Merge commit 'a323570a264da96a0b0bcc1c9aa017794acdc752'

58 files changed, 496 insertions, 229 deletions

diff --git a/nixpkgs/pkgs/os-specific/linux/apfs/default.nix b/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
index e27272a61473..62437d662b92 100644
--- a/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/apfs/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation {
   pname = "apfs";
-  version = "unstable-2021-06-25-${kernel.version}";
+  version = "unstable-2021-09-21-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
-    rev = "2ce6d06dc73036d113da5166c59393233bf54229";
-    sha256 = "sha256-18HFtPr0qcTIZ8njwEtveiPYO+HGlj90bdUoL47UUY0=";
+    rev = "362c4e32ab585b9234a26aa3e49f29b605612a31";
+    sha256 = "sha256-Y8/PGPLirNrICF+Bum60v/DBPa1xpox5VBvt64myZzs=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     homepage = "https://github.com/linux-apfs/linux-apfs-rw";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = kernel.kernelOlder "4.19";
+    broken = kernel.kernelOlder "4.9";
     maintainers = with maintainers; [ Luflosi ];
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/audit/default.nix b/nixpkgs/pkgs/os-specific/linux/audit/default.nix
index 6fa7ba28d8e3..a7f17e449505 100644
--- a/nixpkgs/pkgs/os-specific/linux/audit/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/audit/default.nix
@@ -37,7 +37,14 @@ stdenv.mkDerivation rec {
   # TODO: Remove the musl patches when
   #         https://github.com/linux-audit/audit-userspace/pull/25
   #       is available with the next release.
-  patches = [ ./patches/weak-symbols.patch ]
+  patches = [
+    ./patches/weak-symbols.patch
+    (fetchpatch {
+      # upstream build fix against -fno-common compilers like >=gcc-10
+      url = "https://github.com/linux-audit/audit-userspace/commit/017e6c6ab95df55f34e339d2139def83e5dada1f.patch";
+      sha256 = "100xa1rzkv0mvhjbfgpfm72f7c4p68syflvgc3xm6pxgrqqmfq8h";
+    })
+  ]
   ++ lib.optional stdenv.hostPlatform.isMusl [
     (
       let patch = fetchpatch {
diff --git a/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix b/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix
new file mode 100644
index 000000000000..e9931f0ab7e2
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/autosuspend/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, fetchFromGitHub
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "autosuspend";
+  version = "4.0.0";
+
+  src = fetchFromGitHub {
+    owner = "languitar";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "03qca6avn7bwxcavif7q2nqfzivzp0py7qw3i4hsb28gjrq9nz36";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.cfg \
+      --replace '--cov-config=setup.cfg' ""
+  '';
+
+  propagatedBuildInputs = with python3.pkgs; [
+    portalocker
+    psutil
+    dbus-python
+  ];
+
+  checkInputs = with python3.pkgs; [
+    pytestCheckHook
+    python-dbusmock
+    pytest-httpserver
+    dateutils
+    freezegun
+    pytest-mock
+    requests
+    requests-file
+    icalendar
+    tzlocal
+    jsonpath-ng
+    mpd2
+    lxml
+    pytest-datadir
+  ];
+
+  # Disable tests that need root
+  disabledTests = [
+    "test_smoke"
+    "test_multiple_sessions"
+  ];
+
+  doCheck = true;
+
+  meta = with lib ; {
+    description = "A daemon to automatically suspend and wake up a system";
+    homepage = "https://autosuspend.readthedocs.io";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.bzizou ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/bcc/default.nix b/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
index 929981df4706..221f38faa879 100644
--- a/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bcc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch
+{ lib, stdenv, fetchFromGitHub
 , makeWrapper, cmake, llvmPackages, kernel
 , flex, bison, elfutils, python, luajit, netperf, iperf, libelf
 , systemtap, bash, libbpf
@@ -29,12 +29,6 @@ python.pkgs.buildPythonApplication rec {
     # This is needed until we fix
     # https://github.com/NixOS/nixpkgs/issues/40427
     ./fix-deadlock-detector-import.patch
-    # Add definition for BTF_KIND_FLOAT, added in Linux 5.14
-    # Can be removed once linuxHeaders (used here via glibc) are bumped to 5.14+.
-    (fetchpatch {
-      url = "https://salsa.debian.org/debian/bpfcc/-/raw/71136ef5b66a2ecefd635a7aca2e0e835ff09095/debian/patches/0004-compat-defs.patch";
-      sha256 = "05s1zxihwkvbl2r2mqc5dj7fpcipqyvwr11v8b9hqbwjkm3qpz40";
-    })
   ];
 
   propagatedBuildInputs = [ python.pkgs.netaddr ];
diff --git a/nixpkgs/pkgs/os-specific/linux/bolt/default.nix b/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
index d38a97387f5a..dd9436d9b0ea 100644
--- a/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/bolt/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ stdenv
+, lib
 , meson
 , ninja
 , pkg-config
@@ -30,6 +31,25 @@ stdenv.mkDerivation rec {
     sha256 = "1phgp8fs0dlj74kbkqlvfniwc32daz47b3pvsxlfxqzyrp77xrfm";
   };
 
+  patches = [
+    # meson install tries to create /var/lib/boltd
+    ./0001-skip-mkdir.patch
+
+    # https://github.com/NixOS/nixpkgs/issues/104429
+    # Upstream issue: https://gitlab.freedesktop.org/bolt/bolt/-/issues/167
+    (fetchpatch {
+      name = "disable-atime-tests.diff";
+      url = "https://gitlab.freedesktop.org/roberth/bolt/-/commit/1f672a7de2ebc4dd51590bb90f3b873a8ac0f4e6.diff";
+      sha256 = "134f5s6kjqs6612pwq5pm1miy58crn1kxbyyqhzjnzmf9m57fnc8";
+    })
+
+    # Fix tests with newer umockdev
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/bolt/bolt/-/commit/130e09d1c7ff02c09e4ad1c9c36e9940b68e58d8.patch";
+      sha256 = "HycuM7z4VvtBuZZLU68tBxGT1YjaqJRS4sKyoTGHZEk=";
+    })
+  ];
+
   nativeBuildInputs = [
     asciidoc
     docbook_xml_dtd_45
@@ -61,19 +81,6 @@ stdenv.mkDerivation rec {
       (p: [ p.pygobject3 p.dbus-python p.python-dbusmock ]))
   ];
 
-  patches = [
-    # meson install tries to create /var/lib/boltd
-    ./0001-skip-mkdir.patch
-
-    # https://github.com/NixOS/nixpkgs/issues/104429
-    # Upstream issue: https://gitlab.freedesktop.org/bolt/bolt/-/issues/167
-    (fetchpatch {
-      name = "disable-atime-tests.diff";
-      url = "https://gitlab.freedesktop.org/roberth/bolt/-/commit/1f672a7de2ebc4dd51590bb90f3b873a8ac0f4e6.diff";
-      sha256 = "134f5s6kjqs6612pwq5pm1miy58crn1kxbyyqhzjnzmf9m57fnc8";
-    })
-    ];
-
   postPatch = ''
     patchShebangs scripts tests
   '';
diff --git a/nixpkgs/pkgs/os-specific/linux/bpfmon/default.nix b/nixpkgs/pkgs/os-specific/linux/bpfmon/default.nix
new file mode 100644
index 000000000000..32781d365491
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/bpfmon/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, lib, libpcap, yascreen }:
+
+stdenv.mkDerivation rec {
+  pname = "bpfmon";
+  version = "2.50";
+
+  src = fetchFromGitHub {
+    owner = "bbonev";
+    repo = "bpfmon";
+    rev = "v${version}";
+    sha256 = "sha256-x4EuGZBtg45bD9q1B/6KwjDRXXeRsdFmRllREsech+E=";
+  };
+
+  buildInputs = [ libpcap yascreen ];
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "BPF based visual packet rate monitor";
+    homepage = "https://github.com/bbonev/bpfmon";
+    maintainers = with maintainers; [ arezvov ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/busybox/default.nix b/nixpkgs/pkgs/os-specific/linux/busybox/default.nix
index 4949cd7c14a8..b8a017adcf42 100644
--- a/nixpkgs/pkgs/os-specific/linux/busybox/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/busybox/default.nix
@@ -49,14 +49,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "busybox";
-  version = "1.33.1";
+  version = "1.34.1";
 
   # Note to whoever is updating busybox: please verify that:
   # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
   # still builds after the update.
   src = fetchurl {
     url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
-    sha256 = "0a0dcvsh7nxnhxc5y73fky0z30i9p7r30qfidm2akn0n5fywdkhj";
+    sha256 = "0jfm9fik7nv4w21zqdg830pddgkdjmplmna9yjn9ck1lwn4vsps1";
   };
 
   hardeningDisable = [ "format" "pie" ]
@@ -81,6 +81,14 @@ stdenv.mkDerivation rec {
 
     CONFIG_LFS y
 
+    # More features for modprobe.
+    ${lib.optionalString (!enableMinimal) ''
+      CONFIG_FEATURE_MODPROBE_BLACKLIST y
+      CONFIG_FEATURE_MODUTILS_ALIAS y
+      CONFIG_FEATURE_MODUTILS_SYMBOLS y
+      CONFIG_MODPROBE_SMALL n
+    ''}
+
     ${lib.optionalString enableStatic ''
       CONFIG_STATIC y
     ''}
@@ -135,7 +143,7 @@ stdenv.mkDerivation rec {
     description = "Tiny versions of common UNIX utilities in a single small executable";
     homepage = "https://busybox.net/";
     license = licenses.gpl2Only;
-    maintainers = with maintainers; [ TethysSvensson ];
+    maintainers = with maintainers; [ TethysSvensson qyliss ];
     platforms = platforms.linux;
     priority = 10;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix b/nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix
index a12d97280f19..ae4e19ef0f84 100644
--- a/nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/dmidecode/default.nix
@@ -53,7 +53,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  makeFlags = [ "prefix=$(out)" ];
+  makeFlags = [
+    "prefix=$(out)"
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
 
   meta = with lib; {
     homepage = "https://www.nongnu.org/dmidecode/";
diff --git a/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix
index 73e50c5740bc..242f9e8391a4 100644
--- a/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/erofs-utils/default.nix
@@ -2,17 +2,18 @@
 
 stdenv.mkDerivation rec {
   pname = "erofs-utils";
-  version = "1.2.1";
+  version = "1.3";
   outputs = [ "out" "man" ];
 
   src = fetchgit {
     url =
       "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git";
     rev = "v" + version;
-    sha256 = "1vb4mxsb59g29x7l22cffsqa8x743sra4j5zbmx89hjwpwm9vvcg";
+    sha256 = "0sqiw05zbxr6l0g9gn3whkc4qc5km2qvfg4lnm08nppwskm8yaw8";
   };
 
-  buildInputs = [ autoreconfHook pkg-config fuse libuuid lz4 ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ fuse libuuid lz4 ];
 
   configureFlags = [ "--enable-fuse" ];
 
diff --git a/nixpkgs/pkgs/os-specific/linux/eudev/default.nix b/nixpkgs/pkgs/os-specific/linux/eudev/default.nix
index c8562cc5f3c0..1fdd0647557d 100644
--- a/nixpkgs/pkgs/os-specific/linux/eudev/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/eudev/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation {
     license = lib.licenses.gpl2Plus ;
     maintainers = [lib.maintainers.raskin];
     platforms = lib.platforms.linux;
-    homepage = "https://www.gentoo.org/proj/en/eudev/";
+    homepage = "https://wiki.gentoo.org/wiki/Project:Eudev";
     downloadPage = "http://dev.gentoo.org/~blueness/eudev/";
     updateWalker = true;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
index 1ae8ed3ec773..b06b239221de 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/firmware-linux-nonfree/default.nix
@@ -2,12 +2,12 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "firmware-linux-nonfree";
-  version = "2021-08-18";
+  version = "2021-09-19";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
     rev = "refs/tags/" + lib.replaceStrings [ "-" ] [ "" ] version;
-    sha256 = "sha256-RLPTbH2quBqCF3fi70GtOE0i3lEdaL5xo67xk8gbYMo=";
+    sha256 = "1ix43qqpl5kvs6xpqrs3l5aj6vmwcaxcnv8l04mqqkyi9wamjydn";
   };
 
   installFlags = [ "DESTDIR=$(out)" ];
@@ -17,7 +17,7 @@ stdenvNoCC.mkDerivation rec {
 
   outputHashMode = "recursive";
   outputHashAlgo = "sha256";
-  outputHash = "sha256-0ZNgRGImh6sqln7bNP0a0lbSPEp7GwVoIuuOxW2Y9OM=";
+  outputHash = "02nzl7bwvkcxd499glfbrkpyndrlmqkxvpjwgjr0rccaqdhfl21j";
 
   meta = with lib; {
     description = "Binary firmware collection packaged by kernel.org";
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index 2409d9b1aba1..98cfa68e0313 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -1,22 +1,28 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "1.7";
+  version = "1.9";
 
   src = fetchFromGitHub {
     owner = "thesofproject";
     repo = "sof-bin";
     rev = "v${version}";
-    sha256 = "sha256-Z0Z4HLsIIuW8E1kFNhAECmzj1HkJVfbEw13B8V7PZLk=";
+    sha256 = "sha256-yife3gO8lXOGwRye213II9rCQqDic7B7w1xW1o7ajF8=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
 
   installPhase = ''
+    runHook preInstall
+    cd "v${version}.x"
     mkdir -p $out/lib/firmware/intel/
     cp -a sof-v${version} $out/lib/firmware/intel/sof
     cp -a sof-tplg-v${version} $out/lib/firmware/intel/sof-tplg
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix b/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
index 4d0ae9a1d5a7..73b9cf08b808 100644
--- a/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/firmware/system76-firmware/default.nix
@@ -2,13 +2,13 @@
 rustPlatform.buildRustPackage rec {
   pname = "system76-firmware";
   # Check Makefile when updating, make sure postInstall matches make install
-  version = "1.0.29";
+  version = "1.0.31";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
     rev = version;
-    sha256 = "sha256-4wvVls6Z42GtC/MVFTvCv1UV/w5nt4p9oTMU4Bqh4JU=";
+    sha256 = "sha256-agtaQ5Te4WcbIdCt8TDK4Y2y/9aHrDCUWuPRE5+aFjc=";
   };
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "--workspace" ];
 
-  cargoSha256 = "sha256-x2FO4UWtsvUeKgPxaqjdxtp9vWJq9vLIqQPyGF8nQG4=";
+  cargoSha256 = "sha256-QFHyrvLR1v09RNlXiO/E+blvxPukKwPRRX+vQvlZSNQ=";
 
   # Purposefully don't install systemd unit file, that's for NixOS
   postInstall = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix b/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix
index 321f96d0d36a..e9ee88252ea8 100644
--- a/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/hid-nintendo/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hid-nintendo";
-  version = "3.1";
+  version = "3.2";
 
   src = fetchFromGitHub {
     owner = "nicman23";
     repo = "dkms-hid-nintendo";
     rev = version;
-    sha256 = "sha256-IanH3yHfkQhqtKvKD8lh+muc9yX8XJ5bfdy1Or8Vd5g=";
+    sha256 = "1c262xarslicn9ildndl66sf97i5pzwzra54zh2rp11j7kkvvbyr";
   };
 
   setSourceRoot = ''
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A Nintendo HID kernel module";
     homepage = "https://github.com/nicman23/dkms-hid-nintendo";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     maintainers = [ maintainers.rencire ];
     platforms = platforms.linux;
     broken = versionOlder kernel.version "4.14";
diff --git a/nixpkgs/pkgs/os-specific/linux/joycond/default.nix b/nixpkgs/pkgs/os-specific/linux/joycond/default.nix
index a203073b081c..e60e661f0c44 100644
--- a/nixpkgs/pkgs/os-specific/linux/joycond/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/joycond/default.nix
@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libevdev, udev }:
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libevdev, udev, acl }:
 
 stdenv.mkDerivation rec {
   pname = "joycond";
-  version = "unstable-2021-03-27";
+  version = "unstable-2021-07-30";
 
   src = fetchFromGitHub {
     owner = "DanielOgorchock";
     repo = "joycond";
-    rev = "2d3f553060291f1bfee2e49fc2ca4a768b289df8";
-    sha256 = "0dpmwspll9ar3pxg9rgnh224934par8h8bixdz9i2pqqbc3dqib7";
+    rev = "f9a66914622514c13997c2bf7ec20fa98e9dfc1d";
+    sha256 = "sha256-quw7yBHDDZk1+6uHthsfMCej7g5uP0nIAqzvI6436B8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -25,6 +25,9 @@ stdenv.mkDerivation rec {
 
     substituteInPlace $out/etc/systemd/system/joycond.service --replace \
       "ExecStart=/usr/bin/joycond" "ExecStart=$out/bin/joycond"
+
+    substituteInPlace $out/etc/udev/rules.d/89-joycond.rules --replace \
+      "/bin/setfacl"  "${acl}/bin/setfacl"
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix b/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
index 9d727838b3fb..27428b37284d 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel-headers/default.nix
@@ -81,12 +81,12 @@ let
 in {
   inherit makeLinuxHeaders;
 
-  linuxHeaders = let version = "5.12"; in
+  linuxHeaders = let version = "5.14"; in
     makeLinuxHeaders {
       inherit version;
       src = fetchurl {
         url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-        sha256 = "sha256-fQ328r8jhNaNC9jh/j4HHWQ2Tc3GAC57XIfJLUj6w2Y=";
+        sha256 = "sha256-fgaLXg0mpisQ5TILJdzldYjLvG94HAkEQhOMnJwycbI=";
       };
       patches = [
          ./no-relocs.patch # for building x86 kernel headers on non-ELF platforms
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
index 832e516e6efd..8e1902b61dc1 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -1,38 +1,32 @@
 {
     "4.14": {
         "extra": "-hardened1",
-        "name": "linux-hardened-4.14.246-hardened1.patch",
-        "sha256": "1b15687ac2pkz46qliq1blyja7cjwn19q2bkd0c5912kzly76ghd",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.246-hardened1/linux-hardened-4.14.246-hardened1.patch"
+        "name": "linux-hardened-4.14.250-hardened1.patch",
+        "sha256": "1jgqmrj5djapvk56jwlfq181knhywzrk9cswv1lp5y2jwnnvlj9x",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.250-hardened1/linux-hardened-4.14.250-hardened1.patch"
     },
     "4.19": {
         "extra": "-hardened1",
-        "name": "linux-hardened-4.19.206-hardened1.patch",
-        "sha256": "12ylhvjvabal29gi00cpjh3s47qj0vav6f2y145z4c9r2z77816k",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.206-hardened1/linux-hardened-4.19.206-hardened1.patch"
+        "name": "linux-hardened-4.19.210-hardened1.patch",
+        "sha256": "0lnv0ym6jcf460hsn26lax65n2yb1vvzsfmckaz04jb2kdgm6hr5",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.210-hardened1/linux-hardened-4.19.210-hardened1.patch"
     },
     "5.10": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.10.67-hardened1.patch",
-        "sha256": "1yvfqkcffrva9hf4ns0jkksnvkj58h87msim0yhanlyp5jyz3l1p",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.67-hardened1/linux-hardened-5.10.67-hardened1.patch"
-    },
-    "5.13": {
-        "extra": "-hardened1",
-        "name": "linux-hardened-5.13.19-hardened1.patch",
-        "sha256": "1cj99y2xn7l89lf4mn7arp0r98r4nmvql3ffjpngzv8hsf79xgg7",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.13.19-hardened1/linux-hardened-5.13.19-hardened1.patch"
+        "name": "linux-hardened-5.10.72-hardened1.patch",
+        "sha256": "14zchx1hc4jrq7prv4kkswjnmyqv74wfkjvky57scc8yl04yaqs6",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.72-hardened1/linux-hardened-5.10.72-hardened1.patch"
     },
     "5.14": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.14.6-hardened1.patch",
-        "sha256": "0db5jvbvrk93x745ylxwnmx6ldwhmaqdnb2hfa35j0i2xjaw4hxx",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.6-hardened1/linux-hardened-5.14.6-hardened1.patch"
+        "name": "linux-hardened-5.14.11-hardened1.patch",
+        "sha256": "05n74rnq5c2jx7iynxwgj5wypb0i0p3dar0ri2zxmyssasmbkfa7",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.14.11-hardened1/linux-hardened-5.14.11-hardened1.patch"
     },
     "5.4": {
         "extra": "-hardened1",
-        "name": "linux-hardened-5.4.147-hardened1.patch",
-        "sha256": "1jkvfpckmj9ig4nsxxiigawkay05lk8r9fps16iaq6lz2mf9vqsb",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.147-hardened1/linux-hardened-5.4.147-hardened1.patch"
+        "name": "linux-hardened-5.4.152-hardened1.patch",
+        "sha256": "01rf9za9sv14pxpi0pj1izq4bihhldi2qnhaka5rxlw7nifzzsj2",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.152-hardened1/linux-hardened-5.4.152-hardened1.patch"
     }
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 4fd140a361c5..6044967eaf69 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.14.247";
+  version = "4.14.251";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1kdhlsqpmw68xnfiyx98id8wis6kkxca2d4n7w2ncax0kyzrwyz7";
+    sha256 = "08g1i6wylwi50rns2grdi9f0m8np64qvfqb28drafy772m2klinp";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
index ada819f4850d..3cb9fb7009f4 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "4.19.207";
+  version = "4.19.212";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1fb658n89xf9asnaqi0bnh64ir2f78bdqyjvfb983qad9wqsadym";
+    sha256 = "0hxn3mzxh4hpnrkyjv9gipb81k6p0zd07a3xvb6fb6njvmwdpvsw";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
index f1e4329c2d41..a0d6115a856b 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.284";
+  version = "4.4.289";
   extraMeta.branch = "4.4";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "00xkd2p181cfkys4nri93xy7snmn8g2481x3qz0js7g9p3kz5bqf";
+    sha256 = "1g77kf0yzwvpdxs3kw7wdvb07mmk3zm6ydjcw5dnsza8q2inl69k";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 22f506f56581..b4952dcb9277 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.283";
+  version = "4.9.287";
   extraMeta.branch = "4.9";
   extraMeta.broken = stdenv.isAarch64;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0pdh1lyhdp5c5n39wpr622kgchgf30iqk853a2rv9m3s3fry50lm";
+    sha256 = "1hlpxnlz0y5vxcmkavsirk2kfb2l34fcvmhlcb99slh28xkjhhfl";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
index 720b619049a0..a16c96b9eb83 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.10.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.10.68";
+  version = "5.10.74";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "08cl4bg9k331apj5fjl3jx6s6l543dnbjc1cfvin951m7l787ahv";
+    sha256 = "1c717mn47mg43k7xfwydygwv14r67aksn1c24c99hf8qf14acmap";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.13.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.13.nix
deleted file mode 100644
index 3f5ae2e13f54..000000000000
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.13.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildPackages, fetchurl, perl, buildLinux, nixosTests, modDirVersionArg ? null, ... } @ args:
-
-with lib;
-
-buildLinux (args // rec {
-  version = "5.13.19";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = versions.majorMinor version;
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0yxbcd1k4l4cmdn0hzcck4s0yvhvq9fpwp120dv9cz4i9rrfqxz8";
-  };
-} // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.14.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.14.nix
index 45d39795db6f..ec19fa2357f2 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.14.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.14.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.14.7";
+  version = "5.14.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1avypasvic298823xzpzzkjbmfv9s8bjnmq92ri62qbakx23j9dg";
+    sha256 = "0kcn9g5jyd043f75wk3k34j430callzhw5jh1if9zacqq2s7haw3";
   };
 } // (args.argsOverride or { }))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
index ff4f019fc51c..4b02d19d1cca 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "5.4.148";
+  version = "5.4.154";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1cwibh0y112hip5yd0n692rv44jh4sk2g6mj5n44g754k4i366a6";
+    sha256 = "01iwbz1ncakw90yykdw3cx04wnclwf1qa8nmlis08svbcvs99285";
   };
 } // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
index d9f8912416a5..8ee8c663b3b5 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18314";
-    sha256 = "0fic073zafwdsw7i0j4z57a4aknk8kpgnbrxpbi181n5axdlm99k";
+    rev = "18380";
+    sha256 = "0sg7mnxqzc5zdnl8l7gfy1kc52w7c85fdhywvdbjgs7inx2bb1qd";
   }
 , ...
 }:
@@ -16,7 +16,7 @@ let
 
 in linux.override {
   argsOverride = {
-    modDirVersion = "${linux.modDirVersion}-gnu";
+    modDirVersion = "${linux.modDirVersion}-gnu1";
     isLibre = true;
 
     src = stdenv.mkDerivation {
@@ -35,8 +35,6 @@ in linux.override {
       '';
     };
 
-    extraMeta.broken = true;
-
     passthru.updateScript = ./update-libre.sh;
 
     maintainers = [ lib.maintainers.qyliss ];
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-lqx.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-lqx.nix
index e4c9f03539f6..a0da293548d9 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-lqx.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-lqx.nix
@@ -1,8 +1,8 @@
 { lib, fetchFromGitHub, buildLinux, linux_zen, ... } @ args:
 
 let
-  version = "5.14.6";
-  suffix = "lqx4";
+  version = "5.14.11";
+  suffix = "lqx1";
 in
 
 buildLinux (args // {
@@ -14,7 +14,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${version}-${suffix}";
-    sha256 = "sha256-arje/B/oXW/2QUHKi1vJ2n20zNbri1bcMU58mE0evOM=";
+    sha256 = "sha256-4SSAcI1TwaKgz/bwma+YQtIBtodEAYxqdtUI3ESM7I8=";
   };
 
   extraMeta = {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index daa3c67da962..6ef781f6095c 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.65-rt53"; # updated by ./update-rt.sh
+  version = "5.10.73-rt54"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0riyq1gdm18642fpnhpcw8hspcjqzprzhqnygjxabjjvrvdxxlzd";
+    sha256 = "0xhf0g5pra27hnavpy0y3mn05m5hqn5rd3d6fx0a3vr35c1jicpd";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1sxyic3895dch3x7cabiip5lxv9wqypn22hcy02jg9825260cmd3";
+      sha256 = "0szqm9f939p9z701i5hj881nf5bhfa0a6037bbcz974y0x8g9nmk";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
index a12633eb6d72..fa5729baf73a 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-testing-bcachefs.nix
@@ -1,33 +1,24 @@
-{ lib
-, fetchpatch
-, kernel
-, date ? "2021-07-08"
-, commit ? "3693b2ca83ff9eda49660b31299d2bebe3a1075f"
-, diffHash ? "1sfq3vwc2kxa761s292f2cqrm0vvqvkdx6drpyn5yaxwnapwidcw"
-, kernelPatches # must always be defined in bcachefs' all-packages.nix entry because it's also a top-level attribute supplied by callPackage
-, argsOverride ? {}
-, ...
-} @ args:
+{ lib, buildPackages, fetchFromGitHub, fetchpatch, perl, buildLinux, ... } @ args:
 
-kernel.override ( args // {
+buildLinux (args // {
+  # NOTE: bcachefs-tools should be updated simultaneously to preserve compatibility
+  version = "5.13.0-2021.10.01";
+  modDirVersion = "5.13.0";
 
-  argsOverride = {
-    version = "${kernel.version}-bcachefs-unstable-${date}";
-    extraMeta = {
-      branch = "master";
-      maintainers = with lib.maintainers; [ davidak chiiruno ];
-      platforms = [ "x86_64-linux" ];
-    };
-  } // argsOverride;
+  src = fetchFromGitHub {
+    owner = "koverstreet";
+    repo = "bcachefs";
+    rev = "4114ced1db465b8f4e7f4d6a78aa11416a9ab5d9";
+    sha256 = "sha256-viFC3HHIcjUTDPvloSKKsz9PuSLyvxfYnrtkVUB79mQ=";
+  };
 
-  kernelPatches = [ {
-      name = "bcachefs-${commit}";
-      patch = fetchpatch {
-        name = "bcachefs-${commit}.diff";
-        url = "https://evilpiepirate.org/git/bcachefs.git/rawdiff/?id=${commit}&id2=v${lib.versions.majorMinor kernel.version}";
-        sha256 = diffHash;
-      };
-      extraConfig = "BCACHEFS_FS m";
-    } ] ++ kernelPatches;
+  extraConfig = "BCACHEFS_FS m";
 
-})
+  extraMeta = {
+    branch = "master";
+    hydraPlatforms = []; # Should the testing kernels ever be built on Hydra?
+    maintainers = with lib.maintainers; [ davidak chiiruno ];
+    platforms = [ "x86_64-linux" ];
+  };
+
+} // (args.argsOverride or {}))
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-xanmod.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-xanmod.nix
index 3c02140d1357..08ed46bb0d43 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-xanmod.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-xanmod.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, buildLinux, fetchFromGitHub, ... } @ args:
 
 let
-  version = "5.14.7";
+  version = "5.14.12";
   release = "1";
   suffix = "xanmod${release}-cacule";
 in
@@ -13,7 +13,7 @@ buildLinux (args // rec {
     owner = "xanmod";
     repo = "linux";
     rev = modDirVersion;
-    sha256 = "sha256-W3NAiKMs5ZO/OesWzvfzGqgGa/5A49Gy0a8E4yWY2c8=";
+    sha256 = "sha256-JVTi319BLHM4CgF7KaN3C/92N4uwh59po1AcOinNpww=";
   };
 
   structuredExtraConfig = with lib.kernel; {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/linux-zen.nix b/nixpkgs/pkgs/os-specific/linux/kernel/linux-zen.nix
index 1c064059047e..df740845b6ff 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/linux-zen.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/linux-zen.nix
@@ -2,7 +2,7 @@
 
 let
   # having the full version string here makes it easier to update
-  modDirVersion = "5.14.3-zen1";
+  modDirVersion = "5.14.8-zen1";
   parts = lib.splitString "-" modDirVersion;
   version = lib.elemAt parts 0;
   suffix = lib.elemAt parts 1;
@@ -19,7 +19,7 @@ buildLinux (args // {
     owner = "zen-kernel";
     repo = "zen-kernel";
     rev = "v${modDirVersion}";
-    sha256 = "sha256-ByewBT+1z83jCuEMmNvtmhHaEk4qjHa2Kgue8wVfPIY=";
+    sha256 = "sha256-hquMBDjP4fBMNdjxxnJJKx/oVNd2DwBPmVpZQeEQvHQ=";
   };
 
   structuredExtraConfig = with lib.kernel; {
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix b/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
index 12eca63e2162..9c67df13d314 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -56,6 +56,7 @@ let
   # Dependencies that are required to build kernel modules
   moduleBuildDependencies = optional (lib.versionAtLeast version "4.14") libelf;
 
+
   installkernel = writeTextFile { name = "installkernel"; executable=true; text = ''
     #!${stdenv.shell} -e
     mkdir -p $4
@@ -88,6 +89,8 @@ let
 
       isModular = config.isYes "MODULES";
 
+      buildDTBs = kernelConf.DTB or false;
+
       installsFirmware = (config.isEnabled "FW_LOADER") &&
         (isModular || (config.isDisabled "FIRMWARE_IN_KERNEL")) &&
         (lib.versionOlder version "4.14");
@@ -175,15 +178,16 @@ let
         "KBUILD_BUILD_VERSION=1-NixOS"
         kernelConf.target
         "vmlinux"  # for "perf" and things like that
-      ]
-      ++ optional isModular "modules"
+      ] ++ optional isModular "modules"
+        ++ optional buildDTBs "dtbs"
       ++ extraMakeFlags;
 
       installFlags = [
         "INSTALLKERNEL=${installkernel}"
         "INSTALL_PATH=$(out)"
       ] ++ (optional isModular "INSTALL_MOD_PATH=$(out)")
-      ++ optional installsFirmware "INSTALL_FW_PATH=$(out)/lib/firmware";
+      ++ optional installsFirmware "INSTALL_FW_PATH=$(out)/lib/firmware"
+      ++ optionals buildDTBs ["dtbs_install" "INSTALL_DTBS_PATH=$(out)/dtbs"];
 
       preInstall = ''
         installFlagsArray+=("-j$NIX_BUILD_CORES")
@@ -199,9 +203,7 @@ let
 
       postInstall = (optionalString installsFirmware ''
         mkdir -p $out/lib/firmware
-      '') + (if (kernelConf.DTB or false) then ''
-        make $makeFlags "''${makeFlagsArray[@]}" dtbs dtbs_install INSTALL_DTBS_PATH=$out/dtbs
-      '' else "") + (if isModular then ''
+      '') + (if isModular then ''
         mkdir -p $dev
         cp vmlinux $dev/
         if [ -z "''${dontStrip-}" ]; then
@@ -261,8 +263,7 @@ let
         find .  -type f -name '*.lds' -print0 | xargs -0 -r chmod u-w
 
         # Keep root and arch-specific Makefiles
-        chmod u-w Makefile
-        chmod u-w arch/$arch/Makefile*
+        chmod u-w Makefile arch/"$arch"/Makefile*
 
         # Keep whole scripts dir
         chmod u-w -R scripts
@@ -316,12 +317,10 @@ stdenv.mkDerivation ((drvAttrs config stdenv.hostPlatform.linux-kernel kernelPat
       ++ optional  (lib.versionAtLeast version "4.14" && lib.versionOlder version "5.8") libelf
       # Removed util-linuxMinimal since it should not be a dependency.
       ++ optionals (lib.versionAtLeast version "4.16") [ bison flex ]
-      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole ]
+      ++ optionals (lib.versionAtLeast version "5.2")  [ cpio pahole zlib ]
       ++ optional  (lib.versionAtLeast version "5.8")  elfutils
       ;
 
-  buildInputs = optional (lib.versionAtLeast version "5.2") zlib;
-
   hardeningDisable = [ "bindnow" "format" "fortify" "stackprotector" "pic" "pie" ];
 
   # Absolute paths for compilers avoid any PATH-clobbering issues.
diff --git a/nixpkgs/pkgs/os-specific/linux/kernel/perf.nix b/nixpkgs/pkgs/os-specific/linux/kernel/perf.nix
index b58bca352e63..045f80ce9ac2 100644
--- a/nixpkgs/pkgs/os-specific/linux/kernel/perf.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kernel/perf.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, kernel, elfutils, python2, python3, perl, newt, slang, asciidoc, xmlto, makeWrapper
-, docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkg-config, libunwind, binutils
+, docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkg-config, libunwind, binutils-unwrapped
 , libiberty, audit, libbfd, libopcodes, openssl, systemtap, numactl
 , zlib
 , withGtk ? false, gtk2
@@ -54,7 +54,6 @@ stdenv.mkDerivation {
     "-Wno-error=cpp"
     "-Wno-error=bool-compare"
     "-Wno-error=deprecated-declarations"
-    "-DOBJDUMP_PATH=\"${binutils}/bin/objdump\""
     "-Wno-error=stringop-truncation"
   ];
 
@@ -69,8 +68,9 @@ stdenv.mkDerivation {
   installFlags = [ "install" "install-man" "ASCIIDOC8=1" "prefix=$(out)" ];
 
   preFixup = ''
+    # pull in 'objdump' into PATH to make annotations work
     wrapProgram $out/bin/perf \
-      --prefix PATH : "${binutils}/bin"
+      --prefix PATH : "${binutils-unwrapped}/bin"
   '';
 
   meta = {
diff --git a/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
index 21d803e2b721..6e6eecd49319 100644
--- a/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/kexec-tools/default.nix
@@ -29,6 +29,13 @@ stdenv.mkDerivation rec {
       url = "https://src.fedoraproject.org/rpms/kexec-tools/raw/cb1e5463b5298b064e9b6c86ad6fe3505fec9298/f/kexec-tools-2.0.20-fix-broken-multiboot2-buliding-for-i386.patch";
       sha256 = "1kzmcsbhwfdgxlc5s88ir0n494phww1j16yk0z42x09qlkxxkg0l";
     })
+
+    (fetchpatch {
+      # upstream build fix against -fno-common compilers like >=gcc-10
+      name = "fno-common.patch";
+      url = "https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/patch/?id=cc087b11462af9f971a2c090d07e8d780a867b50";
+      sha256 = "043hcsy6m14h64p6b9w25c7a3y0f487322dj81l6mbm6sws6s9lv";
+    })
   ];
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix b/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
index 732ad88c70db..e90c08942096 100644
--- a/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/libsepol/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, flex }:
+{ lib, stdenv, fetchurl, fetchpatch, flex }:
 
 stdenv.mkDerivation rec {
   pname = "libsepol";
@@ -13,6 +13,20 @@ stdenv.mkDerivation rec {
     sha256 = "0ygb6dh5lng91xs6xiqf5v0nxa68qmjc787p0s5h9w89364f2yjv";
   };
 
+  patches = [
+    # upstream build fix against -fno-common compilers like >=gcc-10
+    (fetchpatch {
+      url = "https://github.com/SELinuxProject/selinux/commit/a96e8c59ecac84096d870b42701a504791a8cc8c.patch";
+      sha256 = "0aybv4kzbhx8xq6s82dsh4ib76k59qzh2bgxmk44iq5cjnqn5rd6";
+      stripLen = 1;
+    })
+    (fetchpatch {
+      url = "https://github.com/SELinuxProject/selinux/commit/3d32fc24d6aff360a538c63dad08ca5c957551b0.patch";
+      sha256 = "1mphwdlj4d6mwmsp5xkpf6ci4rxhgbi3fm79d08h4jbzxaf4wny4";
+      stripLen = 1;
+    })
+  ];
+
   postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
     substituteInPlace src/Makefile --replace 'all: $(LIBA) $(LIBSO)' 'all: $(LIBA)'
     sed -i $'/^\t.*LIBSO/d' src/Makefile
diff --git a/nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix b/nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix
index fda11400e8f5..3590f87e37ad 100644
--- a/nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/lm-sensors/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, bash
 , bison
 , flex
 , which
@@ -24,7 +25,8 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ bison flex which ];
-  buildInputs = [ perl ]
+  # bash is required for correctly replacing the shebangs in all tools for cross-compilation.
+  buildInputs = [ bash perl ]
     ++ lib.optional sensord rrdtool;
 
   makeFlags = [
diff --git a/nixpkgs/pkgs/os-specific/linux/mceinject/default.nix b/nixpkgs/pkgs/os-specific/linux/mceinject/default.nix
new file mode 100644
index 000000000000..3e89ed83361f
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/mceinject/default.nix
@@ -0,0 +1,38 @@
+{ lib, stdenv, fetchFromGitHub, bison, flex }:
+
+stdenv.mkDerivation rec {
+  pname = "mceinject";
+  version = "unstable-2013-01-19";
+
+  src = fetchFromGitHub {
+    owner  = "andikleen";
+    repo   = "mce-inject";
+    rev    = "4cbe46321b4a81365ff3aafafe63967264dbfec5";
+    sha256 = "0gjapg2hrlxp8ssrnhvc19i3r1xpcnql7xv0zjgbv09zyha08g6z";
+  };
+
+  nativeBuildInputs = [ flex bison ];
+
+  NIX_CFLAGS_COMPILE = "-Os -g -Wall";
+
+  NIX_LDFLAGS = [ "-lpthread" ];
+
+  makeFlags = [ "prefix=" ];
+
+  enableParallelBuilding = true;
+
+  installFlags = [ "destdir=$(out)" "manprefix=/share" ];
+
+  meta = with lib; {
+    description = "A tool to inject machine checks into x86 kernel for testing";
+    longDescription = ''
+      mce-inject allows to inject machine check errors on the software level
+      into a running Linux kernel. This is intended for validation of the
+      kernel machine check handler.
+    '';
+    homepage = "https://github.com/andikleen/mce-inject/";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ arkivm ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/mdevd/default.nix b/nixpkgs/pkgs/os-specific/linux/mdevd/default.nix
index 58299ba5e878..fe549e880a4d 100644
--- a/nixpkgs/pkgs/os-specific/linux/mdevd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/mdevd/default.nix
@@ -4,8 +4,8 @@ with skawarePackages;
 
 buildPackage {
   pname = "mdevd";
-  version = "0.1.4.0";
-  sha256 = "1lnwk7qa6x7iia0v12i2jckg42ypi35hk3sa7cjm23ngnhiv5lzz";
+  version = "0.1.5.0";
+  sha256 = "01ykxgnbm53wijdrbld10664xy2wkvyzbbs98mfnqnf4h1y064n0";
 
   description = "mdev-compatible Linux hotplug manager daemon";
   platforms = lib.platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix b/nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix
index 241498057232..13e989243646 100644
--- a/nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/multipath-tools/default.nix
@@ -19,9 +19,11 @@ stdenv.mkDerivation rec {
     substituteInPlace libmultipath/Makefile \
       --replace /usr/include/libdevmapper.h ${lib.getDev lvm2}/include/libdevmapper.h
 
+    # systemd-udev-settle.service is deprecated.
     substituteInPlace multipathd/multipathd.service \
       --replace /sbin/modprobe ${lib.getBin kmod}/sbin/modprobe \
-      --replace /sbin/multipathd "$out/bin/multipathd"
+      --replace /sbin/multipathd "$out/bin/multipathd" \
+      --replace " systemd-udev-settle.service" ""
 
     sed -i -re '
       s,^( *#define +DEFAULT_MULTIPATHDIR\>).*,\1 "'"$out/lib/multipath"'",
diff --git a/nixpkgs/pkgs/os-specific/linux/numad/default.nix b/nixpkgs/pkgs/os-specific/linux/numad/default.nix
index 0526c02f75f8..24fc9e188741 100644
--- a/nixpkgs/pkgs/os-specific/linux/numad/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/numad/default.nix
@@ -1,12 +1,13 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchgit }:
 
 stdenv.mkDerivation rec {
   pname = "numad";
   version = "0.5";
 
-  src = fetchurl {
-    url = "https://git.fedorahosted.org/cgit/numad.git/snapshot/numad-${version}.tar.xz";
-    sha256 = "08zd1yc3w00yv4mvvz5sq1gf91f6p2s9ljcd72m33xgnkglj60v4";
+  src = fetchgit {
+    url = "https://pagure.io/numad.git";
+    rev = "334278ff3d774d105939743436d7378a189e8693";
+    sha256 = "sha256-6nrbfooUI1ufJhsPf68li5584oKQcznXQlxfpStuX5I=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
index 6d21a4fca61b..a8655596c513 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -27,10 +27,10 @@ rec {
     else legacy_390;
 
   beta = generic {
-    version = "470.42.01";
-    sha256_64bit = "04w9nmi3vyww07pmgbd2r1x37s5p6xiy4qg9s06a1kjwzpm59xfd";
-    settingsSha256 = "Ohbkm7j0/V0kzcxfsHujBkrdnaefneoLutf2Rju2hIQ=";
-    persistencedSha256 = "1gfj4ffkidbhgjzdi6sv2sngdcb27w7b0rvfnj129rs36mcxy02j";
+    version = "495.29.05";
+    sha256_64bit = "sha256-9yVLl9QAxpJQR5ZJb059j2TpOx4xxCeGCk8hmhhvEl4=";
+    settingsSha256 = "sha256-dcEI+3bxSTwVbHcR6IgvIUFt4vWtK5T4NMGVhmmeVJ0=";
+    persistencedSha256 = "sha256-OT/hOXEPatc6pAKrxDe0jsmaDFCtVXAbdW4elKe6xE8=";
   };
 
   # Vulkan developer beta driver
diff --git a/nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix b/nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix
index 3a3065084881..57d59c27b6e6 100644
--- a/nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/nvme-cli/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nvme-cli";
-  version = "1.14";
+  version = "1.15";
 
   src = fetchFromGitHub {
     owner = "linux-nvme";
     repo = "nvme-cli";
     rev = "v${version}";
-    sha256 = "0dpadz945482srqpsbfx1bh7rc499fgpyzz1flhk9g9xjbpapkzc";
+    sha256 = "0qr1wa163cb7z6g083nl3zcc28mmlbxh1m97pd54bp3gyrhmdhhr";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/nixpkgs/pkgs/os-specific/linux/powertop/default.nix b/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
index 79594a87c515..b8a0487bc7e7 100644
--- a/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/powertop/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, gettext, libnl, ncurses, pciutils
+{ lib, stdenv, fetchFromGitHub, gettext, libnl, ncurses, pciutils
 , pkg-config, zlib, autoreconfHook }:
 
 stdenv.mkDerivation rec {
@@ -17,14 +17,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config autoreconfHook ];
   buildInputs = [ gettext libnl ncurses pciutils zlib ];
 
-  patches = lib.optional stdenv.hostPlatform.isMusl (
-    fetchpatch {
-      name = "strerror_r.patch";
-      url = "https://git.alpinelinux.org/aports/plain/main/powertop/strerror_r.patch?id=3b9214d436f1611f297b01f72469d66bfe729d6e";
-      sha256 = "1kzddhcrb0n2iah4lhgxwwy4mkhq09ch25jjngyq6pdj6pmfkpfw";
-    }
-  );
-
   NIX_LDFLAGS = [ "-lpthread" ];
 
   postPatch = ''
@@ -36,7 +28,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Analyze power consumption on Intel-based laptops";
     homepage = "https://01.org/powertop";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ fpletz ];
     platforms = platforms.linux;
   };
diff --git a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
index 242a4d03811f..ae7fee77309a 100644
--- a/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rdma-core/default.nix
@@ -2,18 +2,16 @@
 , pandoc, ethtool, iproute2, libnl, udev, python3, perl
 } :
 
-let
-  version = "36.0";
 
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "rdma-core";
-  inherit version;
+  version = "37.0";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${version}";
-    sha256 = "0x3mpwmhln6brwrwix9abdq1bs9zi4qnr3r64vwqk7l6f43mqd30";
+    sha256 = "0cz6dq34w0zxm1c6xk4pqascvvppa1b0m8jfnpncg5a68day8x65";
   };
 
   nativeBuildInputs = [ cmake pkg-config pandoc docutils ];
diff --git a/nixpkgs/pkgs/os-specific/linux/rewritefs/default.nix b/nixpkgs/pkgs/os-specific/linux/rewritefs/default.nix
index f7c79106c41d..e78d5f2d164c 100644
--- a/nixpkgs/pkgs/os-specific/linux/rewritefs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/rewritefs/default.nix
@@ -1,21 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, fuse3, fuse, pcre }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, fuse3, pcre }:
 
 stdenv.mkDerivation {
   pname = "rewritefs";
-  version = "2020-02-21";
+  version = "unstable-2021-10-03";
 
   src = fetchFromGitHub {
     owner  = "sloonz";
     repo   = "rewritefs";
-    rev    = "bc241c7f81e626766786b56cf71d32c1a6ad510c";
-    sha256 = "0zj2560hcbg5az0r8apnv0zz9b22i9r9w6rlih0rbrn673xp7q2i";
+    rev    = "3a56de8b5a2d44968b8bc3885c7d661d46367306";
+    sha256 = "1w2rik0lhqm3wr68x51zs45gqfx79l7fi4p0sqznlfq7sz5s8xxn";
   };
 
   nativeBuildInputs = [ pkg-config ];
-  # Note: fuse is needed solely because (unlike fuse3) it exports ulockmgr.h.
-  # This library was removed in fuse 3 to be distributed separately, but
-  # apparently it's not.
-  buildInputs = [ fuse3 fuse pcre ];
+  buildInputs = [ fuse3 pcre ];
 
   prePatch = ''
     # do not set sticky bit in nix store
diff --git a/nixpkgs/pkgs/os-specific/linux/s6-linux-init/default.nix b/nixpkgs/pkgs/os-specific/linux/s6-linux-init/default.nix
index f618fa7d8daf..5d579c3ab2ad 100644
--- a/nixpkgs/pkgs/os-specific/linux/s6-linux-init/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/s6-linux-init/default.nix
@@ -4,8 +4,8 @@ with skawarePackages;
 
 buildPackage {
   pname = "s6-linux-init";
-  version = "1.0.6.3";
-  sha256 = "1idqjcxhl5wgff8yrsvx2812wahjri2hcs7qs6k62g0sdd8niqr9";
+  version = "1.0.6.4";
+  sha256 = "0grqk111d6aqym1c4l9j26fdqcgra1hvwb9vdgylrfbvn1c3hlpb";
 
   description = "A set of minimalistic tools used to create a s6-based init system, including a /sbin/init binary, on a Linux kernel";
   platforms = lib.platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/s6-linux-utils/default.nix b/nixpkgs/pkgs/os-specific/linux/s6-linux-utils/default.nix
index 3596ab23e72b..06a177f1cc62 100644
--- a/nixpkgs/pkgs/os-specific/linux/s6-linux-utils/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/s6-linux-utils/default.nix
@@ -4,8 +4,8 @@ with skawarePackages;
 
 buildPackage {
   pname = "s6-linux-utils";
-  version = "2.5.1.5";
-  sha256 = "1fj5ldlrc6bx40pphg29rp3byd6fal6869v85kw86c2kdgrxn063";
+  version = "2.5.1.6";
+  sha256 = "0hr49nl0d7a6i5w8cfg43xzvzayb8kpqij9xg7bmw2fyvc2z338z";
 
   description = "A set of minimalistic Linux-specific system utilities";
   platforms = lib.platforms.linux;
diff --git a/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c b/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c
index bb71a732bf99..3ad3cbc69063 100644
--- a/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c
+++ b/nixpkgs/pkgs/os-specific/linux/sdnotify-wrapper/sdnotify-wrapper.c
@@ -2,9 +2,9 @@
    Copyright: (C)2015-2020 Laurent Bercot.  http://skarnet.org/
    ISC license. See http://opensource.org/licenses/ISC
 
-   Build-time requirements: skalibs.  http://skarnet.org/software/skalibs/
+   Build-time requirements: skalibs.  https://skarnet.org/software/skalibs/
    Run-time requirements: none, if you link skalibs statically.
- 
+
    Compilation:
      gcc -o sdnotify-wrapper -L/usr/lib/skalibs sdnotify-wrapper.c -lskarnet
    Use /usr/lib/skalibs/libskarnet.a instead of -lskarnet to link statically.
@@ -67,8 +67,6 @@
 #include <skalibs/tai.h>
 #include <skalibs/iopause.h>
 #include <skalibs/djbunix.h>
-//#include <skalibs/webipc.h>
-// svanderburg: This header no longer exists, but socket.h provides the functions this module needs
 #include <skalibs/socket.h>
 #include <skalibs/exec.h>
 
@@ -106,7 +104,7 @@ static inline int run_child (int fd, unsigned int timeout, pid_t pid, char const
 {
   char dummy[4096] ;
   iopause_fd x = { .fd = fd, .events = IOPAUSE_READ } ;
-  tain_t deadline ;
+  tain deadline ;
   tain_now_g() ;
   if (timeout) tain_from_millisecs(&deadline, timeout) ;
   else deadline = tain_infinite_relative ;
@@ -135,7 +133,7 @@ int main (int argc, char const *const *argv)
   int df = 1, keep = 0 ;
   PROG = "sdnotify-wrapper" ;
   {
-    subgetopt_t l = SUBGETOPT_ZERO ;
+    subgetopt l = SUBGETOPT_ZERO ;
     for (;;)
     {
       int opt = subgetopt_r(argc, argv, "d:ft:k", &l) ;
diff --git a/nixpkgs/pkgs/os-specific/linux/sydbox/default.nix b/nixpkgs/pkgs/os-specific/linux/sydbox/default.nix
new file mode 100644
index 000000000000..bdaf77147f2e
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/sydbox/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, autoreconfHook
+, python3
+, perl
+, libxslt
+, docbook_xsl
+, docbook_xml_dtd_42
+, libseccomp
+, installTests ? true, gnumake, which
+, debugBuild ? false, libunwind
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sydbox-1";
+  version = "2.2.0";
+
+  outputs = [ "out" "dev" "man" "doc" ]
+    ++ lib.optional installTests "installedTests";
+
+  src = fetchurl {
+    url = "https://git.exherbo.org/${pname}.git/snapshot/${pname}-${version}.tar.xz";
+    sha256 = "0664myrrzbvsw73q5b7cqwgv4hl9a7vkm642s1r96gaxm16jk0z7";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+    python3
+    perl
+    libxslt.bin
+    docbook_xsl
+    docbook_xml_dtd_42
+  ];
+
+  buildInputs = [
+    libseccomp
+  ] ++ lib.optional debugBuild libunwind
+    ++ lib.optionals installTests [
+      gnumake
+      python3
+      perl
+      which
+    ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [ ]
+    ++ lib.optionals installTests [ "--enable-installed-tests"
+      "--libexecdir=${placeholder "installedTests"}/libexec" ]
+    ++ lib.optional debugBuild "--enable-debug";
+
+  makeFlags = [ "SYD_INCLUDEDIR=${stdenv.cc.libc.dev}/include" ];
+
+  doCheck = true;
+  checkPhase = ''
+    # Many of the regular test cases in t/ do not work inside the build sandbox
+    make -C syd check
+  '';
+
+  postInstall = if installTests then ''
+    moveToOutput bin/syd-test $installedTests
+  '' else ''
+    # Tests are installed despite --disable-installed-tests
+    rm -r $out/bin/syd-test $out/libexec
+  '';
+
+  meta = with lib; {
+    homepage = "https://sydbox.exherbo.org/";
+    description = "seccomp-based application sandbox";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mvs ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/system76-acpi/default.nix b/nixpkgs/pkgs/os-specific/linux/system76-acpi/default.nix
index f642fad69787..b384cf639487 100644
--- a/nixpkgs/pkgs/os-specific/linux/system76-acpi/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/system76-acpi/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 let
-  version = "1.0.1";
-  sha256 = "0jmm9h607f7k20yassm6af9mh5l00yih5248wwv4i05bd68yw3p5";
+  version = "1.0.2";
+  sha256 = "1i7zjn5cdv9h00fgjg46b8yrz4d3dqvfr25g3f13967ycy58m48h";
 in
 stdenv.mkDerivation {
   name = "system76-acpi-module-${version}-${kernel.version}";
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
     maintainers = [ maintainers.khumba ];
     license = [ licenses.gpl2Only ];
     platforms = [ "i686-linux" "x86_64-linux" ];
-    broken = versionOlder kernel.version "4.14";
+    broken = kernel.kernelOlder "5.2";
     description = "System76 ACPI Driver (DKMS)";
     homepage = "https://github.com/pop-os/system76-acpi-dkms";
     longDescription = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/system76-power/default.nix b/nixpkgs/pkgs/os-specific/linux/system76-power/default.nix
index 38ce20deeab8..8ef0e40312f5 100644
--- a/nixpkgs/pkgs/os-specific/linux/system76-power/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/system76-power/default.nix
@@ -2,19 +2,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "system76-power";
-  version = "1.1.17";
+  version = "1.1.18";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "system76-power";
     rev = version;
-    sha256 = "sha256-9ndukZPNB0qtU0hA9eUYpiAC8Tw1eF16W+sVU7XKvsg=";
+    sha256 = "1zm06ywc3siwh2fpb8p7lp3xqjy4c08j8c8lipd6dyy3bakjh4r1";
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus libusb1 ];
 
-  cargoSha256 = "sha256-6mtBY77d2WAwTpj+g0KVpW/n39uanAL2GNHWC8Qbtqk=";
+  cargoSha256 = "0hda8cxa1pjz90bg215qmx5x2scz9mawq7irxbsw6zmcm7wahlii";
 
   postInstall = ''
     install -D -m 0644 data/system76-power.conf $out/etc/dbus-1/system.d/system76-power.conf
diff --git a/nixpkgs/pkgs/os-specific/linux/system76/default.nix b/nixpkgs/pkgs/os-specific/linux/system76/default.nix
index 84c153c2f82e..7d9cd9bde024 100644
--- a/nixpkgs/pkgs/os-specific/linux/system76/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/system76/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, kernel }:
 let
-  version = "1.0.9";
-  sha256 = "0i4825y2vd679kdjv30ifzj1i1066d3x37z4lgk39hx16993k162";
+  version = "1.0.13";
+  sha256 = "162hhmnww8z9k0795ffs8v3f61hlfm375law156sk5l08if19a4r";
 in
 stdenv.mkDerivation {
   name = "system76-module-${version}-${kernel.version}";
diff --git a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
index 9f92c34cee6b..3af70ff9151c 100644
--- a/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/systemd/default.nix
@@ -32,7 +32,7 @@
 , acl
 , lz4
 , libgcrypt
-, libgpgerror
+, libgpg-error
 , libidn2
 , curl
 , gnutar
@@ -105,7 +105,7 @@
 , docbook_xml_dtd_45
 }:
 
-assert withResolved -> (libgcrypt != null && libgpgerror != null);
+assert withResolved -> (libgcrypt != null && libgpg-error != null);
 assert withImportd ->
 (curl.dev != null && zlib != null && xz != null && libgcrypt != null
   && gnutar != null && gnupg != null && withCompression);
@@ -184,9 +184,6 @@ stdenv.mkDerivation {
     substituteInPlace src/basic/path-util.h --replace "@defaultPathNormal@" "${placeholder "out"}/bin/"
     substituteInPlace src/boot/efi/meson.build \
       --replace \
-      "find_program('ld'" \
-      "find_program('${stdenv.cc.bintools.targetPrefix}ld'" \
-      --replace \
       "find_program('objcopy'" \
       "find_program('${stdenv.cc.bintools.targetPrefix}objcopy'"
   '' + (
@@ -350,7 +347,7 @@ stdenv.mkDerivation {
     ++ lib.optional withLibseccomp libseccomp
     ++ lib.optional withNetworkd iptables
     ++ lib.optional withPCRE2 pcre2
-    ++ lib.optional withResolved libgpgerror
+    ++ lib.optional withResolved libgpg-error
     ++ lib.optional withSelinux libselinux
     ++ lib.optional withRemote libmicrohttpd
     ++ lib.optionals withHomed [ p11-kit ]
@@ -408,6 +405,7 @@ stdenv.mkDerivation {
     "-Dsmack=true"
     "-Db_pie=true"
     "-Dinstall-sysconfdir=false"
+    "-Defi-ld=${stdenv.cc.bintools.targetPrefix}ld"
     /*
       As of now, systemd doesn't allow runtime configuration of these values. So
       the settings in /etc/login.defs have no effect on it. Many people think this
diff --git a/nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix b/nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix
index 5ee5b0bda57f..c783c7924b59 100644
--- a/nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/sysvinit/default.nix
@@ -1,13 +1,13 @@
 { lib, stdenv, fetchurl, withoutInitTools ? false }:
 
-let version = "2.99"; in
+let version = "3.00"; in
 
 stdenv.mkDerivation {
   name = (if withoutInitTools then "sysvtools" else "sysvinit") + "-" + version;
 
   src = fetchurl {
     url = "mirror://savannah/sysvinit/sysvinit-${version}.tar.xz";
-    sha256 = "sha256-sFw2d7tpiv5kyZeWiwDEmyqb0yDOljUjIw7n6kEZd1c=";
+    sha256 = "sha256-7WvCCttnNTiYQefT64ZQ+nUMdq8gv07XOxMwpNTBQBc=";
   };
 
   prePatch = ''
diff --git a/nixpkgs/pkgs/os-specific/linux/tbs/default.nix b/nixpkgs/pkgs/os-specific/linux/tbs/default.nix
index f2a7b692baa3..54268693454c 100644
--- a/nixpkgs/pkgs/os-specific/linux/tbs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/tbs/default.nix
@@ -59,6 +59,6 @@ in stdenv.mkDerivation {
     license = licenses.gpl2;
     maintainers = with maintainers; [ ck3d ];
     priority = -1;
-    broken = lib.versionAtLeast kernel.version "4.18";
+    broken = true;
   };
 }
diff --git a/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix b/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix
new file mode 100644
index 000000000000..708237e5184c
--- /dev/null
+++ b/nixpkgs/pkgs/os-specific/linux/waydroid/default.nix
@@ -0,0 +1,58 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, python3Packages
+, dnsmasq
+, lxc
+, nftables
+, python
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "waydroid";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "0cabh7rysh2v15wrxg250370mw26s5d073yxmczxsarbp4ri2pl4";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    gbinder-python
+    pygobject3
+  ];
+
+  dontUseSetuptoolsBuild = true;
+  dontUsePipInstall = true;
+  dontUseSetuptoolsCheck = true;
+  dontWrapPythonPrograms = true;
+
+  installPhase = ''
+    mkdir -p $out/${python3Packages.python.sitePackages}
+
+    cp -ra tools $out/${python3Packages.python.sitePackages}/tools
+
+    cp -ra data $out/${python3Packages.python.sitePackages}/data
+    wrapProgram $out/${python3Packages.python.sitePackages}/data/scripts/waydroid-net.sh \
+       --prefix PATH ":" ${lib.makeBinPath [ dnsmasq nftables ]}
+
+    mkdir -p $out/share/waydroid/gbinder.d
+    cp gbinder/anbox.conf $out/share/waydroid/gbinder.d/anbox.conf
+
+    mkdir $out/bin
+    cp -a waydroid.py $out/${python3Packages.python.sitePackages}/waydroid.py
+    ln -s $out/${python3Packages.python.sitePackages}/waydroid.py $out/bin/waydroid
+
+    wrapPythonProgramsIn $out/${python3Packages.python.sitePackages} "$out ${python3Packages.gbinder-python} ${python3Packages.pygobject3} ${lxc}"
+  '';
+
+  meta = with lib; {
+    description = "Waydroid is a container-based approach to boot a full Android system on a regular GNU/Linux system like Ubuntu.";
+    homepage = "https://github.com/waydroid/waydroid";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mcaju ];
+  };
+}
diff --git a/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix b/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
index 1dbe281e0967..656fa477768a 100644
--- a/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/wpa_supplicant/default.nix
@@ -1,4 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, openssl, pkg-config, libnl
+, nixosTests
 , withDbus ? true, dbus
 , withReadline ? true, readline
 , withPcsclite ? true, pcsclite
@@ -139,6 +140,10 @@ stdenv.mkDerivation rec {
     install -Dm444 wpa_supplicant.conf $out/share/doc/wpa_supplicant/wpa_supplicant.conf.example
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) wpa_supplicant;
+  };
+
   meta = with lib; {
     homepage = "https://w1.fi/wpa_supplicant/";
     description = "A tool for connecting to WPA and WPA2-protected wireless networks";
diff --git a/nixpkgs/pkgs/os-specific/linux/zfs/default.nix b/nixpkgs/pkgs/os-specific/linux/zfs/default.nix
index 2d1775dac63e..cd25f0e981bd 100644
--- a/nixpkgs/pkgs/os-specific/linux/zfs/default.nix
+++ b/nixpkgs/pkgs/os-specific/linux/zfs/default.nix
@@ -140,6 +140,9 @@ let
         "INSTALL_MOD_PATH=\${out}"
       ];
 
+      # Enabling BTF causes zfs to be build with debug symbols.
+      # Since zfs compress kernel modules on installation, our strip hooks skip stripping them.
+      # Hence we strip modules prior to compression.
       postBuild = optionalString buildKernel ''
          find . -name "*.ko" -print0 | xargs -0 -P$NIX_BUILD_CORES strip --strip-debug
       '';