr = fetchurl {
+    url = "mirror://gnu/mpfr/mpfr-${mpfrVersion}.tar.gz";
+    sha256 = "0dxn4904dra50xa22hi047lj8kkpr41d6vb9sd4grca880c7wv94";
+  };
+
+  mpcVersion = "1.0.3";
+  mpc = fetchurl {
+    url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
+    sha256 = "1hzci2zrrd7v3g1jk35qindq05hbl0bhjcyyisq9z209xb3fqzb1";
+  };
+
+  patches = [
+    # Remove hardcoded NATIVE_SYSTEM_HEADER_DIR
+    ./no-system-headers.patch
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+    gawk
+    diffutils
+    findutils
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.hello-world = result:
+    bash.runCommand "${pname}-simple-program-${version}" {
+        nativeBuildInputs = [ binutils musl result ];
+      } ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        musl-gcc -o test test.c
+        ./test
+        mkdir $out
+      '';
+
+  meta = with lib; {
+    description = "GNU Compiler Collection, version ${version}";
+    homepage = "https://gcc.gnu.org";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  tar xzf ${ccSrc}
+  tar xzf ${gmp}
+  tar xzf ${mpfr}
+  tar xzf ${mpc}
+  cd gcc-${version}
+
+  ln -s ../gmp-${gmpVersion} gmp
+  ln -s ../mpfr-${mpfrVersion} mpfr
+  ln -s ../mpc-${mpcVersion} mpc
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+  # doesn't recognise musl
+  sed -i 's|"os/gnu-linux"|"os/generic"|' libstdc++-v3/configure.host
+
+  # Configure
+  export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export C_INCLUDE_PATH="${musl}/include"
+  export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
+  export LIBRARY_PATH="${musl}/lib"
+
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --with-native-system-header-dir=${musl}/include \
+    --with-build-sysroot=${musl} \
+    --enable-languages=c,c++ \
+    --disable-bootstrap \
+    --disable-libmudflap \
+    --disable-libstdcxx-pch \
+    --disable-lto \
+    --disable-multilib
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
index ce348352b67e..8b56dff58829 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/4.6.nix
@@ -3,9 +3,7 @@
 , hostPlatform
 , fetchurl
 , bash
-, gcc
-, glibc
-, linux-headers
+, tinycc
 , binutils
 , gnumake
 , gnupatch
@@ -31,24 +29,6 @@ let
     sha256 = "1fqqk5zkmdg4vmqzdmip9i42q6b82i3f6yc0n86n9021cr7ms2k9";
   };
 
-  patches = [
-    # This patch enables building gcc-4.6.4 using gcc-2.95.3 and glibc-2.2.5
-    # * Tweak Makefile to allow overriding NATIVE_SYSTEM_HEADER_DIR using #:makeflags
-    # * Add missing limits.h include.
-    # * Add SSIZE_MAX define.  The SSIZE_MAX define has been added to Mes
-    #   upstream and can be removed with the next Mes release.
-    # * Remove -fbuilding-libgcc flag, it assumes features being present from a
-    #   newer gcc or glibc.
-    # * [MES_BOOTSTRAP_GCC]: Disable threads harder.
-    (fetchurl {
-      url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/gcc-boot-4.6.4.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
-      sha256 = "1zzd8gnihw6znrgb6c6pfsmm0vix89xw3giv1nnsykm57j0v3z0d";
-    })
-    ./libstdc++-target.patch
-  ];
-
-  # To reduce the set of pre-built bootstrap inputs, build
-  # GMP & co. from GCC.
   gmpVersion = "4.3.2";
   gmp = fetchurl {
     url = "mirror://gnu/gmp/gmp-${gmpVersion}.tar.gz";
@@ -66,12 +46,17 @@ let
     url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
     sha256 = "1hzci2zrrd7v3g1jk35qindq05hbl0bhjcyyisq9z209xb3fqzb1";
   };
+
+  patches = [
+    # Remove hardcoded NATIVE_SYSTEM_HEADER_DIR
+    ./no-system-headers.patch
+  ];
 in
 bash.runCommand "${pname}-${version}" {
   inherit pname version;
 
   nativeBuildInputs = [
-    gcc
+    tinycc.compiler
     binutils
     gnumake
     gnupatch
@@ -84,10 +69,6 @@ bash.runCommand "${pname}-${version}" {
     gzip
   ];
 
-  # condition in ./libcpp/configure requires `env` which is not available in this coreutils
-  am_cv_CXX_dependencies_compiler_type = "gcc";
-  am_cv_CC_dependencies_compiler_type = "gcc";
-
   passthru.tests.get-version = result:
     bash.runCommand "${pname}-get-version-${version}" {} ''
       ${result}/bin/gcc --version
@@ -118,18 +99,21 @@ bash.runCommand "${pname}-${version}" {
   ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
 
   # Configure
-  export C_INCLUDE_PATH="${gcc}/lib/gcc-lib/${hostPlatform.config}/${gcc.version}/include:${linux-headers}/include:${glibc}/include:$(pwd)/mpfr/src"
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export C_INCLUDE_PATH="${tinycc.libs}/include:$(pwd)/mpfr/src"
   export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
-  export LDFLAGS="-B${glibc}/lib -Wl,-dynamic-linker -Wl,${glibc}"
-  export LDFLAGS_FOR_TARGET=$LDFLAGS
-  export LIBRARY_PATH="${glibc}/lib:${gcc}/lib"
-  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
+
+  # Avoid "Link tests are not allowed after GCC_NO_EXECUTABLES"
+  export lt_cv_shlibpath_overrides_runpath=yes
+  export ac_cv_func_memcpy=yes
+  export ac_cv_func_strerror=yes
+
   bash ./configure \
     --prefix=$out \
     --build=${buildPlatform.config} \
     --host=${hostPlatform.config} \
-    --with-native-system-header-dir=${glibc}/include \
-    --with-build-sysroot=${glibc}/include \
+    --with-native-system-header-dir=${tinycc.libs}/include \
+    --with-build-sysroot=${tinycc.libs}/include \
     --disable-bootstrap \
     --disable-decimal-float \
     --disable-libatomic \
@@ -146,7 +130,7 @@ bash.runCommand "${pname}-${version}" {
     --disable-multilib \
     --disable-plugin \
     --disable-threads \
-    --enable-languages=c,c++ \
+    --enable-languages=c \
     --enable-static \
     --disable-shared \
     --enable-threads=single \
@@ -154,8 +138,8 @@ bash.runCommand "${pname}-${version}" {
     --disable-build-with-cxx
 
   # Build
-  make
+  make -j $NIX_BUILD_CORES
 
   # Install
-  make install
+  make -j $NIX_BUILD_CORES install
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/8.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/8.nix
new file mode 100644
index 000000000000..ea9fdaf8854a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/8.nix
@@ -0,0 +1,141 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, coreutils
+, gcc
+, musl
+, binutils
+, gnumake
+, gnused
+, gnugrep
+, gawk
+, diffutils
+, findutils
+, gnutar
+, gzip
+, bzip2
+, xz
+}:
+let
+  pname = "gcc";
+  version = "8.5.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz";
+    hash = "sha256-0wiEGlEbuDCmEAOXsAQtskzhH2Qtq26m7kSELlMl7VA=";
+  };
+
+  # last version to compile with gcc 4.6
+  gmpVersion = "6.2.1";
+  gmp = fetchurl {
+    url = "mirror://gnu/gmp/gmp-${gmpVersion}.tar.xz";
+    hash = "sha256-/UgpkSzd0S+EGBw0Ucx1K+IkZD6H+sSXtp7d2txJtPI=";
+  };
+
+  mpfrVersion = "4.2.1";
+  mpfr = fetchurl {
+    url = "mirror://gnu/mpfr/mpfr-${mpfrVersion}.tar.xz";
+    hash = "sha256-J3gHNTpnJpeJlpRa8T5Sgp46vXqaW3+yeTiU4Y8fy7I=";
+  };
+
+  mpcVersion = "1.3.1";
+  mpc = fetchurl {
+    url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
+    hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
+  };
+
+  islVersion = "0.24";
+  isl = fetchurl {
+    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
+    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    diffutils
+    findutils
+    gnutar
+    gzip
+    bzip2
+    xz
+  ];
+
+  passthru.tests.hello-world = result:
+    bash.runCommand "${pname}-simple-program-${version}" {
+        nativeBuildInputs = [ binutils musl result ];
+      } ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        musl-gcc -o test test.c
+        ./test
+        mkdir $out
+      '';
+
+  meta = with lib; {
+    description = "GNU Compiler Collection, version ${version}";
+    homepage = "https://gcc.gnu.org";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xf ${src}
+  tar xf ${gmp}
+  tar xf ${mpfr}
+  tar xf ${mpc}
+  tar xf ${isl}
+  cd gcc-${version}
+
+  ln -s ../gmp-${gmpVersion} gmp
+  ln -s ../mpfr-${mpfrVersion} mpfr
+  ln -s ../mpc-${mpcVersion} mpc
+  ln -s ../isl-${islVersion} isl
+
+  # Patch
+  # doesn't recognise musl
+  sed -i 's|"os/gnu-linux"|"os/generic"|' libstdc++-v3/configure.host
+
+  # Configure
+  export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export C_INCLUDE_PATH="${musl}/include"
+  export CPLUS_INCLUDE_PATH="$C_INCLUDE_PATH"
+  export LIBRARY_PATH="${musl}/lib"
+
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --with-native-system-header-dir=/include \
+    --with-sysroot=${musl} \
+    --enable-languages=c,c++ \
+    --disable-bootstrap \
+    --disable-libmpx \
+    --disable-libsanitizer \
+    --disable-lto \
+    --disable-multilib \
+    --disable-plugin
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install-strip
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
new file mode 100644
index 000000000000..fba3b731a004
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/latest.nix
@@ -0,0 +1,137 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, coreutils
+, gcc
+, musl
+, binutils
+, gnumake
+, gnused
+, gnugrep
+, gawk
+, diffutils
+, findutils
+, gnutar
+, gzip
+, bzip2
+, xz
+}:
+let
+  pname = "gcc";
+  version = "13.2.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz";
+    hash = "sha256-4nXnZEKmBnNBon8Exca4PYYTFEAEwEE1KIY9xrXHQ9o=";
+  };
+
+  gmpVersion = "6.3.0";
+  gmp = fetchurl {
+    url = "mirror://gnu/gmp/gmp-${gmpVersion}.tar.xz";
+    hash = "sha256-o8K4AgG4nmhhb0rTC8Zq7kknw85Q4zkpyoGdXENTiJg=";
+  };
+
+  mpfrVersion = "4.2.1";
+  mpfr = fetchurl {
+    url = "mirror://gnu/mpfr/mpfr-${mpfrVersion}.tar.xz";
+    hash = "sha256-J3gHNTpnJpeJlpRa8T5Sgp46vXqaW3+yeTiU4Y8fy7I=";
+  };
+
+  mpcVersion = "1.3.1";
+  mpc = fetchurl {
+    url = "mirror://gnu/mpc/mpc-${mpcVersion}.tar.gz";
+    hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
+  };
+
+  islVersion = "0.24";
+  isl = fetchurl {
+    url = "https://gcc.gnu.org/pub/gcc/infrastructure/isl-${islVersion}.tar.bz2";
+    hash = "sha256-/PeN2WVsEOuM+fvV9ZoLawE4YgX+GTSzsoegoYmBRcA=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    diffutils
+    findutils
+    gnutar
+    gzip
+    bzip2
+    xz
+  ];
+
+  passthru.tests.hello-world = result:
+    bash.runCommand "${pname}-simple-program-${version}" {
+        nativeBuildInputs = [ binutils musl result ];
+      } ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        musl-gcc -o test test.c
+        ./test
+        mkdir $out
+      '';
+
+  meta = with lib; {
+    description = "GNU Compiler Collection, version ${version}";
+    homepage = "https://gcc.gnu.org";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xf ${src}
+  tar xf ${gmp}
+  tar xf ${mpfr}
+  tar xf ${mpc}
+  tar xf ${isl}
+  cd gcc-${version}
+
+  ln -s ../gmp-${gmpVersion} gmp
+  ln -s ../mpfr-${mpfrVersion} mpfr
+  ln -s ../mpc-${mpcVersion} mpc
+  ln -s ../isl-${islVersion} isl
+
+  # Patch
+  # force musl even if host triple is gnu
+  sed -i 's|"os/gnu-linux"|"os/generic"|' libstdc++-v3/configure.host
+
+  # Configure
+  export CC="gcc -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CXX="g++ -Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export CFLAGS_FOR_TARGET="-Wl,-dynamic-linker -Wl,${musl}/lib/libc.so"
+  export LIBRARY_PATH="${musl}/lib"
+
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --with-native-system-header-dir=/include \
+    --with-sysroot=${musl} \
+    --enable-languages=c,c++ \
+    --disable-bootstrap \
+    --disable-libsanitizer \
+    --disable-lto \
+    --disable-multilib \
+    --disable-plugin
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install-strip
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/libstdc++-target.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/libstdc++-target.patch
deleted file mode 100644
index fb622b395806..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/libstdc++-target.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-Patch to make the target libraries 'configure' scripts find the proper CPP.
-I noticed that building the mingw32 cross compiler.
-Looking at the build script for mingw in archlinux, I think that only nixos
-needs this patch. I don't know why.
-diff --git a/Makefile.in b/Makefile.in
-index 93f66b6..d691917 100644
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -266,6 +266,7 @@ BASE_TARGET_EXPORTS = \
- 	AR="$(AR_FOR_TARGET)"; export AR; \
- 	AS="$(COMPILER_AS_FOR_TARGET)"; export AS; \
- 	CC="$(CC_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CC; \
-+	CPP="$(CC_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS -E"; export CC; \
- 	CFLAGS="$(CFLAGS_FOR_TARGET)"; export CFLAGS; \
- 	CONFIG_SHELL="$(SHELL)"; export CONFIG_SHELL; \
- 	CPPFLAGS="$(CPPFLAGS_FOR_TARGET)"; export CPPFLAGS; \
-@@ -291,11 +292,13 @@ BASE_TARGET_EXPORTS = \
- RAW_CXX_TARGET_EXPORTS = \
- 	$(BASE_TARGET_EXPORTS) \
- 	CXX_FOR_TARGET="$(RAW_CXX_FOR_TARGET)"; export CXX_FOR_TARGET; \
--	CXX="$(RAW_CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CXX;
-+	CXX="$(RAW_CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CXX; \
-+	CXXCPP="$(RAW_CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS -E"; export CXX;
- 
- NORMAL_TARGET_EXPORTS = \
- 	$(BASE_TARGET_EXPORTS) \
--	CXX="$(CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CXX;
-+	CXX="$(CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS"; export CXX; \
-+	CXXCPP="$(CXX_FOR_TARGET) $(XGCC_FLAGS_FOR_TARGET) $$TFLAGS -E"; export CXX;
- 
- # Where to find GMP
- HOST_GMPLIBS = @gmplibs@
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/no-system-headers.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/no-system-headers.patch
new file mode 100644
index 000000000000..318553bf916b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gcc/no-system-headers.patch
@@ -0,0 +1,11 @@
+--- a/gcc/Makefile.in
++++ b/gcc/Makefile.in
+@@ -440,7 +440,7 @@ LINKER_PLUGIN_API_H = $(srcdir)/../include/plugin-api.h
+ LTO_SYMTAB_H = $(srcdir)/../include/lto-symtab.h
+ 
+ # Default native SYSTEM_HEADER_DIR, to be overridden by targets.
+-NATIVE_SYSTEM_HEADER_DIR = /usr/include
++# NATIVE_SYSTEM_HEADER_DIR = /usr/include
+ # Default cross SYSTEM_HEADER_DIR, to be overridden by targets.
+ CROSS_SYSTEM_HEADER_DIR = @CROSS_SYSTEM_HEADER_DIR@
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
deleted file mode 100644
index 5c4ff386add5..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/glibc/default.nix
+++ /dev/null
@@ -1,121 +0,0 @@
-{ lib
-, buildPlatform
-, hostPlatform
-, fetchurl
-, bash
-, gcc2-mes
-, gnumake
-, gnupatch
-, gnused
-, gnugrep
-, gnutar
-, gzip
-, gawk
-, heirloom
-, binutils-mes
-, linux-headers
-}:
-let
-  pname = "glibc";
-
-  buildGlibc = { version, src, patches, configureFlags, gcc, binutils, CC, CPP }:
-    bash.runCommand "${pname}-${version}" {
-      inherit pname version;
-
-      nativeBuildInputs = [
-        gcc
-        gnumake
-        gnupatch
-        gnused
-        gnugrep
-        gnutar
-        gzip
-        gawk
-        binutils
-      ];
-
-      meta = with lib; {
-        description = "The GNU C Library";
-        homepage = "https://www.gnu.org/software/libc";
-        license = licenses.lgpl2Plus;
-        maintainers = teams.minimal-bootstrap.members;
-        platforms = platforms.linux;
-      };
-    } ''
-      # Unpack
-      tar xzf ${src}
-      cd glibc-${version}
-
-      # Patch
-      ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
-
-      # Configure
-      export CC="${CC}"
-      export CPP="${CPP}"
-      bash ./configure --prefix=$out ${lib.concatStringsSep " " (
-        [
-          "--build=${buildPlatform.config}"
-          "--host=${hostPlatform.config}"
-          "--with-headers=${linux-headers}/include"
-          "--enable-static"
-          "--disable-shared"
-        ] ++ configureFlags)}
-
-      # Build
-      make
-
-      # Install
-      # GNU sed w/ mes-libc crashes on certain stdio actions
-      export PATH="${heirloom.sed}/bin:$PATH"
-      make install
-    '';
-in
-{
-  glibc22 = buildGlibc rec {
-    # GNU C Library 2.2.5 is the most recent glibc that we managed to build
-    # using gcc-2.95.3.  Newer versions (2.3.x, 2.6, 2.1x) seem to need a newer
-    # gcc.
-    #   - from guix/gnu/packages/commencement.scm
-    version = "2.2.5";
-    src = fetchurl {
-      url = "mirror://gnu/glibc/glibc-${version}.tar.gz";
-      sha256 = "1vl48i16gx6h68whjyhgnn1s57vqq32f9ygfa2fls7pdkbsqvp2q";
-    };
-
-    patches = [
-      # This patch enables building glibc-2.2.5 using TCC and GNU Make 4.x and Mes C Library.
-      #   * Makefile: Do not assemble from stdin, use file indirection.
-      #   * Makefile: Add new target: install-lib-all.
-      #   * Makefile: Avoid building stub DOC.
-      #   * [_LIBC_REENTRANT]: Add missing guarding.
-      #   * [MES_BOOTSTRAP]: Disable some GCC extensions.
-      #   * [MES_BOOTSTRAP]: Add missing GCC div/mod defines.
-      (fetchurl {
-        url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/glibc-boot-${version}.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
-        sha256 = "1nyz2dr9g7scqwwygd6jvbl7xxpwh11ryvgdz8aikkkna02q1pm8";
-      })
-      # We want to allow builds in chroots that lack /bin/sh.  Thus, system(3)
-      # and popen(3) need to be tweaked to use the right shell.  For the bootstrap
-      # glibc, we just use whatever `sh' can be found in $PATH.  The final glibc
-      # instead uses the hard-coded absolute file name of `bash'.
-      (fetchurl {
-        url = "https://git.savannah.gnu.org/cgit/guix.git/plain/gnu/packages/patches/glibc-bootstrap-system-${version}.patch?id=50249cab3a98839ade2433456fe618acc6f804a5";
-        sha256 = "1l67w9rysrlsg2i0r210qxxn37h2969ba9lx7pp3ywlnikvi98m8";
-      })
-    ];
-
-    configureFlags = [
-      "--disable-sanity-checks"
-      "--enable-static-nss"
-      "--without-__thread"
-      "--without-cvs"
-      "--without-gd"
-      "--without-tls"
-    ];
-
-    gcc = gcc2-mes;
-    binutils = binutils-mes;
-    CC = "gcc -D MES_BOOTSTRAP=1 -D BOOTSTRAP_GLIBC=1 -L $(pwd)";
-    CPP = "gcc -E -D MES_BOOTSTRAP=1 -D BOOTSTRAP_GLIBC=1";
-  };
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
new file mode 100644
index 000000000000..504095732e8c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnumake/musl.nix
@@ -0,0 +1,82 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumakeBoot
+, gnupatch
+, gnused
+, gnugrep
+, gawk
+, gnutar
+, gzip
+}:
+let
+  pname = "gnumake-musl";
+  version = "4.4.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/make/make-${version}.tar.gz";
+    hash = "sha256-3Rb7HWe/q3mnL16DkHNcSePo5wtJRaFasfgd23hlj7M=";
+  };
+
+  patches = [
+    # Replaces /bin/sh with sh, see patch file for reasoning
+    ./0001-No-impure-bin-sh.patch
+    # Purity: don't look for library dependencies (of the form `-lfoo') in /lib
+    # and /usr/lib. It's a stupid feature anyway. Likewise, when searching for
+    # included Makefiles, don't look in /usr/include and friends.
+    ./0002-remove-impure-dirs.patch
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumakeBoot
+    gnupatch
+    gnused
+    gnugrep
+    gawk
+    gnutar
+    gzip
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/make --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "A tool to control the generation of non-source files from sources";
+    homepage = "https://www.gnu.org/software/make";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "make";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd make-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np1 -i ${f}") patches}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config}
+
+  # Build
+  make AR="tcc -ar"
+
+  # Install
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/common.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/common.nix
new file mode 100644
index 000000000000..658f05923ac3
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/common.nix
@@ -0,0 +1,12 @@
+{ lib }:
+
+{
+  meta = with lib; {
+    description = "GNU sed, a batch stream editor";
+    homepage = "https://www.gnu.org/software/sed";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "sed";
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
index b5647b96ee3c..ee566f93c164 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/default.nix
@@ -4,41 +4,34 @@
 , fetchurl
 , bash
 , gnumake
-, mesBootstrap ? false, tinycc ? null
-, gcc ? null, glibc ? null, binutils ? null, gnused ? null, linux-headers, gnugrep
+, tinycc
+, gnused
+, gnugrep
+, gnutar
+, gzip
 }:
-assert mesBootstrap -> tinycc != null;
-assert !mesBootstrap -> gcc != null && glibc != null && binutils != null && gnused != null;
+
 let
-  pname = "gnused" + lib.optionalString mesBootstrap "-mes";
-  # last version that can be compiled with mes-libc
-  version = "4.0.9";
+  inherit (import ./common.nix { inherit lib; }) meta;
+  pname = "gnused";
+  # last version that can be bootstrapped with our slightly buggy gnused-mes
+  version = "4.2";
 
   src = fetchurl {
     url = "mirror://gnu/sed/sed-${version}.tar.gz";
-    sha256 = "0006gk1dw2582xsvgx6y6rzs9zw8b36rhafjwm288zqqji3qfrf3";
-  };
-
-  # Thanks to the live-bootstrap project!
-  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/sed-4.0.9/sed-4.0.9.kaem
-  makefile = fetchurl {
-    url = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/sed-4.0.9/mk/main.mk";
-    sha256 = "0w1f5ri0g5zla31m6l6xyzbqwdvandqfnzrsw90dd6ak126w3mya";
+    hash = "sha256-20XNY/0BDmUFN9ZdXfznaJplJ0UjZgbl5ceCk3Jn2YM=";
   };
 in
 bash.runCommand "${pname}-${version}" {
-  inherit pname version;
+  inherit pname version meta;
 
   nativeBuildInputs = [
     gnumake
-  ] ++ lib.optionals mesBootstrap [
     tinycc.compiler
-  ] ++ lib.optionals (!mesBootstrap) [
-    gcc
-    glibc
-    binutils
     gnused
     gnugrep
+    gnutar
+    gzip
   ];
 
   passthru.tests.get-version = result:
@@ -46,51 +39,25 @@ bash.runCommand "${pname}-${version}" {
       ${result}/bin/sed --version
       mkdir ''${out}
     '';
-
-  meta = with lib; {
-    description = "GNU sed, a batch stream editor";
-    homepage = "https://www.gnu.org/software/sed";
-    license = licenses.gpl3Plus;
-    maintainers = teams.minimal-bootstrap.members;
-    mainProgram = "sed";
-    platforms = platforms.unix;
-  };
 } (''
   # Unpack
-  ungz --file ${src} --output sed.tar
-  untar --file sed.tar
-  rm sed.tar
+  tar xzf ${src}
   cd sed-${version}
 
-'' + lib.optionalString mesBootstrap ''
-  # Configure
-  cp ${makefile} Makefile
-  catm config.h
-
-  # Build
-  make \
-    CC="tcc -B ${tinycc.libs}/lib" \
-    LIBC=mes
-
-'' + lib.optionalString (!mesBootstrap) ''
   # Configure
-  export CC="gcc -I${glibc}/include -I${linux-headers}/include"
-  export LIBRARY_PATH="${glibc}/lib"
-  export LIBS="-lc -lnss_files -lnss_dns -lresolv"
-  chmod +x configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
   ./configure \
     --build=${buildPlatform.config} \
     --host=${hostPlatform.config} \
     --disable-shared \
     --disable-nls \
     --disable-dependency-tracking \
-    --without-included-regex \
     --prefix=$out
 
   # Build
-  make
+  make AR="tcc -ar"
 
-'' + ''
   # Install
-  make install PREFIX=$out
+  make install
 '')
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/mes.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/mes.nix
new file mode 100644
index 000000000000..031b5b5f0db0
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnused/mes.nix
@@ -0,0 +1,59 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gnumake
+, tinycc
+}:
+
+let
+  inherit (import ./common.nix { inherit lib; }) meta;
+  pname = "gnused-mes";
+  # last version that can be compiled with mes-libc
+  version = "4.0.9";
+
+  src = fetchurl {
+    url = "mirror://gnu/sed/sed-${version}.tar.gz";
+    sha256 = "0006gk1dw2582xsvgx6y6rzs9zw8b36rhafjwm288zqqji3qfrf3";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/sed-4.0.9/sed-4.0.9.kaem
+  makefile = fetchurl {
+    url = "https://github.com/fosslinux/live-bootstrap/raw/1bc4296091c51f53a5598050c8956d16e945b0f5/sysa/sed-4.0.9/mk/main.mk";
+    sha256 = "0w1f5ri0g5zla31m6l6xyzbqwdvandqfnzrsw90dd6ak126w3mya";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    gnumake
+    tinycc.compiler
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/sed --version
+      mkdir ''${out}
+    '';
+} (''
+  # Unpack
+  ungz --file ${src} --output sed.tar
+  untar --file sed.tar
+  rm sed.tar
+  cd sed-${version}
+
+  # Configure
+  cp ${makefile} Makefile
+  catm config.h
+
+  # Build
+  make \
+    CC="tcc -B ${tinycc.libs}/lib" \
+    LIBC=mes
+
+  # Install
+  make install PREFIX=$out
+'')
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/latest.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/latest.nix
new file mode 100644
index 000000000000..717ea9868fd9
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/latest.nix
@@ -0,0 +1,71 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, gcc
+, musl
+, binutils
+, gnumake
+, gnused
+, gnugrep
+, gawk
+, gzip
+, gnutarBoot
+}:
+let
+  pname = "gnutar";
+  version = "1.35";
+
+  src = fetchurl {
+    url = "mirror://gnu/tar/tar-${version}.tar.gz";
+    hash = "sha256-FNVeMgY+qVJuBX+/Nfyr1TN452l4fv95GcN1WwLStX4=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    gcc
+    musl
+    binutils
+    gnumake
+    gnused
+    gnugrep
+    gawk
+    gzip
+    gnutarBoot
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/tar --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the `tar' archiver";
+    homepage = "https://www.gnu.org/software/tar";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "tar";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd tar-${version}
+
+  # Configure
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    CC=musl-gcc
+
+  # Build
+  make -j $NIX_BUILD_CORES
+
+  # Install
+  make -j $NIX_BUILD_CORES install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
index e07561b3e7e5..e07561b3e7e5 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/mes.nix
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
new file mode 100644
index 000000000000..0818a0de39a2
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/gnutar/musl.nix
@@ -0,0 +1,70 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnugrep
+, gnused
+}:
+let
+  # gnutar with musl preserves modify times, allowing make to not try
+  # rebuilding pregenerated files
+  pname = "gnutar-musl";
+  version = "1.12";
+
+  src = fetchurl {
+    url = "mirror://gnu/tar/tar-${version}.tar.gz";
+    hash = "sha256-xsN+iIsTbM76uQPFEUn0t71lnWnUrqISRfYQU6V6pgo=";
+  };
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnused
+    gnugrep
+  ];
+
+  passthru.tests.get-version = result:
+    bash.runCommand "${pname}-get-version-${version}" {} ''
+      ${result}/bin/tar --version
+      mkdir $out
+    '';
+
+  meta = with lib; {
+    description = "GNU implementation of the `tar' archiver";
+    homepage = "https://www.gnu.org/software/tar";
+    license = licenses.gpl3Plus;
+    maintainers = teams.minimal-bootstrap.members;
+    mainProgram = "tar";
+    platforms = platforms.unix;
+  };
+} ''
+  # Unpack
+  ungz --file ${src} --output tar.tar
+  untar --file tar.tar
+  rm tar.tar
+  cd tar-${version}
+
+  # Configure
+  export CC="tcc -B ${tinycc.libs}/lib"
+  export LD=tcc
+  export ac_cv_sizeof_unsigned_long=4
+  export ac_cv_sizeof_long_long=8
+  export ac_cv_header_netdb_h=no
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-nls
+
+  # Build
+  make AR="tcc -ar"
+
+  # Install
+  make install
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix
new file mode 100644
index 000000000000..704ee42edeb1
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/1.1.nix
@@ -0,0 +1,116 @@
+{ lib
+, buildPlatform
+, hostPlatform
+, fetchurl
+, bash
+, tinycc
+, gnumake
+, gnupatch
+, gnused
+, gnugrep
+, gnutar
+, gzip
+}:
+
+let
+  inherit (import ./common.nix { inherit lib; }) pname meta;
+  version = "1.1.24";
+
+  src = fetchurl {
+    url = "https://musl.libc.org/releases/musl-${version}.tar.gz";
+    hash = "sha256-E3DJqBKyzyp9koAlEMygBYzDfmanvt1wBR8KNAFQIqM=";
+  };
+
+  # Thanks to the live-bootstrap project!
+  # See https://github.com/fosslinux/live-bootstrap/blob/d98f97e21413efc32c770d0356f1feda66025686/sysa/musl-1.1.24/musl-1.1.24.sh
+  liveBootstrap = "https://github.com/fosslinux/live-bootstrap/raw/d98f97e21413efc32c770d0356f1feda66025686/sysa/musl-1.1.24";
+  patches = [
+    (fetchurl {
+      url = "${liveBootstrap}/patches/avoid_set_thread_area.patch";
+      hash = "sha256-TsbBZXk4/KMZG9EKi7cF+sullVXrxlizLNH0UHGXsPs=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/avoid_sys_clone.patch";
+      hash = "sha256-/ZmH64J57MmbxdfQ4RNjamAiBdkImMTlHsHdgV4gMj4=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/fenv.patch";
+      hash = "sha256-vMVGjoN4deAJW5gsSqA207SJqAbvhrnOsGK49DdEiTI=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/makefile.patch";
+      hash = "sha256-03iYBAUnsrEdLIIhhhq5mM6BGnPn2EfUmIHu51opxbw=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/musl_weak_symbols.patch";
+      hash = "sha256-/d9a2eUkpe9uyi1ye6T4CiYc9MR3FZ9na0Gb90+g4v0=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/set_thread_area.patch";
+      hash = "sha256-RIZYqbbRSx4X/0iFUhriwwBRmoXVR295GNBUjf2UrM0=";
+    })
+    (fetchurl {
+      url = "${liveBootstrap}/patches/sigsetjmp.patch";
+      hash = "sha256-wd2Aev1zPJXy3q933aiup5p1IMKzVJBquAyl3gbK4PU=";
+    })
+    # FIXME: this patch causes the build to fail
+    # (fetchurl {
+    #   url = "${liveBootstrap}/patches/stdio_flush_on_exit.patch";
+    #   hash = "sha256-/z5ze3h3QTysay8nRvyvwPv3pmTcKptdkBIaMCoeLDg=";
+    # })
+    # HACK: always flush stdio immediately
+    ./always-flush.patch
+    (fetchurl {
+      url = "${liveBootstrap}/patches/va_list.patch";
+      hash = "sha256-UmcMIl+YCi3wIeVvjbsCyqFlkyYsM4ECNwTfXP+s7vg=";
+    })
+  ];
+in
+bash.runCommand "${pname}-${version}" {
+  inherit pname version meta;
+
+  nativeBuildInputs = [
+    tinycc.compiler
+    gnumake
+    gnupatch
+    gnused
+    gnugrep
+    gnutar
+    gzip
+  ];
+} ''
+  # Unpack
+  tar xzf ${src}
+  cd musl-${version}
+
+  # Patch
+  ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+  # tcc does not support complex types
+  rm -rf src/complex
+  # Configure fails without this
+  mkdir -p /dev
+  # https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a3-intermediate-musl.nix
+  sed -i 's|/bin/sh|${bash}/bin/bash|' \
+    tools/*.sh
+  chmod 755 tools/*.sh
+  # patch popen/system to search in PATH instead of hardcoding /bin/sh
+  sed -i 's|posix_spawn(&pid, "/bin/sh",|posix_spawnp(\&pid, "sh",|' \
+    src/stdio/popen.c src/process/system.c
+  sed -i 's|execl("/bin/sh", "sh", "-c",|execlp("sh", "-c",|'\
+    src/misc/wordexp.c
+
+  # Configure
+  bash ./configure \
+    --prefix=$out \
+    --build=${buildPlatform.config} \
+    --host=${hostPlatform.config} \
+    --disable-shared \
+    CC=tcc
+
+  # Build
+  make AR="tcc -ar" RANLIB=true CFLAGS="-DSYSCALL_NO_TLS"
+
+  # Install
+  make install
+  cp ${tinycc.libs}/lib/libtcc1.a $out/lib
+''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/always-flush.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/always-flush.patch
new file mode 100644
index 000000000000..cdeddf962d9d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/always-flush.patch
@@ -0,0 +1,12 @@
+diff --git src/env/__libc_start_main.c src/env/__libc_start_main.c
+index 8fbe526..9476c22 100644
+--- src/env/__libc_start_main.c
++++ src/env/__libc_start_main.c
+@@ -91,6 +91,7 @@ static int libc_start_main_stage2(int (*main)(int,char **,char **), int argc, ch
+ 	__libc_start_init();
+ 
+ 	/* Pass control to the application */
++	setbuf(stdout, NULL);
+ 	exit(main(argc, argv, envp));
+ 	return 0;
+ }
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
new file mode 100644
index 000000000000..52db5f947425
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/common.nix
@@ -0,0 +1,13 @@
+{ lib }:
+
+{
+  pname = "musl";
+
+  meta = with lib; {
+    description = "An efficient, small, quality libc implementation";
+    homepage = "https://musl.libc.org";
+    license = licenses.mit;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = platforms.unix;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix
index c252d60328e9..437ef342f6ae 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/musl/default.nix
@@ -8,12 +8,11 @@
 , gnumake
 , gnugrep
 , gnused
-, gawk
 , gnutar
 , gzip
 }:
 let
-  pname = "musl";
+  inherit (import ./common.nix { inherit lib; }) pname meta;
   version = "1.2.4";
 
   src = fetchurl {
@@ -22,7 +21,7 @@ let
   };
 in
 bash.runCommand "${pname}-${version}" {
-  inherit pname version;
+  inherit pname version meta;
 
   nativeBuildInputs = [
     gcc
@@ -30,14 +29,13 @@ bash.runCommand "${pname}-${version}" {
     gnumake
     gnused
     gnugrep
-    gawk
     gnutar
     gzip
   ];
 
   passthru.tests.hello-world = result:
     bash.runCommand "${pname}-simple-program-${version}" {
-        nativeBuildInputs = [ gcc binutils ];
+        nativeBuildInputs = [ gcc binutils result ];
       } ''
         cat <<EOF >> test.c
         #include <stdio.h>
@@ -46,18 +44,10 @@ bash.runCommand "${pname}-${version}" {
           return 0;
         }
         EOF
-        gcc -static -B${result}/lib -I${result}/include -o test test.c
+        musl-gcc -o test test.c
         ./test
         mkdir $out
       '';
-
-  meta = with lib; {
-    description = "An efficient, small, quality libc implementation";
-    homepage = "https://musl.libc.org";
-    license = licenses.mit;
-    maintainers = teams.minimal-bootstrap.members;
-    platforms = platforms.unix;
-  };
 } ''
   # Unpack
   tar xzf ${src}
@@ -77,11 +67,15 @@ bash.runCommand "${pname}-${version}" {
   bash ./configure \
     --prefix=$out \
     --build=${buildPlatform.config} \
-    --host=${hostPlatform.config}
+    --host=${hostPlatform.config} \
+    --syslibdir=$out/lib \
+    --enable-wrapper
 
   # Build
-  make
+  make -j $NIX_BUILD_CORES
 
   # Install
-  make install
+  make -j $NIX_BUILD_CORES install
+  sed -i 's|/bin/sh|${bash}/bin/bash|' $out/bin/*
+  ln -s ../lib/libc.so $out/bin/ldd
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
index 203b480326e9..a0663c9dbe4f 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/bootstrap-sources.nix
@@ -7,7 +7,7 @@ rec {
   version = "unstable-2023-05-02";
   rev = "3189b5f325b7ef8b88e3edec7c1cde4fce73c76c";
   outputHashAlgo = "sha256";
-  outputHash = "sha256-FpMp7z+B3cR3LkQ+PooH/b1/NlxH8NHVJNWifaPWt4U=";
+  outputHash = "sha256-7Y9+csTwZIQp0WGbagX+Q4f2zavN7AUk1TSBp/H5Xks=";
 
   /*
   Since `make-minimal-bootstrap-sources` requires nixpkgs and nix it
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
index 996f2f33ea35..9808e25711c1 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/hex0.nix
@@ -9,8 +9,9 @@
 
 let
   hash = {
-    "x86"   = "sha256-QU3RPGy51W7M2xnfFY1IqruKzusrSLU+L190ztN6JW8=";
-    "AMD64" = "sha256-RCgK9oZRDQUiWLVkcIBSR2HeoB+Bh0czthrpjFEkCaY=";
+    "AArch64" = "sha256-XTPsoKeI6wTZAF0UwEJPzuHelWOJe//wXg4HYO0dEJo=";
+    "AMD64"   = "sha256-RCgK9oZRDQUiWLVkcIBSR2HeoB+Bh0czthrpjFEkCaY=";
+    "x86"     = "sha256-QU3RPGy51W7M2xnfFY1IqruKzusrSLU+L190ztN6JW8=";
   }.${stage0Arch} or (throw "Unsupported system: ${hostPlatform.system}");
 
   # Pinned from https://github.com/oriansj/stage0-posix/commit/3189b5f325b7ef8b88e3edec7c1cde4fce73c76c
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
index 2675d055aec6..381902cd2c12 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/make-bootstrap-sources.nix
@@ -13,6 +13,7 @@
 
 { lib
 , fetchFromGitHub
+, fetchpatch
 }:
 
 let
@@ -37,6 +38,13 @@ fetchFromGitHub {
       $out/M2-Planet/M2libc \
       $out/mescc-tools/M2libc \
       $out/mescc-tools-extra/M2libc
+
+    # aarch64: syscall: mkdir -> mkdirat
+    # https://github.com/oriansj/M2libc/pull/17
+    patch -Np1 -d $out/M2libc -i ${(fetchpatch {
+      url = "https://github.com/oriansj/M2libc/commit/ff7c3023b3ab6cfcffc5364620b25f8d0279e96b.patch";
+      hash = "sha256-QAKddv4TixIQHpFa9SVu9fAkeKbzhQaxjaWzW2yJy7A=";
+    })}
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix
index 65f0fb4c2ff1..2114ffc707b1 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/mescc-tools-boot.nix
@@ -83,7 +83,11 @@ rec {
   # Phase-2b Build catm from hex2 #
   #################################
 
-  catm = run "catm" hex2-0 ["${src}/${stage0Arch}/catm_${stage0Arch}.hex2" out];
+  catm =
+    if hostPlatform.isAarch64 then
+      run "catm" hex1 ["${src}/${stage0Arch}/catm_${stage0Arch}.hex1" out]
+    else
+      run "catm" hex2-0 ["${src}/${stage0Arch}/catm_${stage0Arch}.hex2" out];
 
   # catm removes the need for cat or shell support for redirection by providing
   # equivalent functionality via catm output_file input1 input2 ... inputN
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix
index c68f7630f3db..53147df33444 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/stage0-posix/platforms.nix
@@ -6,14 +6,16 @@
 rec {
   # meta.platforms
   platforms = [
+    "aarch64-linux"
     "i686-linux"
     "x86_64-linux"
   ];
 
   # system arch as used within the stage0 project
   stage0Arch = {
-    "i686-linux"   = "x86";
-    "x86_64-linux" = "AMD64";
+    "aarch64-linux" = "AArch64";
+    "i686-linux"    = "x86";
+    "x86_64-linux"  = "AMD64";
   }.${hostPlatform.system} or (throw "Unsupported system: ${hostPlatform.system}");
 
   # lower-case form is widely used by m2libc
@@ -23,7 +25,8 @@ rec {
   m2libcOS = if hostPlatform.isLinux then "linux" else throw "Unsupported system: ${hostPlatform.system}";
 
   baseAddress = {
-    "i686-linux"   = "0x08048000";
-    "x86_64-linux" = "0x00600000";
+    "aarch64-linux" = "0x00600000";
+    "i686-linux"    = "0x08048000";
+    "x86_64-linux"  = "0x00600000";
   }.${hostPlatform.system} or (throw "Unsupported system: ${hostPlatform.system}");
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-duplicate-symbols.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-duplicate-symbols.patch
new file mode 100644
index 000000000000..0aec8b465bf2
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-duplicate-symbols.patch
@@ -0,0 +1,13 @@
+--- tccelf.c
++++ tccelf.c
+@@ -710,8 +710,9 @@ ST_FUNC int set_elf_sym(Section *s, addr_t value, unsigned long size,
+ #if 0
+                 printf("new_bind=%x new_shndx=%x new_vis=%x old_bind=%x old_shndx=%x old_vis=%x\n",
+                        sym_bind, shndx, new_vis, esym_bind, esym->st_shndx, esym_vis);
+-#endif
+                 tcc_error_noabort("'%s' defined twice", name);
++#endif
++                goto do_patch;
+             }
+         } else {
+             esym->st_other = other;
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-static-inside-array.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-static-inside-array.patch
new file mode 100644
index 000000000000..8dc2fe3fcfb4
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/ignore-static-inside-array.patch
@@ -0,0 +1,21 @@
+--- tccgen.c
++++ tccgen.c
+@@ -4941,7 +4941,7 @@ static int post_type(CType *type, AttributeDef *ad, int storage, int td)
+         next();
+         n = -1;
+         t1 = 0;
+-        if (td & TYPE_PARAM) while (1) {
++        while (1) {
+ 	    /* XXX The optional type-quals and static should only be accepted
+ 	       in parameter decls.  The '*' as well, and then even only
+ 	       in prototypes (not function defs).  */
+@@ -4972,7 +4972,8 @@ static int post_type(CType *type, AttributeDef *ad, int storage, int td)
+             }
+             break;
+ 
+-	} else if (tok != ']') {
++	}
++    if (tok != ']') {
+             if (!local_stack || (storage & VT_STATIC))
+                 vpushi(expr_const());
+             else {
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix
new file mode 100644
index 000000000000..4d26faac20b1
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/musl.nix
@@ -0,0 +1,155 @@
+{ lib
+, fetchurl
+, callPackage
+, bash
+, tinycc-bootstrappable
+, musl
+, gnupatch
+, gnutar
+, gzip
+}:
+let
+  pname = "tinycc-musl";
+  # next commit introduces use of realpath (unsupported in mes-libc)
+  version = "unstable-2023-07-10";
+  rev = "fd6d2180c5c801bb0b4c5dde27d61503059fc97d";
+
+  src = fetchurl {
+    url = "https://repo.or.cz/tinycc.git/snapshot/${rev}.tar.gz";
+    hash = "sha256-R81SNbEmh4s9FNQxCWZwUiMCYRkkwOHAdRf0aMnnRiA=";
+  };
+
+  patches = [
+    ./ignore-duplicate-symbols.patch
+    ./ignore-static-inside-array.patch
+    ./static-link.patch
+  ];
+
+  meta = with lib; {
+    description = "Small, fast, and embeddable C compiler and interpreter";
+    homepage = "https://repo.or.cz/w/tinycc.git";
+    license = licenses.lgpl21Only;
+    maintainers = teams.minimal-bootstrap.members;
+    platforms = [ "i686-linux" ];
+  };
+
+  tinycc-musl = bash.runCommand "${pname}-${version}" {
+    inherit pname version meta;
+
+    nativeBuildInputs = [
+      tinycc-bootstrappable.compiler
+      gnupatch
+      gnutar
+      gzip
+    ];
+  } ''
+    # Unpack
+    tar xzf ${src}
+    cd tinycc-${builtins.substring 0 7 rev}
+
+    # Patch
+    ${lib.concatMapStringsSep "\n" (f: "patch -Np0 -i ${f}") patches}
+
+    # Configure
+    touch config.h
+
+    # Build
+    # We first have to recompile using tcc-0.9.26 as tcc-0.9.27 is not self-hosting,
+    # but when linked with musl it is.
+    ln -s ${musl}/lib/libtcc1.a ./libtcc1.a
+
+    tcc \
+      -B ${tinycc-bootstrappable.libs}/lib \
+      -DC2STR \
+      -o c2str \
+      conftest.c
+    ./c2str include/tccdefs.h tccdefs_.h
+
+    tcc -v \
+      -static \
+      -o tcc-musl \
+      -D TCC_TARGET_I386=1 \
+      -D CONFIG_TCCDIR=\"\" \
+      -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+      -D CONFIG_TCC_ELFINTERP=\"/musl/loader\" \
+      -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+      -D CONFIG_TCC_SYSINCLUDEPATHS=\"${musl}/include\" \
+      -D TCC_LIBGCC=\"libc.a\" \
+      -D TCC_LIBTCC1=\"libtcc1.a\" \
+      -D CONFIG_TCC_STATIC=1 \
+      -D CONFIG_USE_LIBGCC=1 \
+      -D TCC_VERSION=\"0.9.27\" \
+      -D ONE_SOURCE=1 \
+      -D TCC_MUSL=1 \
+      -D CONFIG_TCC_PREDEFS=1 \
+      -D CONFIG_TCC_SEMLOCK=0 \
+      -B . \
+      -B ${tinycc-bootstrappable.libs}/lib \
+      tcc.c
+    # libtcc1.a
+    rm -f libtcc1.a
+    tcc -c -D HAVE_CONFIG_H=1 lib/libtcc1.c
+    tcc -ar cr libtcc1.a libtcc1.o
+
+    # Rebuild tcc-musl with itself
+    ./tcc-musl \
+      -v \
+      -static \
+      -o tcc-musl \
+      -D TCC_TARGET_I386=1 \
+      -D CONFIG_TCCDIR=\"\" \
+      -D CONFIG_TCC_CRTPREFIX=\"{B}\" \
+      -D CONFIG_TCC_ELFINTERP=\"/musl/loader\" \
+      -D CONFIG_TCC_LIBPATHS=\"{B}\" \
+      -D CONFIG_TCC_SYSINCLUDEPATHS=\"${musl}/include\" \
+      -D TCC_LIBGCC=\"libc.a\" \
+      -D TCC_LIBTCC1=\"libtcc1.a\" \
+      -D CONFIG_TCC_STATIC=1 \
+      -D CONFIG_USE_LIBGCC=1 \
+      -D TCC_VERSION=\"0.9.27\" \
+      -D ONE_SOURCE=1 \
+      -D TCC_MUSL=1 \
+      -D CONFIG_TCC_PREDEFS=1 \
+      -D CONFIG_TCC_SEMLOCK=0 \
+      -B . \
+      -B ${musl}/lib \
+      tcc.c
+    # libtcc1.a
+    rm -f libtcc1.a
+    ./tcc-musl -c -D HAVE_CONFIG_H=1 lib/libtcc1.c
+    ./tcc-musl -c -D HAVE_CONFIG_H=1 lib/alloca.S
+    ./tcc-musl -ar cr libtcc1.a libtcc1.o alloca.o
+
+    # Install
+    install -D tcc-musl $out/bin/tcc
+    install -Dm444 libtcc1.a $out/lib/libtcc1.a
+  '';
+in
+{
+  compiler = bash.runCommand "${pname}-${version}-compiler" {
+    inherit pname version meta;
+    passthru.tests.hello-world = result:
+      bash.runCommand "${pname}-simple-program-${version}" {} ''
+        cat <<EOF >> test.c
+        #include <stdio.h>
+        int main() {
+          printf("Hello World!\n");
+          return 0;
+        }
+        EOF
+        ${result}/bin/tcc -v -static -B${musl}/lib -o test test.c
+        ./test
+        mkdir $out
+      '';
+    passthru.tinycc-musl = tinycc-musl;
+  } "install -D ${tinycc-musl}/bin/tcc $out/bin/tcc";
+
+  libs = bash.runCommand "${pname}-${version}-libs" {
+    inherit pname version meta;
+  } ''
+    mkdir $out
+    cp -r ${musl}/* $out
+    chmod +w $out/lib/libtcc1.a
+    cp ${tinycc-musl}/lib/libtcc1.a $out/lib/libtcc1.a
+  '';
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/static-link.patch b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/static-link.patch
new file mode 100644
index 000000000000..671a3b37f98d
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/tinycc/static-link.patch
@@ -0,0 +1,10 @@
+--- libtcc.c
++++ libtcc.c
+@@ -793,6 +793,7 @@ LIBTCCAPI TCCState *tcc_new(void)
+ 
+     s->gnu_ext = 1;
+     s->tcc_ext = 1;
++    s->static_link = 1;
+     s->nocommon = 1;
+     s->dollars_in_identifiers = 1; /*on by default like in gcc/clang*/
+     s->cversion = 199901; /* default unless -std=c11 is supplied */
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
index 92cb240c5f16..8dcccbacaca8 100644
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/default.nix
@@ -5,18 +5,19 @@
 , bash
 , tinycc
 , gnumake
+, gnused
 , gnugrep
 , gawk
-, sed
+, gnutar
+, gzip
 }:
 let
   pname = "xz";
-  # >=5.2 uses poll.h, unsupported by meslibc
-  version = "5.0.8";
+  version = "5.4.3";
 
   src = fetchurl {
-    url = "https://tukaani.org/xz/xz-${version}.tar.bz2";
-    sha256 = "1nkb68dyrf16xwyqichcy1vhgbfg20dxz459rcsdx85h1gczk1i2";
+    url = "https://tukaani.org/xz/xz-${version}.tar.gz";
+    hash = "sha256-HDguC8Lk4K9YOYqQPdYv/35RAXHS3keh6+BtFSjpt+k=";
   };
 in
 bash.runCommand "${pname}-${version}" {
@@ -25,9 +26,11 @@ bash.runCommand "${pname}-${version}" {
   nativeBuildInputs = [
     tinycc.compiler
     gnumake
+    gnused
     gnugrep
     gawk
-    sed
+    gnutar
+    gzip
   ];
 
   passthru.tests.get-version = result:
@@ -45,34 +48,23 @@ bash.runCommand "${pname}-${version}" {
   };
 } ''
   # Unpack
-  unbz2 --file ${src} --output xz.tar
-  untar --file xz.tar
-  rm xz.tar
+  tar xzf ${src}
   cd xz-${version}
 
   # Configure
-  export CC="tcc -B ${tinycc.libs}/lib -include${./stubs.h}"
-  export CPP="tcc -E"
-  export LD=tcc
+  export CC="tcc -B ${tinycc.libs}/lib"
   export AR="tcc -ar"
-  export SED=sed
-  export ac_cv_prog_cc_c99=
-  export ac_cv_header_fcntl_h=yes
-  export ac_cv_header_limits_h=yes
-  export ac_cv_header_sys_time_h=yes
-  export ac_cv_func_utime=no
+  export LD=tcc
   bash ./configure \
     --prefix=$out \
     --build=${buildPlatform.config} \
     --host=${hostPlatform.config} \
     --disable-shared \
-    --disable-nls \
-    --disable-threads \
     --disable-assembler
 
   # Build
-  make all
+  make -j $NIX_BUILD_CORES
 
   # Install
-  make install
+  make -j $NIX_BUILD_CORES install
 ''
diff --git a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/stubs.h b/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/stubs.h
deleted file mode 100644
index cbf6f823299e..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/minimal-bootstrap/xz/stubs.h
+++ /dev/null
@@ -1,25 +0,0 @@
-#define sig_atomic_t int
-
-#define SSIZE_MAX LONG_MAX
-
-#define O_NOCTTY 0400
-#define O_NONBLOCK 04000
-
-#define S_ISVTX 01000
-#define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
-
-int fchmod (int fd, int mode)
-{
-  return 0;
-}
-
-int fchown (int fd, int owner, int group)
-{
-  return 0;
-}
-
-#include <signal.h>
-int sigfillset (sigset_t * set)
-{
-  return 0;
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
index 58ceb7404b96..0fea46da56d2 100644
--- a/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mmc-utils/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "mmc-utils";
-  version = "unstable-2023-08-07";
+  version = "unstable-2023-10-10";
 
   src = fetchzip rec {
     url = "https://git.kernel.org/pub/scm/utils/mmc/mmc-utils.git/snapshot/mmc-utils-${passthru.rev}.tar.gz";
-    passthru.rev = "613495ecaca97a19fa7f8f3ea23306472b36453c";
-    sha256 = "zOjm/YDxqU6bu6GMyQTuzuZbrCfaU4FBodRWLb8GTdE=";
+    passthru.rev = "b5ca140312d279ad2f22068fd72a6230eea13436";
+    sha256 = "QU4r8eajrrhT6u6WHEf1xtB1iyecBeHxu4vS+QcwAgM=";
   };
 
   makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "prefix=$(out)" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/net-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/net-tools/default.nix
index 9630b5c0c7a1..bedeaadc294e 100644
--- a/nixpkgs/pkgs/os-specific/linux/net-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/net-tools/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "2.10";
 
   src = fetchurl {
-    url = "mirror://gentoo/distfiles/${pname}-${version}.tar.xz";
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.xz";
     sha256 = "sha256-smJDWlJB6Jv6UcPKvVEzdTlS96e3uT8y4Iy52W9YDWk=";
   };
 
diff --git a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8 b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
index b0ff5b0a672f..d947361b3bc5 100644
--- a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
+++ b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
@@ -421,6 +421,14 @@ nixpkgs=./my-nixpkgs
 Additional options to be passed to
 .Ic ssh
 on the command line.
+.Ed
+.
+.It Ev NIXOS_SWITCH_USE_DIRTY_ENV
+Expose the the current environment variables to post activation scripts. Will
+skip usage of
+.Ic systemd-run
+during system activation. Possibly dangerous, specially in remote environments
+(e.g.: via SSH). Will be removed in the future.
 .El
 .
 .
diff --git a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 2f89642845e2..68e00690652e 100755
--- a/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/nixpkgs/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -653,18 +653,48 @@ fi
 # If we're not just building, then make the new configuration the boot
 # default and/or activate it now.
 if [[ "$action" = switch || "$action" = boot || "$action" = test || "$action" = dry-activate ]]; then
+    # Using systemd-run here to protect against PTY failures/network
+    # disconnections during rebuild.
+    # See: https://github.com/NixOS/nixpkgs/issues/39118
+    cmd=(
+        "systemd-run"
+        "-E" "LOCALE_ARCHIVE" # Will be set to new value early in switch-to-configuration script, but interpreter starts out with old value
+        "--collect"
+        "--no-ask-password"
+        "--pty"
+        "--quiet"
+        "--same-dir"
+        "--service-type=exec"
+        "--unit=nixos-rebuild-switch-to-configuration"
+        "--wait"
+    )
+    # Check if we have a working systemd-run. In chroot environments we may have
+    # a non-working systemd, so we fallback to not using systemd-run.
+    # You may also want to explicitly set NIXOS_SWITCH_USE_DIRTY_ENV environment
+    # variable, since systemd-run runs inside an isolated environment and
+    # this may break some post-switch scripts. However keep in mind that this
+    # may be dangerous in remote access (e.g. SSH).
+    if [[ -n "$NIXOS_SWITCH_USE_DIRTY_ENV" ]]; then
+        log "warning: skipping systemd-run since NIXOS_SWITCH_USE_DIRTY_ENV is set. This environment variable will be ignored in the future"
+        cmd=()
+    elif ! targetHostCmd "${cmd[@]}" true &>/dev/null; then
+        logVerbose "Skipping systemd-run to switch configuration since it is not working in target host."
+        cmd=("env" "-i" "LOCALE_ARCHIVE=$LOCALE_ARCHIVE")
+    else
+        logVerbose "Using systemd-run to switch configuration."
+    fi
     if [[ -z "$specialisation" ]]; then
-        cmd="$pathToConfig/bin/switch-to-configuration"
+        cmd+=("$pathToConfig/bin/switch-to-configuration")
     else
-        cmd="$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration"
+        cmd+=("$pathToConfig/specialisation/$specialisation/bin/switch-to-configuration")
 
-        if [[ ! -f "$cmd" ]]; then
+        if [[ ! -f "${cmd[-1]}" ]]; then
             log "error: specialisation not found: $specialisation"
             exit 1
         fi
     fi
 
-    if ! targetHostCmd "$cmd" "$action"; then
+    if ! targetHostCmd "${cmd[@]}" "$action"; then
         log "warning: error(s) occurred while switching to the new configuration"
         exit 1
     fi
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
index 69e4ae8729d8..c116c6053007 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -54,22 +54,22 @@ rec {
   });
 
   beta = selectHighestVersion latest (generic {
-    version = "535.43.02";
-    sha256_64bit = "sha256-4KTdk4kGDmBGyHntMIzWRivUpEpzmra+p7RBsTL8mYM=";
-    sha256_aarch64 = "sha256-0blD8R+xpOVlitWefIbtw1d3KAnmWHBy7hkxGZHBrE4=";
-    openSha256 = "sha256-W1fwbbEEM7Z/S3J0djxGTtVTewbSALqX1G1OSpdajCM=";
-    settingsSha256 = "sha256-j0sSEbtF2fapv4GSthVTkmJga+ycmrGc1OnGpV6jEkc=";
-    persistencedSha256 = "sha256-M0ovNaJo8SZwLW4CQz9accNK79Z5JtTJ9kKwOzicRZ4=";
+    version = "545.23.06";
+    sha256_64bit = "sha256-QTnTKAGfcvKvKHik0BgAemV3PrRqRlM3B9jjZeupCC8=";
+    sha256_aarch64 = "sha256-qkVP6AiXNoRTqgqPvs/AfErEq8BTQw25rtJ6GS06JTM=";
+    openSha256 = "sha256-m7D5LZdhFCZYAIbhrgZ0pN2z19LsU3I3Q7qsKX7Z6mM=";
+    settingsSha256 = "sha256-+X6gDeU8Qlvprb05aB2quM55y0zEcBXtb65e3Rq9gKg=";
+    persistencedSha256 = "sha256-RQJAIwPqOUI5FB3uf0/Y4K/iwFfoLpU1/+BOK/KF5VA=";
   });
 
   # Vulkan developer beta driver
   # See here for more information: https://developer.nvidia.com/vulkan-driver
   vulkan_beta = generic rec {
-    version = "535.43.09";
+    version = "535.43.13";
     persistencedVersion = "535.98";
     settingsVersion = "535.98";
-    sha256_64bit = "sha256-7QDp+VDgxH7RGW40kbQp4F/luh0DCYb4BS0gU/6wn+c=";
-    openSha256 = "sha256-7MOwKQCTaOo1//8OlSaNdpKeDXejZvmKFFeqhFrhAk8=";
+    sha256_64bit = "sha256-qrzoZWoUSTh4UQ8e/amOhwPrspZOI1kwdPHLn4ySc/Q=";
+    openSha256 = "sha256-aVUdHNoFaUY7MiwEFxwsj8XS1+onckT3V7RiVMEkQP8=";
     settingsSha256 = "sha256-jCRfeB1w6/dA27gaz6t5/Qo7On0zbAPIi74LYLel34s=";
     persistencedSha256 = "sha256-WviDU6B50YG8dO64CGvU3xK8WFUX8nvvVYm/fuGyroM=";
     url = "https://developer.nvidia.com/downloads/vulkan-beta-${lib.concatStrings (lib.splitString "." version)}-linux";
diff --git a/nixpkgs/pkgs/os-specific/linux/oxtools/default.nix b/nixpkgs/pkgs/os-specific/linux/oxtools/default.nix
index 02afb28e66e0..c16e12ab5e14 100644
--- a/nixpkgs/pkgs/os-specific/linux/oxtools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/oxtools/default.nix
@@ -2,19 +2,19 @@
 , glibc, python3
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "0xtools";
-  version = "1.1.3";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "tanelpoder";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-pe64st3yhVfZi8/sTEfH1cNjx7JpqxDmxMmodpXnqaU=";
+    repo = "0xtools";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-h0/HIbwb1CvFUh/NpozDUCjYGCH647lC7JhbpDCvaLk=";
   };
 
   postPatch = ''
-    substituteInPlace lib/0xtools/proc.py \
+    substituteInPlace lib/0xtools/psnproc.py \
       --replace /usr/include/asm/unistd_64.h ${glibc.dev}/include/asm/unistd_64.h
   '';
 
@@ -33,4 +33,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ astro ];
     platforms = [ "x86_64-linux" ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix
index 1d27cf80e4da..dcecfa4c13b8 100644
--- a/nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pax-utils/default.nix
@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchurl
+, fetchgit
 , buildPackages
 , docbook_xml_dtd_44
 , docbook_xsl
@@ -18,9 +18,10 @@ stdenv.mkDerivation rec {
   pname = "pax-utils";
   version = "1.3.7";
 
-  src = fetchurl {
-    url = "mirror://gentoo/distfiles/${pname}-${version}.tar.xz";
-    sha256 = "sha256-EINi0pZo0lz3sMrcY7FaTBz8DbxxrcFRszxf597Ok5o=";
+  src = fetchgit {
+    url = "https://anongit.gentoo.org/git/proj/pax-utils.git";
+    rev = "v${version}";
+    hash = "sha256-WyNng+UtfRz1+Eu4gwXLxUvBAg+m3mdrc8GdEPYRKVE=";
   };
 
   strictDeps = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/pipework/default.nix b/nixpkgs/pkgs/os-specific/linux/pipework/default.nix
index ea274377ced9..3591303a8d0c 100644
--- a/nixpkgs/pkgs/os-specific/linux/pipework/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/pipework/default.nix
@@ -22,6 +22,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/jpetazzo/pipework";
     license = licenses.asl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/projecteur/default.nix b/nixpkgs/pkgs/os-specific/linux/projecteur/default.nix
index ecb0fe535d35..0477985cc196 100644
--- a/nixpkgs/pkgs/os-specific/linux/projecteur/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/projecteur/default.nix
@@ -1,24 +1,39 @@
-{ lib, mkDerivation, fetchFromGitHub,
-  cmake, pkg-config,
-  qtbase, qtgraphicaleffects, wrapQtAppsHook }:
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, cmake
+, pkg-config
+, qtbase
+, qtgraphicaleffects
+, wrapQtAppsHook
+}:
+
 mkDerivation rec {
   pname = "projecteur";
-  version = "0.9.2";
+  version = "0.10";
 
   src = fetchFromGitHub {
     owner = "jahnf";
     repo = "Projecteur";
     rev = "v${version}";
     fetchSubmodules = false;
-    sha256 = "sha256-kg6oYtJ4H5A6RNATBg+XvMfCb9FlhEBFjfxamGosMQg=";
+    hash = "sha256-F7o93rBjrDTmArTIz8RB/uGBOYE6ny/U7ppk+jEhM5A=";
   };
 
   postPatch = ''
     sed '1i#include <array>' -i src/device.h # gcc12
   '';
 
-  buildInputs = [ qtbase qtgraphicaleffects ];
-  nativeBuildInputs = [ wrapQtAppsHook cmake pkg-config ];
+  buildInputs = [
+    qtbase
+    qtgraphicaleffects
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_PREFIX:PATH=${placeholder "out"}"
@@ -26,11 +41,12 @@ mkDerivation rec {
     "-DCMAKE_INSTALL_UDEVRULESDIR=${placeholder "out"}/lib/udev/rules.d"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Linux/X11 application for the Logitech Spotlight device (and similar devices).";
     homepage = "https://github.com/jahnf/Projecteur";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ benneti ];
+    license = lib.licenses.mit;
+    mainProgram = "projecteur";
+    maintainers = with lib.maintainers; [ benneti drupol ];
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix b/nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix
index 6fc6e0012b31..5b627ea9033b 100644
--- a/nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/qmk-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qmk-udev-rules";
-  version = "0.19.11";
+  version = "0.22.3";
 
   src = fetchFromGitHub {
     owner = "qmk";
     repo = "qmk_firmware";
     rev = version;
-    hash = "sha256-RevCj+tFlleH08VGRwJjKhZdXwU6VlMsSCR9090pgRI=";
+    hash = "sha256-HLQxmBlzTdsOAMqfc4taoMM+V2G5novMsbc1drZlNGg=";
   };
 
   dontBuild = true;
diff --git a/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix b/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
index 3c19db403917..6a429a77c57b 100644
--- a/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/raspberrypi-eeprom/default.nix
@@ -1,5 +1,5 @@
 { stdenvNoCC, lib, fetchFromGitHub, makeWrapper
-, python3, binutils-unwrapped, findutils, kmod, pciutils, libraspberrypi
+, python3, binutils-unwrapped, findutils, gawk, kmod, pciutils, libraspberrypi
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "raspberrypi-eeprom";
@@ -40,6 +40,7 @@ stdenvNoCC.mkDerivation rec {
         --prefix PATH : "${lib.makeBinPath ([
           binutils-unwrapped
           findutils
+          gawk
           kmod
           pciutils
           (placeholder "out")
diff --git a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
index 98ddb7bb57b8..e400e5eba7d7 100644
--- a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
@@ -15,17 +15,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "47.0";
+  version = "48.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-R+qgHDu9GRwT5ic1DCDlYe1Xb4hqi8pgitKq9iBBQNQ=";
+    hash = "sha256-/ltuZ9OiwJJ6CuAd6hqJwo+wETOgZ4UcW50BrjudF+k=";
   };
 
   strictDeps = true;
 
+  outputs = [ "out" "man" "dev" ];
+
   nativeBuildInputs = [
     cmake
     docutils
diff --git a/nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix b/nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix
index 6185bf9912dd..8e3a9b0ceb02 100644
--- a/nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rt-tests/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "rt-tests";
-  version = "2.5";
+  version = "2.6";
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/utils/rt-tests/rt-tests.git/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-LzN3YB3Lb7tjyEplrFaNYtiGwHUUTztZBsMrUndd2cU=";
+    sha256 = "sha256-apRJwRqcyzfmyGCCv5BDN92pKP3Nafa9SkxlZ+Bxrm0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix b/nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix
index d85186301071..806df9f6dd4d 100644
--- a/nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rtl8821cu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rtl8821cu";
-  version = "${kernel.version}-unstable-2023-04-28";
+  version = "${kernel.version}-unstable-2023-09-10";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8821cu-20210916";
-    rev = "e49409f22ceea0d5b5ef431e6170580028b84c9d";
-    hash = "sha256-mElZRr4RkRFiraBM8BxT8yesYgvDaj6xP+9T3P+0Ns4=";
+    rev = "f6d4598290c5e9c8e545130e8a31d130f6d135f4";
+    hash = "sha256-jpMf8K9diJ3mbEkP9Cp+VwairK+pwiEGU/AtUIouCqM=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix b/nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix
index 9204121a8cff..0744ed2896ff 100644
--- a/nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/ryzenadj/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pciutils, cmake }:
 stdenv.mkDerivation rec {
   pname = "ryzenadj";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "FlyGoat";
     repo = "RyzenAdj";
     rev = "v${version}";
-    sha256 = "sha256-n/LHFv14aDLbobeamOgDYBml1DgSGJmfmg/qff78i4c=";
+    sha256 = "sha256-Lqq4LNRmqQyeIJfr/+tYdKMEk+P54VnwZAQZcE0ev8Y=";
   };
 
   nativeBuildInputs = [ pciutils cmake ];
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     description = "Adjust power management settings for Ryzen Mobile Processors.";
     homepage = "https://github.com/FlyGoat/RyzenAdj";
     license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ rhendric ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/sssd/default.nix b/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
index 96a3ace57d2d..01ec8ce96a03 100644
--- a/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sssd/default.nix
@@ -5,21 +5,21 @@
   libuuid, systemd, nspr, check, cmocka, uid_wrapper, p11-kit,
   nss_wrapper, ncurses, Po4a, http-parser, jansson, jose,
   docbook_xsl, docbook_xml_dtd_44,
-  nixosTests,
+  testers, nix-update-script, nixosTests,
   withSudo ? false }:
 
 let
   docbookFiles = "${docbook_xsl}/share/xml/docbook-xsl/catalog.xml:${docbook_xml_dtd_44}/xml/dtd/docbook/catalog.xml";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "sssd";
-  version = "2.9.1";
+  version = "2.9.2";
 
   src = fetchFromGitHub {
     owner = "SSSD";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-OafSo28MN92py33foE8oMkPUmV9WUUOkKWJgm0i7MJU=";
+    repo = "sssd";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-CxkEyx9X14x8x9tSSN9d0TBTPKJB2Ip7HTL98uqO0J4=";
   };
 
   postPatch = ''
@@ -96,14 +96,23 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  passthru.tests = { inherit (nixosTests) sssd sssd-ldap; };
+  passthru = {
+    tests = {
+      inherit (nixosTests) sssd sssd-ldap;
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+        command = "sssd --version";
+      };
+    };
+    updateScript = nix-update-script { };
+  };
 
   meta = with lib; {
     description = "System Security Services Daemon";
     homepage = "https://sssd.io/";
-    changelog = "https://sssd.io/release-notes/sssd-${version}.html";
+    changelog = "https://sssd.io/release-notes/sssd-${finalAttrs.version}.html";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ illustris ];
   };
-}
+})
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch b/nixpkgs/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
new file mode 100644
index 000000000000..dd9af6738c4e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
@@ -0,0 +1,45 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Maximilian Bosch <maximilian@mbosch.me>
+Date: Fri, 1 Sep 2023 09:57:02 +0200
+Subject: [PATCH] systemctl-edit: suggest `systemdctl edit --runtime` on system
+ scope
+
+This is a NixOS-specific change. When trying to modify a unit with
+`systemctl edit` on NixOS, it'll fail with "Read-only file system":
+
+    $ systemctl edit libvirtd
+    Failed to open "/etc/systemd/system/libvirtd.service.d/.#override.conffa9825a0c9a249eb": Read-only file system
+
+This is because `/etc/systemd/system` is a symlink into the store. In
+fact, I'd consider this a feature rather than a bug since this ensures I
+don't introduce state imperatively.
+
+However, people wrongly assume that it's not possible to edit units
+ad-hoc and re-deploy their system for quick&dirty debugging where this
+would be absolutely fine (and doable with `--runtime` which adds a
+transient and non-persistent unit override in `/run`).
+
+To make sure that people learn about it quicker, this patch
+throws an error which suggests using `--runtime` when running
+`systemctl edit` on the system scope.
+
+For the user scope this isn't needed because user-level unit overrides
+are written into `$XDG_CONFIG_HOME/systemd/user`.
+---
+ src/systemctl/systemctl-edit.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
+index e3f25d52d5..81c9c6f6b7 100644
+--- a/src/systemctl/systemctl-edit.c
++++ b/src/systemctl/systemctl-edit.c
+@@ -323,6 +323,9 @@ int verb_edit(int argc, char *argv[], void *userdata) {
+         sd_bus *bus;
+         int r;
+ 
++        if (!arg_runtime && arg_runtime_scope == RUNTIME_SCOPE_SYSTEM)
++                return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "The unit-directory '/etc/systemd/system' is read-only on NixOS, so it's not possible to edit system-units directly. Use 'systemctl edit --runtime' instead.");
++
+         if (!on_tty())
+                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot edit units if not on a tty.");
+ 
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
index a938a98f2417..954977882ee9 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
@@ -88,7 +88,7 @@
 , withAnalyze ? true
 , withApparmor ? true
 , withAudit ? true
-, withBootloader ? true # compiles systemd-boot, assumes EFI is available.
+, withBootloader ? withEfi && !stdenv.hostPlatform.isMusl # compiles systemd-boot, assumes EFI is available.
 , withCompression ? true  # adds bzip2, lz4, xz and zstd
 , withCoredump ? true
 , withCryptsetup ? true
@@ -201,11 +201,12 @@ stdenv.mkDerivation (finalAttrs: {
     ./0016-inherit-systemd-environment-when-calling-generators.patch
     ./0017-core-don-t-taint-on-unmerged-usr.patch
     ./0018-tpm2_context_init-fix-driver-name-checking.patch
+    ./0019-systemctl-edit-suggest-systemdctl-edit-runtime-on-sy.patch
   ] ++ lib.optional stdenv.hostPlatform.isMusl (
     let
       oe-core = fetchzip {
-        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-f34f6ab04b443608497b73668365819343d0c2fe.tar.gz";
-        sha256 = "DFcLPvjQIxGEDADpP232ZRd7cOEKt6B48Ah29nIGTt4=";
+        url = "https://git.openembedded.org/openembedded-core/snapshot/openembedded-core-eb8a86fee9eeae787cc0a58ef2ed087fd48d93eb.tar.gz";
+        sha256 = "tE2KpXLvOknIpEZFdOnNxvBmDvZrra3kvQp9tKxa51c=";
       };
       musl-patches = oe-core + "/meta/recipes-core/systemd/systemd";
     in
@@ -213,7 +214,6 @@ stdenv.mkDerivation (finalAttrs: {
       (musl-patches + "/0001-Adjust-for-musl-headers.patch")
       (musl-patches + "/0005-pass-correct-parameters-to-getdents64.patch")
       (musl-patches + "/0006-test-bus-error-strerror-is-assumed-to-be-GNU-specifi.patch")
-      (musl-patches + "/0007-Add-sys-stat.h-for-S_IFDIR.patch")
       (musl-patches + "/0009-missing_type.h-add-comparison_fn_t.patch")
       (musl-patches + "/0010-add-fallback-parse_printf_format-implementation.patch")
       (musl-patches + "/0011-src-basic-missing.h-check-for-missing-strndupa.patch")
@@ -229,7 +229,8 @@ stdenv.mkDerivation (finalAttrs: {
       (musl-patches + "/0022-Handle-__cpu_mask-usage.patch")
       (musl-patches + "/0023-Handle-missing-gshadow.patch")
       (musl-patches + "/0024-missing_syscall.h-Define-MIPS-ABI-defines-for-musl.patch")
-      (musl-patches + "/0026-src-boot-efi-efi-string.c-define-wchar_t-from-__WCHA.patch")
+      (musl-patches + "/0028-sd-event-Make-malloc_trim-conditional-on-glibc.patch")
+      (musl-patches + "/0029-shared-Do-not-use-malloc_info-on-musl.patch")
     ]
   );
 
@@ -481,7 +482,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dportabled=${lib.boolToString withPortabled}"
     "-Dhwdb=${lib.boolToString withHwdb}"
     "-Dremote=${lib.boolToString withRemote}"
-    "-Dsysusers=false"
     "-Dtimedated=${lib.boolToString withTimedated}"
     "-Dtimesyncd=${lib.boolToString withTimesyncd}"
     "-Duserdb=${lib.boolToString withUserDb}"
@@ -724,7 +724,7 @@ stdenv.mkDerivation (finalAttrs: {
   #   https://github.com/NixOS/nixpkgs/issues/169693
   # The hack is to move EFI file out of lib/ before doStrip
   # run and return it after doStrip run.
-  preFixup = lib.optionalString withEfi ''
+  preFixup = lib.optionalString withBootloader ''
     mv $out/lib/systemd/boot/efi $out/dont-strip-me
   '';
 
@@ -734,7 +734,7 @@ stdenv.mkDerivation (finalAttrs: {
       # This needs to be in LD_LIBRARY_PATH because rpath on a binary is not propagated to libraries using dlopen, in this case `libcryptsetup.so`
       wrapProgram $out/$f --prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib/cryptsetup
     done
-  '' + lib.optionalString withEfi ''
+  '' + lib.optionalString withBootloader ''
     mv $out/dont-strip-me $out/lib/systemd/boot/efi
   '' + lib.optionalString withUkify ''
     # To cross compile a derivation that builds a UKI with ukify, we need to wrap
diff --git a/nixpkgs/pkgs/os-specific/linux/tailor-gui/default.nix b/nixpkgs/pkgs/os-specific/linux/tailor-gui/default.nix
new file mode 100644
index 000000000000..86964ab4d36a
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/tailor-gui/default.nix
@@ -0,0 +1,60 @@
+{ stdenv
+, lib
+, rustPlatform
+, cargo
+, rustc
+, pkg-config
+, desktop-file-utils
+, appstream-glib
+, wrapGAppsHook4
+, meson
+, ninja
+, libadwaita
+, gtk4
+, tuxedo-rs
+}:
+let
+  src = tuxedo-rs.src;
+  sourceRoot = "source/tailor_gui";
+  pname = "tailor_gui";
+  version = tuxedo-rs.version;
+in
+stdenv.mkDerivation {
+
+  inherit src sourceRoot pname version;
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src sourceRoot;
+    name = "${pname}-${version}";
+    hash = "sha256-DUaSLv1V6skWXQ7aqD62uspq+I9KiWmjlwwxykVve5A=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    pkg-config
+    desktop-file-utils
+    appstream-glib
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    cargo
+    rustc
+    meson
+    ninja
+    libadwaita
+    gtk4
+  ];
+
+  meta = with lib; {
+    description = "Rust GUI for interacting with hardware from TUXEDO Computers";
+    longDescription = ''
+      An alternative to the TUXEDO Control Center (https://www.tuxedocomputers.com/en/TUXEDO-Control-Center.tuxedo),
+      written in Rust.
+    '';
+    homepage = "https://github.com/AaronErhardt/tuxedo-rs";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ mrcjkb ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/tuxedo-rs/default.nix b/nixpkgs/pkgs/os-specific/linux/tuxedo-rs/default.nix
new file mode 100644
index 000000000000..c9fb057da68b
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/tuxedo-rs/default.nix
@@ -0,0 +1,47 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+let
+
+  # NOTE: This src is shared with tailor-gui.
+  # When updating, the tailor-gui.cargoDeps hash needs to be updated.
+  src = fetchFromGitHub {
+    owner = "AaronErhardt";
+    repo = "tuxedo-rs";
+    rev = "a77a9f6c64e6dd1ede3511934392cbc16271ef6b";
+    hash = "sha256-bk17vI1gLHayvCWfmZdCMqgmbJFOTDaaCaHcj9cLpMY=";
+  };
+
+in
+rustPlatform.buildRustPackage {
+  pname = "tuxedo-rs";
+  version = "0.2.2";
+
+  inherit src;
+
+  # Some of the tests are impure and rely on files in /etc/tailord
+  doCheck = false;
+
+  cargoHash = "sha256-vuXqab9W8NSD5U9dk15xM4fM/vd/fGgGdsvReMncWHg=";
+
+  postInstall = ''
+    install -Dm444 tailord/com.tux.Tailor.conf -t $out/share/dbus-1/system.d
+  '';
+
+  meta = with lib; {
+    description = "Rust utilities for interacting with hardware from TUXEDO Computers";
+    longDescription = ''
+      An alternative to the TUXEDO Control Center daemon.
+
+      Contains the following binaries:
+      - tailord: Daemon handling fan, keyboard and general HW support for Tuxedo laptops
+      - tailor: CLI
+    '';
+    homepage = "https://github.com/AaronErhardt/tuxedo-rs";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ mrcjkb ];
+    platforms = platforms.linux;
+  };
+}
+
diff --git a/nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix b/nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix
deleted file mode 100644
index 43c9bbfa8f3f..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/uclibc-ng/default.nix
+++ /dev/null
@@ -1,141 +0,0 @@
-{ lib
-, stdenv
-, buildPackages
-, fetchurl
-, linuxHeaders
-, libiconvReal
-, extraConfig ? ""
-}:
-
-let
-  isCross = (stdenv.buildPlatform != stdenv.hostPlatform);
-  configParser = ''
-    function parseconfig {
-        set -x
-        while read LINE; do
-            NAME=`echo "$LINE" | cut -d \  -f 1`
-            OPTION=`echo "$LINE" | cut -d \  -f 2`
-
-            if test -z "$NAME"; then
-                continue
-            fi
-
-            echo "parseconfig: removing $NAME"
-            sed -i /^$NAME=/d .config
-
-            #if test "$OPTION" != n; then
-                echo "parseconfig: setting $NAME=$OPTION"
-                echo "$NAME=$OPTION" >> .config
-            #fi
-        done
-        set +x
-    }
-  '';
-
-  # UCLIBC_SUSV4_LEGACY defines 'tmpnam', needed for gcc libstdc++ builds.
-  nixConfig = ''
-    RUNTIME_PREFIX "/"
-    DEVEL_PREFIX "/"
-    UCLIBC_HAS_WCHAR y
-    UCLIBC_HAS_FTW y
-    UCLIBC_HAS_RPC y
-    DO_C99_MATH y
-    UCLIBC_HAS_PROGRAM_INVOCATION_NAME y
-    UCLIBC_HAS_RESOLVER_SUPPORT y
-    UCLIBC_SUSV4_LEGACY y
-    UCLIBC_HAS_THREADS_NATIVE y
-    KERNEL_HEADERS "${linuxHeaders}/include"
-  '' + lib.optionalString (stdenv.hostPlatform.gcc.float or "" == "soft") ''
-    UCLIBC_HAS_FPU n
-  '' + lib.optionalString (stdenv.isAarch32 && isCross) ''
-    CONFIG_ARM_EABI y
-    ARCH_WANTS_BIG_ENDIAN n
-    ARCH_BIG_ENDIAN n
-    ARCH_WANTS_LITTLE_ENDIAN y
-    ARCH_LITTLE_ENDIAN y
-    UCLIBC_HAS_FPU n
-  '';
-in
-stdenv.mkDerivation rec {
-  pname = "uclibc-ng";
-  version = "1.0.44";
-
-  src = fetchurl {
-    url = "https://downloads.uclibc-ng.org/releases/${version}/uClibc-ng-${version}.tar.xz";
-    sha256 = "sha256-ffnZh5VYJzgvHCQA2lE0Vr7Ltvhovf03c3Jl8cvuyZQ=";
-  };
-
-  # 'ftw' needed to build acl, a coreutils dependency
-  configurePhase = ''
-    make defconfig
-    ${configParser}
-    cat << EOF | parseconfig
-    ${nixConfig}
-    ${extraConfig}
-    ${stdenv.hostPlatform.uclibc.extraConfig or ""}
-    EOF
-    ( set +o pipefail; yes "" | make oldconfig )
-  '';
-
-  hardeningDisable = [ "stackprotector" ];
-
-  # Cross stripping hurts.
-  dontStrip = isCross;
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  makeFlags = [
-    "ARCH=${stdenv.hostPlatform.linuxArch}"
-    "TARGET_ARCH=${stdenv.hostPlatform.linuxArch}"
-    "VERBOSE=1"
-  ] ++ lib.optionals (isCross) [
-    "CROSS=${stdenv.cc.targetPrefix}"
-  ];
-
-  # `make libpthread/nptl/sysdeps/unix/sysv/linux/lowlevelrwlock.h`:
-  # error: bits/sysnum.h: No such file or directory
-  enableParallelBuilding = false;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    make $makeFlags PREFIX=$out VERBOSE=1 install
-    (cd $out/include && ln -s $(ls -d ${linuxHeaders}/include/* | grep -v "scsi$") .)
-    # libpthread.so may not exist, so I do || true
-    sed -i s@/lib/@$out/lib/@g $out/lib/libc.so $out/lib/libpthread.so || true
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    homepage = "https://uclibc-ng.org";
-    description = "Embedded C library";
-    longDescription = ''
-      uClibc-ng is a small C library for developing embedded Linux systems. It
-      is much smaller than the GNU C Library, but nearly all applications
-      supported by glibc also work perfectly with uClibc-ng.
-
-      Porting applications from glibc to uClibc-ng typically involves just
-      recompiling the source code. uClibc-ng supports shared libraries and
-      threading. It currently runs on standard Linux and MMU-less (also known as
-      uClinux) systems with support for Aarch64, Alpha, ARC, ARM, AVR32,
-      Blackfin, CRIS, C-Sky, C6X, FR-V, H8/300, HPPA, i386, IA64, KVX, LM32,
-      M68K/Coldfire, Metag, Microblaze, MIPS, MIPS64, NDS32, NIOS2, OpenRISC,
-      PowerPC, RISCV64, Sparc, Sparc64, SuperH, Tile, X86_64 and XTENSA
-      processors. Alpha, FR-V, HPPA, IA64, LM32, NIOS2, Tile and Sparc64 are
-      experimental and need more testing.
-    '';
-    license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ rasendubi AndersonTorres ];
-    platforms = platforms.linux;
-    badPlatforms = platforms.aarch64;
-  };
-
-  passthru = {
-    # Derivations may check for the existance of this attribute, to know what to
-    # link to.
-    libiconv = libiconvReal;
-  };
-
-}
diff --git a/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix b/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
index 07a9ceaa5173..11b2ed28fb3f 100644
--- a/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/udisks/2-default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "udisks";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "storaged-project";
     repo = "udisks";
     rev = "${pname}-${version}";
-    sha256 = "sha256-M0L2MjVKv7VmtML/JZx0I8vNj+m6KDWGezvcwFqoTNI=";
+    sha256 = "sha256-L8jr1+SJWsCizkPXC8VKDy2eVa7/FpqdB8SkBYq6vwc=";
   };
 
   outputs = [ "out" "man" "dev" ] ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) "devdoc";
diff --git a/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix b/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
index 19ac7fcd42b3..dfc43cba01c2 100644
--- a/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/uhk-agent/default.nix
@@ -1,11 +1,11 @@
 { appimageTools, lib, fetchurl }:
 let
   pname = "uhk-agent";
-  version = "3.0.2";
+  version = "3.1.0";
   src = fetchurl {
     url = "https://github.com/UltimateHackingKeyboard/agent/releases/download/v${version}/UHK.Agent-${version}-linux-x86_64.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-RrZ2J6bmk8VXVmpUi9bjqQRJBYjGIczMaSEG9aQ4U4I=";
+    sha256 = "sha256-KFuB1cbrEDfqeRyrhXZs4ClhdIjZqIT5a+rnvdi3kpA=";
   };
 
   appimageContents = appimageTools.extract {
@@ -33,7 +33,7 @@ in appimageTools.wrapType2 {
     description = "Agent is the configuration application of the Ultimate Hacking Keyboard";
     homepage = "https://github.com/UltimateHackingKeyboard/agent";
     license = licenses.unfreeRedistributable;
-    maintainers = with maintainers; [ ngiger ];
+    maintainers = with maintainers; [ ngiger nickcao ];
     platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/upower/default.nix b/nixpkgs/pkgs/os-specific/linux/upower/default.nix
index a002e1af8899..36d8a3b9c45f 100644
--- a/nixpkgs/pkgs/os-specific/linux/upower/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/upower/default.nix
@@ -24,7 +24,7 @@
 , libimobiledevice
 , withDocs ? withIntrospection
 , mesonEmulatorHook
-, withIntrospection ? stdenv.hostPlatform.emulatorAvailable buildPackages
+, withIntrospection ? lib.meta.availableOn stdenv.hostPlatform gobject-introspection && stdenv.hostPlatform.emulatorAvailable buildPackages
 , buildPackages
 , gobject-introspection
 }:
diff --git a/nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix b/nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix
index 385f4da1142d..670de2028c4f 100644
--- a/nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/usbrelay/default.nix
@@ -1,13 +1,13 @@
 { stdenv, lib, fetchFromGitHub, hidapi, installShellFiles }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "usbrelay";
-  version = "1.2";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "darrylb123";
     repo = "usbrelay";
     rev = finalAttrs.version;
-    sha256 = "sha256-oJyHzbXOBKxLmPFZMS2jLF80frkiKjPJ89UwkenjIzs=";
+    sha256 = "sha256-9jEiMmBEpqY4+nKh3H8N/JrLohp/7oPK3rPmRjp2gvc=";
   };
 
   nativeBuildInputs = [
diff --git a/nixpkgs/pkgs/os-specific/linux/vmware/default.nix b/nixpkgs/pkgs/os-specific/linux/vmware/default.nix
index aeb6afec24af..7c1994687ae7 100644
--- a/nixpkgs/pkgs/os-specific/linux/vmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/vmware/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "vmware-modules";
-  version = "workstation-17.0.2-2023-08-12-${kernel.version}";
+  version = "workstation-17.0.2-2023-09-29-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "mkubecek";
     repo = "vmware-host-modules";
     # Developer no longer provides tags for kernel compatibility fixes
-    # Commit hash for branch workstation-17.0.2 as of 2023-08-12
-    rev = "8b2d31498a8df9b1215f407c989b065953b73455";
-    sha256 = "sha256-R0nY4O3ASQkOop+ddU4k72HiIJU/aJz0l3lkJN/kuHc=";
+    # Commit hash for branch workstation-17.0.2 as of 2023-09-29
+    rev = "29de7e2bd45d32e6983106d6f15810c70ba3e654";
+    hash = "sha256-l0QJbjySINM/7EyNhZl6UnUonwPoGnCnsQeC8YtI15c=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/wireless-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/wireless-tools/default.nix
index fbe5d95e2a65..e95506461a4b 100644
--- a/nixpkgs/pkgs/os-specific/linux/wireless-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/wireless-tools/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "30.pre9";
 
   src = fetchurl {
-    url = "http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/wireless_tools.${version}.tar.gz";
+    url = "https://hewlettpackard.github.io/wireless-tools/wireless_tools.${version}.tar.gz";
     sha256 = "0qscyd44jmhs4k32ggp107hlym1pcyjzihiai48xs7xzib4wbndb";
   };
 
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
   ];
 
   meta = {
+    description = "Wireless tools for Linux";
+    homepage = "https://hewlettpackard.github.io/wireless-tools/Tools.html";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl2;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/xsensors/default.nix b/nixpkgs/pkgs/os-specific/linux/xsensors/default.nix
index 02ce560d8a94..e3639fefffa4 100644
--- a/nixpkgs/pkgs/os-specific/linux/xsensors/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/xsensors/default.nix
@@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     license = licenses.gpl2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ cstrahan ];
+    maintainers = with maintainers; [ ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/generic.nix b/nixpkgs/pkgs/os-specific/linux/zfs/generic.nix
index 41aa909532fd..81ff2214bcad 100644
--- a/nixpkgs/pkgs/os-specific/linux/zfs/generic.nix
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/generic.nix
@@ -83,6 +83,9 @@ stdenv'.mkDerivation {
       substituteInPlace ./udev/vdev_id \
         --replace "PATH=/bin:/sbin:/usr/bin:/usr/sbin" \
          "PATH=${makeBinPath [ coreutils gawk gnused gnugrep systemd ]}"
+      substituteInPlace ./config/zfs-build.m4 \
+        --replace "bashcompletiondir=/etc/bash_completion.d" \
+          "bashcompletiondir=$out/share/bash-completion/completions"
     '' else ''
       substituteInPlace ./etc/zfs/Makefile.am --replace "\$(sysconfdir)/zfs" "$out/etc/zfs"
 
@@ -138,6 +141,14 @@ stdenv'.mkDerivation {
     "INSTALL_MOD_PATH=\${out}"
   ];
 
+  preConfigure = ''
+    # The kernel module builds some tests during the configurePhase, this envvar controls their parallelism
+    export TEST_JOBS=$NIX_BUILD_CORES
+    if [ -z "$enableParallelBuilding" ]; then
+      export TEST_JOBS=1
+    fi
+  '';
+
   # Enabling BTF causes zfs to be build with debug symbols.
   # Since zfs compress kernel modules on installation, our strip hooks skip stripping them.
   # Hence we strip modules prior to compression.
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix b/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix
index 14cda12e6f32..1a77396300eb 100644
--- a/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/stable.nix
@@ -14,10 +14,13 @@ callPackage ./generic.nix args {
   # check the release notes for compatible kernels
   kernelCompatible =
     if stdenv'.isx86_64 || removeLinuxDRM
-    then kernel.kernelOlder "6.4"
+    then kernel.kernelOlder "6.6"
     else kernel.kernelOlder "6.2";
-  latestCompatibleLinuxPackages = linuxKernel.packages.linux_6_1;
+  latestCompatibleLinuxPackages = if stdenv'.isx86_64 || removeLinuxDRM
+    then linuxKernel.packages.linux_6_5
+    else linuxKernel.packages.linux_6_1;
   extraPatches = [
+    # applied in version 2.2.x
     (fetchpatch {
       name = "musl.patch";
       url = "https://github.com/openzfs/zfs/commit/1f19826c9ac85835cbde61a7439d9d1fefe43a4a.patch";
@@ -26,7 +29,7 @@ callPackage ./generic.nix args {
   ];
 
   # this package should point to the latest release.
-  version = "2.1.12";
+  version = "2.1.13";
 
-  sha256 = "eYUR5d4gpTrlFu6j1uL83DWL9uPGgAUDRdSEb73V5i4=";
+  sha256 = "tqUCn/Hf/eEmyWRQthWQdmTJK2sDspnHiiEfn9rz2Kc=";
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix b/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix
index 592d94b0030a..23882322c093 100644
--- a/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/unstable.nix
@@ -12,20 +12,20 @@ in
 callPackage ./generic.nix args {
   # check the release notes for compatible kernels
   kernelCompatible = if stdenv'.isx86_64 || removeLinuxDRM
-    then kernel.kernelOlder "6.5"
+    then kernel.kernelOlder "6.6"
     else kernel.kernelOlder "6.2";
 
   latestCompatibleLinuxPackages = if stdenv'.isx86_64 || removeLinuxDRM
-  then linuxKernel.packages.linux_6_4
-  else linuxKernel.packages.linux_6_1;
+    then linuxKernel.packages.linux_6_5
+    else linuxKernel.packages.linux_6_1;
 
   # this package should point to a version / git revision compatible with the latest kernel release
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.2.0-rc4";
+  version = "2.2.0-rc5";
 
-  sha256 = "sha256-zTG6iujlWB2H8j6i+t59zdyztoDFk373AjgHzC8x5mQ=";
+  sha256 = "sha256-97dTmSneAuhDR7LrJxG7/xPpI1hGv5mDDuq8HRTZKx0=";
 
   isUnstable = true;
 }