about summary refs log tree commit diff
path: root/pkgs/os-specific/linux
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific/linux')
-rw-r--r--pkgs/os-specific/linux/android-udev-rules/default.nix4
-rw-r--r--pkgs/os-specific/linux/apfs/default.nix4
-rw-r--r--pkgs/os-specific/linux/eventstat/default.nix4
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch138
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/default.nix395
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch13
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch14
-rw-r--r--pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch49
-rw-r--r--pkgs/os-specific/linux/firmware/sof-firmware/default.nix12
-rw-r--r--pkgs/os-specific/linux/health-check/default.nix4
-rw-r--r--pkgs/os-specific/linux/intel-compute-runtime/default.nix4
-rw-r--r--pkgs/os-specific/linux/iotop-c/default.nix1
-rw-r--r--pkgs/os-specific/linux/iotop/default.nix1
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix36
-rw-r--r--pkgs/os-specific/linux/kernel/generic.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/patches.json60
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json16
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix10
-rw-r--r--pkgs/os-specific/linux/kmscube/default.nix35
-rw-r--r--pkgs/os-specific/linux/ksmbd-tools/default.nix1
-rw-r--r--pkgs/os-specific/linux/libnl-tiny/default.nix6
-rw-r--r--pkgs/os-specific/linux/linuxptp/default.nix5
-rw-r--r--pkgs/os-specific/linux/mdevctl/default.nix6
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/default.nix4
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh2
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/test/repl.nix146
-rw-r--r--pkgs/os-specific/linux/nsncd/default.nix19
-rw-r--r--pkgs/os-specific/linux/nss_ldap/default.nix8
-rwxr-xr-xpkgs/os-specific/linux/nvidia-x11/builder.sh8
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix18
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/generic.nix5
-rw-r--r--pkgs/os-specific/linux/rdma-core/default.nix4
-rw-r--r--pkgs/os-specific/linux/rtl8812au/default.nix6
-rw-r--r--pkgs/os-specific/linux/rtl88x2bu/default.nix6
-rw-r--r--pkgs/os-specific/linux/sasutils/default.nix4
-rw-r--r--pkgs/os-specific/linux/systemd/default.nix8
38 files changed, 332 insertions, 742 deletions
diff --git a/pkgs/os-specific/linux/android-udev-rules/default.nix b/pkgs/os-specific/linux/android-udev-rules/default.nix
index 7765ce0aa52a3..a99100ad8f4ef 100644
--- a/pkgs/os-specific/linux/android-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/android-udev-rules/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20231207";
+  version = "20240114";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    hash = "sha256-wNGIDOHbQ4qtKqtGqLOGEopWgnox3cATY77daRNVUFM=";
+    hash = "sha256-qf+KcEcWOsgLMifUOqNbi5t4s62p1gUfna45MyD01U0=";
   };
 
   installPhase = ''
diff --git a/pkgs/os-specific/linux/apfs/default.nix b/pkgs/os-specific/linux/apfs/default.nix
index 0c8d7cb989d46..28505f8c9eee4 100644
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  tag = "0.3.6";
+  tag = "0.3.7";
 in
 stdenv.mkDerivation {
   pname = "apfs";
@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     owner = "linux-apfs";
     repo = "linux-apfs-rw";
     rev = "v${tag}";
-    hash = "sha256-k62PgUffBx6ZrWWLeX460adh/vv6XWxSmtEiwaWxiaU=";
+    hash = "sha256-LmUaIKZ1Msc4yAXNMzyDhPCPsQYeYnUbRF6pA9WvHYk=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/eventstat/default.nix b/pkgs/os-specific/linux/eventstat/default.nix
index 2c139cd3c865c..0de1ded835435 100644
--- a/pkgs/os-specific/linux/eventstat/default.nix
+++ b/pkgs/os-specific/linux/eventstat/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eventstat";
-  version = "0.05.01";
+  version = "0.06.00";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-raODDA1EKtZThFg0NV6EfrWj5mSQNaiekywfOfAvYXI=";
+    hash = "sha256-lCtXILpZn1/laRnsfE5DlQQQKKvfHxOJu87SkpWKeTE=";
   };
 
   buildInputs = [ ncurses ];
diff --git a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch b/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
deleted file mode 100644
index 4e95ccea8dc11..0000000000000
--- a/pkgs/os-specific/linux/firmware/fwupd/add-option-for-installation-sysconfdir.patch
+++ /dev/null
@@ -1,138 +0,0 @@
-diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
-index b0ff5b106..13ac380d0 100644
---- a/data/bios-settings.d/meson.build
-+++ b/data/bios-settings.d/meson.build
-@@ -1,5 +1,5 @@
- if build_standalone and host_machine.system() == 'linux'
- install_data('README.md',
--  install_dir: join_paths(sysconfdir, 'fwupd', 'bios-settings.d')
-+  install_dir: join_paths(sysconfdir_install, 'fwupd', 'bios-settings.d')
- )
- endif
-diff --git a/data/meson.build b/data/meson.build
-index e13da4adf..6858c240f 100644
---- a/data/meson.build
-+++ b/data/meson.build
-@@ -26,7 +26,7 @@ endif
-
- if build_standalone
-   install_data(['fwupd.conf'],
--    install_dir: join_paths(sysconfdir, 'fwupd'),
-+    install_dir: join_paths(sysconfdir_install, 'fwupd'),
-     install_mode: 'rw-r-----',
-   )
-   plugin_quirks += files([
-diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 3649fecea..c3462744b 100644
---- a/data/pki/meson.build
-+++ b/data/pki/meson.build
-@@ -12,13 +12,13 @@ install_data([
-     'GPG-KEY-Linux-Foundation-Firmware',
-     'GPG-KEY-Linux-Vendor-Firmware-Service',
-   ],
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
- )
- install_data([
-     'GPG-KEY-Linux-Foundation-Metadata',
-     'GPG-KEY-Linux-Vendor-Firmware-Service',
-   ],
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
- )
- endif
-
-@@ -26,11 +26,11 @@ if supported_pkcs7
- install_data([
-     'LVFS-CA.pem',
-   ],
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd')
- )
- install_data([
-     'LVFS-CA.pem',
-   ],
--  install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata')
-+  install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata')
- )
- endif
-diff --git a/data/remotes.d/meson.build b/data/remotes.d/meson.build
-index c20a1a05e..5354bac7f 100644
---- a/data/remotes.d/meson.build
-+++ b/data/remotes.d/meson.build
-@@ -15,14 +15,14 @@ if build_standalone and get_option('lvfs') != 'false'
-     output: 'lvfs.conf',
-     configuration: con3,
-     install: true,
--    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
-   )
-   configure_file(
-     input: 'lvfs-testing.conf',
-     output: 'lvfs-testing.conf',
-     configuration: con3,
-     install: true,
--    install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+    install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
-   )
-   i18n.merge_file(
-     input: 'lvfs.metainfo.xml',
-@@ -56,12 +56,12 @@ configure_file(
-   output: 'vendor.conf',
-   configuration: con2,
-   install: true,
--  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
- )
- configure_file(
-   input: 'vendor-directory.conf',
-   output: 'vendor-directory.conf',
-   configuration: con2,
-   install: true,
--  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+  install_dir: join_paths(sysconfdir_install, 'fwupd', 'remotes.d'),
- )
-diff --git a/meson.build b/meson.build
-index ca6ccdf92..0a3097d90 100644
---- a/meson.build
-+++ b/meson.build
-@@ -195,6 +195,12 @@ endif
- mandir = join_paths(prefix, get_option('mandir'))
- localedir = join_paths(prefix, get_option('localedir'))
-
-+if get_option('sysconfdir_install') != ''
-+  sysconfdir_install = join_paths(prefix, get_option('sysconfdir_install'))
-+else
-+  sysconfdir_install = sysconfdir
-+endif
-+
- diffcmd = find_program('diff')
- gio = dependency('gio-2.0', version: '>= 2.68.0')
- giounix = dependency('gio-unix-2.0', version: '>= 2.68.0', required: false)
-
-diff --git a/meson_options.txt b/meson_options.txt
-index 877891126..986d0ee31 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -1,3 +1,8 @@
-+option('sysconfdir_install',
-+  type: 'string',
-+  value: '',
-+  description: 'sysconfdir to use during installation'
-+)
- option('build',
-   type: 'combo',
-   choices: [
-diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
-index eb196c21e..c9a29f680 100644
---- a/plugins/uefi-capsule/meson.build
-+++ b/plugins/uefi-capsule/meson.build
-@@ -20,7 +20,7 @@ if host_machine.system() == 'linux'
-     output: '35_fwupd',
-     configuration: con2,
-     install: true,
--    install_dir: join_paths(sysconfdir, 'grub.d')
-+    install_dir: join_paths(sysconfdir_install, 'grub.d')
-   )
- elif host_machine.system() == 'freebsd'
-   backend_srcs += 'fu-uefi-backend-freebsd.c'
diff --git a/pkgs/os-specific/linux/firmware/fwupd/default.nix b/pkgs/os-specific/linux/firmware/fwupd/default.nix
deleted file mode 100644
index ac1605f979e72..0000000000000
--- a/pkgs/os-specific/linux/firmware/fwupd/default.nix
+++ /dev/null
@@ -1,395 +0,0 @@
-# Updating? Keep $out/etc synchronized with passthru keys
-
-{ stdenv
-, lib
-, fetchFromGitHub
-, gi-docgen
-, pkg-config
-, gobject-introspection
-, gettext
-, libgudev
-, libdrm
-, polkit
-, libxmlb
-, glib
-, gusb
-, sqlite
-, libarchive
-, libredirect
-, curl
-, libjcat
-, elfutils
-, valgrind
-, meson
-, libuuid
-, ninja
-, gnutls
-, protobufc
-, python3
-, wrapGAppsNoGuiHook
-, ensureNewerSourcesForZipFilesHook
-, json-glib
-, bash-completion
-, shared-mime-info
-, umockdev
-, vala
-, makeFontsConf
-, freefont_ttf
-, pango
-, tpm2-tss
-, bubblewrap
-, efibootmgr
-, flashrom
-, tpm2-tools
-, fwupd-efi
-, nixosTests
-, runCommand
-, unstableGitUpdater
-, modemmanager
-, libqmi
-, libmbim
-, libcbor
-, xz
-, enableFlashrom ? false
-, enablePassim ? false
-}:
-
-let
-  python = python3.withPackages (p: with p; [
-    jinja2
-    pygobject3
-    setuptools
-  ]);
-
-  isx86 = stdenv.hostPlatform.isx86;
-
-  # Dell isn't supported on Aarch64
-  haveDell = isx86;
-
-  # only redfish for x86_64
-  haveRedfish = stdenv.isx86_64;
-
-  # only use msr if x86 (requires cpuid)
-  haveMSR = isx86;
-
-  # # Currently broken on Aarch64
-  # haveFlashrom = isx86;
-  # Experimental
-  haveFlashrom = isx86 && enableFlashrom;
-
-  runPythonCommand =
-    name:
-    buildCommandPython:
-
-    runCommand
-      name
-      {
-        nativeBuildInputs = [ python3 ];
-        inherit buildCommandPython;
-      }
-      ''
-        exec python3 -c "$buildCommandPython"
-      '';
-
-  test-firmware =
-    let
-      version = "unstable-2022-04-02";
-      src = fetchFromGitHub {
-        name = "fwupd-test-firmware-${version}";
-        owner = "fwupd";
-        repo = "fwupd-test-firmware";
-        rev = "39954e434d63e20e85870dd1074818f48a0c08b7";
-        hash = "sha256-d4qG3fKyxkfN91AplRYqARFz+aRr+R37BpE450bPxi0=";
-        passthru = {
-          inherit src version; # For update script
-          updateScript = unstableGitUpdater {
-            url = "${test-firmware.meta.homepage}.git";
-          };
-        };
-      };
-    in
-    src // {
-      meta = src.meta // {
-        # For update script
-        position =
-          let
-            pos = builtins.unsafeGetAttrPos "updateScript" test-firmware;
-          in
-          pos.file + ":" + toString pos.line;
-      };
-    };
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "fwupd";
-  version = "1.9.11";
-
-  # libfwupd goes to lib
-  # daemon, plug-ins and libfwupdplugin go to out
-  # CLI programs go to out
-  outputs = [ "out" "lib" "dev" "devdoc" "man" "installedTests" ];
-
-  src = fetchFromGitHub {
-    owner = "fwupd";
-    repo = "fwupd";
-    rev = finalAttrs.version;
-    hash = "sha256-chPZ9nGhFcaExoJDJvFy8terIGZRU6S90RKBYkoWyGQ=";
-  };
-
-  patches = [
-    # Since /etc is the domain of NixOS, not Nix,
-    # we cannot install files there.
-    # Let’s install the files to $prefix/etc
-    # while still reading them from /etc.
-    # NixOS module for fwupd will take take care of copying the files appropriately.
-    ./add-option-for-installation-sysconfdir.patch
-
-    # Install plug-ins and libfwupdplugin to $out output,
-    # they are not really part of the library.
-    ./install-fwupdplugin-to-out.patch
-
-    # Installed tests are installed to different output
-    # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
-    ./installed-tests-path.patch
-
-    # EFI capsule is located in fwupd-efi now.
-    ./efi-app-path.patch
-  ];
-
-  nativeBuildInputs = [
-    # required for firmware zipping
-    ensureNewerSourcesForZipFilesHook
-    meson
-    ninja
-    gi-docgen
-    pkg-config
-    gobject-introspection
-    gettext
-    shared-mime-info
-    valgrind
-    gnutls
-    protobufc # for protoc
-    python
-    wrapGAppsNoGuiHook
-    vala
-  ];
-
-  buildInputs = [
-    polkit
-    libxmlb
-    gusb
-    sqlite
-    libarchive
-    libdrm
-    curl
-    elfutils
-    libgudev
-    libjcat
-    libuuid
-    json-glib
-    umockdev
-    bash-completion
-    pango
-    tpm2-tss
-    fwupd-efi
-    protobufc
-    modemmanager
-    libmbim
-    libcbor
-    libqmi
-    xz # for liblzma
-  ] ++ lib.optionals haveFlashrom [
-    flashrom
-  ];
-
-  mesonFlags = [
-    "-Ddocs=enabled"
-    # We are building the official releases.
-    "-Dsupported_build=enabled"
-    "-Dlaunchd=disabled"
-    "-Dudevdir=lib/udev"
-    "-Dsystemd_root_prefix=${placeholder "out"}"
-    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
-    "--localstatedir=/var"
-    "--sysconfdir=/etc"
-    "-Dsysconfdir_install=${placeholder "out"}/etc"
-    "-Defi_os_dir=nixos"
-    "-Dplugin_modem_manager=enabled"
-    # We do not want to place the daemon into lib (cyclic reference)
-    "--libexecdir=${placeholder "out"}/libexec"
-  ] ++ lib.optionals (!enablePassim) [
-    "-Dpassim=disabled"
-  ] ++ lib.optionals (!haveDell) [
-    "-Dplugin_synaptics_mst=disabled"
-  ] ++ lib.optionals (!haveRedfish) [
-    "-Dplugin_redfish=disabled"
-  ] ++ lib.optionals (!haveFlashrom) [
-    "-Dplugin_flashrom=disabled"
-  ] ++ lib.optionals (!haveMSR) [
-    "-Dplugin_msr=disabled"
-  ];
-
-  # TODO: wrapGAppsHook wraps efi capsule even though it is not ELF
-  dontWrapGApps = true;
-
-  doCheck = true;
-
-  # Environment variables
-
-  # Fontconfig error: Cannot load default config file
-  FONTCONFIG_FILE =
-    let
-      fontsConf = makeFontsConf {
-        fontDirectories = [ freefont_ttf ];
-      };
-    in
-    fontsConf;
-
-  # error: “PolicyKit files are missing”
-  # https://github.com/NixOS/nixpkgs/pull/67625#issuecomment-525788428
-  PKG_CONFIG_POLKIT_GOBJECT_1_ACTIONDIR = "/run/current-system/sw/share/polkit-1/actions";
-
-  # Phase hooks
-
-  postPatch = ''
-    patchShebangs \
-      contrib/generate-version-script.py \
-      contrib/generate-man.py \
-      po/test-deps
-
-    substituteInPlace data/installed-tests/fwupdmgr-p2p.sh \
-      --replace "gdbus" ${glib.bin}/bin/gdbus
-
-    # tests fail with: Failed to load SMBIOS: neither SMBIOS or DT found
-    sed -i 's/test(.*)//' plugins/lenovo-thinklmi/meson.build
-    sed -i 's/test(.*)//' plugins/mtd/meson.build
-    # fails on amd cpu
-    sed -i 's/test(.*)//' libfwupdplugin/meson.build
-    # in nixos test tries to chmod 0777 $out/share/installed-tests/fwupd/tests/redfish.conf
-    sed -i "s/get_option('tests')/false/" plugins/redfish/meson.build
-
-    # Device tests use device emulation and need to download emulation data from
-    # the internet, which does not work on our test VMs.
-    # It's probably better to disable these tests for NixOS by setting
-    # the device-tests directory to /dev/null.
-    # For more info on device emulation, see:
-    #   https://github.com/fwupd/fwupd/blob/eeeac4e9ba8a6513428b456a551bffd95d533e50/docs/device-emulation.md
-    substituteInPlace data/installed-tests/meson.build \
-      --replace "join_paths(datadir, 'fwupd', 'device-tests')" "'/dev/null'"
-  '';
-
-  preBuild = ''
-    # jcat-tool at buildtime requires a home directory
-    export HOME="$(mktemp -d)"
-  '';
-
-  preCheck = ''
-    addToSearchPath XDG_DATA_DIRS "${shared-mime-info}/share"
-
-    echo "12345678901234567890123456789012" > machine-id
-    export NIX_REDIRECTS=/etc/machine-id=$(realpath machine-id) \
-    LD_PRELOAD=${libredirect}/lib/libredirect.so
-  '';
-
-  postInstall = ''
-    # These files have weird licenses so they are shipped separately.
-    cp --recursive --dereference "${test-firmware}/installed-tests/tests" "$installedTests/libexec/installed-tests/fwupd"
-  '';
-
-  preFixup =
-    let
-      binPath = [
-        efibootmgr
-        bubblewrap
-        tpm2-tools
-      ];
-    in
-    ''
-      gappsWrapperArgs+=(
-        --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
-        # See programs reached with fu_common_find_program_in_path in source
-        --prefix PATH : "${lib.makeBinPath binPath}"
-      )
-    '';
-
-  postFixup = ''
-    # Since we had to disable wrapGAppsHook, we need to wrap the executables manually.
-    find -L "$out/bin" "$out/libexec" -type f -executable -print0 \
-      | while IFS= read -r -d ''' file; do
-      if [[ "$file" != *.efi ]]; then
-        echo "Wrapping program $file"
-        wrapGApp "$file"
-      fi
-    done
-
-    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
-    moveToOutput "share/doc" "$devdoc"
-  '';
-
-  separateDebugInfo = true;
-
-  passthru = {
-    filesInstalledToEtc = [
-      "fwupd/bios-settings.d/README.md"
-      "fwupd/fwupd.conf"
-      "fwupd/remotes.d/lvfs-testing.conf"
-      "fwupd/remotes.d/lvfs.conf"
-      "fwupd/remotes.d/vendor.conf"
-      "fwupd/remotes.d/vendor-directory.conf"
-      "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
-      "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
-      "pki/fwupd/LVFS-CA.pem"
-      "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
-      "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
-      "pki/fwupd-metadata/LVFS-CA.pem"
-      "grub.d/35_fwupd"
-    ];
-
-    # DisabledPlugins key in fwupd/daemon.conf
-    defaultDisabledPlugins = [
-      "test"
-      "test_ble"
-    ];
-
-    # For updating.
-    inherit test-firmware;
-
-    # For downstream consumers that need the fwupd-efi this was built with.
-    inherit fwupd-efi;
-
-    tests =
-      let
-        listToPy = list: "[${lib.concatMapStringsSep ", " (f: "'${f}'") list}]";
-      in
-      {
-        installedTests = nixosTests.installed-tests.fwupd;
-
-        passthruMatches = runPythonCommand "fwupd-test-passthru-matches" ''
-          import itertools
-          import configparser
-          import os
-          import pathlib
-
-          etc = '${finalAttrs.finalPackage}/etc'
-          package_etc = set(itertools.chain.from_iterable([[os.path.relpath(os.path.join(prefix, file), etc) for file in files] for (prefix, dirs, files) in os.walk(etc)]))
-          passthru_etc = set(${listToPy finalAttrs.passthru.filesInstalledToEtc})
-          assert len(package_etc - passthru_etc) == 0, f'fwupd package contains the following paths in /etc that are not listed in passthru.filesInstalledToEtc: {package_etc - passthru_etc}'
-          assert len(passthru_etc - package_etc) == 0, f'fwupd package lists the following paths in passthru.filesInstalledToEtc that are not contained in /etc: {passthru_etc - package_etc}'
-
-          config = configparser.RawConfigParser()
-          config.read('${finalAttrs.finalPackage}/etc/fwupd/fwupd.conf')
-          package_disabled_plugins = config.get('fwupd', 'DisabledPlugins').rstrip(';').split(';')
-          passthru_disabled_plugins = ${listToPy finalAttrs.passthru.defaultDisabledPlugins}
-          assert package_disabled_plugins == passthru_disabled_plugins, f'Default disabled plug-ins in the package {package_disabled_plugins} do not match those listed in passthru.defaultDisabledPlugins {passthru_disabled_plugins}'
-
-          pathlib.Path(os.getenv('out')).touch()
-        '';
-      };
-  };
-
-  meta = with lib; {
-    homepage = "https://fwupd.org/";
-    maintainers = with maintainers; [ rvdp ];
-    license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
-  };
-})
diff --git a/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch b/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
deleted file mode 100644
index f9e65a10e657c..0000000000000
--- a/pkgs/os-specific/linux/firmware/fwupd/efi-app-path.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/meson.build b/meson.build
-index b18108c74..7e674b4d2 100644
---- a/meson.build
-+++ b/meson.build
-@@ -404,7 +404,7 @@ endif
-
- # EFI
- if build_standalone
--  efi_app_location = join_paths(libexecdir, 'fwupd', 'efi')
-+  efi_app_location = join_paths(dependency('fwupd-efi').get_variable(pkgconfig: 'prefix'), 'libexec', 'fwupd', 'efi')
-   conf.set_quoted('EFI_APP_LOCATION', efi_app_location)
-   if host_cpu == 'x86'
-     EFI_MACHINE_TYPE_NAME = 'ia32'
diff --git a/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch b/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
deleted file mode 100644
index e6269ae840bb9..0000000000000
--- a/pkgs/os-specific/linux/firmware/fwupd/install-fwupdplugin-to-out.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 9ae278b66..7cddf1a0d 100644
---- a/meson.build
-+++ b/meson.build
-@@ -507,7 +507,7 @@ if build_standalone
- if host_machine.system() == 'windows'
-   libdir_pkg = 'fwupd-@0@'.format(fwupd_version)
- else
--  libdir_pkg = join_paths(libdir, 'fwupd-@0@'.format(fwupd_version))
-+  libdir_pkg = join_paths(prefix, 'lib', 'fwupd-@0@'.format(fwupd_version))
- endif
- conf.set_quoted('FWUPD_LIBDIR_PKG', libdir_pkg)
- endif
-
diff --git a/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch b/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
deleted file mode 100644
index 2954f89e14c38..0000000000000
--- a/pkgs/os-specific/linux/firmware/fwupd/installed-tests-path.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-diff --git a/data/installed-tests/meson.build b/data/installed-tests/meson.build
-index dfce86b1c..5e34c4fa6 100644
---- a/data/installed-tests/meson.build
-+++ b/data/installed-tests/meson.build
-@@ -86,5 +86,5 @@ configure_file(
-   output: 'fwupd-tests.conf',
-   configuration: con2,
-   install: true,
--  install_dir: join_paths(sysconfdir, 'fwupd', 'remotes.d'),
-+  install_dir: join_paths(get_option('installed_test_prefix'), 'etc', 'fwupd', 'remotes.d'),
- )
-diff --git a/meson.build b/meson.build
-index ca6ccdf92..36b1b47b0 100644
---- a/meson.build
-+++ b/meson.build
-@@ -188,8 +188,8 @@ else
-   datadir = join_paths(prefix, get_option('datadir'))
-   sysconfdir = join_paths(prefix, get_option('sysconfdir'))
-   localstatedir = join_paths(prefix, get_option('localstatedir'))
--  installed_test_bindir = join_paths(libexecdir, 'installed-tests', meson.project_name())
--  installed_test_datadir = join_paths(datadir, 'installed-tests', meson.project_name())
-+  installed_test_bindir = join_paths(get_option('installed_test_prefix'), 'libexec', 'installed-tests', meson.project_name())
-+  installed_test_datadir = join_paths(get_option('installed_test_prefix'), 'share', 'installed-tests', meson.project_name())
-   daemon_dir = join_paths(libexecdir, 'fwupd')
- endif
- mandir = join_paths(prefix, get_option('mandir'))
-@@ -497,6 +497,7 @@ gnome = import('gnome')
- i18n = import('i18n')
- 
- conf.set_quoted('FWUPD_PREFIX', prefix)
-+conf.set_quoted('FWUPD_INSTALLED_TEST_PREFIX', get_option('installed_test_prefix'))
- conf.set_quoted('FWUPD_BINDIR', bindir)
- conf.set_quoted('FWUPD_LIBDIR', libdir)
- conf.set_quoted('FWUPD_LIBEXECDIR', libexecdir)
-diff --git a/meson_options.txt b/meson_options.txt
-index 877891126..bfc5d1afd 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -452,6 +452,10 @@ option('elogind',
-     'false': 'disabled',
-   },
- )
-+option('installed_test_prefix',
-+  type: 'string',
-+  description: 'Prefix for installed tests'
-+)
- option('tests',
-   type: 'boolean',
-   value: true,
diff --git a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
index 2f33a139c9d3d..737c7b9369356 100644
--- a/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/sof-firmware/default.nix
@@ -5,11 +5,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "sof-firmware";
-  version = "2.2.6";
+  version = "2023.12";
 
   src = fetchurl {
-    url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-v${version}.tar.gz";
-    sha256 = "sha256-kyLCp2NtAoRcOyaYTVirj3jWP/THZtCEwxlqWF4ACQU=";
+    url = "https://github.com/thesofproject/sof-bin/releases/download/v${version}/sof-bin-${version}.tar.gz";
+    sha256 = "sha256-VeR+tj5iSNvat9ojK7HjHKLnFVs33BFvbcWxc8ujUDs=";
   };
 
   dontFixup = true; # binaries must not be stripped or patchelfed
@@ -17,8 +17,10 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
     mkdir -p $out/lib/firmware/intel
-    cp -av sof-v${version} $out/lib/firmware/intel/sof
-    cp -av sof-tplg-v${version} $out/lib/firmware/intel/sof-tplg
+    cp -av sof $out/lib/firmware/intel/sof
+    cp -av sof-tplg $out/lib/firmware/intel/sof-tplg
+    cp -av sof-ace-tplg $out/lib/firmware/intel/sof-ace-tplg
+    cp -av sof-ipc4 $out/lib/firmware/intel/sof-ipc4
     runHook postInstall
   '';
 
diff --git a/pkgs/os-specific/linux/health-check/default.nix b/pkgs/os-specific/linux/health-check/default.nix
index 4d1d634ff83de..b8737eb153025 100644
--- a/pkgs/os-specific/linux/health-check/default.nix
+++ b/pkgs/os-specific/linux/health-check/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "health-check";
-  version = "0.03.12";
+  version = "0.04.00";
 
   src = fetchFromGitHub {
     owner = "ColinIanKing";
     repo = pname;
     rev = "V${version}";
-    hash = "sha256-LuUCs6GLaxI5ywv6dr8dlvAXfcLbr1t7y6s/pb6JDpg=";
+    hash = "sha256-CPKXpPpdagq3UnTk8Z58WtSPek8L79totKX+Uh6foVg=";
   };
 
   buildInputs = [ json_c libbsd ];
diff --git a/pkgs/os-specific/linux/intel-compute-runtime/default.nix b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
index 0deb493a49b70..a8699684dbb71 100644
--- a/pkgs/os-specific/linux/intel-compute-runtime/default.nix
+++ b/pkgs/os-specific/linux/intel-compute-runtime/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "23.35.27191.9";
+  version = "23.43.27642.18";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    hash = "sha256-yyuP9erK3bQ5oegLXPM+of6x7fslUXHPlX2q71lnGWA=";
+    hash = "sha256-AXHNIWCezPYTzc+SXp1B4BzhfSfM2GUCpWLtCT1SE7I=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/iotop-c/default.nix b/pkgs/os-specific/linux/iotop-c/default.nix
index 1d7dc9e4d1122..2003cc21d57ba 100644
--- a/pkgs/os-specific/linux/iotop-c/default.nix
+++ b/pkgs/os-specific/linux/iotop-c/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     description = "iotop identifies processes that use high amount of input/output requests on your machine";
     homepage = "https://github.com/Tomas-M/iotop";
     maintainers = [ maintainers.arezvov ];
+    mainProgram = "iotop-c";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/iotop/default.nix b/pkgs/os-specific/linux/iotop/default.nix
index 0376ff1a55eca..41647a2378e49 100644
--- a/pkgs/os-specific/linux/iotop/default.nix
+++ b/pkgs/os-specific/linux/iotop/default.nix
@@ -22,6 +22,7 @@ python3Packages.buildPythonApplication rec {
     description = "A tool to find out the processes doing the most IO";
     homepage = "http://guichaz.free.fr/iotop";
     license = licenses.gpl2;
+    mainProgram = "iotop";
     maintainers = [ maintainers.raskin ];
     platforms = platforms.linux;
   };
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 2aacb88dc87e0..e621a15bd8c9b 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -345,7 +345,7 @@ let
     };
 
     video = {
-      DRM_LEGACY = no;
+      DRM_LEGACY = whenOlder "6.8" no;
       NOUVEAU_LEGACY_CTX_SUPPORT = whenBetween "5.2" "6.3" no;
 
       # Allow specifying custom EDID on the kernel command line
@@ -685,23 +685,23 @@ let
       VBOXGUEST = option no;
       DRM_VBOXVIDEO = option no;
 
-      XEN                         = mkIf stdenv.is64bit (option yes);
-      XEN_DOM0                    = mkIf stdenv.is64bit (option yes);
-      PCI_XEN                     = mkIf stdenv.is64bit (option yes);
-      HVC_XEN                     = mkIf stdenv.is64bit (option yes);
-      HVC_XEN_FRONTEND            = mkIf stdenv.is64bit (option yes);
-      XEN_SYS_HYPERVISOR          = mkIf stdenv.is64bit (option yes);
-      SWIOTLB_XEN                 = mkIf stdenv.is64bit (option yes);
-      XEN_BACKEND                 = mkIf stdenv.is64bit (option yes);
-      XEN_BALLOON                 = mkIf stdenv.is64bit (option yes);
-      XEN_BALLOON_MEMORY_HOTPLUG  = mkIf stdenv.is64bit (option yes);
-      XEN_EFI                     = mkIf stdenv.is64bit (option yes);
-      XEN_HAVE_PVMMU              = mkIf stdenv.is64bit (option yes);
-      XEN_MCE_LOG                 = mkIf stdenv.is64bit (option yes);
-      XEN_PVH                     = mkIf stdenv.is64bit (option yes);
-      XEN_PVHVM                   = mkIf stdenv.is64bit (option yes);
-      XEN_SAVE_RESTORE            = mkIf stdenv.is64bit (option yes);
-      XEN_SELFBALLOONING          = mkIf stdenv.is64bit (whenOlder "5.3" yes);
+      XEN                         = option yes;
+      XEN_DOM0                    = option yes;
+      PCI_XEN                     = option yes;
+      HVC_XEN                     = option yes;
+      HVC_XEN_FRONTEND            = option yes;
+      XEN_SYS_HYPERVISOR          = option yes;
+      SWIOTLB_XEN                 = option yes;
+      XEN_BACKEND                 = option yes;
+      XEN_BALLOON                 = option yes;
+      XEN_BALLOON_MEMORY_HOTPLUG  = option yes;
+      XEN_EFI                     = option yes;
+      XEN_HAVE_PVMMU              = option yes;
+      XEN_MCE_LOG                 = option yes;
+      XEN_PVH                     = option yes;
+      XEN_PVHVM                   = option yes;
+      XEN_SAVE_RESTORE            = option yes;
+      XEN_SELFBALLOONING          = whenOlder "5.3" yes;
 
       # Enable device detection on virtio-mmio hypervisors
       VIRTIO_MMIO_CMDLINE_DEVICES = yes;
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index df67005dd8165..27d744c1ab778 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -37,7 +37,7 @@
   modDirVersion ? null
 
 , # An attribute set whose attributes express the availability of
-  # certain features in this kernel.  E.g. `{iwlwifi = true;}'
+  # certain features in this kernel.  E.g. `{ia32Emulation = true;}'
   # indicates a kernel that provides Intel wireless support.  Used in
   # NixOS to implement kernel-specific behaviour.
   features ? {}
@@ -89,9 +89,7 @@ let
 
   # Combine the `features' attribute sets of all the kernel patches.
   kernelFeatures = lib.foldr (x: y: (x.features or {}) // y) ({
-    iwlwifi = true;
     efiBootStub = true;
-    needsCifsUtils = true;
     netfilterRPFilter = true;
     ia32Emulation = true;
   } // features) kernelPatches;
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 345d25e6e4c45..918d8e8f16fb4 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,52 +2,52 @@
     "4.19": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-4.19.304-hardened1.patch",
-            "sha256": "0bv6abcx8sknhsnijs176yq7q2mgrlyrv5xysnxa0l6wqpl2gqif",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.304-hardened1/linux-hardened-4.19.304-hardened1.patch"
+            "name": "linux-hardened-4.19.305-hardened1.patch",
+            "sha256": "1lrz04mxcp82qmfmwsahi5amv9j5j5qv7xjq9jcrycwcj0ljrfcv",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.305-hardened1/linux-hardened-4.19.305-hardened1.patch"
         },
-        "sha256": "165mljr8v1cf4vf4a4b44hx089rprkssvi2azq5wbxxg3basbind",
-        "version": "4.19.304"
+        "sha256": "1s6srmhd3visqchshg566c7gq5wnxr3m74854kxksqhhfif450ns",
+        "version": "4.19.305"
     },
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.10.206-hardened1.patch",
-            "sha256": "14xmp28grpwpgrsg88bnv164kk54k6akw5jydrs8447mqfyw7sqr",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.206-hardened1/linux-hardened-5.10.206-hardened1.patch"
+            "name": "linux-hardened-5.10.208-hardened1.patch",
+            "sha256": "0aniccfyi81wwfzva3i2vxairnkdwrypislphf8r9wg49sya2z7f",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.208-hardened1/linux-hardened-5.10.208-hardened1.patch"
         },
-        "sha256": "0ns8qxcrxj9i76b93xcghl002l8vbkg7ksd435sikig62qr62gf4",
-        "version": "5.10.206"
+        "sha256": "0vpvy47cmcinhs76cjl2n81zrlhbqgpi4v29izn2hzsl15x189ch",
+        "version": "5.10.208"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.15.146-hardened1.patch",
-            "sha256": "0cd8gzixkc89n647g108f9r9dn8a3vw9ajdh4g7w7bq6vq71gglj",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.146-hardened1/linux-hardened-5.15.146-hardened1.patch"
+            "name": "linux-hardened-5.15.147-hardened1.patch",
+            "sha256": "1z37g4gwxhdsbqh0yy7m9wlglayrmypsrdjgx0vk3shgvaiwx2il",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.147-hardened1/linux-hardened-5.15.147-hardened1.patch"
         },
-        "sha256": "14nijbspmzd4r38l8cpl4vn9dhawzcfnhyc0gnaxl2m8l9gpm02s",
-        "version": "5.15.146"
+        "sha256": "1m7wznqiakarpar4a0nbwxql0hkvds0s79zx3r1xn0fj4mbfdhan",
+        "version": "5.15.147"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-5.4.266-hardened1.patch",
-            "sha256": "1gbyxz788j5lirjc62b56didnwq5s69cfindzndsj1r5wm0hknp4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.266-hardened1/linux-hardened-5.4.266-hardened1.patch"
+            "name": "linux-hardened-5.4.267-hardened1.patch",
+            "sha256": "12jyk0dmrs8kmmh8ca4s3jr2pk6m0izhm5yvncgjwff3xybzyj5p",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.267-hardened1/linux-hardened-5.4.267-hardened1.patch"
         },
-        "sha256": "1dmcn9i3nvf1gldm1a32gnl5ybwbk2lizb3wa4gc06g7dxz2y1ys",
-        "version": "5.4.266"
+        "sha256": "0hqw8ww7y9mjrh1wgdkiwk8llxpf4lxwmsmzxm8j4l615kpqvlj2",
+        "version": "5.4.267"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.72-hardened1.patch",
-            "sha256": "0zp6i44y3fi2xsk4jbwhk8w688ci34p5ymmk3kkb8s1cvhqzgddy",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.72-hardened1/linux-hardened-6.1.72-hardened1.patch"
+            "name": "linux-hardened-6.1.74-hardened1.patch",
+            "sha256": "0j7qbbf5s1khzbmsjh5i0nskj9nlw5224sz6zrvv5a1aw6bad976",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.74-hardened1/linux-hardened-6.1.74-hardened1.patch"
         },
-        "sha256": "09h9kzv2xfrn369ynl09dfnjl9025b9vpkcxg75gyp63fy8fdp4q",
-        "version": "6.1.72"
+        "sha256": "08i0pgmmdnrmlha6ncl6if39rqg44c9dqyggf0swxlmfkzbx3yxp",
+        "version": "6.1.74"
     },
     "6.5": {
         "patch": {
@@ -62,11 +62,11 @@
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.6.11-hardened1.patch",
-            "sha256": "07l4fvc115iqiwbaq916g1l1jpmcg8injr5z5dx6jp2h635w72n3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.11-hardened1/linux-hardened-6.6.11-hardened1.patch"
+            "name": "linux-hardened-6.6.13-hardened1.patch",
+            "sha256": "108cpr6nidjha98g0x05vsqmdidjb9ikx4ggxjric76c5dsddg2l",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.6.13-hardened1/linux-hardened-6.6.13-hardened1.patch"
         },
-        "sha256": "0lhyczcj1fhh52fjf06ikp5yh7kxc1qymsw44rv6v25vc6kfbqmg",
-        "version": "6.6.11"
+        "sha256": "1g60hblf4mywq3rivkqmz2n7a9arinxwh4g4n4x4xb8ysiyrxf48",
+        "version": "6.6.13"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 197b5d638861b..67231acccf780 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,15 +1,15 @@
 {
     "testing": {
-        "version": "6.7-rc8",
-        "hash": "sha256:02drhwl3f53y97gimgclz61zsa57v29vphkbrzr4cwmz4sh1vngk"
+        "version": "6.8-rc1",
+        "hash": "sha256:0rnrd1iy73vkrablx6rqlmxv9bv9zjfh6zj09aqca9rr5h8iz1p3"
     },
     "6.5": {
         "version": "6.5.13",
         "hash": "sha256:1dfbbydmayfj9npx3z0g38p574pmcx3qgs49dv0npigl48wd9yvq"
     },
     "6.1": {
-        "version": "6.1.73",
-        "hash": "sha256:11vyblm4nkjncdi3akcyizw7jkyxsqn2mjixc51f7kgiddq4ibbc"
+        "version": "6.1.74",
+        "hash": "sha256:08i0pgmmdnrmlha6ncl6if39rqg44c9dqyggf0swxlmfkzbx3yxp"
     },
     "5.15": {
         "version": "5.15.147",
@@ -28,11 +28,11 @@
         "hash": "sha256:1s6srmhd3visqchshg566c7gq5wnxr3m74854kxksqhhfif450ns"
     },
     "6.6": {
-        "version": "6.6.12",
-        "hash": "sha256:01a6czk6xz9syxvkb2yhbn3vypqy2mnjq7ni84x4nklw7n6frmqz"
+        "version": "6.6.13",
+        "hash": "sha256:1g60hblf4mywq3rivkqmz2n7a9arinxwh4g4n4x4xb8ysiyrxf48"
     },
     "6.7": {
-        "version": "6.7",
-        "hash": "sha256:0s8hbcsg7fdvspqam8kzcxygjsznr4zfi60nqgc81l3n4m518cgg"
+        "version": "6.7.1",
+        "hash": "sha256:1hv8mma3i6zhjix5k2g12jmajqy29c1xjfjkllmj18l6irbgmkqy"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index ffe37b8d5e7a5..9b70c577b4e60 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.70-rt21"; # updated by ./update-rt.sh
+  version = "6.1.73-rt22"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "1vxgardfm2fi4c7zkxpljqicllfqqnp835a9lyb7dh2nchk6a4zd";
+    sha256 = "11vyblm4nkjncdi3akcyizw7jkyxsqn2mjixc51f7kgiddq4ibbc";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "03lb5s16f7j7s7qvh55mxiv6a6rdnx2j8cyy6c6v4naaq9s82lgn";
+      sha256 = "1hl7y2sab21l81nl165b77jhfjhpcc1gvz64fs2yjjp4q2qih4b0";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index bf163701f3311..5b51de103320d 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.1.72";
-    hash = "sha256-S8Ilrce7xQb549NPIBRIMMIng4xY77Hbq58rE5LOow8=";
+    version = "6.1.74";
+    hash = "sha256-PqCojvh7JwTcavtQHB8l/WxCTg94ndOy9KGVXsmGO/Y=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.6.10";
-    hash = "sha256-5BymQhVWMHg4zlQIPxf40JQI9iSWQqTZfbDd6+G3RsQ=";
+    version = "6.6.13";
+    hash = "sha256-RTfa9eIGYDqnffFnOFNaghKoGcHVy4rGYQkYumcw6Tk=";
     variant = "main";
   };
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 54aa1df85b4ad..5c29069aed937 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.7"; #zen
-    suffix = "zen3"; #zen
-    sha256 = "0iflyip1a70i7bhll5bpls513g3q1hwsi1irm42rmjsysh4fb188"; #zen
+    version = "6.7.1"; #zen
+    suffix = "zen1"; #zen
+    sha256 = "0zk7rdbqszdcs86azkycqgaci077a621qzndvs0i3zsw79wr6dnh"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.6.11"; #lqx
+    version = "6.7.1"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "0vsfpbkkj73hcncrihviqbmy20id1hx08c537by1a6hfc0f9y55z"; #lqx
+    sha256 = "12fsf7wigma1wmqcpqp1aabmwxsf4yhwa6y3xhbnmiz83cakx27z"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
diff --git a/pkgs/os-specific/linux/kmscube/default.nix b/pkgs/os-specific/linux/kmscube/default.nix
index b9da379017001..a416e2aa14bd5 100644
--- a/pkgs/os-specific/linux/kmscube/default.nix
+++ b/pkgs/os-specific/linux/kmscube/default.nix
@@ -1,26 +1,27 @@
-{ lib, stdenv, fetchgit, fetchpatch, autoreconfHook, libdrm, libX11, libGL, mesa, pkg-config }:
+{ lib, stdenv, fetchFromGitLab, meson, ninja, libdrm, libX11, libGL, mesa, pkg-config, gst_all_1 }:
 
 stdenv.mkDerivation {
   pname = "kmscube";
-  version = "unstable-2018-06-17";
+  version = "unstable-2023-09-25";
 
-  src = fetchgit {
-    url = "git://anongit.freedesktop.org/mesa/kmscube";
-    rev = "9dcce71e603616ee7a54707e932f962cdf8fb20a";
-    sha256 = "1q5b5yvyfj3127385mp1bfmcbnpnbdswdk8gspp7g4541xk4k933";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mesa";
+    repo = "kmscube";
+    rev = "96d63eb59e34c647cda1cbb489265f8c536ae055";
+    hash = "sha256-kpnn4JBNvwatrcCF/RGk/fQ7qiKD26iLBr9ovDmAKBo=";
   };
 
-  patches = [
-    # Pull upstream patch for -fno-common toolchains.
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://gitlab.freedesktop.org/mesa/kmscube/-/commit/908ef39864442c0807954af5d3f88a3da1a6f8a5.patch";
-      sha256 = "1gxn3b50mvjlc25234839v5z29r8fd9di4176a3yx4gbsz8cc5vi";
-    })
-  ];
-
-  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  buildInputs = [ libdrm libX11 libGL mesa ];
+  nativeBuildInputs = [ meson pkg-config ninja ];
+  buildInputs = [
+    libdrm
+    libX11
+    libGL
+    mesa
+  ] ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+  ]);
 
   meta = with lib; {
     description = "Example OpenGL app using KMS/GBM";
diff --git a/pkgs/os-specific/linux/ksmbd-tools/default.nix b/pkgs/os-specific/linux/ksmbd-tools/default.nix
index edb9ce3fb8b78..dd429b2959902 100644
--- a/pkgs/os-specific/linux/ksmbd-tools/default.nix
+++ b/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
   patches = [ ./0001-skip-installing-example-configuration.patch ];
   mesonFlags = [
     "-Drundir=/run"
+    "-Dsystemdsystemunitdir=lib/systemd/system"
     "--sysconfdir /etc"
   ];
 
diff --git a/pkgs/os-specific/linux/libnl-tiny/default.nix b/pkgs/os-specific/linux/libnl-tiny/default.nix
index ec39b560826dd..8a8c84513f624 100644
--- a/pkgs/os-specific/linux/libnl-tiny/default.nix
+++ b/pkgs/os-specific/linux/libnl-tiny/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation {
   pname = "libnl-tiny";
-  version = "unstable-2023-07-27";
+  version = "unstable-2023-12-05";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libnl-tiny.git";
-    rev = "bc92a280186f9becc53c0f17e4e43cfbdeec7e7b";
-    hash = "sha256-/d6so8hfBOyp8NbUhPZ0aRj6gXO/RLgwCQnAT7N/rF8=";
+    rev = "965c4bf49658342ced0bd6e7cb069571b4a1ddff";
+    hash = "sha256-kegTV7FXMERW7vjRZo/Xp4cbSBZmynBgge2lK71Fx94=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/os-specific/linux/linuxptp/default.nix b/pkgs/os-specific/linux/linuxptp/default.nix
index 27a9ccb3303fc..de215024555d8 100644
--- a/pkgs/os-specific/linux/linuxptp/default.nix
+++ b/pkgs/os-specific/linux/linuxptp/default.nix
@@ -15,7 +15,10 @@ stdenv.mkDerivation rec {
        '/usr/include/linux/' "${linuxHeaders}/include/linux/"
   '';
 
-  makeFlags = [ "prefix=" ];
+  makeFlags = [
+    "prefix="
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+  ];
 
   preInstall = ''
     export DESTDIR=$out
diff --git a/pkgs/os-specific/linux/mdevctl/default.nix b/pkgs/os-specific/linux/mdevctl/default.nix
index 80c3c1316d85d..ce4ea250827b4 100644
--- a/pkgs/os-specific/linux/mdevctl/default.nix
+++ b/pkgs/os-specific/linux/mdevctl/default.nix
@@ -7,14 +7,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdevctl";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-0X/3DWNDPOgSNNTqcj44sd7DNGFt+uGBjkc876dSgU8=";
+    hash = "sha256-4K4NW3DOTtzZJ7Gg0mnRPr88YeqEjTtKX+C4P8i923E=";
   };
 
-  cargoHash = "sha256-TmumQBWuH5fJOe2qzcDtEGbmCs2G9Gfl8mH7xifzRGc=";
+  cargoHash = "sha256-hCqNy32uPLsKfUJqiG2DRcXfqdvlp4bCutQmt+FieXc=";
 
   nativeBuildInputs = [
     docutils
diff --git a/pkgs/os-specific/linux/nixos-rebuild/default.nix b/pkgs/os-specific/linux/nixos-rebuild/default.nix
index 9a7cca68bfd72..4849ff75c54ab 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/default.nix
+++ b/pkgs/os-specific/linux/nixos-rebuild/default.nix
@@ -1,4 +1,5 @@
-{ substituteAll
+{ callPackage
+, substituteAll
 , runtimeShell
 , coreutils
 , gnused
@@ -36,6 +37,7 @@ substituteAll {
   # run some a simple installer tests to make sure nixos-rebuild still works for them
   passthru.tests = {
     install-bootloader = nixosTests.nixos-rebuild-install-bootloader;
+    repl = callPackage ./test/repl.nix {};
     simple-installer = nixosTests.installer.simple;
     specialisations = nixosTests.nixos-rebuild-specialisations;
     target-host = nixosTests.nixos-rebuild-target-host;
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index 006b5db6320c5..bde6ff9d959ba 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -572,6 +572,7 @@ if [ "$action" = repl ]; then
                     - ${blue}config${reset}   All option values
                     - ${blue}options${reset}  Option data and metadata
                     - ${blue}pkgs${reset}     Nixpkgs package set
+                    - ${blue}lib${reset}      Nixpkgs library functions
                     - other module arguments
 
                     - ${blue}flake${reset}    Flake outputs, inputs and source info of $flake
@@ -592,6 +593,7 @@ if [ "$action" = repl ]; then
                 configuration._module.specialArgs //
                 {
                   inherit (configuration) config options;
+                  lib = configuration.lib or configuration.pkgs.lib;
                   inherit flake;
                 };
           in builtins.seq scope builtins.trace motd scope
diff --git a/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix b/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix
new file mode 100644
index 0000000000000..1161ff84664d3
--- /dev/null
+++ b/pkgs/os-specific/linux/nixos-rebuild/test/repl.nix
@@ -0,0 +1,146 @@
+{ lib,
+  expect,
+  nix,
+  nixos-rebuild,
+  path,
+  runCommand,
+  stdenv,
+  writeText,
+}:
+let
+  # Arguably not true, but it holds up for now.
+  escapeExpect = lib.strings.escapeNixString;
+
+  expectSetup = ''
+    set timeout 180
+    proc expect_simple { pattern } {
+      puts "Expecting: $pattern"
+      expect {
+        timeout {
+          puts "\nTimeout waiting for: $pattern\n"
+          exit 1
+        }
+        $pattern
+      }
+    }
+  '';
+
+  # In case we want/need to evaluate packages or the assertions or whatever,
+  # we want to have a linux system.
+  # TODO: make the non-flake test use thise.
+  linuxSystem = lib.replaceStrings ["darwin"] ["linux"] stdenv.hostPlatform.system;
+
+in
+runCommand "test-nixos-rebuild-repl" {
+  nativeBuildInputs = [
+    expect
+    nix
+    nixos-rebuild
+  ];
+  nixpkgs =
+    if builtins.pathExists (path + "/.git")
+    then lib.cleanSource path
+    else path;
+} ''
+  export HOME=$(mktemp -d)
+  export TEST_ROOT=$PWD/test-tmp
+
+  # Prepare for running Nix in sandbox
+  export NIX_BUILD_HOOK=
+  export NIX_CONF_DIR=$TEST_ROOT/etc
+  export NIX_LOCALSTATE_DIR=$TEST_ROOT/var
+  export NIX_LOG_DIR=$TEST_ROOT/var/log/nix
+  export NIX_STATE_DIR=$TEST_ROOT/var/nix
+  export NIX_STORE_DIR=$TEST_ROOT/store
+  export PAGER=cat
+  mkdir -p $TEST_ROOT $NIX_CONF_DIR
+
+  echo General setup
+  ##################
+
+  export NIX_PATH=nixpkgs=$nixpkgs:nixos-config=$HOME/configuration.nix
+  cat >> ~/configuration.nix <<EOF
+  {
+    boot.loader.grub.enable = false;
+    fileSystems."/".device = "x";
+    imports = [ ./hardware-configuration.nix ];
+  }
+  EOF
+
+  echo '{ }' > ~/hardware-configuration.nix
+
+
+  echo Test traditional NixOS configuration
+  #########################################
+
+  expect ${writeText "test-nixos-rebuild-repl-expect" ''
+    ${expectSetup}
+    spawn nixos-rebuild repl --fast
+
+    expect "nix-repl> "
+
+    send "config.networking.hostName\n"
+    expect "\"nixos\""
+  ''}
+
+
+  echo Test flake based NixOS configuration
+  #########################################
+
+  # Switch to flake flavored environment
+  unset NIX_PATH
+  cat > $NIX_CONF_DIR/nix.conf <<EOF
+  experimental-features = nix-command flakes
+  EOF
+
+  # Make the config pure
+  echo '{ nixpkgs.hostPlatform = "${linuxSystem}"; }' > ~/hardware-configuration.nix
+
+  cat >~/flake.nix <<EOF
+  {
+    inputs.nixpkgs.url = "path:$nixpkgs";
+    outputs = { nixpkgs, ... }: {
+      nixosConfigurations.testconf = nixpkgs.lib.nixosSystem {
+        modules = [
+          ./configuration.nix
+          # Let's change it up a bit
+          { networking.hostName = "itsme"; }
+        ];
+      };
+    };
+  }
+  EOF
+
+  # cat -n ~/flake.nix
+
+  expect ${writeText "test-nixos-rebuild-repl-expect" ''
+    ${expectSetup}
+    spawn sh -c "nixos-rebuild repl --fast --flake path:\$HOME#testconf"
+
+    expect_simple "nix-repl>"
+
+    send "config.networking.hostName\n"
+    expect_simple "itsme"
+
+    expect_simple "nix-repl>"
+    send "lib.version\n"
+    expect_simple ${escapeExpect (
+      # The version string is a bit different in the flake lib, so we expect a prefix and ignore the rest
+      # Furthermore, including the revision (suffix) would cause unnecessary rebuilds.
+      # Note that a length of 4 only matches e.g. "24.
+      lib.strings.substring 0 4 (lib.strings.escapeNixString lib.version))}
+
+    # Make sure it's the right lib - should be the flake lib, not Nixpkgs lib.
+    expect_simple "nix-repl>"
+    send "lib?nixosSystem\n"
+    expect_simple "true"
+    expect_simple "nix-repl>"
+    send "lib?nixos\n"
+    expect_simple "true"
+  ''}
+  echo
+
+  #########
+  echo Done
+  touch $out
+''
diff --git a/pkgs/os-specific/linux/nsncd/default.nix b/pkgs/os-specific/linux/nsncd/default.nix
index 81590a6f86921..01cb6695b330e 100644
--- a/pkgs/os-specific/linux/nsncd/default.nix
+++ b/pkgs/os-specific/linux/nsncd/default.nix
@@ -7,19 +7,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nsncd";
-  version = "unstable-2023-10-26";
+  version = "unstable-2024-01-16";
 
-  # https://github.com/twosigma/nsncd/pull/71 has not been upstreamed
-  # to twosigma/nsncd yet. Using the nix-community fork in the
-  # meantime.
   src = fetchFromGitHub {
-    owner = "nix-community";
+    owner = "twosigma";
     repo = "nsncd";
-    rev =  "d6513421f420e407248c6d0aee39ae2f861a7cec";
-    hash = "sha256-PykzwpPxMDHJOr2HubXuw+Krk9Jbi0E3M2lEAOXhx2M=";
+    rev =  "f4706786f26d12c533035fb2916be9be5751150b";
+    hash = "sha256-GbKDWW00eZZwmslkaGIO8hjCyD5xi7h+S2WP6q5ekOQ=";
   };
 
-  cargoSha256 = "sha256-cUM7rYXWpJ0aMiurXBp15IlxAmf/x5uiodxEqBPCQT0=";
+  cargoSha256 = "sha256-jAxcyMPDTBFBrG0cuKm0Tm5p/UEnUgTPQKDgqY2yK7w=";
+  checkFlags = [
+    # Relies on the test environment to be able to resolve "localhost"
+    # on IPv4. That's not the case in the Nix sandbox somehow. Works
+    # when running cargo test impurely on a (NixOS|Debian) machine.
+    "--skip=ffi::test_gethostbyname2_r"
+  ];
 
   meta = with lib; {
     description = "the name service non-caching daemon";
diff --git a/pkgs/os-specific/linux/nss_ldap/default.nix b/pkgs/os-specific/linux/nss_ldap/default.nix
index 23bc8ff0dfad7..7366932d1e676 100644
--- a/pkgs/os-specific/linux/nss_ldap/default.nix
+++ b/pkgs/os-specific/linux/nss_ldap/default.nix
@@ -29,7 +29,13 @@ stdenv.mkDerivation rec {
     mkdir -p $out/etc
   '';
 
-  buildInputs = [ openldap perl ];
+  nativeBuildInputs = [
+    perl # shebang of vers_string
+  ];
+
+  buildInputs = [
+    openldap
+  ];
 
   meta = with lib; {
     description = "LDAP module for the Solaris Nameservice Switch (NSS)";
diff --git a/pkgs/os-specific/linux/nvidia-x11/builder.sh b/pkgs/os-specific/linux/nvidia-x11/builder.sh
index fbb116ab42adc..aa614aec12839 100755
--- a/pkgs/os-specific/linux/nvidia-x11/builder.sh
+++ b/pkgs/os-specific/linux/nvidia-x11/builder.sh
@@ -14,6 +14,8 @@ unpackFile() {
 
 
 buildPhase() {
+    runHook preBuild
+
     if [ -n "$bin" ]; then
         # Create the module.
         echo "Building linux driver against kernel: $kernel";
@@ -23,10 +25,14 @@ buildPhase() {
 
         cd ..
     fi
+
+    runHook postBuild
 }
 
 
 installPhase() {
+    runHook preInstall
+
     # Install libGL and friends.
 
     # since version 391, 32bit libraries are bundled in the 32/ sub-directory
@@ -214,6 +220,8 @@ installPhase() {
         # FIXME: needs PATH and other fixes
         # install -Dm755 nvidia-bug-report.sh $bin/bin/nvidia-bug-report.sh
     fi
+
+    runHook postInstall
 }
 
 genericBuild
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index bd57c19db335e..3eab03b91769b 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -117,10 +117,18 @@ rec {
     persistencedSha256 = "sha256-NuqUQbVt80gYTXgIcu0crAORfsj9BCRooyH3Gp1y1ns=";
 
     broken = kernel.kernelAtLeast "6.2";
+
+    # fixes the bug described in https://bbs.archlinux.org/viewtopic.php?pid=2083439#p2083439
+    # see https://bbs.archlinux.org/viewtopic.php?pid=2083651#p2083651
+    # and https://bbs.archlinux.org/viewtopic.php?pid=2083699#p2083699
+    postInstall = ''
+      mv $out/lib/tls/* $out/lib
+      rmdir $out/lib/tls
+    '';
   };
 
   legacy_340 = let
-    # Source cooresponding to https://aur.archlinux.org/packages/nvidia-340xx-dkms
+    # Source corresponding to https://aur.archlinux.org/packages/nvidia-340xx-dkms
     aurPatches = fetchFromGitHub {
       owner = "archlinux-jerry";
       repo = "nvidia-340xx";
@@ -154,5 +162,13 @@ rec {
 
     broken = kernel.kernelAtLeast "6.7";
     patches = map (patch: "${aurPatches}/${patch}") patchset;
+
+    # fixes the bug described in https://bbs.archlinux.org/viewtopic.php?pid=2083439#p2083439
+    # see https://bbs.archlinux.org/viewtopic.php?pid=2083651#p2083651
+    # and https://bbs.archlinux.org/viewtopic.php?pid=2083699#p2083699
+    postInstall = ''
+      mv $out/lib/tls/* $out/lib
+      rmdir $out/lib/tls
+    '';
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index c60098ab899d5..44ed90a3bb212 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -19,10 +19,12 @@
 , useFabricmanager ? false
 , ibtSupport ? false
 
-, prePatch ? ""
+, prePatch ? null
 , postPatch ? null
 , patchFlags ? null
 , patches ? [ ]
+, preInstall ? null
+, postInstall ? null
 , broken ? false
 , brokenOpen ? broken
 }@args:
@@ -145,6 +147,7 @@ let
 
     patches = if libsOnly then null else patches;
     inherit prePatch postPatch patchFlags;
+    inherit preInstall postInstall;
     inherit version useGLVND useProfiles;
     inherit (stdenv.hostPlatform) system;
     inherit i686bundled;
diff --git a/pkgs/os-specific/linux/rdma-core/default.nix b/pkgs/os-specific/linux/rdma-core/default.nix
index 5d75249d616cc..abbdd71694d22 100644
--- a/pkgs/os-specific/linux/rdma-core/default.nix
+++ b/pkgs/os-specific/linux/rdma-core/default.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rdma-core";
-  version = "49.0";
+  version = "49.1";
 
   src = fetchFromGitHub {
     owner = "linux-rdma";
     repo = "rdma-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4095U7fLIvixUY3K6l0iFJh7oWwwKAX/WcD3ziqdsLg=";
+    hash = "sha256-fAEHugGRlrn0rRazyeC649H4vc0V3dqTTSDAo1HY22A=";
   };
 
   strictDeps = true;
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index adc197a1166ec..ed330fc246375 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8812au";
-  version = "${kernel.version}-unstable-2023-07-22";
+  version = "${kernel.version}-unstable-2024-01-19";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8812au-20210629";
-    rev = "b5f4e6e894eca8fea38661e2fc22a2570e0274ad";
-    hash = "sha256-3uPowesJVh/cnagMz/Uadb+U5rDUAWfU39tZaDNCoqg=";
+    rev = "3b921c0beda8583c1d2d1b0b7e4692d11e7ea772";
+    hash = "sha256-Ji61Y23uGSTyj3Z5ia9iev5rVzSOv7XY/IfAClhz7Q8=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl88x2bu/default.nix b/pkgs/os-specific/linux/rtl88x2bu/default.nix
index 73b098894b989..edb2feed6c619 100644
--- a/pkgs/os-specific/linux/rtl88x2bu/default.nix
+++ b/pkgs/os-specific/linux/rtl88x2bu/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl88x2bu";
-  version = "${kernel.version}-unstable-2023-09-24";
+  version = "${kernel.version}-unstable-2023-11-29";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "88x2bu-20210702";
-    rev = "888ba1b309e6258a736ef5c37a68836cd0ea5517";
-    sha256 = "sha256-oLRGRKUNTmIw+Zn23TArGumo24AIH2YEMpnStyXBNw8=";
+    rev = "cd2b6cbd9c8fbfebee8a1f28fab8e4434450456c";
+    sha256 = "sha256-t1lLJSEDzY2zvgcKYaxUq/umrlLpxu4+4zWmG8R0Wz4=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/sasutils/default.nix b/pkgs/os-specific/linux/sasutils/default.nix
index d30e7f608c77f..64d288117bf4a 100644
--- a/pkgs/os-specific/linux/sasutils/default.nix
+++ b/pkgs/os-specific/linux/sasutils/default.nix
@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "sasutils";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "stanford-rc";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-9JRw+UoxU0I5RHuimzYrM/3j8UWHuicVpoOdRRrj2Wc=";
+    sha256 = "sha256-DK0mEqlPf9UGtUxqbzB0l1xX0P4htYm2NYvV7zilhx0=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 23f875d2dc46c..39ec1a6eac176 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -89,7 +89,11 @@
 , withAnalyze ? true
 , withApparmor ? true
 , withAudit ? true
-, withBootloader ? withEfi && !stdenv.hostPlatform.isMusl # compiles systemd-boot, assumes EFI is available.
+  # compiles systemd-boot, assumes EFI is available.
+, withBootloader ? withEfi
+    && !stdenv.hostPlatform.isMusl
+    # "Unknown 64-bit data model"
+    && !stdenv.hostPlatform.isRiscV32
 , withCompression ? true  # adds bzip2, lz4, xz and zstd
 , withCoredump ? true
 , withCryptsetup ? true
@@ -108,6 +112,8 @@
     && !stdenv.hostPlatform.isMips64   # see https://github.com/NixOS/nixpkgs/pull/194149#issuecomment-1266642211
     # can't find gnu/stubs-32.h
     && (stdenv.hostPlatform.isPower64 -> stdenv.hostPlatform.isBigEndian)
+    # https://reviews.llvm.org/D43106#1019077
+    && (stdenv.hostPlatform.isRiscV32 -> stdenv.cc.isClang)
     # buildPackages.targetPackages.llvmPackages is the same as llvmPackages,
     # but we do it this way to avoid taking llvmPackages as an input, and
     # risking making it too easy to ignore the above comment about llvmPackages.