about summary refs log tree commit diff
path: root/pkgs/os-specific
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/os-specific')
-rw-r--r--pkgs/os-specific/bsd/freebsd/lib/default.nix67
-rw-r--r--pkgs/os-specific/bsd/freebsd/package-set.nix2
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch2
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/libifconfig-no-internal.patch36
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/mount-use-path.patch18
-rw-r--r--pkgs/os-specific/bsd/freebsd/patches/14.0/rc-user.patch17
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/bintrans.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/bsdlabel.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/cap_mkdb.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/daemon.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/devfs.nix10
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/dmesg.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod-firmware.nix54
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/package.nix53
-rwxr-xr-xpkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/update.py21
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/versions.json20
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/fdisk.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/fsck.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/geom.nix44
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/getent.nix1
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/getty.nix21
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/id.nix1
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/ifconfig.nix24
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/init.nix7
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/kldconfig.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/kldload.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/kldstat.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/kldunload.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/lib80211.nix13
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libbsdxml.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libbsm.nix7
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libgeom.nix17
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libifconfig.nix9
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libipsec.nix9
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libkiconv.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libpam.nix44
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix14
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libsysdecode.nix14
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libufs.nix8
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/libzfs.nix85
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/limits.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/login.nix28
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/makefs.nix24
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mdconfig.nix7
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix72
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mkimg.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mount.nix13
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/mount_msdosfs.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/newfs.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/newfs_msdos.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/newsyslog.nix15
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/nscd.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/ping.nix24
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/protect.nix1
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/pwd_mkdb.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/rc.nix76
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/rcorder.nix1
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/reboot.nix6
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/route.nix10
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/services_mkdb.nix8
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/shutdown.nix9
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/stand-efi.nix60
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/stat.nix2
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/swapon.nix1
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix170
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/sysctl.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/syslogd.nix23
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/top.nix17
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/truss.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/vtfontcvt.nix5
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/zfs-data.nix9
-rw-r--r--pkgs/os-specific/bsd/freebsd/pkgs/zfs.nix49
-rw-r--r--pkgs/os-specific/bsd/netbsd/pkgs/make.nix1
-rw-r--r--pkgs/os-specific/bsd/openbsd/default.nix1
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/csu.nix10
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix12
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/librthread.nix1
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/libutil.nix1
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix11
-rw-r--r--pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix1
-rw-r--r--pkgs/os-specific/darwin/apparency/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-11.0/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_Executables.nix27
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_macOSNMOS_SDK.nix28
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/apple-sdk-releases.json20
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/default.nix49
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/default.nix146
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/fixups.nix160
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/private.nix35
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/public.nix209
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libSystem.nix96
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libnetwork.nix16
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libobjc.nix22
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libpm.nix25
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libs/Xplugin.nix30
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libs/default.nix10
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libs/libDER.nix11
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libs/sandbox.nix13
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libs/simd.nix11
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libs/utmp.nix12
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libs/xpc.nix12
-rw-r--r--pkgs/os-specific/darwin/apple-sdk-12.3/libunwind.nix28
-rw-r--r--pkgs/os-specific/darwin/apple-sdk/default.nix11
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix4
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/default.nix12
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix2
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix16
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/xnu/headers-10.12-x86_64.txt (renamed from pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt)0
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-arm64.txt (renamed from pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt)0
-rw-r--r--pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-x86_64.txt1481
-rw-r--r--pkgs/os-specific/darwin/binutils/default.nix190
-rw-r--r--pkgs/os-specific/darwin/cctools/port.nix8
-rw-r--r--pkgs/os-specific/darwin/defaultbrowser/default.nix2
-rw-r--r--pkgs/os-specific/darwin/karabiner-elements/default.nix2
-rw-r--r--pkgs/os-specific/darwin/pam-reattach/default.nix14
-rw-r--r--pkgs/os-specific/darwin/raycast/default.nix4
-rw-r--r--pkgs/os-specific/darwin/rectangle/default.nix2
-rw-r--r--pkgs/os-specific/darwin/shortcat/default.nix2
-rw-r--r--pkgs/os-specific/darwin/swiftbar/default.nix10
-rw-r--r--pkgs/os-specific/darwin/xattr/default.nix1
-rw-r--r--pkgs/os-specific/linux/anbox/default.nix2
-rw-r--r--pkgs/os-specific/linux/apparmor/default.nix6
-rw-r--r--pkgs/os-specific/linux/atop/atop.service.patch12
-rw-r--r--pkgs/os-specific/linux/atop/atopacct.service.patch7
-rw-r--r--pkgs/os-specific/linux/atop/default.nix10
-rw-r--r--pkgs/os-specific/linux/atop/fix-paths.patch86
-rw-r--r--pkgs/os-specific/linux/audit/default.nix23
-rw-r--r--pkgs/os-specific/linux/below/default.nix3
-rw-r--r--pkgs/os-specific/linux/bpftune/default.nix1
-rw-r--r--pkgs/os-specific/linux/brillo/default.nix2
-rw-r--r--pkgs/os-specific/linux/catfs/Cargo.lock267
-rw-r--r--pkgs/os-specific/linux/catfs/default.nix11
-rw-r--r--pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff13
-rw-r--r--pkgs/os-specific/linux/cpupower-gui/default.nix1
-rw-r--r--pkgs/os-specific/linux/cryptsetup/default.nix4
-rw-r--r--pkgs/os-specific/linux/decklink/default.nix49
-rw-r--r--pkgs/os-specific/linux/displaylink/default.nix61
-rw-r--r--pkgs/os-specific/linux/fanctl/default.nix2
-rw-r--r--pkgs/os-specific/linux/ffado/default.nix71
-rw-r--r--pkgs/os-specific/linux/ffado/fix-build.patch54
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/default.nix24
-rw-r--r--pkgs/os-specific/linux/firmware/linux-firmware/source.nix7
-rwxr-xr-xpkgs/os-specific/linux/firmware/linux-firmware/update.sh49
-rw-r--r--pkgs/os-specific/linux/hostapd/0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch101
-rw-r--r--pkgs/os-specific/linux/hostapd/default.nix65
-rw-r--r--pkgs/os-specific/linux/hwdata/default.nix4
-rw-r--r--pkgs/os-specific/linux/intel-cmt-cat/default.nix4
-rw-r--r--pkgs/os-specific/linux/iproute/default.nix7
-rw-r--r--pkgs/os-specific/linux/kernel/common-config.nix17
-rw-r--r--pkgs/os-specific/linux/kernel/hardened/config.nix19
-rwxr-xr-xpkgs/os-specific/linux/kernel/hardened/update.py2
-rw-r--r--pkgs/os-specific/linux/kernel/kernels-org.json36
-rw-r--r--pkgs/os-specific/linux/kernel/linux-libre.nix4
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.10.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-5.4.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.1.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/linux-rt-6.6.nix6
-rw-r--r--pkgs/os-specific/linux/kernel/mainline.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/manual-config.nix5
-rw-r--r--pkgs/os-specific/linux/kernel/perf/default.nix27
-rw-r--r--pkgs/os-specific/linux/kernel/xanmod-kernels.nix8
-rw-r--r--pkgs/os-specific/linux/kernel/zen-kernels.nix30
-rw-r--r--pkgs/os-specific/linux/kinect-audio-setup/default.nix2
-rw-r--r--pkgs/os-specific/linux/libbpf/default.nix4
-rw-r--r--pkgs/os-specific/linux/libzbc/default.nix4
-rw-r--r--pkgs/os-specific/linux/linux-wifi-hotspot/default.nix4
-rw-r--r--pkgs/os-specific/linux/nfs-utils/default.nix15
-rw-r--r--pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.842
-rwxr-xr-xpkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh108
-rw-r--r--pkgs/os-specific/linux/numad/default.nix23
-rw-r--r--pkgs/os-specific/linux/numad/numad-linker-flags.patch33
-rw-r--r--pkgs/os-specific/linux/nvidia-x11/default.nix12
-rw-r--r--pkgs/os-specific/linux/oxtools/default.nix4
-rw-r--r--pkgs/os-specific/linux/policycoreutils/default.nix4
-rw-r--r--pkgs/os-specific/linux/power-profiles-daemon/default.nix2
-rw-r--r--pkgs/os-specific/linux/prl-tools/default.nix4
-rw-r--r--pkgs/os-specific/linux/pscircle/default.nix2
-rw-r--r--pkgs/os-specific/linux/rtl8812au/default.nix10
-rw-r--r--pkgs/os-specific/linux/rtl8814au/default.nix6
-rw-r--r--pkgs/os-specific/linux/rtl8821ce/default.nix35
-rw-r--r--pkgs/os-specific/linux/rtl8852bu/default.nix12
-rw-r--r--pkgs/os-specific/linux/sd-switch/default.nix6
-rw-r--r--pkgs/os-specific/linux/sysdig/default.nix2
-rw-r--r--pkgs/os-specific/linux/trace-cmd/kernelshark.nix4
-rw-r--r--pkgs/os-specific/linux/usbguard/default.nix2
-rw-r--r--pkgs/os-specific/windows/mingw-w64/default.nix1
187 files changed, 4785 insertions, 823 deletions
diff --git a/pkgs/os-specific/bsd/freebsd/lib/default.nix b/pkgs/os-specific/bsd/freebsd/lib/default.nix
index d022f7cfa14c6..3fea3bc3e7f22 100644
--- a/pkgs/os-specific/bsd/freebsd/lib/default.nix
+++ b/pkgs/os-specific/bsd/freebsd/lib/default.nix
@@ -1,4 +1,8 @@
-{ version }:
+{
+  version,
+  lib,
+  writeText,
+}:
 
 {
   inherit version;
@@ -15,4 +19,65 @@
     .${stdenv'.hostPlatform.parsed.cpu.name} or stdenv'.hostPlatform.parsed.cpu.name;
 
   install-wrapper = builtins.readFile ../../lib/install-wrapper.sh;
+
+  # this function takes a list of patches and a list of paths and returns a list of derivations,
+  # one per file that is patched, containing the actual patch contents. This allows us to have
+  # extract only the patches that are relevant for a given subset of the source tree.
+  # note: the "list of patches" input can be a directory containing patch files, a path or a list of valid inputs to this argument, recursively.
+  filterPatches =
+    patches: paths:
+    let
+      isDir =
+        file:
+        let
+          base = baseNameOf file;
+          type = (builtins.readDir (dirOf file)).${base} or null;
+        in
+        file == /. || type == "directory";
+      consolidatePatches =
+        patches:
+        if (lib.isDerivation patches) then
+          [ patches ]
+        else if (builtins.isPath patches) then
+          (if (isDir patches) then (lib.filesystem.listFilesRecursive patches) else [ patches ])
+        else if (builtins.isList patches) then
+          (lib.flatten (builtins.map consolidatePatches patches))
+        else
+          throw "Bad patches - must be path or derivation or list thereof";
+      consolidated = consolidatePatches patches;
+      splitPatch =
+        patchFile:
+        let
+          allLines' = lib.strings.splitString "\n" (builtins.readFile patchFile);
+          allLines = builtins.filter (
+            line: !((lib.strings.hasPrefix "diff --git" line) || (lib.strings.hasPrefix "index " line))
+          ) allLines';
+          foldFunc =
+            a: b:
+            if ((lib.strings.hasPrefix "--- " b) || (lib.strings.hasPrefix "diff --git " b)) then
+              (a ++ [ [ b ] ])
+            else
+              ((lib.lists.init a) ++ (lib.lists.singleton ((lib.lists.last a) ++ [ b ])));
+          partitionedPatches' = lib.lists.foldl foldFunc [ [ ] ] allLines;
+          partitionedPatches =
+            if (builtins.length partitionedPatches' > 1) then
+              (lib.lists.drop 1 partitionedPatches')
+            else
+              (throw "${patchFile} does not seem to be a unified patch (diff -u). this is required for FreeBSD.");
+          filterFunc =
+            patchLines:
+            let
+              prefixedPath = builtins.elemAt (builtins.split " |\t" (builtins.elemAt patchLines 1)) 2;
+              unfixedPath = lib.path.subpath.join (lib.lists.drop 1 (lib.path.subpath.components prefixedPath));
+            in
+            lib.lists.any (included: lib.path.hasPrefix (/. + ("/" + included)) (/. + ("/" + unfixedPath))) (
+              paths
+            );
+          filteredLines = builtins.filter filterFunc partitionedPatches;
+          derive = patchLines: writeText "freebsd-patch" (lib.concatLines patchLines);
+          derivedPatches = builtins.map derive filteredLines;
+        in
+        derivedPatches;
+    in
+    lib.lists.concatMap splitPatch consolidated;
 }
diff --git a/pkgs/os-specific/bsd/freebsd/package-set.nix b/pkgs/os-specific/bsd/freebsd/package-set.nix
index 4ff6cb2102490..e9f45ed64c709 100644
--- a/pkgs/os-specific/bsd/freebsd/package-set.nix
+++ b/pkgs/os-specific/bsd/freebsd/package-set.nix
@@ -7,6 +7,7 @@
   versionData,
   buildFreebsd,
   patchesRoot,
+  writeText,
 }:
 
 self:
@@ -39,6 +40,7 @@ lib.packagesFromDirectoryRecursive {
         ]
       )
     );
+    inherit lib writeText;
   };
 
   # The manual callPackages below should in principle be unnecessary, but are
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch
index 256db9e2d9cf4..a1418bd499753 100644
--- a/pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/libcxxrt-headers.patch
@@ -4,7 +4,7 @@
  SRCS+=		terminate.cc
  SRCS+=		typeinfo.cc
  
-+INCS+=cxxabi.h unwind.h unwind-arm.h unwind-itanium.h
++INCS+=cxxabi.h
 +
  WARNS?=		0
  CFLAGS+=	-isystem ${SRCDIR} -nostdinc++
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/libifconfig-no-internal.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/libifconfig-no-internal.patch
new file mode 100644
index 0000000000000..a84ca0ff89ffd
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/libifconfig-no-internal.patch
@@ -0,0 +1,36 @@
+diff --git a/lib/libifconfig/Makefile b/lib/libifconfig/Makefile
+index 6bdb202bec1d..ebc626901cfc 100644
+--- a/lib/libifconfig/Makefile
++++ b/lib/libifconfig/Makefile
+@@ -1,7 +1,6 @@
+ 
+ PACKAGE=	lib${LIB}
+ LIB=		ifconfig
+-INTERNALLIB=	true
+ 
+ LIBADD=		m
+ 
+@@ -36,8 +35,8 @@ SRCS+=	${GEN}
+ CLEANFILES+= ${GEN}
+ 
+ # If libifconfig become public uncomment those two lines
+-#INCSDIR=	${INCLUDEDIR}
+-#INCS=		libifconfig.h libifconfig_sfp.h libifconfig_sfp_tables.h
++INCSDIR=	${INCLUDEDIR}
++INCS=		libifconfig.h libifconfig_sfp.h libifconfig_sfp_tables.h
+ 
+ #MAN=		libifconfig.3
+ 
+diff --git a/lib/libifconfig/Symbol.map b/lib/libifconfig/Symbol.map
+index 2d80fb31652a..8b08947112e5 100644
+--- a/lib/libifconfig/Symbol.map
++++ b/lib/libifconfig/Symbol.map
+@@ -2,6 +2,8 @@ FBSD_1.6 {
+ 	ifconfig_bridge_get_bridge_status;
+ 	ifconfig_bridge_free_bridge_status;
+ 	ifconfig_carp_get_info;
++	ifconfig_carp_get_vhid;
++	ifconfig_carp_set_info;
+ 	ifconfig_close;
+ 	ifconfig_create_interface;
+ 	ifconfig_create_interface_vlan;
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/mount-use-path.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/mount-use-path.patch
new file mode 100644
index 0000000000000..614c327dda69a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/mount-use-path.patch
@@ -0,0 +1,18 @@
+diff --git a/sbin/mount/mount.c b/sbin/mount/mount.c
+index 2fcc94e40818..7de6da1bb20e 100644
+--- a/sbin/mount/mount.c
++++ b/sbin/mount/mount.c
+@@ -155,12 +155,9 @@ exec_mountprog(const char *name, const char *execname, char *const argv[])
+ 		EXIT(1);
+ 	case 0:					/* Child. */
+ 		/* Go find an executable. */
+-		execvP(execname, _PATH_SYSPATH, argv);
++		execvp(execname, argv);
+ 		if (errno == ENOENT) {
+ 			xo_warn("exec %s not found", execname);
+-			if (execname[0] != '/') {
+-				xo_warnx("in path: %s", _PATH_SYSPATH);
+-			}
+ 		}
+ 		EXIT(1);
+ 	default:				/* Parent. */
diff --git a/pkgs/os-specific/bsd/freebsd/patches/14.0/rc-user.patch b/pkgs/os-specific/bsd/freebsd/patches/14.0/rc-user.patch
new file mode 100644
index 0000000000000..27e8f9a13f211
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/patches/14.0/rc-user.patch
@@ -0,0 +1,17 @@
+diff --git a/libexec/rc/rc b/libexec/rc/rc
+index 0ea61a4b2c0a..d9bfb228224c 100644
+--- a/libexec/rc/rc
++++ b/libexec/rc/rc
+@@ -87,6 +87,12 @@ if ! [ -e ${firstboot_sentinel} ]; then
+ 	skip_firstboot="-s firstboot"
+ fi
+ 
++if [ -z "$USER_LOGIN" ]; then
++        skip="$skip -s user"
++else
++        skip="$skip -k user"
++fi
++
+ # Do a first pass to get everything up to $early_late_divider so that
+ # we can do a second pass that includes $local_startup directories
+ #
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/bintrans.nix b/pkgs/os-specific/bsd/freebsd/pkgs/bintrans.nix
new file mode 100644
index 0000000000000..d10426e26ca1b
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/bintrans.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "usr.bin/bintrans";
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/bsdlabel.nix b/pkgs/os-specific/bsd/freebsd/pkgs/bsdlabel.nix
new file mode 100644
index 0000000000000..45d5516ecc78d
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/bsdlabel.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, libgeom }:
+mkDerivation {
+  path = "sbin/bsdlabel";
+  extraPaths = [ "sys/geom" ];
+  buildInputs = [ libgeom ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/cap_mkdb.nix b/pkgs/os-specific/bsd/freebsd/pkgs/cap_mkdb.nix
new file mode 100644
index 0000000000000..d579b5605bcf2
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/cap_mkdb.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "usr.bin/cap_mkdb";
+
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/daemon.nix b/pkgs/os-specific/bsd/freebsd/pkgs/daemon.nix
new file mode 100644
index 0000000000000..b7c29ccfc2a51
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/daemon.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "usr.sbin/daemon";
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/devfs.nix b/pkgs/os-specific/bsd/freebsd/pkgs/devfs.nix
new file mode 100644
index 0000000000000..8fc29aa382d6f
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/devfs.nix
@@ -0,0 +1,10 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "sbin/devfs";
+
+  # These config files are mostly examples and not super useful
+  # in nixbsd
+  postPatch = ''
+    sed -i 's/^CONFS=.*$//' $BSDSRCDIR/sbin/devfs/Makefile
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/dmesg.nix b/pkgs/os-specific/bsd/freebsd/pkgs/dmesg.nix
new file mode 100644
index 0000000000000..f2412ff557666
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/dmesg.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, lib }:
+mkDerivation {
+  path = "sbin/dmesg";
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod-firmware.nix b/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod-firmware.nix
new file mode 100644
index 0000000000000..002b9276cf5b7
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod-firmware.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  mkDerivation,
+  fetchFromGitHub,
+  buildFreebsd,
+  sys,
+  withAmd ? true,
+  withIntel ? true,
+}:
+mkDerivation rec {
+  pname =
+    "drm-kmod-firmware" + lib.optionalString withAmd "-amd" + lib.optionalString withIntel "-intel";
+
+  version = "20230625_8";
+
+  src = fetchFromGitHub {
+    owner = "freebsd";
+    repo = "drm-kmod-firmware";
+    rev = version;
+    hash = "sha256-Ly9B0zf+YODel/X1sZYVVUVWh38faNLhkcXcjEnQwII=";
+  };
+
+  extraNativeBuildInputs = [ buildFreebsd.xargs-j ];
+
+  hardeningDisable = [
+    "pic" # generates relocations the linker can't handle
+    "stackprotector" # generates stack protection for the function generating the stack canary
+  ];
+
+  # hardeningDisable = stackprotector doesn't seem to be enough, put it in cflags too
+  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+
+  KMODS =
+    lib.optional withIntel "i915kmsfw"
+    ++ lib.optionals withAmd [
+      "amdgpukmsfw"
+      "radeonkmsfw"
+    ];
+
+  env = sys.passthru.env;
+  SYSDIR = "${sys.src}/sys";
+
+  KMODDIR = "${builtins.placeholder "out"}/kernel";
+
+  meta = {
+    description = "GPU firmware for FreeBSD drm-kmod";
+    platforms = lib.platforms.freebsd;
+    license =
+      lib.optional withAmd lib.licenses.unfreeRedistributableFirmware
+      # Intel license prohibits modification. this will wrap firmware files in an ELF
+      ++ lib.optional withIntel lib.licenses.unfree;
+    sourceProvenance = [ lib.sourceTypes.binaryFirmware ];
+  };
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/package.nix
new file mode 100644
index 0000000000000..42806392d217a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  mkDerivation,
+  fetchFromGitHub,
+  xargs-j,
+  versionData,
+  sys,
+}:
+let
+  # Based off ports tree versions
+  reldate = lib.toIntBase10 versionData.reldate;
+  branch =
+    if reldate >= 1500008 then
+      "6.1-lts"
+    else if reldate >= 1400097 then
+      "5.15-lts"
+    else if reldate >= 1302000 then
+      "5.10-lts"
+    else
+      throw "drm-kmod not supported on FreeBSD version ${reldate}";
+
+  fetchOptions = (lib.importJSON ./versions.json).${branch};
+in
+mkDerivation {
+  pname = "drm-kmod";
+  version = branch;
+
+  src = fetchFromGitHub fetchOptions;
+
+  extraNativeBuildInputs = [ xargs-j ];
+
+  hardeningDisable = [
+    "pic" # generates relocations the linker can't handle
+    "stackprotector" # generates stack protection for the function generating the stack canary
+  ];
+
+  # hardeningDisable = stackprotector doesn't seem to be enough, put it in cflags too
+  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
+
+  env = sys.passthru.env;
+  SYSDIR = "${sys.src}/sys";
+
+  KMODDIR = "${builtins.placeholder "out"}/kernel";
+
+  meta = {
+    description = "Linux drm driver, ported to FreeBSD";
+    platforms = lib.platforms.freebsd;
+    license = with lib.licenses; [
+      bsd2
+      gpl2Only
+    ];
+  };
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/update.py b/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/update.py
new file mode 100755
index 0000000000000..c724e3cbd104a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/update.py
@@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python -p python3 nix-prefetch-github git
+
+import subprocess
+import json
+import os.path
+
+BRANCHES = ["5.10-lts", "5.15-lts", "6.1-lts"]
+BASE_DIR = os.path.dirname(os.path.abspath(__file__))
+
+versions = dict()
+
+for branch in BRANCHES:
+    text = subprocess.check_output(
+        ["nix-prefetch-github", "freebsd", "drm-kmod", "--rev", branch, "--json"]
+    ).decode("utf-8")
+    versions[branch] = json.loads(text)
+
+with open(os.path.join(BASE_DIR, "versions.json"), "w") as out:
+    json.dump(versions, out, sort_keys=True, indent=2)
+    out.write("\n")
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/versions.json b/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/versions.json
new file mode 100644
index 0000000000000..9375e53e9d4dd
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/drm-kmod/versions.json
@@ -0,0 +1,20 @@
+{
+  "5.10-lts": {
+    "hash": "sha256-6v8FhaEch9fJfo0/1UXeo0bcZh5n4Y2TyAsyHmCBJgw=",
+    "owner": "freebsd",
+    "repo": "drm-kmod",
+    "rev": "e7950546196d44af502dd6abf162d1453f6f0dd0"
+  },
+  "5.15-lts": {
+    "hash": "sha256-i768QfnYo2hqxnoCEnfYqOurDSRwkAsC4qsP7TUalxc=",
+    "owner": "freebsd",
+    "repo": "drm-kmod",
+    "rev": "d7dc64fb8e63208afaca01e6d48284aa2305df35"
+  },
+  "6.1-lts": {
+    "hash": "sha256-+CsqQ0beJgoO3SSWzwLcAO8JP15oaDW9HR+bxwPaan4=",
+    "owner": "freebsd",
+    "repo": "drm-kmod",
+    "rev": "f2d6d4b58446fa45de575bae76d6435439b3ca8b"
+  }
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/fdisk.nix b/pkgs/os-specific/bsd/freebsd/pkgs/fdisk.nix
new file mode 100644
index 0000000000000..62654008955c4
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/fdisk.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, libgeom }:
+mkDerivation {
+  path = "sbin/fdisk";
+
+  buildInputs = [ libgeom ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/fsck.nix b/pkgs/os-specific/bsd/freebsd/pkgs/fsck.nix
new file mode 100644
index 0000000000000..ba55a5f651ed4
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/fsck.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "sbin/fsck";
+  extraPaths = [ "sbin/mount" ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/geom.nix b/pkgs/os-specific/bsd/freebsd/pkgs/geom.nix
new file mode 100644
index 0000000000000..552d2e420120a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/geom.nix
@@ -0,0 +1,44 @@
+{
+  mkDerivation,
+  libgeom,
+  libufs,
+  openssl,
+}:
+let
+  libs = mkDerivation {
+    name = "geom-class-libs";
+    path = "lib/geom";
+    extraPaths = [
+      "lib/Makefile.inc"
+      "sbin/geom"
+      "sys/geom"
+
+      # geli isn't okay with just libcrypt, it wants files in here
+      "sys/crypto/sha2"
+      "sys/opencrypto"
+    ];
+
+    # libgeom needs sbuf and bsdxml but linker doesn't know that
+    buildInputs = [
+      libgeom
+      libufs
+      openssl
+    ];
+
+    # tools want geom headers but don't seem to declare it
+    preBuild = ''
+      export NIX_CFLAGS_COMPILE="-I$BSDSRCDIR/sys $NIX_CFLAGS_COMPILE";
+    '';
+  };
+in
+mkDerivation {
+  path = "sbin/geom";
+  extraPaths = [
+    "lib/Makefile.inc"
+    "lib/geom"
+  ];
+
+  GEOM_CLASS_DIR = "${libs}/lib";
+
+  buildInputs = [ libgeom ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/getent.nix b/pkgs/os-specific/bsd/freebsd/pkgs/getent.nix
new file mode 100644
index 0000000000000..4d812f506b4dc
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/getent.nix
@@ -0,0 +1 @@
+{ mkDerivation }: mkDerivation { path = "usr.bin/getent"; }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/getty.nix b/pkgs/os-specific/bsd/freebsd/pkgs/getty.nix
new file mode 100644
index 0000000000000..4335a21fe4f3c
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/getty.nix
@@ -0,0 +1,21 @@
+{
+  mkDerivation,
+  login,
+  wrappedLogin ? null,
+}:
+mkDerivation {
+  path = "libexec/getty";
+
+  postPatch = ''
+    sed -E -i -e "s|/usr/bin/login|${
+      if (wrappedLogin != null) then wrappedLogin else "${login}/bin/login"
+    }|g" $BSDSRCDIR/libexec/getty/*.h
+  '';
+
+  MK_TESTS = "no";
+
+  postInstall = ''
+    mkdir -p $out/etc
+    cp $BSDSRCDIR/libexec/getty/gettytab $out/etc/gettytab
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/id.nix b/pkgs/os-specific/bsd/freebsd/pkgs/id.nix
new file mode 100644
index 0000000000000..d838995f89bd7
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/id.nix
@@ -0,0 +1 @@
+{ mkDerivation }: mkDerivation { path = "usr.bin/id"; }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/ifconfig.nix b/pkgs/os-specific/bsd/freebsd/pkgs/ifconfig.nix
new file mode 100644
index 0000000000000..16b20733af4b3
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/ifconfig.nix
@@ -0,0 +1,24 @@
+{
+  mkDerivation,
+  compatIfNeeded,
+  libifconfig,
+  lib80211,
+  libjail,
+  libnv,
+}:
+mkDerivation {
+  path = "sbin/ifconfig";
+
+  buildInputs = compatIfNeeded ++ [
+    libifconfig
+    lib80211
+    libjail
+    libnv
+  ];
+
+  # ifconfig believes libifconfig is internal and thus PIE.
+  # We build libifconfig as an external library
+  MK_PIE = "no";
+
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/init.nix b/pkgs/os-specific/bsd/freebsd/pkgs/init.nix
new file mode 100644
index 0000000000000..502c532b82e8d
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/init.nix
@@ -0,0 +1,7 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "sbin/init";
+  extraPaths = [ "sbin/mount" ];
+  NO_FSCHG = "yes";
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/kldconfig.nix b/pkgs/os-specific/bsd/freebsd/pkgs/kldconfig.nix
new file mode 100644
index 0000000000000..29f2a1b54308f
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/kldconfig.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, lib }:
+mkDerivation {
+  path = "sbin/kldconfig";
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/kldload.nix b/pkgs/os-specific/bsd/freebsd/pkgs/kldload.nix
new file mode 100644
index 0000000000000..a39909dc03692
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/kldload.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, lib }:
+mkDerivation {
+  path = "sbin/kldload";
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/kldstat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/kldstat.nix
new file mode 100644
index 0000000000000..164376a6bff90
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/kldstat.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, lib }:
+mkDerivation {
+  path = "sbin/kldstat";
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/kldunload.nix b/pkgs/os-specific/bsd/freebsd/pkgs/kldunload.nix
new file mode 100644
index 0000000000000..fc622fc9edade
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/kldunload.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, lib }:
+mkDerivation {
+  path = "sbin/kldunload";
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/lib80211.nix b/pkgs/os-specific/bsd/freebsd/pkgs/lib80211.nix
new file mode 100644
index 0000000000000..1cc8d337e0572
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/lib80211.nix
@@ -0,0 +1,13 @@
+{
+  mkDerivation,
+  libsbuf,
+  libbsdxml,
+}:
+mkDerivation {
+  path = "lib/lib80211";
+  buildInputs = [
+    libsbuf
+    libbsdxml
+  ];
+  clangFixup = true;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libbsdxml.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libbsdxml.nix
new file mode 100644
index 0000000000000..333e4048c8376
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libbsdxml.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "lib/libexpat";
+  extraPaths = [ "contrib/expat" ];
+  buildInputs = [ ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libbsm.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libbsm.nix
new file mode 100644
index 0000000000000..96ec9fd84d383
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libbsm.nix
@@ -0,0 +1,7 @@
+{ mkDerivation, libpam }:
+mkDerivation {
+  path = "lib/libbsm";
+  extraPaths = [ "contrib/openbsm" ];
+  buildInputs = [ libpam ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libgeom.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libgeom.nix
new file mode 100644
index 0000000000000..295d9d75c5370
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libgeom.nix
@@ -0,0 +1,17 @@
+{
+  mkDerivation,
+  libbsdxml,
+  libsbuf,
+}:
+mkDerivation {
+  path = "lib/libgeom";
+  buildInputs = [
+    libbsdxml
+    libsbuf
+  ];
+
+  makeFlags = [
+    "SHLIB_MAJOR=1"
+    "STRIP=-s"
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libifconfig.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libifconfig.nix
new file mode 100644
index 0000000000000..4d7ab09b0c00c
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libifconfig.nix
@@ -0,0 +1,9 @@
+{ mkDerivation, buildPackages }:
+mkDerivation {
+  path = "lib/libifconfig";
+  extraPaths = [
+    "tools/lua"
+    "lib/libc/Versions.def"
+  ];
+  LUA = "${buildPackages.lua}/bin/lua";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libipsec.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libipsec.nix
new file mode 100644
index 0000000000000..a250448bac54d
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libipsec.nix
@@ -0,0 +1,9 @@
+{ mkDerivation, buildPackages }:
+mkDerivation {
+  path = "lib/libipsec";
+
+  extraNativeBuildInputs = [
+    buildPackages.byacc
+    buildPackages.flex
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libkiconv.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libkiconv.nix
new file mode 100644
index 0000000000000..543f3e7ac042f
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libkiconv.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "lib/libkiconv";
+  extraPaths = [ "sys" ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libpam.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libpam.nix
new file mode 100644
index 0000000000000..2afb20377d6bb
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libpam.nix
@@ -0,0 +1,44 @@
+{
+  mkDerivation,
+  openssl,
+  libradius,
+}:
+mkDerivation {
+  path = "lib/libpam/libpam";
+  extraPaths = [
+    "lib/libpam"
+    "contrib/openpam"
+    "lib/Makefile.inc"
+    "contrib/pam_modules"
+    "crypto/openssh"
+  ];
+  buildInputs = [
+    libradius
+    openssl
+  ];
+
+  MK_NIS = "no"; # TODO
+
+  # TODO
+  postPatch = ''
+    sed -E -i -e /pam_tacplus/d $BSDSRCDIR/lib/libpam/modules/modules.inc
+    sed -E -i -e /pam_krb5/d $BSDSRCDIR/lib/libpam/modules/modules.inc
+    sed -E -i -e /pam_ksu/d $BSDSRCDIR/lib/libpam/modules/modules.inc
+    sed -E -i -e /pam_ssh/d $BSDSRCDIR/lib/libpam/modules/modules.inc
+  '';
+
+  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I$BSDSRCDIR/lib/libpam/libpam -DOPENPAM_MODULES_DIRECTORY=\"$out/lib\""
+  '';
+
+  MK_TESTS = "no";
+
+  postInstall = ''
+    make $makeFlags installconfig
+
+    export NIX_LDFLAGS="$NIX_LDFLAGS -L$out/lib"
+    make -C $BSDSRCDIR/lib/libpam/modules $makeFlags
+    make -C $BSDSRCDIR/lib/libpam/modules $makeFlags install
+    make -C $BSDSRCDIR/lib/libpam/modules $makeFlags installconfig
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix
new file mode 100644
index 0000000000000..9766d75e6c3f7
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libradius.nix
@@ -0,0 +1,14 @@
+{
+  mkDerivation,
+  openssl,
+  libmd,
+}:
+mkDerivation {
+  path = "lib/libradius";
+  buildInputs = [
+    libmd
+    openssl
+  ];
+
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libsysdecode.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libsysdecode.nix
new file mode 100644
index 0000000000000..da78404e2a58f
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libsysdecode.nix
@@ -0,0 +1,14 @@
+{ mkDerivation, stdenv }:
+mkDerivation {
+  path = "lib/libsysdecode";
+  extraPaths = [
+    "sys"
+    "libexec/rtld-elf"
+  ];
+
+  preBuild = ''
+    sed -E -i -e "s|..INCLUDEDIR.|${stdenv.cc.libc}/include|g" $BSDSRCDIR/lib/libsysdecode/Makefile
+  '';
+
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libufs.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libufs.nix
new file mode 100644
index 0000000000000..c0d71eb2b9c13
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libufs.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "lib/libufs";
+  extraPaths = [
+    "sys/libkern"
+    "sys/ufs"
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
index 6df6fa740f45e..b7600185ae07b 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libutil.nix
@@ -1,8 +1,4 @@
-{
-  mkDerivation,
-  lib,
-  stdenv,
-}:
+{ mkDerivation, lib }:
 mkDerivation {
   path = "lib/libutil";
   extraPaths = [ "lib/libc/gen" ];
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/libzfs.nix b/pkgs/os-specific/bsd/freebsd/pkgs/libzfs.nix
new file mode 100644
index 0000000000000..fcb4b29dc14d6
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/libzfs.nix
@@ -0,0 +1,85 @@
+{
+  mkDerivation,
+  lib,
+  libbsdxml,
+  libgeom,
+  openssl,
+  zfs-data,
+  zlib,
+}:
+# When I told you this was libzfs, I lied.
+# This is actually all the openzfs libs.
+# We need to build a bunch of them before libzfs otherwise it complains
+# For the dependency tree see sys/contrib/openzfs/lib/Makefile.am
+# or cddl/lib/Makefile
+let
+  libs = [
+    # Not really "zfs" libraries, they're solaris compatiblity libraries
+    "libspl"
+    "libumem"
+
+    # Libraires with no dependencies here execpt libumem and libspl
+    "libavl"
+    "libicp"
+    "libnvpair"
+    "libtpool"
+
+    # Depend only on the previous ones
+    "libzutil"
+    "libzfs_core"
+    "libuutil"
+
+    # Final libraries
+    "libzpool"
+    "libzfs"
+  ];
+in
+mkDerivation {
+  path = "cddl/lib/libzfs";
+  extraPaths = [
+    "cddl/Makefile.inc"
+    "cddl/compat/opensolaris"
+    "cddl/lib"
+    "sys/contrib/openzfs"
+    "sys/modules/zfs"
+  ];
+
+  buildInputs = [
+    libbsdxml
+    libgeom
+    openssl
+    zlib
+  ];
+
+  postPatch = ''
+    # libnvpair uses `struct xdr_bytesrec`, which is never defined when this is set
+    # no idea how this works upstream
+    sed -i 's/-DHAVE_XDR_BYTESREC//' $BSDSRCDIR/cddl/lib/libnvpair/Makefile
+
+    # libzfs wants some files from compatibility.d, put them in the store
+    sed -i 's|/usr/share/zfs|${zfs-data}/share/zfs|' $BSDSRCDIR/cddl/lib/libzfs/Makefile
+  '';
+
+  # If we don't specify an object directory then
+  # make will try to put openzfs objects in nonexistant directories.
+  # This one seems to work
+  preBuild =
+    ''
+      export MAKEOBJDIRPREFIX=$BSDSRCDIR/obj
+    ''
+    + lib.flip lib.concatMapStrings libs (libname: ''
+      echo "building dependency ${libname}"
+      make -C $BSDSRCDIR/cddl/lib/${libname} $makeFlags
+      make -C $BSDSRCDIR/cddl/lib/${libname} $makeFlags install
+    '');
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  meta = {
+    platforms = lib.platforms.freebsd;
+    license = with lib.licenses; [ cddl ];
+  };
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/limits.nix b/pkgs/os-specific/bsd/freebsd/pkgs/limits.nix
new file mode 100644
index 0000000000000..1e045c8a13fae
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/limits.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, libutil }:
+mkDerivation {
+  path = "usr.bin/limits";
+  buildInputs = [ libutil ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/login.nix b/pkgs/os-specific/bsd/freebsd/pkgs/login.nix
new file mode 100644
index 0000000000000..8952068b8e9c1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/login.nix
@@ -0,0 +1,28 @@
+{
+  mkDerivation,
+  libutil,
+  libpam,
+  libbsm,
+  cap_mkdb,
+}:
+mkDerivation {
+  path = "usr.bin/login";
+  buildInputs = [
+    libutil
+    libpam
+    libbsm
+  ];
+  extraNativeBuildInputs = [ cap_mkdb ];
+
+  postPatch = ''
+    sed -E -i -e "s|..DESTDIR./etc|\''${CONFDIR}|g" $BSDSRCDIR/usr.bin/login/Makefile
+  '';
+
+  MK_TESTS = "no";
+  MK_SETUID_LOGIN = "no";
+
+  postInstall = ''
+    mkdir -p $out/etc
+    make $makeFlags installconfig
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/makefs.nix b/pkgs/os-specific/bsd/freebsd/pkgs/makefs.nix
new file mode 100644
index 0000000000000..c685a84264b7a
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/makefs.nix
@@ -0,0 +1,24 @@
+{
+  mkDerivation,
+  libnetbsd,
+  compatIfNeeded,
+  libsbuf,
+}:
+mkDerivation {
+  path = "usr.sbin/makefs";
+  extraPaths = [
+    "stand/libsa"
+    "sys/cddl/boot"
+    "sys/ufs/ffs"
+    "sbin/newfs_msdos"
+    "contrib/mtree"
+    "contrib/mknod"
+    "sys/fs/cd9660"
+  ];
+  buildInputs = compatIfNeeded ++ [
+    libnetbsd
+    libsbuf
+  ];
+  MK_TESTS = "no";
+  MK_PIE = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mdconfig.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mdconfig.nix
new file mode 100644
index 0000000000000..b5e13344d94ac
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mdconfig.nix
@@ -0,0 +1,7 @@
+{ mkDerivation, libgeom }:
+mkDerivation {
+  path = "sbin/mdconfig";
+  buildInputs = [ libgeom ];
+
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
index a085367ac68e6..ec4b698116b9c 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix
@@ -2,9 +2,6 @@
   lib,
   stdenv,
   stdenvNoCC,
-  stdenvNoLibs,
-  overrideCC,
-  buildPackages,
   versionData,
   writeText,
   patches,
@@ -24,15 +21,7 @@
 lib.makeOverridable (
   attrs:
   let
-    stdenv' =
-      if attrs.noCC or false then
-        stdenvNoCC
-      else if attrs.noLibc or false then
-        stdenvNoLibs
-      else if attrs.noLibcxx or false then
-        overrideCC stdenv buildPackages.llvmPackages.clangNoLibcxx
-      else
-        stdenv;
+    stdenv' = if attrs.noCC or false then stdenvNoCC else stdenv;
   in
   stdenv'.mkDerivation (
     rec {
@@ -117,61 +106,10 @@ lib.makeOverridable (
     }
     // {
       patches =
-        let
-          isDir =
-            file:
-            let
-              base = baseNameOf file;
-              type = (builtins.readDir (dirOf file)).${base} or null;
-            in
-            file == /. || type == "directory";
-          consolidatePatches =
-            patches:
-            if (lib.isDerivation patches) then
-              [ patches ]
-            else if (builtins.isPath patches) then
-              (if (isDir patches) then (lib.filesystem.listFilesRecursive patches) else [ patches ])
-            else if (builtins.isList patches) then
-              (lib.flatten (builtins.map consolidatePatches patches))
-            else
-              throw "Bad patches - must be path or derivation or list thereof";
-          consolidated = consolidatePatches patches;
-          splitPatch =
-            patchFile:
-            let
-              allLines' = lib.strings.splitString "\n" (builtins.readFile patchFile);
-              allLines = builtins.filter (
-                line: !((lib.strings.hasPrefix "diff --git" line) || (lib.strings.hasPrefix "index " line))
-              ) allLines';
-              foldFunc =
-                a: b:
-                if ((lib.strings.hasPrefix "--- " b) || (lib.strings.hasPrefix "diff --git " b)) then
-                  (a ++ [ [ b ] ])
-                else
-                  ((lib.lists.init a) ++ (lib.lists.singleton ((lib.lists.last a) ++ [ b ])));
-              partitionedPatches' = lib.lists.foldl foldFunc [ [ ] ] allLines;
-              partitionedPatches =
-                if (builtins.length partitionedPatches' > 1) then
-                  (lib.lists.drop 1 partitionedPatches')
-                else
-                  (throw "${patchFile} does not seem to be a unified patch (diff -u). this is required for FreeBSD.");
-              filterFunc =
-                patchLines:
-                let
-                  prefixedPath = builtins.elemAt (builtins.split " |\t" (builtins.elemAt patchLines 1)) 2;
-                  unfixedPath = lib.path.subpath.join (lib.lists.drop 1 (lib.path.subpath.components prefixedPath));
-                in
-                lib.lists.any (included: lib.path.hasPrefix (/. + ("/" + included)) (/. + ("/" + unfixedPath))) (
-                  (attrs.extraPaths or [ ]) ++ [ attrs.path ]
-                );
-              filteredLines = builtins.filter filterFunc partitionedPatches;
-              derive = patchLines: writeText "freebsd-patch" (lib.concatLines patchLines);
-              derivedPatches = builtins.map derive filteredLines;
-            in
-            derivedPatches;
-          picked = lib.lists.concatMap splitPatch consolidated;
-        in
-        picked ++ attrs.patches or [ ];
+        (lib.optionals (attrs.autoPickPatches or true) (
+          freebsd-lib.filterPatches patches (attrs.extraPaths or [ ] ++ [ attrs.path ])
+        ))
+        ++ attrs.patches or [ ];
     }
   )
 )
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mkimg.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mkimg.nix
new file mode 100644
index 0000000000000..00982a2a52a74
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mkimg.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "usr.bin/mkimg";
+  extraPaths = [ "sys/sys/disk" ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mount.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mount.nix
new file mode 100644
index 0000000000000..a4885871ad1c5
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mount.nix
@@ -0,0 +1,13 @@
+{
+  mkDerivation,
+  libutil,
+  libxo,
+  ...
+}:
+mkDerivation {
+  path = "sbin/mount";
+  buildInputs = [
+    libutil
+    libxo
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/mount_msdosfs.nix b/pkgs/os-specific/bsd/freebsd/pkgs/mount_msdosfs.nix
new file mode 100644
index 0000000000000..da42260ffbad5
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/mount_msdosfs.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, libkiconv }:
+mkDerivation {
+  path = "sbin/mount_msdosfs";
+  extraPaths = [ "sbin/mount" ];
+  buildInputs = [ libkiconv ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/newfs.nix b/pkgs/os-specific/bsd/freebsd/pkgs/newfs.nix
new file mode 100644
index 0000000000000..7b7af7fcb25f8
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/newfs.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, libufs }:
+mkDerivation {
+  path = "sbin/newfs";
+  extraPaths = [ "sys/geom" ];
+  buildInputs = [ libufs ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/newfs_msdos.nix b/pkgs/os-specific/bsd/freebsd/pkgs/newfs_msdos.nix
new file mode 100644
index 0000000000000..274421a1a0966
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/newfs_msdos.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "sbin/newfs_msdos";
+
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/newsyslog.nix b/pkgs/os-specific/bsd/freebsd/pkgs/newsyslog.nix
new file mode 100644
index 0000000000000..947f324587ba5
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/newsyslog.nix
@@ -0,0 +1,15 @@
+{
+  mkDerivation,
+  compatIfNeeded,
+  libsbuf,
+}:
+mkDerivation {
+  path = "usr.sbin/newsyslog";
+
+  buildInputs = compatIfNeeded ++ [ libsbuf ];
+
+  # The only subdir is newsyslog.conf.d, all config files we don't want
+  postPatch = ''
+    sed -E -i -e '/^SUBDIR/d' $BSDSRCDIR/usr.sbin/newsyslog/Makefile
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/nscd.nix b/pkgs/os-specific/bsd/freebsd/pkgs/nscd.nix
new file mode 100644
index 0000000000000..c3ae6d46f0675
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/nscd.nix
@@ -0,0 +1,5 @@
+{ mkDerivation, libutil, ... }:
+mkDerivation {
+  path = "usr.sbin/nscd";
+  buildInputs = [ libutil ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/ping.nix b/pkgs/os-specific/bsd/freebsd/pkgs/ping.nix
new file mode 100644
index 0000000000000..ea209db2b960d
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/ping.nix
@@ -0,0 +1,24 @@
+{
+  mkDerivation,
+  lib,
+  libcasper,
+  libcapsicum,
+  libipsec,
+}:
+mkDerivation {
+  path = "sbin/ping";
+  buildInputs = [
+    libcasper
+    libcapsicum
+    libipsec
+  ];
+
+  postPatch = ''
+    sed -i 's/4555/0555/' $BSDSRCDIR/sbin/ping/Makefile
+  '';
+
+  MK_TESTS = "no";
+  clangFixup = true;
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/protect.nix b/pkgs/os-specific/bsd/freebsd/pkgs/protect.nix
new file mode 100644
index 0000000000000..00e5dcfb16e94
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/protect.nix
@@ -0,0 +1 @@
+{ mkDerivation }: mkDerivation { path = "usr.bin/protect"; }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/pwd_mkdb.nix b/pkgs/os-specific/bsd/freebsd/pkgs/pwd_mkdb.nix
new file mode 100644
index 0000000000000..27c3a9cec42ac
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/pwd_mkdb.nix
@@ -0,0 +1,6 @@
+{ mkDerivation, ... }:
+mkDerivation {
+  path = "usr.sbin/pwd_mkdb";
+
+  extraPaths = [ "lib/libc/gen" ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/rc.nix b/pkgs/os-specific/bsd/freebsd/pkgs/rc.nix
new file mode 100644
index 0000000000000..92b645851b9c1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/rc.nix
@@ -0,0 +1,76 @@
+{
+  mkDerivation,
+  lib,
+  sysctl,
+  bash,
+  rcorder,
+  bin,
+  stat,
+  id,
+  protect,
+  mount,
+}:
+let
+  rcDepsPath = lib.makeBinPath [
+    sysctl
+    bin
+    bash
+    rcorder
+    stat
+    id
+    mount
+    protect
+  ];
+in
+mkDerivation {
+  path = "libexec/rc";
+  MK_TESTS = "no";
+
+  postPatch =
+    ''
+      substituteInPlace "$BSDSRCDIR/libexec/rc/rc.d/Makefile" "$BSDSRCDIR/libexec/rc/Makefile" --replace-fail /etc $out/etc
+      substituteInPlace "$BSDSRCDIR/libexec/rc/rc.d/Makefile" --replace-fail /var $out/var
+    ''
+    + (
+      let
+        bins = [
+          "/sbin/sysctl"
+          "/usr/bin/protect"
+          "/usr/bin/id"
+          "/bin/ps"
+          "/bin/cpuset"
+          "/usr/bin/stat"
+          "/bin/rm"
+          "/bin/chmod"
+          "/bin/cat"
+          "/bin/sync"
+          "/bin/sleep"
+          "/bin/date"
+        ];
+        scripts = [
+          "rc"
+          "rc.initdiskless"
+          "rc.shutdown"
+          "rc.subr"
+          "rc.suspend"
+          "rc.resume"
+        ];
+        scriptPaths = "$BSDSRCDIR/libexec/rc/{${lib.concatStringsSep "," scripts}}";
+      in
+      # set PATH correctly in scripts
+      ''
+        sed -E -i -e "s|PATH=.*|PATH=${rcDepsPath}|g" ${scriptPaths}
+      ''
+      # replace executable absolute filepaths with PATH lookups
+      + lib.concatMapStringsSep "\n" (fname: ''
+        sed -E -i -e "s|${fname}|${lib.last (lib.splitString "/" fname)}|g" \
+          ${scriptPaths}'') bins
+    );
+
+  skipIncludesPhase = true;
+
+  postInstall = ''
+    makeFlags="$(sed -E -e 's/CONFDIR=[^ ]*//g' <<<"$makeFlags")"
+    make $makeFlags installconfig
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/rcorder.nix b/pkgs/os-specific/bsd/freebsd/pkgs/rcorder.nix
new file mode 100644
index 0000000000000..ddacf18e7b95e
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/rcorder.nix
@@ -0,0 +1 @@
+{ mkDerivation }: mkDerivation { path = "sbin/rcorder"; }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/reboot.nix b/pkgs/os-specific/bsd/freebsd/pkgs/reboot.nix
new file mode 100644
index 0000000000000..10a042dc45fde
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/reboot.nix
@@ -0,0 +1,6 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "sbin/reboot";
+
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/route.nix b/pkgs/os-specific/bsd/freebsd/pkgs/route.nix
new file mode 100644
index 0000000000000..83278e7857971
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/route.nix
@@ -0,0 +1,10 @@
+{
+  mkDerivation,
+  compatIfNeeded,
+  libjail,
+}:
+mkDerivation {
+  path = "sbin/route";
+  buildInputs = compatIfNeeded ++ [ libjail ];
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/services_mkdb.nix b/pkgs/os-specific/bsd/freebsd/pkgs/services_mkdb.nix
new file mode 100644
index 0000000000000..33c07093260ef
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/services_mkdb.nix
@@ -0,0 +1,8 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "usr.sbin/services_mkdb";
+  postInstall = ''
+    mkdir -p $out/etc
+    cp $BSDSRCDIR/usr.sbin/services_mkdb/services $out/etc/services
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/shutdown.nix b/pkgs/os-specific/bsd/freebsd/pkgs/shutdown.nix
new file mode 100644
index 0000000000000..4d32db0ed1da4
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/shutdown.nix
@@ -0,0 +1,9 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "sbin/shutdown";
+
+  MK_TESTS = "no";
+  preBuild = ''
+    sed -i 's/4554/0554/' Makefile
+  '';
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/stand-efi.nix b/pkgs/os-specific/bsd/freebsd/pkgs/stand-efi.nix
new file mode 100644
index 0000000000000..c2d42af7814a4
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/stand-efi.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  include,
+  buildPackages,
+  freebsd-lib,
+  vtfontcvt,
+}:
+let
+  hostArchBsd = freebsd-lib.mkBsdArch stdenv;
+in
+mkDerivation {
+  path = "stand/efi";
+  extraPaths = [
+    "contrib/bzip2"
+    "contrib/llvm-project/compiler-rt/lib/builtins"
+    "contrib/lua"
+    "contrib/pnglite"
+    "contrib/terminus"
+    "lib/libc"
+    "lib/liblua"
+    "libexec/flua"
+    "stand"
+    "sys"
+  ];
+  extraNativeBuildInputs = [ vtfontcvt ];
+
+  makeFlags = [
+    "STRIP=-s" # flag to install, not command
+    "MK_MAN=no"
+    "MK_TESTS=no"
+    "OBJCOPY=${lib.getBin buildPackages.binutils-unwrapped}/bin/${buildPackages.binutils-unwrapped.targetPrefix}objcopy"
+  ] ++ lib.optional (!stdenv.hostPlatform.isFreeBSD) "MK_WERROR=no";
+
+  hardeningDisable = [ "stackprotector" ];
+
+  # ???
+  preBuild = ''
+    NIX_CFLAGS_COMPILE+=" -I${include}/include -I$BSDSRCDIR/sys/sys -I$BSDSRCDIR/sys/${hostArchBsd}/include"
+    export NIX_CFLAGS_COMPILE
+
+    make -C $BSDSRCDIR/stand/libsa $makeFlags
+    make -C $BSDSRCDIR/stand/ficl $makeFlags
+    make -C $BSDSRCDIR/stand/liblua $makeFlags
+  '';
+
+  postPatch = ''
+    sed -E -i -e 's|/bin/pwd|${buildPackages.coreutils}/bin/pwd|' $BSDSRCDIR/stand/defs.mk
+    #sed -E -i -e 's|-e start|-Wl,-e,start|g' $BSDSRCDIR/stand/i386/Makefile.inc $BSDSRCDIR/stand/i386/*/Makefile
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin/lua
+    cp $BSDSRCDIR/stand/lua/*.lua $out/bin/lua
+    cp -r $BSDSRCDIR/stand/defaults $out/bin/defaults
+  '';
+
+  meta.platforms = lib.platforms.freebsd;
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix b/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix
index a801ab895441c..78c01ae498bd3 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/stat.nix
@@ -19,4 +19,6 @@ mkDerivation {
     mandoc
     groff
   ];
+
+  MK_TESTS = "no";
 }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/swapon.nix b/pkgs/os-specific/bsd/freebsd/pkgs/swapon.nix
new file mode 100644
index 0000000000000..d7bd8a870b8f4
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/swapon.nix
@@ -0,0 +1 @@
+{ mkDerivation }: mkDerivation { path = "sbin/swapon"; }
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix b/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix
index 86f847cbd45cf..5bca92269212f 100644
--- a/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/sys/package.nix
@@ -1,85 +1,137 @@
 {
-  stdenv,
+  lib,
   mkDerivation,
-  freebsd-lib,
+  stdenv,
   buildPackages,
+  freebsd-lib,
+  patches,
+  filterSource,
+  applyPatches,
+  baseConfig ? "GENERIC",
+  extraFlags ? { },
   bsdSetupHook,
+  mandoc,
+  groff,
+  gawk,
   freebsdSetupHook,
   makeMinimal,
   install,
-  mandoc,
-  groff,
   config,
   rpcgen,
   file2c,
-  gawk,
-  uudecode,
+  bintrans,
   xargs-j,
 }:
-
-mkDerivation (
-  let
-    cfg = "MINIMAL";
-  in
-  rec {
+let
+  hostArchBsd = freebsd-lib.mkBsdArch stdenv;
+  filteredSource = filterSource {
+    pname = "sys";
     path = "sys";
-
-    nativeBuildInputs = [
-      bsdSetupHook
-      freebsdSetupHook
-      makeMinimal
-      install
-      mandoc
-      groff
-
-      config
-      rpcgen
-      file2c
-      gawk
-      uudecode
-      xargs-j
+    extraPaths = [ "include" ];
+  };
+  patchedSource = applyPatches {
+    src = filteredSource;
+    patches = freebsd-lib.filterPatches patches [
+      "sys"
+      "include"
     ];
+    postPatch = ''
+      for f in sys/conf/kmod.mk sys/contrib/dev/acpica/acpica_prep.sh; do
+        substituteInPlace "$f" --replace-warn 'xargs -J' 'xargs-j '
+      done
+
+      for f in sys/conf/*.mk; do
+        substituteInPlace "$f" --replace-quiet 'KERN_DEBUGDIR}''${' 'KERN_DEBUGDIR_'
+      done
 
-    # --dynamic-linker /red/herring is used when building the kernel.
-    NIX_ENFORCE_PURITY = 0;
+      sed -i sys/${hostArchBsd}/conf/${baseConfig} \
+        -e 's/WITH_CTF=1/WITH_CTF=0/' \
+        -e '/KDTRACE/d'
+    '';
+  };
 
-    AWK = "${buildPackages.gawk}/bin/awk";
+  # Kernel modules need this for kern.opts.mk
+  env =
+    {
+      MK_CTF = "no";
+    }
+    // (lib.flip lib.mapAttrs' extraFlags (
+      name: value: {
+        name = "MK_${lib.toUpper name}";
+        value = if value then "yes" else "no";
+      }
+    ));
+in
+mkDerivation rec {
+  pname = "sys";
 
-    CWARNEXTRA = "-Wno-error=shift-negative-value -Wno-address-of-packed-member";
+  # Patch source outside of this derivation so out-of-tree modules can use it
+  src = patchedSource;
+  path = "sys";
+  autoPickPatches = false;
 
-    MK_CTF = "no";
+  nativeBuildInputs = [
+    bsdSetupHook
+    mandoc
+    groff
+    gawk
+    freebsdSetupHook
+    makeMinimal
+    install
+    config
+    rpcgen
+    file2c
+    bintrans
+    xargs-j
+  ];
 
-    KODIR = "${builtins.placeholder "out"}/kernel";
-    KMODDIR = "${builtins.placeholder "out"}/kernel";
-    DTBDIR = "${builtins.placeholder "out"}/dbt";
+  # --dynamic-linker /red/herring is used when building the kernel.
+  NIX_ENFORCE_PURITY = 0;
 
-    KERN_DEBUGDIR = "${builtins.placeholder "out"}/debug";
-    KERN_DEBUGDIR_KODIR = "${KERN_DEBUGDIR}/kernel";
-    KERN_DEBUGDIR_KMODDIR = "${KERN_DEBUGDIR}/kernel";
+  AWK = "${buildPackages.gawk}/bin/awk";
 
-    skipIncludesPhase = true;
+  CWARNEXTRA = "-Wno-error=shift-negative-value -Wno-address-of-packed-member";
 
-    configurePhase = ''
-      runHook preConfigure
+  hardeningDisable = [
+    "pic" # generates relocations the linker can't handle
+    "stackprotector" # generates stack protection for the function generating the stack canary
+  ];
 
-      for f in conf/kmod.mk contrib/dev/acpica/acpica_prep.sh; do
-        substituteInPlace "$f" --replace 'xargs -J' 'xargs-j '
-      done
+  # hardeningDisable = stackprotector doesn't seem to be enough, put it in cflags too
+  NIX_CFLAGS_COMPILE = "-fno-stack-protector";
 
-      for f in conf/*.mk; do
-        substituteInPlace "$f" --replace 'KERN_DEBUGDIR}''${' 'KERN_DEBUGDIR_'
-      done
+  inherit env;
+  passthru.env = env;
 
-      cd ${freebsd-lib.mkBsdArch stdenv}/conf
-      sed -i ${cfg} \
-        -e 's/WITH_CTF=1/WITH_CTF=0/' \
-        -e '/KDTRACE/d'
-      config ${cfg}
+  KODIR = "${builtins.placeholder "out"}/kernel";
+  KMODDIR = "${builtins.placeholder "out"}/kernel";
+  DTBDIR = "${builtins.placeholder "out"}/dbt";
 
-      runHook postConfigure
-    '';
-    preBuild = ''
-      cd ../compile/${cfg}
-    '';
-  }
-)
+  KERN_DEBUGDIR = "${builtins.placeholder "debug"}/lib/debug";
+  KERN_DEBUGDIR_KODIR = "${KERN_DEBUGDIR}/kernel";
+  KERN_DEBUGDIR_KMODDIR = "${KERN_DEBUGDIR}/kernel";
+
+  skipIncludesPhase = true;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cd ${hostArchBsd}/conf
+    config ${baseConfig}
+
+    runHook postConfigure
+  '';
+  preBuild = ''
+    cd ../compile/${baseConfig}
+  '';
+
+  outputs = [
+    "out"
+    "debug"
+  ];
+
+  meta = {
+    description = "FreeBSD kernel and modules";
+    platforms = lib.platforms.freebsd;
+  };
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/sysctl.nix b/pkgs/os-specific/bsd/freebsd/pkgs/sysctl.nix
new file mode 100644
index 0000000000000..42b956614c510
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/sysctl.nix
@@ -0,0 +1,5 @@
+{ mkDerivation, ... }:
+mkDerivation {
+  path = "sbin/sysctl";
+  MK_TESTS = "no";
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/syslogd.nix b/pkgs/os-specific/bsd/freebsd/pkgs/syslogd.nix
new file mode 100644
index 0000000000000..33b7acdf9800c
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/syslogd.nix
@@ -0,0 +1,23 @@
+{ mkDerivation, lib }:
+mkDerivation {
+  path = "usr.sbin/syslogd";
+
+  extraPaths = [
+    "usr.bin/wall"
+    "sys/sys"
+  ];
+
+  # These want to install some config files which we don't want
+  MK_FTP = "no";
+  MK_LPR = "no";
+  MK_PPP = "no";
+
+  MK_TESTS = "no";
+
+  meta = {
+    description = "FreeBSD syslog daemon";
+    maintainers = with lib.maintainers; [ artemist ];
+    platforms = lib.platforms.freebsd;
+    license = lib.licenses.bsd2;
+  };
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/top.nix b/pkgs/os-specific/bsd/freebsd/pkgs/top.nix
new file mode 100644
index 0000000000000..0059fb731d2dd
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/top.nix
@@ -0,0 +1,17 @@
+{
+  mkDerivation,
+  libjail,
+  libncurses-tinfo,
+  libutil,
+  libsbuf,
+  ...
+}:
+mkDerivation {
+  path = "usr.bin/top";
+  buildInputs = [
+    libjail
+    libncurses-tinfo
+    libutil
+    libsbuf
+  ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/truss.nix b/pkgs/os-specific/bsd/freebsd/pkgs/truss.nix
new file mode 100644
index 0000000000000..df00db4367bd9
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/truss.nix
@@ -0,0 +1,5 @@
+{ mkDerivation, libsysdecode }:
+mkDerivation {
+  path = "usr.bin/truss";
+  buildInputs = [ libsysdecode ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/vtfontcvt.nix b/pkgs/os-specific/bsd/freebsd/pkgs/vtfontcvt.nix
new file mode 100644
index 0000000000000..a0ea69b3fd4d1
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/vtfontcvt.nix
@@ -0,0 +1,5 @@
+{ mkDerivation }:
+mkDerivation {
+  path = "usr.bin/vtfontcvt";
+  extraPaths = [ "sys/cddl/contrib/opensolaris/common/lz4" ];
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/zfs-data.nix b/pkgs/os-specific/bsd/freebsd/pkgs/zfs-data.nix
new file mode 100644
index 0000000000000..8b13f7ba9d767
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/zfs-data.nix
@@ -0,0 +1,9 @@
+{ mkDerivation, lib }:
+mkDerivation {
+  path = "cddl/share/zfs/compatibility.d";
+  extraPaths = [ "sys/contrib/openzfs/cmd/zpool/compatibility.d" ];
+
+  meta = with lib; {
+    license = licenses.cddl;
+  };
+}
diff --git a/pkgs/os-specific/bsd/freebsd/pkgs/zfs.nix b/pkgs/os-specific/bsd/freebsd/pkgs/zfs.nix
new file mode 100644
index 0000000000000..505fa37fe2d7b
--- /dev/null
+++ b/pkgs/os-specific/bsd/freebsd/pkgs/zfs.nix
@@ -0,0 +1,49 @@
+{
+  mkDerivation,
+  lib,
+  libgeom,
+  libjail,
+  libzfs,
+  openssl,
+  zfs-data,
+}:
+mkDerivation {
+  path = "cddl/sbin/zfs";
+  extraPaths = [
+    "cddl/compat/opensolaris"
+    "cddl/sbin/zpool"
+    "sys/contrib/openzfs"
+    "sys/modules/zfs"
+  ];
+
+  buildInputs = [
+    libgeom
+    libjail
+    libzfs
+    openssl
+  ];
+
+  postPatch = ''
+    sed -i 's|/usr/share/zfs|${zfs-data}/share/zfs|' $BSDSRCDIR/cddl/sbin/zpool/Makefile
+  '';
+
+  # I lied, this is both zpool and zfs
+  preBuild = ''
+    make -C $BSDSRCDIR/cddl/sbin/zpool $makeFlags
+    make -C $BSDSRCDIR/cddl/sbin/zpool $makeFlags install
+  '';
+
+  outputs = [
+    "out"
+    "man"
+    "debug"
+  ];
+
+  meta = {
+    platforms = lib.platforms.freebsd;
+    license = with lib.licenses; [
+      cddl
+      bsd2
+    ];
+  };
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/make.nix b/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
index 9612ca7ff4893..6652d5454387b 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/make.nix
@@ -1,7 +1,6 @@
 {
   lib,
   mkDerivation,
-  stdenv,
   make-rules,
 }:
 
diff --git a/pkgs/os-specific/bsd/openbsd/default.nix b/pkgs/os-specific/bsd/openbsd/default.nix
index 4db2df57bc262..cfe594d518ed4 100644
--- a/pkgs/os-specific/bsd/openbsd/default.nix
+++ b/pkgs/os-specific/bsd/openbsd/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   crossLibcStdenv,
-  stdenvNoCC,
   makeScopeWithSplicing',
   generateSplicesForMkScope,
   buildPackages,
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix b/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix
index 03a7180425684..34c1183ba8bbc 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/csu.nix
@@ -1,6 +1,7 @@
 {
   lib,
   mkDerivation,
+  fetchpatch,
   bsdSetupHook,
   openbsdSetupHook,
   makeMinimal,
@@ -11,6 +12,15 @@
 mkDerivation {
   noLibc = true;
   path = "lib/csu";
+  patches = [
+    # Support for a new NOBLIBSTATIC make variable
+    (fetchpatch {
+      name = "nolibstatic-support.patch";
+      url = "https://marc.info/?l=openbsd-tech&m=171972639411562&q=raw";
+      hash = "sha256-ZMegMq/A/SeFp8fofIyF0AA0IUo/11ZgKxg/UNT4z3E=";
+      includes = [ "libexec/ld.so/*" ];
+    })
+  ];
   nativeBuildInputs = [
     bsdSetupHook
     openbsdSetupHook
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix
index d8d6cc398e0de..94fda2d905715 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/libcMinimal/package.nix
@@ -2,6 +2,7 @@
   lib,
   crossLibcStdenv,
   mkDerivation,
+  fetchpatch,
   bsdSetupHook,
   openbsdSetupHook,
   makeMinimal,
@@ -9,13 +10,11 @@
   flex,
   byacc,
   gencat,
+  lorder,
+  tsort,
   rpcgen,
   csu,
   include,
-  ctags,
-  tsort,
-  llvmPackages,
-  fetchpatch,
 }:
 
 mkDerivation {
@@ -35,9 +34,11 @@ mkDerivation {
   patches = [
     ./netbsd-make-to-lower.patch
     ./disable-librebuild.patch
+    # Do not produce ctags, can do that separately.
     (fetchpatch {
+      name = "skip-tags.patch";
       url = "https://marc.info/?l=openbsd-tech&m=171575286706032&q=raw";
-      sha256 = "sha256-2fqabJZLUvXUIWe5WZ4NrTOwgQCXqH49Wo0hAPu5lu0=";
+      hash = "sha256-2fqabJZLUvXUIWe5WZ4NrTOwgQCXqH49Wo0hAPu5lu0=";
     })
   ];
 
@@ -47,6 +48,7 @@ mkDerivation {
     makeMinimal
     install
     tsort
+    lorder
     gencat
   ];
 
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/librthread.nix b/pkgs/os-specific/bsd/openbsd/pkgs/librthread.nix
index 1d42d55290c39..047877348f086 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/librthread.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/librthread.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenvLibcMinimal,
   mkDerivation,
   libcMinimal,
 }:
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/libutil.nix b/pkgs/os-specific/bsd/openbsd/pkgs/libutil.nix
index 627fabe8cf2a3..fbb3a66a57070 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/libutil.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/libutil.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenvLibcMinimal,
   mkDerivation,
   libcMinimal,
   bsdSetupHook,
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix b/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix
index fefa1136eb76d..a16448752566e 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/make-rules/package.nix
@@ -14,11 +14,20 @@ mkDerivation {
   dontBuild = true;
 
   patches = [
+    # Use `$AR` not hardcoded `ar`
     (fetchpatch {
+      name = "use-ar-variable.patch";
       url = "https://marc.info/?l=openbsd-tech&m=171575284906018&q=raw";
-      sha256 = "sha256-bigxJGbaf9mCmFXxLVzQpnUUaEMMDfF3eZkTXVzd6B8=";
+      hash = "sha256-bigxJGbaf9mCmFXxLVzQpnUUaEMMDfF3eZkTXVzd6B8=";
     })
     ./netbsd-make-sinclude.patch
+    # Support for a new NOBLIBSTATIC make variable
+    (fetchpatch {
+      name = "nolibstatic-support.patch";
+      url = "https://marc.info/?l=openbsd-tech&m=171972639411562&q=raw";
+      hash = "sha256-p4izV6ZXkfgJud+ZZU1Wqr5qFuHUzE6qVXM7QnXvV3k=";
+      includes = [ "share/mk/*" ];
+    })
   ];
 
   postPatch = ''
diff --git a/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix b/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix
index a238a326f46d5..6ec9ba3429161 100644
--- a/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix
+++ b/pkgs/os-specific/bsd/openbsd/pkgs/mkDerivation.nix
@@ -92,6 +92,7 @@ lib.makeOverridable (
       installPhase = "includesPhase";
       dontBuild = true;
     }
+    // lib.optionalAttrs stdenv'.hostPlatform.isStatic { NOLIBSHARED = true; }
     // attrs
   )
 )
diff --git a/pkgs/os-specific/darwin/apparency/default.nix b/pkgs/os-specific/darwin/apparency/default.nix
index d5f9a7be172b1..54a8395f48077 100644
--- a/pkgs/os-specific/darwin/apparency/default.nix
+++ b/pkgs/os-specific/darwin/apparency/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     description = "App That Opens Apps";
     homepage = "https://www.mothersruin.com/software/Apparency/";
     license = lib.licenses.unfreeRedistributable;
-    maintainers = with lib.maintainers; [ Enzime ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "appy";
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
index 238c1b7e460b0..7262400c3eb02 100644
--- a/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk-11.0/default.nix
@@ -51,7 +51,7 @@ let
   };
 
   mkCc = cc:
-    if stdenv.isAarch64 then cc
+    if lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11" then cc
     else
       cc.override {
         bintools = stdenv.cc.bintools.override { libc = packages.Libsystem; };
@@ -59,7 +59,7 @@ let
       };
 
   mkStdenv = stdenv:
-    if stdenv.isAarch64 then stdenv
+    if lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11" then stdenv
     else
       let
         darwinMinVersion = "10.12";
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_Executables.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_Executables.nix
new file mode 100644
index 0000000000000..f3ff413d0cae3
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_Executables.nix
@@ -0,0 +1,27 @@
+{
+  stdenvNoCC,
+  fetchurl,
+  cpio,
+  pbzx,
+  version,
+}:
+
+let
+  releases = builtins.fromJSON (builtins.readFile ./apple-sdk-releases.json);
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "CLTools_Executables";
+  inherit version;
+
+  src = fetchurl releases.${version}.${finalAttrs.pname};
+
+  nativeBuildInputs = [
+    cpio
+    pbzx
+  ];
+
+  buildCommand = ''
+    pbzx $src | cpio -idm
+    mv Library/Developer/CommandLineTools $out
+  '';
+})
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_macOSNMOS_SDK.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_macOSNMOS_SDK.nix
new file mode 100644
index 0000000000000..7af2c48cc0819
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/CLTools_macOSNMOS_SDK.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  cpio,
+  pbzx,
+  version,
+}:
+
+let
+  releases = builtins.fromJSON (builtins.readFile ./apple-sdk-releases.json);
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "CLTools_macOSNMOS_SDK";
+  inherit version;
+
+  src = fetchurl releases.${version}.${finalAttrs.pname};
+
+  nativeBuildInputs = [
+    cpio
+    pbzx
+  ];
+
+  buildCommand = ''
+    pbzx $src | cpio -idm
+    mv Library/Developer/CommandLineTools/SDKs/MacOSX${lib.versions.majorMinor version}.sdk $out
+  '';
+})
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/apple-sdk-releases.json b/pkgs/os-specific/darwin/apple-sdk-12.3/apple-sdk-releases.json
new file mode 100644
index 0000000000000..87e01f0039ce2
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/apple-sdk-releases.json
@@ -0,0 +1,20 @@
+{
+  "12.3": {
+    "CLTools_Executables": {
+      "hash": "sha256-XlxHwCq+rtBF3Yyfdob3UEHN7YKzb7JF84lRmZbB/50=",
+      "url": "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_Executables.pkg"
+    },
+    "CLTools_macOSLMOS_SDK": {
+      "hash": "sha256-mY9YTlyTujV6R89WaNmkJrfOQatXnoSW8gKxnawQz5Q=",
+      "url": "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOSLMOS_SDK.pkg"
+    },
+    "CLTools_macOSNMOS_SDK": {
+      "hash": "sha256-Tr9VCeCP5udmh09U/zPQG2c4ky1LXscBwPfgpRy8uds=",
+      "url": "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOSNMOS_SDK.pkg"
+    },
+    "CLTools_macOS_SDK": {
+      "hash": "sha256-2xwYLfiYuEdck7/8NY3iqiPKvoG9HAjXt8Ewyp9c0Es=",
+      "url": "https://swcdn.apple.com/content/downloads/24/42/002-83793-A_74JRE8GVAT/rlnkct919wgc5c0pjq986z5bb9h62uvni2/CLTools_macOS_SDK.pkg"
+    }
+  }
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix
new file mode 100644
index 0000000000000..85444ec95e614
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  newScope,
+  overrideCC,
+  pkgs,
+  stdenv,
+  stdenvNoCC,
+}:
+
+let
+  version = "12.3";
+
+  MacOSX-SDK = callPackage ./CLTools_macOSNMOS_SDK.nix { inherit version; };
+  callPackage = newScope (pkgs.darwin // packages);
+
+  packages = {
+    # Make sure we pass our special `callPackage` instead of using packages.callPackage which
+    # does not have necessary attributes in scope.
+    frameworks = callPackage ./frameworks { inherit callPackage; };
+    libs = callPackage ./libs { inherit callPackage; };
+
+    CLTools_Executables = callPackage ./CLTools_Executables.nix { inherit version; };
+    Libsystem = callPackage ./libSystem.nix { };
+    LibsystemCross = callPackage ./libSystem.nix { };
+    libunwind = callPackage ./libunwind.nix { };
+    libnetwork = callPackage ./libnetwork.nix { };
+    libpm = callPackage ./libpm.nix { };
+    # Avoid introducing a new objc4 if stdenv already has one, to prevent
+    # conflicting LLVM modules.
+    objc4 = stdenv.objc4 or (callPackage ./libobjc.nix { });
+
+    darwin-stubs = stdenvNoCC.mkDerivation {
+      pname = "darwin-stubs";
+      inherit (MacOSX-SDK) version;
+
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+
+      buildCommand = ''
+        mkdir -p "$out"
+        ln -s ${MacOSX-SDK}/System "$out/System"
+        ln -s ${MacOSX-SDK}/usr "$out/usr"
+      '';
+    };
+
+    sdkRoot = pkgs.callPackage ../apple-sdk/sdkRoot.nix { sdkVersion = version; };
+  };
+in
+packages
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/default.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/default.nix
new file mode 100644
index 0000000000000..113633c556313
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/default.nix
@@ -0,0 +1,146 @@
+{
+  lib,
+  stdenvNoCC,
+  buildPackages,
+  # macOS things
+  callPackage,
+  darwin-stubs,
+}:
+
+let
+  inherit (darwin-stubs) version;
+  fixup-frameworks = callPackage ./fixups.nix { };
+  private-frameworks = callPackage ./private.nix { };
+  public-frameworks = callPackage ./public.nix { };
+
+  mkDepsRewrites =
+    deps:
+    let
+      mergeRewrites = x: y: {
+        prefix = lib.mergeAttrs (x.prefix or { }) (y.prefix or { });
+        const = lib.mergeAttrs (x.const or { }) (y.const or { });
+      };
+
+      rewriteArgs =
+        {
+          prefix ? { },
+          const ? { },
+        }:
+        lib.concatLists (
+          (lib.mapAttrsToList (from: to: [
+            "-p"
+            "${from}:${to}"
+          ]) prefix)
+          ++ (lib.mapAttrsToList (from: to: [
+            "-c"
+            "${from}:${to}"
+          ]) const)
+        );
+
+      rewrites =
+        depList:
+        lib.fold mergeRewrites { } (
+          map (dep: dep.tbdRewrites) (lib.filter (dep: dep ? tbdRewrites) depList)
+        );
+    in
+    lib.escapeShellArgs (rewriteArgs (rewrites (lib.attrValues deps)));
+
+  mkFramework =
+    {
+      name,
+      deps,
+      private ? false,
+    }:
+    let
+      standardFrameworkPath =
+        name: private:
+        "/System/Library/${lib.optionalString private "Private"}Frameworks/${name}.framework";
+
+      self = stdenvNoCC.mkDerivation {
+        pname = "apple-${lib.optionalString private "private-"}framework-${name}";
+        inherit (darwin-stubs) version;
+
+        # because we copy files from the system
+        preferLocalBuild = true;
+
+        dontUnpack = true;
+        dontBuild = true;
+
+        disallowedRequisites = [ darwin-stubs ];
+
+        nativeBuildInputs = [ buildPackages.darwin.rewrite-tbd ];
+
+        installPhase = ''
+          mkdir -p $out/Library/Frameworks
+
+          cp -r ${darwin-stubs}${standardFrameworkPath name private} $out/Library/Frameworks
+
+          if [[ -d ${darwin-stubs}/usr/lib/swift/${name}.swiftmodule ]]; then
+            mkdir -p $out/lib/swift
+            cp -r -t $out/lib/swift \
+              ${darwin-stubs}/usr/lib/swift/${name}.swiftmodule \
+              ${darwin-stubs}/usr/lib/swift/libswift${name}.tbd
+          fi
+
+          # Fix and check tbd re-export references
+          chmod u+w -R $out
+          find $out -name '*.tbd' -type f | while IFS=$'\n' read tbd; do
+            echo "Fixing re-exports in $tbd"
+            rewrite-tbd \
+              -p ${standardFrameworkPath name private}/:$out/Library/Frameworks/${name}.framework/ \
+              -p /usr/lib/swift/:$out/lib/swift/ \
+              ${mkDepsRewrites deps} \
+              -r ${builtins.storeDir} \
+              "$tbd"
+          done
+        '';
+
+        propagatedBuildInputs = lib.attrValues deps;
+
+        passthru.tbdRewrites.prefix."${standardFrameworkPath name private}/" = "${self}/Library/Frameworks/${name}.framework/";
+
+        meta = with lib; {
+          description = "Apple SDK framework ${name}";
+          maintainers = with maintainers; [ ];
+          platforms = platforms.darwin;
+        };
+      };
+    in
+    self;
+
+  # Helper functions for creating framework derivations.
+  framework =
+    name: deps:
+    mkFramework {
+      inherit name deps;
+      private = false;
+    };
+
+  # Helper functions for creating private framework derivations.
+  privateFramework =
+    name: deps:
+    mkFramework {
+      inherit name deps;
+      private = true;
+    };
+
+  # Merge addToFrameworks into public-frameworks and remove elements of removeFromFrameworks.
+  deps =
+    let
+      inherit (fixup-frameworks) addToFrameworks removeFromFrameworks;
+      fixupDeps =
+        name: deps:
+        lib.pipe deps [
+          # Add dependencies from addToFrameworks.
+          (deps: lib.recursiveUpdate deps (addToFrameworks.${name} or { }))
+          # Keep dependencies not in removeFromFrameworks.
+          (lib.filterAttrs (depName: _: !(removeFromFrameworks.${name}.${depName} or false)))
+        ];
+    in
+    lib.mapAttrs fixupDeps public-frameworks;
+
+  # Create derivations and add private frameworks.
+  bareFrameworks =
+    (lib.mapAttrs framework deps) // (lib.mapAttrs privateFramework private-frameworks);
+in
+bareFrameworks // fixup-frameworks.overrideFrameworks bareFrameworks
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/fixups.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/fixups.nix
new file mode 100644
index 0000000000000..f8b08c1e7222d
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/fixups.nix
@@ -0,0 +1,160 @@
+{
+  lib,
+  # macOS things
+  frameworks,
+  libnetwork,
+  libs,
+  darwin-stubs,
+  objc4,
+}:
+
+{
+  # Used to add dependencies which are not picked up by gen-frameworks.py.
+  # Some of these are simply private frameworks the generator does not see.
+  # Trial and error, building things and adding dependencies when they fail.
+  addToFrameworks =
+    let
+      inherit (libs) libDER;
+      libobjc = objc4;
+    in
+    with frameworks;
+    {
+      # Below this comment are entries migrated from before the generator was
+      # added. If, for a given framework, you are able to reverify the extra
+      # deps are really necessary on top of the generator deps, move it above
+      # this comment (and maybe document your findings).
+      AVFoundation = {
+        inherit ApplicationServices AVFCapture AVFCore;
+      };
+      Accelerate = {
+        inherit CoreWLAN IOBluetooth;
+      };
+      AddressBook = {
+        inherit AddressBookCore ContactsPersistence libobjc;
+      };
+      AppKit = {
+        inherit AudioToolbox AudioUnit UIFoundation;
+      };
+      AudioToolbox = {
+        inherit AudioToolboxCore;
+      };
+      AudioUnit = {
+        inherit Carbon CoreAudio;
+      };
+      Carbon = {
+        inherit IOKit QuartzCore libobjc;
+      };
+      CoreAudio = {
+        inherit IOKit;
+      };
+      CoreFoundation = {
+        inherit libobjc;
+      };
+      CoreGraphics = {
+        inherit SystemConfiguration;
+      };
+      CoreMIDIServer = {
+        inherit CoreMIDI;
+      };
+      CoreMedia = {
+        inherit ApplicationServices AudioToolbox AudioUnit;
+      };
+      CoreServices = {
+        inherit CoreAudio NetFS ServiceManagement;
+      };
+      CoreWLAN = {
+        inherit SecurityFoundation;
+      };
+      DiscRecording = {
+        inherit IOKit libobjc;
+      };
+      Foundation = {
+        inherit SystemConfiguration libobjc;
+      };
+      GameKit = {
+        inherit
+          GameCenterFoundation
+          GameCenterUI
+          GameCenterUICore
+          ReplayKit
+          ;
+      };
+      ICADevices = {
+        inherit Carbon libobjc;
+      };
+      IOBluetooth = {
+        inherit CoreBluetooth;
+      };
+      JavaScriptCore = {
+        inherit libobjc;
+      };
+      Kernel = {
+        inherit IOKit;
+      };
+      LinkPresentation = {
+        inherit URLFormatting;
+      };
+      MediaToolbox = {
+        inherit AudioUnit;
+      };
+      MetricKit = {
+        inherit SignpostMetrics;
+      };
+      Network = {
+        inherit libnetwork;
+      };
+      PCSC = {
+        inherit CoreData;
+      };
+      PassKit = {
+        inherit PassKitCore;
+      };
+      QTKit = {
+        inherit
+          CoreMedia
+          CoreMediaIO
+          MediaToolbox
+          VideoToolbox
+          ;
+      };
+      Quartz = {
+        inherit QTKit;
+      };
+      QuartzCore = {
+        inherit
+          ApplicationServices
+          CoreImage
+          CoreVideo
+          Metal
+          OpenCL
+          libobjc
+          ;
+      };
+      Security = {
+        inherit IOKit libDER;
+      };
+      TWAIN = {
+        inherit Carbon;
+      };
+      VideoDecodeAcceleration = {
+        inherit CoreVideo;
+      };
+      WebKit = {
+        inherit ApplicationServices Carbon libobjc;
+      };
+    };
+
+  # Used to remove dependencies which are picked up by gen-frameworks.py -- used mainly to break
+  # cyclic dependencies.
+  removeFromFrameworks = { };
+
+  # Overrides for framework derivations.
+  overrideFrameworks = super: {
+    # This framework doesn't exist in newer SDKs (somewhere around 10.13), but
+    # there are references to it in nixpkgs.
+    QuickTime = throw "QuickTime framework not available";
+
+    # Seems to be appropriate given https://developer.apple.com/forums/thread/666686
+    JavaVM = super.JavaNativeFoundation;
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/private.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/private.nix
new file mode 100644
index 0000000000000..d58b28fa02715
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/private.nix
@@ -0,0 +1,35 @@
+{ objc4, frameworks }:
+
+# generated by hand to avoid exposing all private frameworks
+# frameworks here are only the necessary ones used by public frameworks.
+{
+  AVFCapture = { };
+  AVFCore = { };
+  AddressBookCore = {
+    inherit (frameworks) ContactsPersistence;
+  };
+  AudioToolboxCore = { };
+  ContactsPersistence = { };
+  UIFoundation = { };
+  GameCenterFoundation = { };
+  GameCenterUI = { };
+  GameCenterUICore = { };
+  URLFormatting = { };
+  SignpostMetrics = { };
+  PassKitCore = { };
+  SkyLight = { };
+
+  # Also expose CoreSymbolication; used by `root` package.
+  CoreSymbolication = { };
+
+  # Also expose DebugSymbols; used by `llvmPackages_8.lldb` package.
+  DebugSymbols = { };
+
+  # Also expose DisplayServices; used by `sketchybar` package.
+  DisplayServices = {
+    libobjc = objc4;
+  };
+
+  # Also expose MultitouchSupport; used by `chuck` package.
+  MultitouchSupport = { };
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/public.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/public.nix
new file mode 100644
index 0000000000000..4488c84bf1245
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/frameworks/public.nix
@@ -0,0 +1,209 @@
+# This file is generated by gen-frameworks.nix.
+# Do not edit, put overrides in apple_sdk.nix instead.
+{ libs, frameworks }: with libs; with frameworks;
+{
+  AGL                              = { inherit Carbon OpenGL; };
+  AVFAudio                         = { inherit AudioToolbox CoreAudioTypes CoreMIDI CoreMedia Foundation; };
+  AVFoundation                     = { inherit AVFAudio CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia CoreVideo Foundation IOKit ImageIO MediaToolbox Metal QuartzCore UniformTypeIdentifiers simd; };
+  AVKit                            = { inherit AVFoundation AppKit Cocoa Foundation; };
+  Accelerate                       = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  Accessibility                    = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Accounts                         = { inherit Foundation; };
+  AdServices                       = { inherit Foundation; };
+  AdSupport                        = { inherit Foundation; };
+  AddressBook                      = { inherit Carbon Cocoa CoreFoundation Foundation; };
+  AppKit                           = { inherit Accessibility ApplicationServices CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal OpenGL QuartzCore; };
+  AppTrackingTransparency          = { inherit Foundation; };
+  AppleScriptKit                   = {};
+  AppleScriptObjC                  = { inherit Foundation; };
+  ApplicationServices              = { inherit ColorSync CoreFoundation CoreGraphics CoreServices CoreText ImageIO; };
+  AudioToolbox                     = { inherit Carbon CoreAudio CoreAudioTypes CoreFoundation CoreMIDI Foundation; };
+  AudioUnit                        = { inherit AudioToolbox; };
+  AudioVideoBridging               = { inherit Foundation IOKit; };
+  AuthenticationServices           = { inherit AppKit Foundation; };
+  AutomaticAssessmentConfiguration = { inherit Foundation; };
+  Automator                        = { inherit AppKit Cocoa Foundation OSAKit; };
+  BackgroundTasks                  = { inherit Foundation; };
+  BusinessChat                     = { inherit Cocoa Foundation; };
+  CFNetwork                        = { inherit CoreFoundation; };
+  CHIP                             = { inherit Foundation Security; };
+  CalendarStore                    = {};
+  CallKit                          = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  Carbon                           = { inherit ApplicationServices CoreServices Foundation Security; };
+  ClassKit                         = { inherit CoreGraphics Foundation; };
+  CloudKit                         = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit; };
+  Cocoa                            = { inherit AppKit CoreData Foundation; };
+  Collaboration                    = { inherit AppKit CoreServices Foundation; };
+  ColorSync                        = { inherit CoreFoundation; };
+  Combine                          = {};
+  Contacts                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ContactsUI                       = { inherit AppKit; };
+  CoreAudio                        = { inherit CoreAudioTypes CoreFoundation; };
+  CoreAudioKit                     = { inherit AppKit AudioUnit Cocoa Foundation; };
+  CoreAudioTypes                   = { inherit CoreFoundation; };
+  CoreBluetooth                    = { inherit Foundation; };
+  CoreData                         = { inherit Combine CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreDisplay                      = {};
+  CoreFoundation                   = {};
+  CoreGraphics                     = { inherit CoreFoundation IOKit; };
+  CoreHaptics                      = { inherit Foundation; };
+  CoreImage                        = { inherit ApplicationServices CoreFoundation CoreGraphics CoreVideo Foundation IOKit IOSurface ImageIO Metal OpenGL; };
+  CoreLocation                     = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDI                         = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  CoreMIDIServer                   = {};
+  CoreML                           = { inherit CoreFoundation CoreGraphics CoreVideo Foundation IOKit ImageIO Metal; };
+  CoreMedia                        = { inherit CoreAudio CoreAudioTypes CoreFoundation CoreGraphics CoreVideo Foundation IOKit Metal; };
+  CoreMediaIO                      = { inherit CoreAudio CoreFoundation CoreGraphics CoreMedia Foundation IOKit Metal; };
+  CoreMotion                       = { inherit Foundation; };
+  CoreServices                     = { inherit CFNetwork CoreFoundation DiskArbitration Security; };
+  CoreSpotlight                    = { inherit Foundation UniformTypeIdentifiers; };
+  CoreTelephony                    = {};
+  CoreText                         = { inherit CoreFoundation CoreGraphics; };
+  CoreVideo                        = { inherit ApplicationServices CoreFoundation CoreGraphics IOSurface Metal OpenGL; };
+  CoreWLAN                         = { inherit Foundation IOKit; };
+  CreateML                         = { inherit AVFoundation Combine CoreAudio CoreFoundation CoreGraphics CoreImage CoreML CoreMedia CoreServices CoreVideo Foundation IOKit ImageIO Metal MetalPerformanceShaders NaturalLanguage TabularData VideoToolbox Vision simd; };
+  CryptoKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit LocalAuthentication Security; };
+  CryptoTokenKit                   = { inherit CoreFoundation CoreGraphics Foundation IOKit Security; };
+  DVDPlayback                      = { inherit ApplicationServices CoreFoundation Security; };
+  DataDetection                    = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  DeveloperToolsSupport            = {};
+  DeviceActivity                   = { inherit Foundation ManagedSettings; };
+  DeviceCheck                      = { inherit Foundation; };
+  DirectoryService                 = { inherit CoreFoundation; };
+  DiscRecording                    = { inherit CoreServices Foundation; };
+  DiscRecordingUI                  = { inherit Carbon Cocoa DiscRecording; };
+  DiskArbitration                  = { inherit CoreFoundation IOKit; };
+  DriverKit                        = {};
+  EventKit                         = { inherit CoreGraphics CoreLocation Foundation; };
+  ExceptionHandling                = { inherit Foundation; };
+  ExecutionPolicy                  = { inherit Foundation; };
+  ExposureNotification             = { inherit Foundation; };
+  ExternalAccessory                = { inherit Foundation; };
+  FWAUserLib                       = { inherit IOKit; };
+  FileProvider                     = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  FileProviderUI                   = { inherit AppKit FileProvider Foundation; };
+  FinderSync                       = { inherit AppKit Foundation; };
+  ForceFeedback                    = { inherit CoreFoundation IOKit; };
+  Foundation                       = { inherit Combine CoreFoundation CoreGraphics CoreServices IOKit Security; };
+  GLKit                            = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal ModelIO OpenGL QuartzCore simd; };
+  GLUT                             = { inherit OpenGL; };
+  GSS                              = { inherit CoreFoundation; };
+  GameController                   = { inherit AppKit Foundation IOKit; };
+  GameKit                          = { inherit AppKit Cocoa Contacts CoreGraphics Foundation GameController GameplayKit Metal MetalKit ModelIO SceneKit SpriteKit simd; };
+  GameplayKit                      = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation GLKit IOKit Metal ModelIO QuartzCore SceneKit SpriteKit simd; };
+  GroupActivities                  = { inherit AVFoundation Combine CoreGraphics CryptoKit Foundation Network UniformTypeIdentifiers; };
+  Hypervisor                       = {};
+  ICADevices                       = { inherit CoreFoundation CoreGraphics CoreServices IOBluetooth; };
+  IMServicePlugIn                  = { inherit Foundation; };
+  IOBluetooth                      = { inherit CoreAudio CoreFoundation CoreServices Foundation IOKit; };
+  IOBluetoothUI                    = { inherit Cocoa IOBluetooth; };
+  IOKit                            = { inherit CoreFoundation; };
+  IOSurface                        = { inherit CoreFoundation Foundation IOKit; };
+  IOUSBHost                        = { inherit Foundation IOKit; };
+  IdentityLookup                   = { inherit Foundation; };
+  ImageCaptureCore                 = { inherit Cocoa CoreGraphics Foundation; };
+  ImageIO                          = { inherit CoreFoundation CoreGraphics; };
+  InputMethodKit                   = { inherit Carbon Cocoa Foundation; };
+  InstallerPlugins                 = {};
+  InstantMessage                   = {};
+  Intents                          = { inherit CoreFoundation CoreGraphics CoreLocation Foundation IOKit UserNotifications; };
+  IntentsUI                        = { inherit AppKit; };
+  JavaNativeFoundation             = { inherit Foundation; };
+  JavaRuntimeSupport               = { inherit ApplicationServices Cocoa Foundation QuartzCore; };
+  JavaScriptCore                   = { inherit CoreFoundation CoreGraphics Foundation; };
+  Kerberos                         = {};
+  Kernel                           = {};
+  KernelManagement                 = { inherit Foundation; };
+  LDAP                             = {};
+  LatentSemanticMapping            = { inherit Carbon CoreFoundation; };
+  LinkPresentation                 = { inherit AppKit Foundation; };
+  LocalAuthentication              = { inherit Foundation; };
+  LocalAuthenticationEmbeddedUI    = { inherit AppKit Foundation LocalAuthentication; };
+  MLCompute                        = { inherit CoreFoundation CoreGraphics Foundation IOKit Metal; };
+  MailKit                          = { inherit AppKit Foundation; };
+  ManagedSettings                  = { inherit Combine Foundation; };
+  MapKit                           = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage CoreLocation Foundation IOKit Metal QuartzCore; };
+  MediaAccessibility               = { inherit CoreFoundation CoreGraphics CoreText; };
+  MediaLibrary                     = { inherit Foundation; };
+  MediaPlayer                      = { inherit AVFoundation CoreGraphics Foundation; };
+  MediaToolbox                     = { inherit AudioToolbox CoreFoundation CoreMedia; };
+  Message                          = {};
+  Metal                            = { inherit CoreFoundation CoreGraphics Foundation IOKit IOSurface; };
+  MetalKit                         = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal ModelIO QuartzCore simd; };
+  MetalPerformanceShaders          = { inherit CoreGraphics Foundation Metal simd; };
+  MetalPerformanceShadersGraph     = { inherit Foundation MetalPerformanceShaders; };
+  MetricKit                        = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  ModelIO                          = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  MultipeerConnectivity            = { inherit Cocoa Foundation; };
+  MusicKit                         = { inherit Combine CoreGraphics Foundation; };
+  NaturalLanguage                  = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  NearbyInteraction                = { inherit CoreFoundation CoreGraphics Foundation IOKit simd; };
+  NetFS                            = { inherit CoreFoundation; };
+  Network                          = { inherit CoreFoundation Foundation Security; };
+  NetworkExtension                 = { inherit Foundation Network Security; };
+  NotificationCenter               = { inherit AppKit Foundation; };
+  OSAKit                           = { inherit Carbon Cocoa; };
+  OSLog                            = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  OpenAL                           = {};
+  OpenCL                           = { inherit OpenGL; };
+  OpenDirectory                    = { inherit CoreFoundation Foundation; };
+  OpenGL                           = {};
+  PCSC                             = {};
+  PDFKit                           = { inherit AppKit Cocoa; };
+  PHASE                            = { inherit AVFAudio AVFoundation CoreAudioTypes Foundation ModelIO simd; };
+  ParavirtualizedGraphics          = { inherit AppKit CoreVideo Foundation IOSurface Metal; };
+  PassKit                          = { inherit AppKit Contacts CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal QuartzCore; };
+  PencilKit                        = { inherit AppKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal QuartzCore; };
+  Photos                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreLocation CoreMIDI CoreMedia Foundation IOKit ImageIO Metal QuartzCore UniformTypeIdentifiers simd; };
+  PhotosUI                         = { inherit AppKit Foundation MapKit Photos; };
+  PreferencePanes                  = { inherit Cocoa; };
+  PushKit                          = { inherit Foundation; };
+  QTKit                            = {};
+  Quartz                           = { inherit AppKit ApplicationServices Cocoa Foundation ImageCaptureCore OpenGL PDFKit QuartzCore QuickLookUI; };
+  QuartzCore                       = { inherit CoreFoundation CoreGraphics CoreImage CoreVideo Foundation IOKit Metal OpenGL; };
+  QuickLook                        = { inherit ApplicationServices CoreFoundation; };
+  QuickLookThumbnailing            = { inherit CoreGraphics Foundation UniformTypeIdentifiers; };
+  QuickLookUI                      = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal PDFKit QuartzCore QuickLook UniformTypeIdentifiers; };
+  RealityFoundation                = { inherit AVFAudio AVFoundation AppKit AudioToolbox Combine CoreAudio CoreFoundation CoreGraphics CoreMIDI CoreMedia CoreMotion CoreText CoreVideo Foundation IOKit Metal QuartzCore simd; };
+  RealityKit                       = { inherit AppKit Combine CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal MultipeerConnectivity QuartzCore RealityFoundation simd; };
+  ReplayKit                        = { inherit AVFoundation AppKit Foundation; };
+  Ruby                             = {};
+  SafariServices                   = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal QuartzCore; };
+  SceneKit                         = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  ScreenCaptureKit                 = { inherit AppKit CoreGraphics CoreMedia Foundation; };
+  ScreenSaver                      = { inherit AppKit Foundation; };
+  ScreenTime                       = { inherit AppKit Foundation; };
+  ScriptingBridge                  = { inherit ApplicationServices CoreServices Foundation; };
+  Security                         = { inherit CoreFoundation; };
+  SecurityFoundation               = { inherit Foundation Security; };
+  SecurityInterface                = { inherit AppKit Cocoa Security SecurityFoundation; };
+  SensorKit                        = { inherit CoreFoundation CoreLocation Foundation; };
+  ServiceManagement                = { inherit CoreFoundation Security; };
+  ShazamKit                        = { inherit AVFAudio CoreAudio CoreFoundation CoreGraphics CoreMIDI CoreMedia Foundation IOKit Metal MusicKit; };
+  Social                           = { inherit AppKit Foundation; };
+  SoundAnalysis                    = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreML CoreMedia Foundation IOKit Metal QuartzCore UniformTypeIdentifiers simd; };
+  Speech                           = { inherit AVFoundation CoreAudio CoreFoundation CoreGraphics CoreImage CoreMIDI CoreMedia Foundation IOKit Metal QuartzCore UniformTypeIdentifiers simd; };
+  SpriteKit                        = { inherit AppKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage Foundation GLKit IOKit Metal ModelIO QuartzCore simd; };
+  StoreKit                         = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage CryptoKit Foundation IOKit Metal QuartzCore Security; };
+  SwiftUI                          = { inherit Accessibility AppKit Combine CoreData CoreFoundation CoreGraphics CoreImage DeveloperToolsSupport Foundation IOKit Metal QuartzCore UniformTypeIdentifiers; };
+  SyncServices                     = {};
+  System                           = {};
+  SystemConfiguration              = { inherit CoreFoundation Security; };
+  SystemExtensions                 = { inherit Foundation; };
+  TWAIN                            = {};
+  TabularData                      = { inherit Combine Foundation; };
+  Tcl                              = {};
+  Tk                               = {};
+  UniformTypeIdentifiers           = { inherit CoreFoundation CoreGraphics Foundation IOKit; };
+  UserNotifications                = { inherit Foundation; };
+  UserNotificationsUI              = { inherit AppKit; };
+  VideoDecodeAcceleration          = {};
+  VideoSubscriberAccount           = { inherit Foundation; };
+  VideoToolbox                     = { inherit CoreFoundation CoreGraphics CoreMedia CoreVideo; };
+  Virtualization                   = { inherit AppKit Cocoa CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit Metal QuartzCore; };
+  Vision                           = { inherit CoreAudio CoreFoundation CoreGraphics CoreML CoreMedia CoreVideo Foundation IOKit ImageIO Metal simd; };
+  WebKit                           = { inherit AppKit CoreData CoreFoundation CoreGraphics CoreImage Foundation IOKit JavaScriptCore Metal QuartzCore; };
+  WidgetKit                        = { inherit Combine CoreFoundation CoreGraphics Foundation IOKit Intents SwiftUI UniformTypeIdentifiers; };
+  iTunesLibrary                    = { inherit Foundation; };
+  vmnet                            = {};
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libSystem.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libSystem.nix
new file mode 100644
index 0000000000000..5d57038a46573
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libSystem.nix
@@ -0,0 +1,96 @@
+{
+  stdenvNoCC,
+  buildPackages,
+  darwin-stubs,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "libSystem";
+  inherit (darwin-stubs) version;
+
+  nativeBuildInputs = [ buildPackages.darwin.rewrite-tbd ];
+
+  csu = [
+    "bundle1.o"
+    "crt0.o"
+    "crt1.10.5.o"
+    "crt1.10.6.o"
+    "crt1.o"
+    "dylib1.10.5.o"
+    "dylib1.o"
+    "gcrt1.o"
+    "lazydylib1.o"
+  ];
+
+  buildCommand =
+    ''
+      mkdir -p $out/{include,lib/swift}
+    ''
+    # Copy each directory in ${darwin-stubs}/usr/include into $out/include
+    + ''
+      for dir in $(ls -d ${darwin-stubs}/usr/include/*/); do
+        cp -dr $dir $out/include
+      done
+    ''
+    # Copy each header and modulemap file in ${darwin-stubs}/usr/include into $out/include
+    + ''
+      cp -d \
+        ${darwin-stubs}/usr/include/*.h \
+        ${darwin-stubs}/usr/include/*.modulemap \
+        $out/include
+    ''
+    # Remove curses.h, ncurses.h, ncurses_dll.h, and unctrl.h which conflict with ncurses.
+    # Then, remove the module map for ncurses.
+    # NOTE: The sed expression expects the module map to use consistent indentation across
+    #   releases. If this changes, the sed expression will need to be updated.
+    #
+    #   For example, right now we assume that there is one leading space before the
+    #   "explicit" keyword and that the closing brace is on its own line (also with one
+    #   leading space).
+    + ''
+      rm $out/include/{curses,ncurses,ncurses_dll,unctrl}.h
+      sed -i -e '/^ explicit module ncurses {/,/^ }$/d' $out/include/module.modulemap
+    ''
+    + ''
+      rm $out/include/tk*.h $out/include/tcl*.h
+
+      cp -dr \
+        ${darwin-stubs}/usr/lib/libSystem.* \
+        ${darwin-stubs}/usr/lib/system \
+        $out/lib
+
+      # Extra libraries
+      for name in c dbm dl info m mx poll proc pthread rpcsvc util gcc_s.1 resolv; do
+        cp -d \
+          ${darwin-stubs}/usr/lib/lib$name.tbd \
+          ${darwin-stubs}/usr/lib/lib$name.*.tbd \
+          $out/lib
+      done
+
+      for name in os Dispatch; do
+        cp -dr \
+          ${darwin-stubs}/usr/lib/swift/$name.swiftmodule \
+          ${darwin-stubs}/usr/lib/swift/libswift$name.tbd \
+          $out/lib/swift
+      done
+
+      for f in $csu; do
+        from=${darwin-stubs}/usr/lib/$f
+        if [ -e "$from" ]; then
+          cp -d $from $out/lib
+        else
+          echo "Csu file '$from' doesn't exist: skipping"
+        fi
+      done
+
+      chmod u+w -R $out/lib
+      find $out -name '*.tbd' -type f | while read tbd; do
+        rewrite-tbd \
+          -c /usr/lib/libsystem.dylib:$out/lib/libsystem.dylib \
+          -p /usr/lib/system/:$out/lib/system/ \
+          -p /usr/lib/swift/:$out/lib/swift/ \
+          -r ${builtins.storeDir} \
+          "$tbd"
+      done
+    '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libnetwork.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libnetwork.nix
new file mode 100644
index 0000000000000..e7bae2fc77a08
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libnetwork.nix
@@ -0,0 +1,16 @@
+{ stdenvNoCC, darwin-stubs }:
+
+let
+  self = stdenvNoCC.mkDerivation {
+    pname = "libnetwork";
+    inherit (darwin-stubs) version;
+
+    buildCommand = ''
+      mkdir -p $out/lib
+      cp ${darwin-stubs}/usr/lib/libnetwork* $out/lib
+    '';
+
+    passthru.tbdRewrites.const."/usr/lib/libnetwork.dylib" = "${self}/lib/libnetwork.dylib";
+  };
+in
+self
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libobjc.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libobjc.nix
new file mode 100644
index 0000000000000..14d7e92c8a540
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libobjc.nix
@@ -0,0 +1,22 @@
+{ stdenvNoCC, darwin-stubs }:
+
+let
+  self = stdenvNoCC.mkDerivation {
+    pname = "libobjc";
+    inherit (darwin-stubs) version;
+
+    buildCommand = ''
+      mkdir -p $out/{include,lib/swift}
+      cp -r ${darwin-stubs}/usr/include/objc $out/include
+      cp ${darwin-stubs}/usr/lib/libobjc* $out/lib
+      cp -r ${darwin-stubs}/usr/lib/swift/ObjectiveC.swiftmodule $out/lib/swift
+      cp ${darwin-stubs}/usr/lib/swift/libswiftObjectiveC.tbd $out/lib/swift
+    '';
+
+    passthru.tbdRewrites = {
+      const."/usr/lib/libobjc.A.dylib" = "${self}/lib/libobjc.A.dylib";
+      const."/usr/lib/swift/libswiftObjectiveC.dylib" = "${self}/lib/swift/libswiftObjectiveC.dylib";
+    };
+  };
+in
+self
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libpm.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libpm.nix
new file mode 100644
index 0000000000000..110b9a1ab4789
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libpm.nix
@@ -0,0 +1,25 @@
+{
+  stdenvNoCC,
+  buildPackages,
+  darwin-stubs,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "libpm";
+  inherit (darwin-stubs) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp ${darwin-stubs}/usr/lib/libpm* $out/lib
+  '';
+
+  passthru.tbdRewrites = {
+    const."/usr/lib/libpmenergy.dylib" = "${placeholder "out"}/lib/libpmenergy.dylib";
+    const."/usr/lib/libpmsample.dylib" = "${placeholder "out"}/lib/libpmsample.dylib";
+  };
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/Xplugin.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/Xplugin.nix
new file mode 100644
index 0000000000000..6e125c001183c
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/Xplugin.nix
@@ -0,0 +1,30 @@
+{
+  frameworks,
+  darwin-stubs,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-Xplugin";
+  inherit (darwin-stubs) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  propagatedBuildInputs = with frameworks; [
+    OpenGL
+    ApplicationServices
+    Carbon
+    IOKit
+    CoreGraphics
+    CoreServices
+    CoreText
+  ];
+
+  installPhase = ''
+    mkdir -p $out/include $out/lib
+    cp "${darwin-stubs}/include/Xplugin.h" $out/include/Xplugin.h
+    cp ${darwin-stubs}/usr/lib/libXplugin.1.tbd $out/lib
+    ln -s libXplugin.1.tbd $out/lib/libXplugin.tbd
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/default.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/default.nix
new file mode 100644
index 0000000000000..87a36ba32b62e
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/default.nix
@@ -0,0 +1,10 @@
+{ callPackage }:
+
+{
+  libDER = callPackage ./libDER.nix { };
+  sandbox = callPackage ./sandbox.nix { };
+  simd = callPackage ./simd.nix { };
+  utmp = callPackage ./utmp.nix { };
+  xpc = callPackage ./xpc.nix { };
+  Xplugin = callPackage ./Xplugin.nix { };
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/libDER.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/libDER.nix
new file mode 100644
index 0000000000000..4aa8e2bd95509
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/libDER.nix
@@ -0,0 +1,11 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-libDER";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include
+    cp -r ${darwin-stubs}/usr/include/libDER $out/include
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/sandbox.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/sandbox.nix
new file mode 100644
index 0000000000000..f4e9955a0b9b5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/sandbox.nix
@@ -0,0 +1,13 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-sandbox";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include $out/lib
+    cp "${darwin-stubs}/usr/include/sandbox.h" $out/include/sandbox.h
+    cp "${darwin-stubs}/usr/lib/libsandbox.1.tbd" $out/lib
+    ln -s libsandbox.1.tbd $out/lib/libsandbox.tbd
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/simd.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/simd.nix
new file mode 100644
index 0000000000000..45226a5bec59b
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/simd.nix
@@ -0,0 +1,11 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-simd";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include
+    cp -r ${darwin-stubs}/usr/include/simd $out/include
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/utmp.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/utmp.nix
new file mode 100644
index 0000000000000..bc85b9be35b50
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/utmp.nix
@@ -0,0 +1,12 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-utmp";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include
+    cp "${darwin-stubs}/include/utmp.h" $out/include
+    cp "${darwin-stubs}/include/utmpx.h" $out/include
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libs/xpc.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/xpc.nix
new file mode 100644
index 0000000000000..8c9848daf9caf
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libs/xpc.nix
@@ -0,0 +1,12 @@
+{ darwin-stubs, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation {
+  pname = "apple-lib-xpc";
+  inherit (darwin-stubs) version;
+
+  buildCommand = ''
+    mkdir -p $out/include
+    cp -r "${darwin-stubs}/usr/include/xpc" $out/include/xpc
+    cp "${darwin-stubs}/usr/include/launch.h" $out/include/launch.h
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk-12.3/libunwind.nix b/pkgs/os-specific/darwin/apple-sdk-12.3/libunwind.nix
new file mode 100644
index 0000000000000..c1846a9bf92f5
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-sdk-12.3/libunwind.nix
@@ -0,0 +1,28 @@
+{
+  stdenvNoCC,
+  buildPackages,
+  darwin-stubs,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "libunwind";
+  inherit (darwin-stubs) version;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ buildPackages.darwin.checkReexportsHook ];
+
+  installPhase = ''
+    mkdir -p $out/include/mach-o
+
+    cp \
+      ${darwin-stubs}/usr/include/libunwind.h \
+      ${darwin-stubs}/usr/include/unwind.h \
+      $out/include
+
+    cp \
+      ${darwin-stubs}/usr/include/mach-o/compact_unwind_encoding.h \
+      $out/include/mach-o
+  '';
+}
diff --git a/pkgs/os-specific/darwin/apple-sdk/default.nix b/pkgs/os-specific/darwin/apple-sdk/default.nix
index a3d1df0867a9a..7298eba6c50aa 100644
--- a/pkgs/os-specific/darwin/apple-sdk/default.nix
+++ b/pkgs/os-specific/darwin/apple-sdk/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cpio, pbzx, pkgs, lib, darwin-stubs, print-reexports }:
+{ stdenv, stdenvNoCC, fetchurl, cpio, pbzx, pkgs, lib, darwin-stubs, print-reexports }:
 
 let
   # sadly needs to be exported because security_tool needs it
@@ -263,6 +263,15 @@ in rec {
         ln -s libsandbox.1.tbd $out/lib/libsandbox.tbd
       '';
     };
+
+    simd = stdenvNoCC.mkDerivation {
+      name = "apple-lib-simd";
+
+      preferLocalBuild = true;
+      allowSubstitutes = false;
+
+      buildCommand = "echo 'simd library not available in the 10.12 SDK'; exit 1";
+    };
   };
 
   overrides = super: {
diff --git a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
index 206f46125b9bf..af37143835c5d 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/Libsystem/default.nix
@@ -59,7 +59,7 @@ appleDerivation' stdenv {
       (cd $dep/include && find . -name '*.h' | copyHierarchy $out/include)
     done
 
-    (cd ${buildPackages.darwin.cctools.dev}/include/mach-o && find . -name '*.h' | copyHierarchy $out/include/mach-o)
+    (cd ${lib.getDev buildPackages.darwin.cctools}/include/mach-o && find . -name '*.h' | copyHierarchy $out/include/mach-o)
 
     for header in pthread.h pthread_impl.h pthread_spis.h sched.h; do
       ln -s "$out/include/pthread/$header" "$out/include/$header"
@@ -142,7 +142,7 @@ appleDerivation' stdenv {
       $out/lib
 
     substituteInPlace $out/lib/libSystem.B.tbd \
-      --replace "/usr/lib/system/" "$out/lib/system/"
+      --replace-fail "/usr/lib/system/" "$out/lib/system/"
     ln -s libSystem.B.tbd $out/lib/libSystem.tbd
 
     # Set up links to pretend we work like a conventional unix (Apple's design, not mine!)
diff --git a/pkgs/os-specific/darwin/apple-source-releases/default.nix b/pkgs/os-specific/darwin/apple-source-releases/default.nix
index 3eae8749c4e4d..aae3d515a6f90 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/default.nix
@@ -1,6 +1,10 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, pkgs }:
 
 let
+
+  isSdk10_12 = stdenv.hostPlatform.darwinSdkVersion == "10.12";
+
+
   # This attrset can in theory be computed automatically, but for that to work nicely we need
   # import-from-derivation to work properly. Currently it's rather ugly when we try to bootstrap
   # a stdenv out of something like this. With some care we can probably get rid of this, but for
@@ -271,10 +275,10 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     Libinfo         = applePackage "Libinfo"           "osx-10.11.6"     "sha256-6F7wiwerv4nz/xXHtp1qCHSaFzZgzcRN+jbmXA5oWOQ=" {};
     Libm            = applePackage "Libm"              "osx-10.7.4"      "sha256-KjMETfT4qJm0m0Ux/F6Rq8bI4Q4UVnFx6IKbKxXd+Es=" {};
     Libnotify       = applePackage "Libnotify"         "osx-10.12.6"     "sha256-6wvMBxAUfiYcQtmlfYCj1d3kFmFM/jdboTd7hRvi3e4=" {};
-    libmalloc       = if stdenv.isx86_64 then
+    libmalloc       = if isSdk10_12 then
       applePackage "libmalloc" "osx-10.12.6" "sha256-brfG4GEF2yZipKdhlPq6DhT2z5hKYSb2MAmffaikdO4=" {}
     else macosPackages_11_0_1.libmalloc;
-    libplatform     = if stdenv.isx86_64 then
+    libplatform     = if isSdk10_12 then
       applePackage "libplatform"       "osx-10.12.6"     "sha256-6McMTjw55xtnCsFI3AB1osRagnuB5pSTqeMKD3gpGtM=" {}
     else macosPackages_11_0_1.libplatform;
     libpthread      = applePackage "libpthread"        "osx-10.12.6"     "sha256-QvJ9PERmrCWBiDmOWrLvQUKZ4JxHuh8gS5nlZKDLqE8=" {};
@@ -286,7 +290,7 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     objc4           = applePackage "objc4"             "osx-10.12.6"     "sha256-ZsxRpdsfv3Dxs7yBBCkjbKXKR6aXwkEpxc1XYXz7ueM=" {};
     ppp             = applePackage "ppp"               "osx-10.12.6"     "sha256-M1zoEjjeKIDUEP6ACbpUJk3OXjobw4g/qzUmxGdX1J0=" {};
     removefile      = applePackage "removefile"        "osx-10.12.6"     "sha256-UpNk27kGXnZss1ZXWVJU9jLz/NW63ZAZEDLhyCYoi9M=" {};
-    xnu             = if stdenv.isx86_64 then
+    xnu             = if isSdk10_12 then
       applePackage "xnu" "osx-10.12.6" "sha256-C8TPQlUT3RbzAy8YnZPNtr70hpaVG9Llv0h42s3NENI=" {}
     else macosPackages_11_0_1.xnu;
     hfs             = applePackage "hfs"               "osx-10.12.6"     "sha256-eGi18HQFJrU5UHoBOE0LqO5gQ0xOf8+OJuAWQljfKE4=" {};
@@ -297,7 +301,7 @@ developerToolsPackages_11_3_1 // macosPackages_11_0_1 // {
     diskdev_cmds    = applePackage "diskdev_cmds"      "osx-10.11.6"     "sha256-VX+hcZ7JhOA8EhwLloPlM3Yx79RXp9OYHV9Mi10uw3Q=" {
       macosPackages_11_0_1 = macosPackages_11_0_1;
     };
-    network_cmds    = if stdenv.isx86_64 then
+    network_cmds    = if isSdk10_12 then
       applePackage "network_cmds" "osx-10.11.6" "sha256-I89CLIswGheewOjiNZwQTgWvWbhm0qtB5+KUqzxnQ5M=" {}
     else macosPackages_11_0_1.network_cmds;
     file_cmds       = applePackage "file_cmds"         "osx-10.11.6"     "sha256-JYy6HwmultKeZtLfaysbsyLoWg+OaTh7eJu54JkJC0Q=" {};
diff --git a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
index 600571f222562..c6ac966a65caf 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/network_cmds/default.nix
@@ -1,4 +1,4 @@
-{ lib, appleDerivation, xcbuildHook, stdenv
+{ lib, appleDerivation, xcbuildHook
 , Librpcsvc, xnu, libpcap, developer_cmds }:
 
 appleDerivation {
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
index 14ede7949d0f9..2820df1db1b19 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/default.nix
@@ -1,4 +1,4 @@
-{ appleDerivation', lib, stdenv, stdenvNoCC, buildPackages
+{ appleDerivation', lib, stdenv, stdenvNoCC, buildPackages, pkgsBuildBuild
 , bootstrap_cmds, bison, flex
 , gnum4, unifdef, perl, python3
 , headersOnly ? true
@@ -12,7 +12,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
 
   nativeBuildInputs = [ bootstrap_cmds bison flex gnum4 unifdef perl python3 ];
 
-  patches = lib.optionals stdenv.isx86_64 [ ./python3.patch ];
+  patches = lib.optionals (lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11") [ ./python3.patch ];
 
   postPatch = ''
     substituteInPlace Makefile \
@@ -48,7 +48,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
       --replace 'MACHINE_ARCH=armv7' 'MACHINE_ARCH=arm64' # this might break the comments saying 32-bit is required
 
     patchShebangs .
-  '' + lib.optionalString stdenv.isAarch64 ''
+  '' + lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11") ''
     # iig is closed-sourced, we don't have it
     # create an empty file to the header instead
     # this line becomes: echo "" > $@; echo --header ...
@@ -72,7 +72,11 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
   HOST_FLEX = "flex";
   HOST_BISON = "bison";
   HOST_GM4 = "m4";
-  MIGCC = "cc";
+  # use unwrapped clang to generate headers because wrapper is not compatible with a 32 bit -arch.
+  # aarch64 should likely do this as well and remove the --replace MACHINE_ARCH above
+  MIGCC = if stdenv.isx86_64 && lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11"
+    then "${lib.getBin pkgsBuildBuild.stdenv.cc.cc}/bin/clang"
+    else "cc";
   ARCHS = arch;
   ARCH_CONFIGS = arch;
 
@@ -80,7 +84,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
 
   preBuild = let macosVersion =
     "10.0 10.1 10.2 10.3 10.4 10.5 10.6 10.7 10.8 10.9 10.10 10.11" +
-    lib.optionalString stdenv.isAarch64 " 10.12 10.13 10.14 10.15 11.0";
+    lib.optionalString (lib.versionAtLeast stdenv.hostPlatform.darwinSdkVersion "11") " 10.12 10.13 10.14 10.15 11.0";
    in ''
     # This is a bit of a hack...
     mkdir -p sdk/usr/local/libexec
@@ -150,7 +154,7 @@ appleDerivation' (if headersOnly then stdenvNoCC else stdenv) (
     mv $out/Library/Frameworks/IOKit.framework $out/Library/PrivateFrameworks
   '';
 
-  appleHeaders = builtins.readFile (./. + "/headers-${arch}.txt");
+  appleHeaders = builtins.readFile (./. + "/headers-${stdenv.hostPlatform.darwinSdkVersion}-${arch}.txt");
 } // lib.optionalAttrs headersOnly {
   HOST_CODESIGN = "echo";
   HOST_CODESIGN_ALLOCATE = "echo";
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-10.12-x86_64.txt
index 8d7d9be7f2180..8d7d9be7f2180 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-x86_64.txt
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-10.12-x86_64.txt
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-arm64.txt
index 23ae12a9b057a..23ae12a9b057a 100644
--- a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-arm64.txt
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-arm64.txt
diff --git a/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-x86_64.txt b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-x86_64.txt
new file mode 100644
index 0000000000000..f2ab4917845eb
--- /dev/null
+++ b/pkgs/os-specific/darwin/apple-source-releases/xnu/headers-11.0-x86_64.txt
@@ -0,0 +1,1481 @@
+AssertMacros.h
+_errno.h
+_libkernel_init.h
+atm/atm_notification.defs
+atm/atm_types.defs
+atm/atm_types.h
+bank/bank_types.h
+bsd/bsm/audit.h
+bsd/crypto/entropy/diag_entropy_sysctl.h
+bsd/dev/random/randomdev.h
+bsd/i386/_limits.h
+bsd/i386/_mcontext.h
+bsd/i386/_param.h
+bsd/i386/_types.h
+bsd/i386/endian.h
+bsd/i386/limits.h
+bsd/i386/param.h
+bsd/i386/profile.h
+bsd/i386/signal.h
+bsd/i386/types.h
+bsd/i386/vmparam.h
+bsd/libkern/copyio.h
+bsd/libkern/libkern.h
+bsd/machine/_limits.h
+bsd/machine/_mcontext.h
+bsd/machine/_param.h
+bsd/machine/_types.h
+bsd/machine/byte_order.h
+bsd/machine/disklabel.h
+bsd/machine/endian.h
+bsd/machine/limits.h
+bsd/machine/param.h
+bsd/machine/profile.h
+bsd/machine/signal.h
+bsd/machine/types.h
+bsd/machine/vmparam.h
+bsd/miscfs/devfs/devfs.h
+bsd/miscfs/devfs/devfs_proto.h
+bsd/miscfs/devfs/devfsdefs.h
+bsd/miscfs/devfs/fdesc.h
+bsd/miscfs/fifofs/fifo.h
+bsd/miscfs/specfs/specdev.h
+bsd/miscfs/union/union.h
+bsd/net/bpf.h
+bsd/net/dlil.h
+bsd/net/ethernet.h
+bsd/net/if.h
+bsd/net/if_arp.h
+bsd/net/if_dl.h
+bsd/net/if_ether.h
+bsd/net/if_llc.h
+bsd/net/if_media.h
+bsd/net/if_mib.h
+bsd/net/if_types.h
+bsd/net/if_utun.h
+bsd/net/if_var.h
+bsd/net/init.h
+bsd/net/kext_net.h
+bsd/net/kpi_interface.h
+bsd/net/kpi_interfacefilter.h
+bsd/net/kpi_protocol.h
+bsd/net/ndrv.h
+bsd/net/net_kev.h
+bsd/net/pfkeyv2.h
+bsd/net/radix.h
+bsd/net/route.h
+bsd/netinet/bootp.h
+bsd/netinet/icmp6.h
+bsd/netinet/icmp_var.h
+bsd/netinet/if_ether.h
+bsd/netinet/igmp.h
+bsd/netinet/igmp_var.h
+bsd/netinet/in.h
+bsd/netinet/in_arp.h
+bsd/netinet/in_pcb.h
+bsd/netinet/in_systm.h
+bsd/netinet/in_var.h
+bsd/netinet/ip.h
+bsd/netinet/ip6.h
+bsd/netinet/ip_icmp.h
+bsd/netinet/ip_var.h
+bsd/netinet/kpi_ipfilter.h
+bsd/netinet/tcp.h
+bsd/netinet/tcp_fsm.h
+bsd/netinet/tcp_seq.h
+bsd/netinet/tcp_timer.h
+bsd/netinet/tcp_var.h
+bsd/netinet/tcpip.h
+bsd/netinet/udp.h
+bsd/netinet/udp_var.h
+bsd/netinet6/ah.h
+bsd/netinet6/esp.h
+bsd/netinet6/in6.h
+bsd/netinet6/in6_var.h
+bsd/netinet6/ipcomp.h
+bsd/netinet6/ipsec.h
+bsd/netinet6/nd6.h
+bsd/netinet6/raw_ip6.h
+bsd/netinet6/scope6_var.h
+bsd/netkey/keysock.h
+bsd/pthread/bsdthread_private.h
+bsd/pthread/priority_private.h
+bsd/pthread/workqueue_internal.h
+bsd/pthread/workqueue_syscalls.h
+bsd/pthread/workqueue_trace.h
+bsd/security/audit/audit.h
+bsd/security/audit/audit_bsd.h
+bsd/security/audit/audit_ioctl.h
+bsd/security/audit/audit_private.h
+bsd/sys/_endian.h
+bsd/sys/_select.h
+bsd/sys/_structs.h
+bsd/sys/_types.h
+bsd/sys/_types/_blkcnt_t.h
+bsd/sys/_types/_blksize_t.h
+bsd/sys/_types/_caddr_t.h
+bsd/sys/_types/_clock_t.h
+bsd/sys/_types/_ct_rune_t.h
+bsd/sys/_types/_dev_t.h
+bsd/sys/_types/_errno_t.h
+bsd/sys/_types/_fd_clr.h
+bsd/sys/_types/_fd_copy.h
+bsd/sys/_types/_fd_def.h
+bsd/sys/_types/_fd_isset.h
+bsd/sys/_types/_fd_set.h
+bsd/sys/_types/_fd_setsize.h
+bsd/sys/_types/_fd_zero.h
+bsd/sys/_types/_filesec_t.h
+bsd/sys/_types/_fsblkcnt_t.h
+bsd/sys/_types/_fsfilcnt_t.h
+bsd/sys/_types/_fsid_t.h
+bsd/sys/_types/_fsobj_id_t.h
+bsd/sys/_types/_gid_t.h
+bsd/sys/_types/_guid_t.h
+bsd/sys/_types/_id_t.h
+bsd/sys/_types/_in_addr_t.h
+bsd/sys/_types/_in_port_t.h
+bsd/sys/_types/_ino64_t.h
+bsd/sys/_types/_ino_t.h
+bsd/sys/_types/_int16_t.h
+bsd/sys/_types/_int32_t.h
+bsd/sys/_types/_int64_t.h
+bsd/sys/_types/_int8_t.h
+bsd/sys/_types/_intptr_t.h
+bsd/sys/_types/_iovec_t.h
+bsd/sys/_types/_key_t.h
+bsd/sys/_types/_mach_port_t.h
+bsd/sys/_types/_mbstate_t.h
+bsd/sys/_types/_mode_t.h
+bsd/sys/_types/_nlink_t.h
+bsd/sys/_types/_null.h
+bsd/sys/_types/_o_dsync.h
+bsd/sys/_types/_o_sync.h
+bsd/sys/_types/_off_t.h
+bsd/sys/_types/_offsetof.h
+bsd/sys/_types/_os_inline.h
+bsd/sys/_types/_pid_t.h
+bsd/sys/_types/_posix_vdisable.h
+bsd/sys/_types/_ptrdiff_t.h
+bsd/sys/_types/_rsize_t.h
+bsd/sys/_types/_rune_t.h
+bsd/sys/_types/_s_ifmt.h
+bsd/sys/_types/_sa_family_t.h
+bsd/sys/_types/_seek_set.h
+bsd/sys/_types/_sigaltstack.h
+bsd/sys/_types/_sigset_t.h
+bsd/sys/_types/_size_t.h
+bsd/sys/_types/_socklen_t.h
+bsd/sys/_types/_ssize_t.h
+bsd/sys/_types/_suseconds_t.h
+bsd/sys/_types/_time_t.h
+bsd/sys/_types/_timespec.h
+bsd/sys/_types/_timeval.h
+bsd/sys/_types/_timeval32.h
+bsd/sys/_types/_timeval64.h
+bsd/sys/_types/_u_char.h
+bsd/sys/_types/_u_int.h
+bsd/sys/_types/_u_int16_t.h
+bsd/sys/_types/_u_int32_t.h
+bsd/sys/_types/_u_int64_t.h
+bsd/sys/_types/_u_int8_t.h
+bsd/sys/_types/_u_short.h
+bsd/sys/_types/_ucontext.h
+bsd/sys/_types/_ucontext64.h
+bsd/sys/_types/_uid_t.h
+bsd/sys/_types/_uintptr_t.h
+bsd/sys/_types/_useconds_t.h
+bsd/sys/_types/_user32_itimerval.h
+bsd/sys/_types/_user32_ntptimeval.h
+bsd/sys/_types/_user32_timespec.h
+bsd/sys/_types/_user32_timeval.h
+bsd/sys/_types/_user32_timex.h
+bsd/sys/_types/_user64_itimerval.h
+bsd/sys/_types/_user64_ntptimeval.h
+bsd/sys/_types/_user64_timespec.h
+bsd/sys/_types/_user64_timeval.h
+bsd/sys/_types/_user64_timex.h
+bsd/sys/_types/_user_timespec.h
+bsd/sys/_types/_user_timeval.h
+bsd/sys/_types/_uuid_t.h
+bsd/sys/_types/_va_list.h
+bsd/sys/_types/_wchar_t.h
+bsd/sys/_types/_wint_t.h
+bsd/sys/appleapiopts.h
+bsd/sys/attr.h
+bsd/sys/bsdtask_info.h
+bsd/sys/buf.h
+bsd/sys/cdefs.h
+bsd/sys/codesign.h
+bsd/sys/commpage.h
+bsd/sys/conf.h
+bsd/sys/content_protection.h
+bsd/sys/cprotect.h
+bsd/sys/csr.h
+bsd/sys/decmpfs.h
+bsd/sys/dir.h
+bsd/sys/dirent.h
+bsd/sys/disk.h
+bsd/sys/disklabel.h
+bsd/sys/disktab.h
+bsd/sys/dkstat.h
+bsd/sys/doc_tombstone.h
+bsd/sys/domain.h
+bsd/sys/errno.h
+bsd/sys/ev.h
+bsd/sys/event.h
+bsd/sys/eventhandler.h
+bsd/sys/eventvar.h
+bsd/sys/fbt.h
+bsd/sys/fcntl.h
+bsd/sys/file.h
+bsd/sys/file_internal.h
+bsd/sys/filedesc.h
+bsd/sys/fileport.h
+bsd/sys/filio.h
+bsd/sys/fsctl.h
+bsd/sys/fsevents.h
+bsd/sys/fslog.h
+bsd/sys/guarded.h
+bsd/sys/imgact.h
+bsd/sys/ioccom.h
+bsd/sys/ioctl.h
+bsd/sys/ioctl_compat.h
+bsd/sys/ipc.h
+bsd/sys/kasl.h
+bsd/sys/kauth.h
+bsd/sys/kdebug.h
+bsd/sys/kdebug_kernel.h
+bsd/sys/kdebug_private.h
+bsd/sys/kern_control.h
+bsd/sys/kern_event.h
+bsd/sys/kern_memorystatus.h
+bsd/sys/kern_memorystatus_freeze.h
+bsd/sys/kern_memorystatus_notify.h
+bsd/sys/kern_sysctl.h
+bsd/sys/kernel.h
+bsd/sys/kernel_types.h
+bsd/sys/kpi_mbuf.h
+bsd/sys/kpi_private.h
+bsd/sys/kpi_socket.h
+bsd/sys/kpi_socketfilter.h
+bsd/sys/ktrace.h
+bsd/sys/linker_set.h
+bsd/sys/lock.h
+bsd/sys/lockf.h
+bsd/sys/mach_swapon.h
+bsd/sys/malloc.h
+bsd/sys/mbuf.h
+bsd/sys/md5.h
+bsd/sys/memory_maintenance.h
+bsd/sys/mman.h
+bsd/sys/monotonic.h
+bsd/sys/mount.h
+bsd/sys/mount_internal.h
+bsd/sys/msg.h
+bsd/sys/msgbuf.h
+bsd/sys/munge.h
+bsd/sys/namei.h
+bsd/sys/netport.h
+bsd/sys/param.h
+bsd/sys/paths.h
+bsd/sys/persona.h
+bsd/sys/pgo.h
+bsd/sys/pipe.h
+bsd/sys/posix_sem.h
+bsd/sys/posix_shm.h
+bsd/sys/priv.h
+bsd/sys/proc.h
+bsd/sys/proc_info.h
+bsd/sys/proc_internal.h
+bsd/sys/proc_require.h
+bsd/sys/protosw.h
+bsd/sys/pthread_internal.h
+bsd/sys/pthread_shims.h
+bsd/sys/queue.h
+bsd/sys/quota.h
+bsd/sys/random.h
+bsd/sys/reason.h
+bsd/sys/reboot.h
+bsd/sys/resource.h
+bsd/sys/resourcevar.h
+bsd/sys/sbuf.h
+bsd/sys/select.h
+bsd/sys/sem.h
+bsd/sys/sem_internal.h
+bsd/sys/semaphore.h
+bsd/sys/shm.h
+bsd/sys/shm_internal.h
+bsd/sys/signal.h
+bsd/sys/signalvar.h
+bsd/sys/socket.h
+bsd/sys/socketvar.h
+bsd/sys/sockio.h
+bsd/sys/spawn.h
+bsd/sys/spawn_internal.h
+bsd/sys/stackshot.h
+bsd/sys/stat.h
+bsd/sys/stdio.h
+bsd/sys/sys_domain.h
+bsd/sys/syscall.h
+bsd/sys/sysctl.h
+bsd/sys/syslimits.h
+bsd/sys/syslog.h
+bsd/sys/sysproto.h
+bsd/sys/systm.h
+bsd/sys/termios.h
+bsd/sys/time.h
+bsd/sys/timex.h
+bsd/sys/tree.h
+bsd/sys/tty.h
+bsd/sys/ttychars.h
+bsd/sys/ttycom.h
+bsd/sys/ttydefaults.h
+bsd/sys/ttydev.h
+bsd/sys/types.h
+bsd/sys/ubc.h
+bsd/sys/ucontext.h
+bsd/sys/ucred.h
+bsd/sys/uio.h
+bsd/sys/uio_internal.h
+bsd/sys/ulock.h
+bsd/sys/un.h
+bsd/sys/unicode.h
+bsd/sys/unistd.h
+bsd/sys/unpcb.h
+bsd/sys/user.h
+bsd/sys/utfconv.h
+bsd/sys/ux_exception.h
+bsd/sys/vfs_context.h
+bsd/sys/vm.h
+bsd/sys/vmmeter.h
+bsd/sys/vmparam.h
+bsd/sys/vnode.h
+bsd/sys/vnode_if.h
+bsd/sys/vnode_internal.h
+bsd/sys/vsock.h
+bsd/sys/vsock_domain.h
+bsd/sys/vsock_transport.h
+bsd/sys/wait.h
+bsd/sys/work_interval.h
+bsd/sys/xattr.h
+bsd/uuid/uuid.h
+bsd/vfs/vfs_disk_conditioner.h
+bsd/vfs/vfs_support.h
+bsd/vm/vnode_pager.h
+bsm/audit.h
+bsm/audit_domain.h
+bsm/audit_errno.h
+bsm/audit_fcntl.h
+bsm/audit_internal.h
+bsm/audit_kevents.h
+bsm/audit_record.h
+bsm/audit_socket_type.h
+corecrypto/cc.h
+corecrypto/cc_config.h
+corecrypto/cc_error.h
+corecrypto/cc_fault_canary.h
+corecrypto/cc_macros.h
+corecrypto/cc_priv.h
+corecrypto/cc_runtime_config.h
+corecrypto/ccaes.h
+corecrypto/ccasn1.h
+corecrypto/ccchacha20poly1305.h
+corecrypto/cccmac.h
+corecrypto/ccdes.h
+corecrypto/ccdigest.h
+corecrypto/ccdigest_priv.h
+corecrypto/ccdrbg.h
+corecrypto/ccdrbg_impl.h
+corecrypto/cchmac.h
+corecrypto/cckprng.h
+corecrypto/ccmd4.h
+corecrypto/ccmode.h
+corecrypto/ccmode_impl.h
+corecrypto/ccmode_siv.h
+corecrypto/ccmode_siv_hmac.h
+corecrypto/ccn.h
+corecrypto/ccpad.h
+corecrypto/ccrng.h
+corecrypto/ccrsa.h
+corecrypto/ccsha1.h
+corecrypto/ccsha2.h
+corecrypto/cczp.h
+corecrypto/fipspost_trace.h
+corpses/task_corpse.h
+default_pager/default_pager_types.h
+device/device.defs
+device/device_port.h
+device/device_types.defs
+device/device_types.h
+gethostuuid.h
+gethostuuid_private.h
+i386/_limits.h
+i386/_mcontext.h
+i386/_param.h
+i386/_types.h
+i386/eflags.h
+i386/endian.h
+i386/fasttrap_isa.h
+i386/limits.h
+i386/param.h
+i386/profile.h
+i386/signal.h
+i386/types.h
+i386/user_ldt.h
+i386/vmparam.h
+iokit/DriverKit/IOBufferMemoryDescriptor.h
+iokit/DriverKit/IODMACommand.h
+iokit/DriverKit/IODataQueueDispatchSource.h
+iokit/DriverKit/IODispatchQueue.h
+iokit/DriverKit/IODispatchSource.h
+iokit/DriverKit/IOInterruptDispatchSource.h
+iokit/DriverKit/IOKitKeys.h
+iokit/DriverKit/IOMemoryDescriptor.h
+iokit/DriverKit/IOMemoryMap.h
+iokit/DriverKit/IORPC.h
+iokit/DriverKit/IOReturn.h
+iokit/DriverKit/IOService.h
+iokit/DriverKit/IOServiceNotificationDispatchSource.h
+iokit/DriverKit/IOTypes.h
+iokit/DriverKit/IOUserClient.h
+iokit/DriverKit/IOUserServer.h
+iokit/DriverKit/OSAction.h
+iokit/DriverKit/OSObject.h
+iokit/IOKit/AppleKeyStoreInterface.h
+iokit/IOKit/IOBSD.h
+iokit/IOKit/IOBufferMemoryDescriptor.h
+iokit/IOKit/IOCPU.h
+iokit/IOKit/IOCatalogue.h
+iokit/IOKit/IOCommand.h
+iokit/IOKit/IOCommandGate.h
+iokit/IOKit/IOCommandPool.h
+iokit/IOKit/IOCommandQueue.h
+iokit/IOKit/IOConditionLock.h
+iokit/IOKit/IODMACommand.h
+iokit/IOKit/IODMAController.h
+iokit/IOKit/IODMAEventSource.h
+iokit/IOKit/IODataQueue.h
+iokit/IOKit/IODataQueueShared.h
+iokit/IOKit/IODeviceMemory.h
+iokit/IOKit/IODeviceTreeSupport.h
+iokit/IOKit/IOEventSource.h
+iokit/IOKit/IOFilterInterruptEventSource.h
+iokit/IOKit/IOHibernatePrivate.h
+iokit/IOKit/IOInterleavedMemoryDescriptor.h
+iokit/IOKit/IOInterruptAccounting.h
+iokit/IOKit/IOInterruptController.h
+iokit/IOKit/IOInterruptEventSource.h
+iokit/IOKit/IOInterrupts.h
+iokit/IOKit/IOKernelReportStructs.h
+iokit/IOKit/IOKernelReporters.h
+iokit/IOKit/IOKitDebug.h
+iokit/IOKit/IOKitDiagnosticsUserClient.h
+iokit/IOKit/IOKitKeys.h
+iokit/IOKit/IOKitKeysPrivate.h
+iokit/IOKit/IOKitServer.h
+iokit/IOKit/IOLib.h
+iokit/IOKit/IOLocks.h
+iokit/IOKit/IOLocksPrivate.h
+iokit/IOKit/IOMapper.h
+iokit/IOKit/IOMemoryCursor.h
+iokit/IOKit/IOMemoryDescriptor.h
+iokit/IOKit/IOMessage.h
+iokit/IOKit/IOMultiMemoryDescriptor.h
+iokit/IOKit/IONVRAM.h
+iokit/IOKit/IONotifier.h
+iokit/IOKit/IOPMGR.h
+iokit/IOKit/IOPlatformActions.h
+iokit/IOKit/IOPlatformExpert.h
+iokit/IOKit/IOPolledInterface.h
+iokit/IOKit/IORPC.h
+iokit/IOKit/IORangeAllocator.h
+iokit/IOKit/IORegistryEntry.h
+iokit/IOKit/IOReportMacros.h
+iokit/IOKit/IOReportTypes.h
+iokit/IOKit/IOReturn.h
+iokit/IOKit/IOService.h
+iokit/IOKit/IOServicePM.h
+iokit/IOKit/IOSharedDataQueue.h
+iokit/IOKit/IOSharedLock.h
+iokit/IOKit/IOStatistics.h
+iokit/IOKit/IOStatisticsPrivate.h
+iokit/IOKit/IOSubMemoryDescriptor.h
+iokit/IOKit/IOSyncer.h
+iokit/IOKit/IOTimeStamp.h
+iokit/IOKit/IOTimerEventSource.h
+iokit/IOKit/IOTypes.h
+iokit/IOKit/IOUserClient.h
+iokit/IOKit/IOUserServer.h
+iokit/IOKit/IOWorkLoop.h
+iokit/IOKit/OSMessageNotification.h
+iokit/IOKit/PassthruInterruptController.h
+iokit/IOKit/assert.h
+iokit/IOKit/nvram/IONVRAMController.h
+iokit/IOKit/platform/AppleMacIO.h
+iokit/IOKit/platform/AppleMacIODevice.h
+iokit/IOKit/platform/AppleNMI.h
+iokit/IOKit/platform/ApplePlatformExpert.h
+iokit/IOKit/platform/IOPlatformIO.h
+iokit/IOKit/power/IOPwrController.h
+iokit/IOKit/pwr_mgt/IOPM.h
+iokit/IOKit/pwr_mgt/IOPMLibDefs.h
+iokit/IOKit/pwr_mgt/IOPMPowerSource.h
+iokit/IOKit/pwr_mgt/IOPMPowerSourceList.h
+iokit/IOKit/pwr_mgt/IOPMpowerState.h
+iokit/IOKit/pwr_mgt/IOPowerConnection.h
+iokit/IOKit/pwr_mgt/RootDomain.h
+iokit/IOKit/rtc/IORTCController.h
+iokit/IOKit/system.h
+iokit/IOKit/system_management/IOWatchDogTimer.h
+kern/exc_guard.h
+kern/exc_resource.h
+kern/kcdata.h
+kern/kern_cdata.h
+libkern/OSByteOrder.h
+libkern/OSDebug.h
+libkern/OSKextLib.h
+libkern/OSReturn.h
+libkern/OSTypes.h
+libkern/_OSByteOrder.h
+libkern/firehose/chunk_private.h
+libkern/firehose/firehose_types_private.h
+libkern/firehose/ioctl_private.h
+libkern/firehose/tracepoint_private.h
+libkern/i386/OSByteOrder.h
+libkern/i386/_OSByteOrder.h
+libkern/libkern/Block.h
+libkern/libkern/Block_private.h
+libkern/libkern/OSAtomic.h
+libkern/libkern/OSBase.h
+libkern/libkern/OSByteOrder.h
+libkern/libkern/OSDebug.h
+libkern/libkern/OSKextLib.h
+libkern/libkern/OSKextLibPrivate.h
+libkern/libkern/OSMalloc.h
+libkern/libkern/OSReturn.h
+libkern/libkern/OSSerializeBinary.h
+libkern/libkern/OSTypes.h
+libkern/libkern/_OSByteOrder.h
+libkern/libkern/c++/OSAllocation.h
+libkern/libkern/c++/OSArray.h
+libkern/libkern/c++/OSBoolean.h
+libkern/libkern/c++/OSBoundedArray.h
+libkern/libkern/c++/OSBoundedArrayRef.h
+libkern/libkern/c++/OSBoundedPtr.h
+libkern/libkern/c++/OSBoundedPtrFwd.h
+libkern/libkern/c++/OSCPPDebug.h
+libkern/libkern/c++/OSCollection.h
+libkern/libkern/c++/OSCollectionIterator.h
+libkern/libkern/c++/OSContainers.h
+libkern/libkern/c++/OSData.h
+libkern/libkern/c++/OSDictionary.h
+libkern/libkern/c++/OSEndianTypes.h
+libkern/libkern/c++/OSIterator.h
+libkern/libkern/c++/OSKext.h
+libkern/libkern/c++/OSLib.h
+libkern/libkern/c++/OSMetaClass.h
+libkern/libkern/c++/OSNumber.h
+libkern/libkern/c++/OSObject.h
+libkern/libkern/c++/OSOrderedSet.h
+libkern/libkern/c++/OSPtr.h
+libkern/libkern/c++/OSSerialize.h
+libkern/libkern/c++/OSSet.h
+libkern/libkern/c++/OSSharedPtr.h
+libkern/libkern/c++/OSString.h
+libkern/libkern/c++/OSSymbol.h
+libkern/libkern/c++/OSUnserialize.h
+libkern/libkern/c++/bounded_array.h
+libkern/libkern/c++/bounded_array_ref.h
+libkern/libkern/c++/bounded_ptr.h
+libkern/libkern/c++/bounded_ptr_fwd.h
+libkern/libkern/c++/intrusive_shared_ptr.h
+libkern/libkern/c++/safe_allocation.h
+libkern/libkern/crc.h
+libkern/libkern/crypto/aes.h
+libkern/libkern/crypto/aesxts.h
+libkern/libkern/crypto/chacha20poly1305.h
+libkern/libkern/crypto/crypto_internal.h
+libkern/libkern/crypto/des.h
+libkern/libkern/crypto/md5.h
+libkern/libkern/crypto/rand.h
+libkern/libkern/crypto/register_crypto.h
+libkern/libkern/crypto/rsa.h
+libkern/libkern/crypto/sha1.h
+libkern/libkern/crypto/sha2.h
+libkern/libkern/i386/OSByteOrder.h
+libkern/libkern/i386/_OSByteOrder.h
+libkern/libkern/img4/interface.h
+libkern/libkern/kernel_mach_header.h
+libkern/libkern/kext_request_keys.h
+libkern/libkern/kxld.h
+libkern/libkern/kxld_types.h
+libkern/libkern/locks.h
+libkern/libkern/machine/OSByteOrder.h
+libkern/libkern/mkext.h
+libkern/libkern/prelink.h
+libkern/libkern/ptrauth_utils.h
+libkern/libkern/section_keywords.h
+libkern/libkern/stack_protector.h
+libkern/libkern/sysctl.h
+libkern/libkern/tree.h
+libkern/libkern/version.h
+libkern/libkern/zconf.h
+libkern/libkern/zlib.h
+libkern/machine/OSByteOrder.h
+libkern/os/atomic.h
+libkern/os/atomic_private.h
+libkern/os/atomic_private_arch.h
+libkern/os/atomic_private_impl.h
+libkern/os/base.h
+libkern/os/base_private.h
+libkern/os/cpp_util.h
+libkern/os/hash.h
+libkern/os/log.h
+libkern/os/log_private.h
+libkern/os/object.h
+libkern/os/overflow.h
+libkern/os/ptrtools.h
+libkern/os/reason_private.h
+libkern/os/refcnt.h
+libkern/os/refcnt_internal.h
+libkern/os/trace.h
+libproc.h
+mach/audit_triggers.defs
+mach/audit_triggers_types.h
+mach/boolean.h
+mach/bootstrap.h
+mach/clock.defs
+mach/clock.h
+mach/clock_priv.defs
+mach/clock_priv.h
+mach/clock_reply.defs
+mach/clock_reply.h
+mach/clock_types.defs
+mach/clock_types.h
+mach/dyld_kernel.h
+mach/error.h
+mach/exc.defs
+mach/exc.h
+mach/exception.h
+mach/exception_types.h
+mach/host_info.h
+mach/host_notify.h
+mach/host_notify_reply.defs
+mach/host_priv.defs
+mach/host_priv.h
+mach/host_reboot.h
+mach/host_security.defs
+mach/host_security.h
+mach/host_special_ports.h
+mach/i386/_structs.h
+mach/i386/asm.h
+mach/i386/boolean.h
+mach/i386/exception.h
+mach/i386/fp_reg.h
+mach/i386/kern_return.h
+mach/i386/ndr_def.h
+mach/i386/processor_info.h
+mach/i386/rpc.h
+mach/i386/sdt_isa.h
+mach/i386/thread_state.h
+mach/i386/thread_status.h
+mach/i386/vm_param.h
+mach/i386/vm_types.h
+mach/kern_return.h
+mach/kmod.h
+mach/lock_set.defs
+mach/lock_set.h
+mach/mach.h
+mach/mach_error.h
+mach/mach_eventlink.h
+mach/mach_exc.defs
+mach/mach_host.defs
+mach/mach_host.h
+mach/mach_init.h
+mach/mach_interface.h
+mach/mach_param.h
+mach/mach_port.defs
+mach/mach_port.h
+mach/mach_port_internal.h
+mach/mach_right.h
+mach/mach_syscalls.h
+mach/mach_time.h
+mach/mach_traps.h
+mach/mach_types.defs
+mach/mach_types.h
+mach/mach_vm.defs
+mach/mach_vm.h
+mach/mach_vm_internal.h
+mach/mach_voucher.defs
+mach/mach_voucher.h
+mach/mach_voucher_attr_control.defs
+mach/mach_voucher_types.h
+mach/machine.h
+mach/machine/_structs.h
+mach/machine/asm.h
+mach/machine/boolean.h
+mach/machine/exception.h
+mach/machine/kern_return.h
+mach/machine/machine_types.defs
+mach/machine/ndr_def.h
+mach/machine/processor_info.h
+mach/machine/rpc.h
+mach/machine/sdt.h
+mach/machine/sdt_isa.h
+mach/machine/thread_state.h
+mach/machine/thread_status.h
+mach/machine/vm_param.h
+mach/machine/vm_types.h
+mach/memory_entry.defs
+mach/memory_entry.h
+mach/memory_object_types.h
+mach/message.h
+mach/mig.h
+mach/mig_errors.h
+mach/mig_strncpy_zerofill_support.h
+mach/mig_voucher_support.h
+mach/ndr.h
+mach/notify.defs
+mach/notify.h
+mach/policy.h
+mach/port.h
+mach/port_obj.h
+mach/processor.defs
+mach/processor.h
+mach/processor_info.h
+mach/processor_set.defs
+mach/processor_set.h
+mach/rpc.h
+mach/sdt.h
+mach/semaphore.h
+mach/shared_memory_server.h
+mach/shared_region.h
+mach/std_types.defs
+mach/std_types.h
+mach/sync.h
+mach/sync_policy.h
+mach/task.defs
+mach/task.h
+mach/task_access.defs
+mach/task_info.h
+mach/task_inspect.h
+mach/task_policy.h
+mach/task_special_ports.h
+mach/telemetry_notification.defs
+mach/thread_act.defs
+mach/thread_act.h
+mach/thread_act_internal.h
+mach/thread_info.h
+mach/thread_policy.h
+mach/thread_special_ports.h
+mach/thread_state.h
+mach/thread_status.h
+mach/thread_switch.h
+mach/time_value.h
+mach/vm_attributes.h
+mach/vm_behavior.h
+mach/vm_inherit.h
+mach/vm_map.defs
+mach/vm_map.h
+mach/vm_map_internal.h
+mach/vm_page_size.h
+mach/vm_param.h
+mach/vm_prot.h
+mach/vm_purgable.h
+mach/vm_region.h
+mach/vm_statistics.h
+mach/vm_sync.h
+mach/vm_task.h
+mach/vm_types.h
+mach_debug/hash_info.h
+mach_debug/ipc_info.h
+mach_debug/lockgroup_info.h
+mach_debug/mach_debug.h
+mach_debug/mach_debug_types.defs
+mach_debug/mach_debug_types.h
+mach_debug/page_info.h
+mach_debug/vm_info.h
+mach_debug/zone_info.h
+machine/_limits.h
+machine/_mcontext.h
+machine/_param.h
+machine/_types.h
+machine/byte_order.h
+machine/endian.h
+machine/fasttrap_isa.h
+machine/limits.h
+machine/param.h
+machine/profile.h
+machine/signal.h
+machine/types.h
+machine/vmparam.h
+machine_types.modulemap
+miscfs/devfs/devfs.h
+miscfs/specfs/specdev.h
+miscfs/union/union.h
+net/bpf.h
+net/dlil.h
+net/ethernet.h
+net/if.h
+net/if_arp.h
+net/if_dl.h
+net/if_llc.h
+net/if_media.h
+net/if_mib.h
+net/if_types.h
+net/if_utun.h
+net/if_var.h
+net/kext_net.h
+net/ndrv.h
+net/net_kev.h
+net/pfkeyv2.h
+net/route.h
+netinet/bootp.h
+netinet/icmp6.h
+netinet/icmp_var.h
+netinet/if_ether.h
+netinet/igmp.h
+netinet/igmp_var.h
+netinet/in.h
+netinet/in_pcb.h
+netinet/in_systm.h
+netinet/in_var.h
+netinet/ip.h
+netinet/ip6.h
+netinet/ip_icmp.h
+netinet/ip_var.h
+netinet/tcp.h
+netinet/tcp_fsm.h
+netinet/tcp_seq.h
+netinet/tcp_timer.h
+netinet/tcp_var.h
+netinet/tcpip.h
+netinet/udp.h
+netinet/udp_var.h
+netinet6/ah.h
+netinet6/esp.h
+netinet6/in6.h
+netinet6/in6_var.h
+netinet6/ipcomp.h
+netinet6/ipsec.h
+netinet6/nd6.h
+netinet6/raw_ip6.h
+netinet6/scope6_var.h
+netkey/keysock.h
+nfs/krpc.h
+nfs/nfs.h
+nfs/nfs_gss.h
+nfs/nfs_ioctl.h
+nfs/nfs_lock.h
+nfs/nfsdiskless.h
+nfs/nfsm_subs.h
+nfs/nfsmount.h
+nfs/nfsnode.h
+nfs/nfsproto.h
+nfs/nfsrvcache.h
+nfs/rpcv2.h
+nfs/xdr_subs.h
+os/atomic.h
+os/base.h
+os/overflow.h
+os/tsd.h
+osfmk/UserNotification/KUNCUserNotifications.h
+osfmk/UserNotification/UNDReply.defs
+osfmk/UserNotification/UNDRequest.defs
+osfmk/UserNotification/UNDTypes.defs
+osfmk/UserNotification/UNDTypes.h
+osfmk/atm/atm_internal.h
+osfmk/atm/atm_notification.defs
+osfmk/atm/atm_types.defs
+osfmk/atm/atm_types.h
+osfmk/bank/bank_types.h
+osfmk/console/serial_protos.h
+osfmk/console/video_console.h
+osfmk/corpses/task_corpse.h
+osfmk/default_pager/default_pager_types.h
+osfmk/device/device.defs
+osfmk/device/device_port.h
+osfmk/device/device_types.defs
+osfmk/device/device_types.h
+osfmk/gssd/gssd_mach.defs
+osfmk/gssd/gssd_mach.h
+osfmk/gssd/gssd_mach_types.h
+osfmk/i386/apic.h
+osfmk/i386/asm.h
+osfmk/i386/atomic.h
+osfmk/i386/bit_routines.h
+osfmk/i386/cpu_capabilities.h
+osfmk/i386/cpu_data.h
+osfmk/i386/cpu_number.h
+osfmk/i386/cpu_topology.h
+osfmk/i386/cpuid.h
+osfmk/i386/eflags.h
+osfmk/i386/fpu.h
+osfmk/i386/io_map_entries.h
+osfmk/i386/lapic.h
+osfmk/i386/lock.h
+osfmk/i386/locks.h
+osfmk/i386/locks_i386_inlines.h
+osfmk/i386/machine_cpu.h
+osfmk/i386/machine_routines.h
+osfmk/i386/memory_types.h
+osfmk/i386/mp.h
+osfmk/i386/mp_desc.h
+osfmk/i386/mp_events.h
+osfmk/i386/mtrr.h
+osfmk/i386/pal_hibernate.h
+osfmk/i386/pal_native.h
+osfmk/i386/pal_routines.h
+osfmk/i386/panic_hooks.h
+osfmk/i386/pmCPU.h
+osfmk/i386/pmap.h
+osfmk/i386/proc_reg.h
+osfmk/i386/rtclock_protos.h
+osfmk/i386/seg.h
+osfmk/i386/simple_lock.h
+osfmk/i386/smp.h
+osfmk/i386/trap.h
+osfmk/i386/tsc.h
+osfmk/i386/tss.h
+osfmk/i386/ucode.h
+osfmk/i386/vmx.h
+osfmk/ipc/ipc_types.h
+osfmk/kdp/kdp_callout.h
+osfmk/kdp/kdp_dyld.h
+osfmk/kdp/kdp_en_debugger.h
+osfmk/kern/affinity.h
+osfmk/kern/arcade.h
+osfmk/kern/arithmetic_128.h
+osfmk/kern/assert.h
+osfmk/kern/audit_sessionport.h
+osfmk/kern/backtrace.h
+osfmk/kern/bits.h
+osfmk/kern/block_hint.h
+osfmk/kern/btlog.h
+osfmk/kern/cambria_layout.h
+osfmk/kern/circle_queue.h
+osfmk/kern/clock.h
+osfmk/kern/coalition.h
+osfmk/kern/cpu_data.h
+osfmk/kern/cpu_number.h
+osfmk/kern/cpu_quiesce.h
+osfmk/kern/cs_blobs.h
+osfmk/kern/debug.h
+osfmk/kern/ecc.h
+osfmk/kern/energy_perf.h
+osfmk/kern/exc_guard.h
+osfmk/kern/exc_resource.h
+osfmk/kern/extmod_statistics.h
+osfmk/kern/host.h
+osfmk/kern/hv_support.h
+osfmk/kern/hv_support_kext.h
+osfmk/kern/ipc_kobject.h
+osfmk/kern/ipc_mig.h
+osfmk/kern/ipc_misc.h
+osfmk/kern/kalloc.h
+osfmk/kern/kcdata.h
+osfmk/kern/kern_cdata.h
+osfmk/kern/kern_types.h
+osfmk/kern/kext_alloc.h
+osfmk/kern/kpc.h
+osfmk/kern/ledger.h
+osfmk/kern/lock.h
+osfmk/kern/lock_group.h
+osfmk/kern/lock_stat.h
+osfmk/kern/locks.h
+osfmk/kern/mach_param.h
+osfmk/kern/macro_help.h
+osfmk/kern/monotonic.h
+osfmk/kern/mpqueue.h
+osfmk/kern/mpsc_queue.h
+osfmk/kern/page_decrypt.h
+osfmk/kern/percpu.h
+osfmk/kern/pms.h
+osfmk/kern/policy_internal.h
+osfmk/kern/priority_queue.h
+osfmk/kern/processor.h
+osfmk/kern/queue.h
+osfmk/kern/remote_time.h
+osfmk/kern/restartable.h
+osfmk/kern/sched_clutch.h
+osfmk/kern/sched_prim.h
+osfmk/kern/sfi.h
+osfmk/kern/simple_lock.h
+osfmk/kern/startup.h
+osfmk/kern/task.h
+osfmk/kern/telemetry.h
+osfmk/kern/thread.h
+osfmk/kern/thread_call.h
+osfmk/kern/thread_group.h
+osfmk/kern/timer_call.h
+osfmk/kern/trustcache.h
+osfmk/kern/turnstile.h
+osfmk/kern/ux_handler.h
+osfmk/kern/waitq.h
+osfmk/kern/work_interval.h
+osfmk/kern/zalloc.h
+osfmk/kextd/kextd_mach.defs
+osfmk/kextd/kextd_mach.h
+osfmk/kperf/action.h
+osfmk/kperf/context.h
+osfmk/kperf/kdebug_trigger.h
+osfmk/kperf/kperf.h
+osfmk/kperf/kperfbsd.h
+osfmk/kperf/kptimer.h
+osfmk/kperf/lazy.h
+osfmk/kperf/pet.h
+osfmk/lockd/lockd_mach.defs
+osfmk/lockd/lockd_mach.h
+osfmk/lockd/lockd_mach_types.h
+osfmk/mach/arcade_upcall_server.h
+osfmk/mach/audit_triggers.defs
+osfmk/mach/audit_triggers_server.h
+osfmk/mach/audit_triggers_types.h
+osfmk/mach/boolean.h
+osfmk/mach/clock.defs
+osfmk/mach/clock.h
+osfmk/mach/clock_priv.defs
+osfmk/mach/clock_priv.h
+osfmk/mach/clock_reply.defs
+osfmk/mach/clock_reply_server.h
+osfmk/mach/clock_types.defs
+osfmk/mach/clock_types.h
+osfmk/mach/coalition.h
+osfmk/mach/coalition_notification_server.h
+osfmk/mach/dyld_kernel.h
+osfmk/mach/error.h
+osfmk/mach/exc.defs
+osfmk/mach/exc_server.h
+osfmk/mach/exception.h
+osfmk/mach/exception_types.h
+osfmk/mach/fairplayd_notification_server.h
+osfmk/mach/host_info.h
+osfmk/mach/host_notify.h
+osfmk/mach/host_notify_reply.defs
+osfmk/mach/host_priv.defs
+osfmk/mach/host_priv.h
+osfmk/mach/host_reboot.h
+osfmk/mach/host_security.defs
+osfmk/mach/host_security.h
+osfmk/mach/host_special_ports.h
+osfmk/mach/i386/_structs.h
+osfmk/mach/i386/asm.h
+osfmk/mach/i386/boolean.h
+osfmk/mach/i386/exception.h
+osfmk/mach/i386/fp_reg.h
+osfmk/mach/i386/kern_return.h
+osfmk/mach/i386/ndr_def.h
+osfmk/mach/i386/processor_info.h
+osfmk/mach/i386/rpc.h
+osfmk/mach/i386/sdt_isa.h
+osfmk/mach/i386/syscall_sw.h
+osfmk/mach/i386/thread_state.h
+osfmk/mach/i386/thread_status.h
+osfmk/mach/i386/vm_param.h
+osfmk/mach/i386/vm_types.h
+osfmk/mach/kern_return.h
+osfmk/mach/kmod.h
+osfmk/mach/ktrace_background.h
+osfmk/mach/lock_set.defs
+osfmk/mach/lock_set.h
+osfmk/mach/mach_eventlink_types.h
+osfmk/mach/mach_exc.defs
+osfmk/mach/mach_exc_server.h
+osfmk/mach/mach_host.defs
+osfmk/mach/mach_host.h
+osfmk/mach/mach_interface.h
+osfmk/mach/mach_param.h
+osfmk/mach/mach_port.defs
+osfmk/mach/mach_port.h
+osfmk/mach/mach_syscalls.h
+osfmk/mach/mach_time.h
+osfmk/mach/mach_traps.h
+osfmk/mach/mach_types.defs
+osfmk/mach/mach_types.h
+osfmk/mach/mach_vm.defs
+osfmk/mach/mach_vm.h
+osfmk/mach/mach_voucher.defs
+osfmk/mach/mach_voucher.h
+osfmk/mach/mach_voucher_attr_control.defs
+osfmk/mach/mach_voucher_attr_control.h
+osfmk/mach/mach_voucher_types.h
+osfmk/mach/machine.h
+osfmk/mach/machine/_structs.h
+osfmk/mach/machine/asm.h
+osfmk/mach/machine/boolean.h
+osfmk/mach/machine/exception.h
+osfmk/mach/machine/kern_return.h
+osfmk/mach/machine/machine_types.defs
+osfmk/mach/machine/ndr_def.h
+osfmk/mach/machine/processor_info.h
+osfmk/mach/machine/rpc.h
+osfmk/mach/machine/sdt.h
+osfmk/mach/machine/sdt_isa.h
+osfmk/mach/machine/syscall_sw.h
+osfmk/mach/machine/thread_state.h
+osfmk/mach/machine/thread_status.h
+osfmk/mach/machine/vm_param.h
+osfmk/mach/machine/vm_types.h
+osfmk/mach/memory_entry.defs
+osfmk/mach/memory_entry.h
+osfmk/mach/memory_object_control.h
+osfmk/mach/memory_object_default_server.h
+osfmk/mach/memory_object_types.h
+osfmk/mach/message.h
+osfmk/mach/mig.h
+osfmk/mach/mig_errors.h
+osfmk/mach/mig_strncpy_zerofill_support.h
+osfmk/mach/mig_voucher_support.h
+osfmk/mach/ndr.h
+osfmk/mach/notify.defs
+osfmk/mach/notify.h
+osfmk/mach/notify_server.h
+osfmk/mach/policy.h
+osfmk/mach/port.h
+osfmk/mach/processor.defs
+osfmk/mach/processor.h
+osfmk/mach/processor_info.h
+osfmk/mach/processor_set.defs
+osfmk/mach/processor_set.h
+osfmk/mach/resource_monitors.h
+osfmk/mach/rpc.h
+osfmk/mach/sdt.h
+osfmk/mach/semaphore.h
+osfmk/mach/sfi_class.h
+osfmk/mach/shared_memory_server.h
+osfmk/mach/shared_region.h
+osfmk/mach/std_types.defs
+osfmk/mach/std_types.h
+osfmk/mach/sync_policy.h
+osfmk/mach/syscall_sw.h
+osfmk/mach/sysdiagnose_notification_server.h
+osfmk/mach/task.defs
+osfmk/mach/task.h
+osfmk/mach/task_access.defs
+osfmk/mach/task_access.h
+osfmk/mach/task_access_server.h
+osfmk/mach/task_info.h
+osfmk/mach/task_inspect.h
+osfmk/mach/task_policy.h
+osfmk/mach/task_special_ports.h
+osfmk/mach/telemetry_notification.defs
+osfmk/mach/telemetry_notification_server.h
+osfmk/mach/thread_act.defs
+osfmk/mach/thread_act.h
+osfmk/mach/thread_info.h
+osfmk/mach/thread_policy.h
+osfmk/mach/thread_special_ports.h
+osfmk/mach/thread_status.h
+osfmk/mach/thread_switch.h
+osfmk/mach/time_value.h
+osfmk/mach/upl.h
+osfmk/mach/vfs_nspace.h
+osfmk/mach/vfs_nspace_server.h
+osfmk/mach/vm_attributes.h
+osfmk/mach/vm_behavior.h
+osfmk/mach/vm_inherit.h
+osfmk/mach/vm_map.defs
+osfmk/mach/vm_map.h
+osfmk/mach/vm_param.h
+osfmk/mach/vm_prot.h
+osfmk/mach/vm_purgable.h
+osfmk/mach/vm_region.h
+osfmk/mach/vm_statistics.h
+osfmk/mach/vm_sync.h
+osfmk/mach/vm_types.h
+osfmk/mach_debug/hash_info.h
+osfmk/mach_debug/ipc_info.h
+osfmk/mach_debug/lockgroup_info.h
+osfmk/mach_debug/mach_debug.h
+osfmk/mach_debug/mach_debug_types.defs
+osfmk/mach_debug/mach_debug_types.h
+osfmk/mach_debug/page_info.h
+osfmk/mach_debug/vm_info.h
+osfmk/mach_debug/zone_info.h
+osfmk/machine/atomic.h
+osfmk/machine/config.h
+osfmk/machine/cpu_capabilities.h
+osfmk/machine/cpu_number.h
+osfmk/machine/io_map_entries.h
+osfmk/machine/lock.h
+osfmk/machine/locks.h
+osfmk/machine/machine_cpuid.h
+osfmk/machine/machine_kpc.h
+osfmk/machine/machine_remote_time.h
+osfmk/machine/machine_routines.h
+osfmk/machine/memory_types.h
+osfmk/machine/monotonic.h
+osfmk/machine/pal_hibernate.h
+osfmk/machine/pal_routines.h
+osfmk/machine/simple_lock.h
+osfmk/machine/smp.h
+osfmk/machine/trap.h
+osfmk/prng/entropy.h
+osfmk/prng/random.h
+osfmk/string.h
+osfmk/tests/ktest.h
+osfmk/tests/xnupost.h
+osfmk/vm/WKdm_new.h
+osfmk/vm/memory_types.h
+osfmk/vm/pmap.h
+osfmk/vm/vm_compressor_algorithms.h
+osfmk/vm/vm_fault.h
+osfmk/vm/vm_kern.h
+osfmk/vm/vm_map.h
+osfmk/vm/vm_options.h
+osfmk/vm/vm_pageout.h
+osfmk/vm/vm_protos.h
+osfmk/vm/vm_shared_region.h
+osfmk/voucher/ipc_pthread_priority_types.h
+osfmk/x86_64/machine_kpc.h
+osfmk/x86_64/machine_remote_time.h
+osfmk/x86_64/monotonic.h
+pexpert/boot.h
+pexpert/i386/boot.h
+pexpert/i386/efi.h
+pexpert/i386/protos.h
+pexpert/machine/boot.h
+pexpert/machine/protos.h
+pexpert/pexpert.h
+pexpert/pexpert/boot.h
+pexpert/pexpert/device_tree.h
+pexpert/pexpert/i386/boot.h
+pexpert/pexpert/i386/efi.h
+pexpert/pexpert/i386/protos.h
+pexpert/pexpert/machine/boot.h
+pexpert/pexpert/machine/protos.h
+pexpert/pexpert/pexpert.h
+pexpert/pexpert/protos.h
+pexpert/protos.h
+san/san/kasan.h
+san/san/ksancov.h
+san/san/memintrinsics.h
+security/audit/audit_ioctl.h
+security/security/_label.h
+security/security/mac.h
+security/security/mac_data.h
+security/security/mac_framework.h
+security/security/mac_internal.h
+security/security/mac_mach_internal.h
+security/security/mac_policy.h
+servers/key_defs.h
+servers/ls_defs.h
+servers/netname.h
+servers/netname_defs.h
+servers/nm_defs.h
+spawn.h
+sys/_endian.h
+sys/_posix_availability.h
+sys/_select.h
+sys/_structs.h
+sys/_symbol_aliasing.h
+sys/_types.h
+sys/_types/_blkcnt_t.h
+sys/_types/_blksize_t.h
+sys/_types/_caddr_t.h
+sys/_types/_clock_t.h
+sys/_types/_ct_rune_t.h
+sys/_types/_dev_t.h
+sys/_types/_errno_t.h
+sys/_types/_fd_clr.h
+sys/_types/_fd_copy.h
+sys/_types/_fd_def.h
+sys/_types/_fd_isset.h
+sys/_types/_fd_set.h
+sys/_types/_fd_setsize.h
+sys/_types/_fd_zero.h
+sys/_types/_filesec_t.h
+sys/_types/_fsblkcnt_t.h
+sys/_types/_fsfilcnt_t.h
+sys/_types/_fsid_t.h
+sys/_types/_fsobj_id_t.h
+sys/_types/_gid_t.h
+sys/_types/_guid_t.h
+sys/_types/_id_t.h
+sys/_types/_in_addr_t.h
+sys/_types/_in_port_t.h
+sys/_types/_ino64_t.h
+sys/_types/_ino_t.h
+sys/_types/_int16_t.h
+sys/_types/_int32_t.h
+sys/_types/_int64_t.h
+sys/_types/_int8_t.h
+sys/_types/_intptr_t.h
+sys/_types/_iovec_t.h
+sys/_types/_key_t.h
+sys/_types/_mach_port_t.h
+sys/_types/_mbstate_t.h
+sys/_types/_mode_t.h
+sys/_types/_nlink_t.h
+sys/_types/_null.h
+sys/_types/_o_dsync.h
+sys/_types/_o_sync.h
+sys/_types/_off_t.h
+sys/_types/_offsetof.h
+sys/_types/_os_inline.h
+sys/_types/_pid_t.h
+sys/_types/_posix_vdisable.h
+sys/_types/_ptrdiff_t.h
+sys/_types/_rsize_t.h
+sys/_types/_rune_t.h
+sys/_types/_s_ifmt.h
+sys/_types/_sa_family_t.h
+sys/_types/_seek_set.h
+sys/_types/_sigaltstack.h
+sys/_types/_sigset_t.h
+sys/_types/_size_t.h
+sys/_types/_socklen_t.h
+sys/_types/_ssize_t.h
+sys/_types/_suseconds_t.h
+sys/_types/_time_t.h
+sys/_types/_timespec.h
+sys/_types/_timeval.h
+sys/_types/_timeval32.h
+sys/_types/_timeval64.h
+sys/_types/_u_char.h
+sys/_types/_u_int.h
+sys/_types/_u_int16_t.h
+sys/_types/_u_int32_t.h
+sys/_types/_u_int64_t.h
+sys/_types/_u_int8_t.h
+sys/_types/_u_short.h
+sys/_types/_ucontext.h
+sys/_types/_ucontext64.h
+sys/_types/_uid_t.h
+sys/_types/_uintptr_t.h
+sys/_types/_useconds_t.h
+sys/_types/_uuid_t.h
+sys/_types/_va_list.h
+sys/_types/_wchar_t.h
+sys/_types/_wint_t.h
+sys/acct.h
+sys/aio.h
+sys/appleapiopts.h
+sys/attr.h
+sys/buf.h
+sys/cdefs.h
+sys/clonefile.h
+sys/commpage.h
+sys/conf.h
+sys/dir.h
+sys/dirent.h
+sys/disk.h
+sys/dkstat.h
+sys/domain.h
+sys/dtrace.h
+sys/dtrace_glue.h
+sys/dtrace_impl.h
+sys/errno.h
+sys/ev.h
+sys/event.h
+sys/fasttrap.h
+sys/fasttrap_isa.h
+sys/fcntl.h
+sys/file.h
+sys/filedesc.h
+sys/filio.h
+sys/fsgetpath.h
+sys/gmon.h
+sys/ioccom.h
+sys/ioctl.h
+sys/ioctl_compat.h
+sys/ipc.h
+sys/kauth.h
+sys/kdebug.h
+sys/kdebug_signpost.h
+sys/kern_control.h
+sys/kern_event.h
+sys/kernel.h
+sys/kernel_types.h
+sys/lctx.h
+sys/loadable_fs.h
+sys/lock.h
+sys/lockf.h
+sys/lockstat.h
+sys/log_data.h
+sys/malloc.h
+sys/mbuf.h
+sys/mman.h
+sys/mount.h
+sys/msg.h
+sys/msgbuf.h
+sys/netport.h
+sys/param.h
+sys/paths.h
+sys/pipe.h
+sys/poll.h
+sys/posix_sem.h
+sys/posix_shm.h
+sys/proc.h
+sys/proc_info.h
+sys/protosw.h
+sys/ptrace.h
+sys/queue.h
+sys/quota.h
+sys/random.h
+sys/reboot.h
+sys/resource.h
+sys/resourcevar.h
+sys/sbuf.h
+sys/sdt.h
+sys/select.h
+sys/sem.h
+sys/semaphore.h
+sys/shm.h
+sys/signal.h
+sys/signalvar.h
+sys/snapshot.h
+sys/socket.h
+sys/socketvar.h
+sys/sockio.h
+sys/spawn.h
+sys/stat.h
+sys/stdio.h
+sys/sys_domain.h
+sys/syscall.h
+sys/sysctl.h
+sys/syslimits.h
+sys/syslog.h
+sys/termios.h
+sys/time.h
+sys/timeb.h
+sys/times.h
+sys/timex.h
+sys/tprintf.h
+sys/trace.h
+sys/tty.h
+sys/ttychars.h
+sys/ttycom.h
+sys/ttydefaults.h
+sys/ttydev.h
+sys/types.h
+sys/ubc.h
+sys/ucontext.h
+sys/ucred.h
+sys/uio.h
+sys/un.h
+sys/unistd.h
+sys/unpcb.h
+sys/user.h
+sys/utfconv.h
+sys/utsname.h
+sys/vadvise.h
+sys/vcmd.h
+sys/vm.h
+sys/vmmeter.h
+sys/vmparam.h
+sys/vnioctl.h
+sys/vnode.h
+sys/vnode_if.h
+sys/vsock.h
+sys/vstat.h
+sys/wait.h
+sys/xattr.h
+sys__types.modulemap
+sys_cdefs.modulemap
+sys_types.modulemap
+system-version-compat-support.h
+uuid/uuid.h
+vfs/vfs_support.h
+voucher/ipc_pthread_priority_types.h
diff --git a/pkgs/os-specific/darwin/binutils/default.nix b/pkgs/os-specific/darwin/binutils/default.nix
index 78c510f7da4cd..ee9a80518acdf 100644
--- a/pkgs/os-specific/darwin/binutils/default.nix
+++ b/pkgs/os-specific/darwin/binutils/default.nix
@@ -1,108 +1,124 @@
-{ lib, stdenv, makeWrapper, binutils-unwrapped, cctools, llvm, clang-unwrapped, dualAs ? false }:
-
-# Make sure both underlying packages claim to have prepended their binaries
-# with the same targetPrefix.
-assert binutils-unwrapped.targetPrefix == cctools.targetPrefix;
+{
+  lib,
+  stdenvNoCC,
+  cctools,
+  clang-unwrapped,
+  llvm,
+  llvm-manpages,
+  makeWrapper,
+  enableManpages ? stdenvNoCC.targetPlatform == stdenvNoCC.hostPlatform,
+}:
 
 let
-  inherit (binutils-unwrapped) targetPrefix;
-  cmds = [
-    "ar" "ranlib" "as" "install_name_tool"
-    "ld" "strip" "otool" "lipo" "nm" "strings" "size"
+  inherit (stdenvNoCC) targetPlatform hostPlatform;
+  targetPrefix = lib.optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-";
+
+  llvm_cmds = [
+    "addr2line"
+    "ar"
+    "c++filt"
+    "dsymutil"
+    "nm"
+    "objcopy"
+    "objdump"
+    "otool"
+    "size"
+    "strings"
+    "strip"
+  ];
+
+  cctools_cmds = [
     "codesign_allocate"
+    "gprof"
+    "ranlib"
+    # Use the cctools versions because the LLVM ones can crash or fail when the cctools ones don’t.
+    # Revisit when LLVM is updated to LLVM 18 on Darwin.
+    "lipo"
+    "install_name_tool"
   ];
-  isCCToolsLLVM = lib.getName cctools == "cctools-llvm";
-in
 
-# TODO: loop over targetPrefixed binaries too
-stdenv.mkDerivation {
-  pname = "${targetPrefix}cctools-binutils-darwin" + lib.optionalString dualAs "-dualas";
+  linkManPages =
+    pkg: source: target:
+    lib.optionalString enableManpages ''
+      sourcePath=${pkg}/share/man/man1/${source}.1.gz
+      targetPath=''${!outputMan}/share/man/man1/${target}.1.gz
+
+      if [ -f "$sourcePath" ]; then
+        mkdir -p "$(dirname "$targetPath")"
+        ln -s "$sourcePath" "$targetPath"
+      fi
+    '';
+in
+stdenvNoCC.mkDerivation {
+  pname = "${targetPrefix}cctools-binutils-darwin";
   inherit (cctools) version;
-  outputs = [ "out" "man" ];
+
+  outputs = [ "out" ] ++ lib.optional enableManpages "man";
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
   buildCommand = ''
     mkdir -p $out/bin $out/include
 
-    ln -s ${binutils-unwrapped.out}/bin/${targetPrefix}c++filt $out/bin/${targetPrefix}c++filt
-
-    # We specifically need:
-    # - ld: binutils doesn't provide it on darwin
-    # - as: as above
-    # - ar: the binutils one produces .a files that the cctools ld doesn't like
-    # - ranlib: for compatibility with ar
-    # - otool: we use it for some of our name mangling
-    # - install_name_tool: we use it to rewrite stuff in our bootstrap tools
-    # - strip: the binutils one seems to break mach-o files
-    # - lipo: gcc build assumes it exists
-    # - nm: the gnu one doesn't understand many new load commands
-    for i in ${lib.concatStringsSep " " (map (e: targetPrefix + e) cmds)}; do
-      ln -sf "${cctools}/bin/$i" "$out/bin/$i"
-    done
+    for tool in ${toString llvm_cmds}; do
+      # Translate between LLVM and traditional tool names (e.g., `c++filt` versus `cxxfilt`).
+      cctoolsTool=''${tool//-/_}
+      llvmTool=''${tool//++/xx}
 
-    ln -s ${llvm}/bin/dsymutil $out/bin/dsymutil
+      # Some tools aren’t prefixed (like `dsymutil`).
+      llvmPath="${lib.getBin llvm}/bin"
+      if [ -e "$llvmPath/llvm-$llvmTool" ]; then
+        llvmTool=llvm-$llvmTool
+      elif [ -e "$llvmPath/${targetPrefix}$llvmTool" ]; then
+        llvmTool=${targetPrefix}$llvmTool
+      fi
 
-    ln -s ${binutils-unwrapped.out}/share $out/share
+      # Not all tools are included in the bootstrap tools. Don’t link them if they don’t exist.
+      if [ -e "$llvmPath/$llvmTool" ]; then
+        ln -s "$llvmPath/$llvmTool" "$out/bin/${targetPrefix}$cctoolsTool"
+      fi
+      ${linkManPages llvm-manpages "$llvmTool" "$cctoolsTool"}
+    done
 
-    mkdir -p "$man"/share/man/man{1,5}
-    for i in ${lib.concatStringsSep " " cmds}; do
-      for path in "${cctools.man}"/share/man/man?/$i.*; do
-        dest_path="$man''${path#${cctools.man}}"
-        ln -sv "$path" "$dest_path"
-      done
+    for tool in ${toString cctools_cmds}; do
+      toolsrc="${lib.getBin cctools}/bin/${targetPrefix}$tool"
+      if [ -e "$toolsrc" ]; then
+        ln -s "${lib.getBin cctools}/bin/${targetPrefix}$tool" "$out/bin/${targetPrefix}$tool"
+      fi
+      ${linkManPages (lib.getMan cctools) "$tool" "$tool"}
     done
-  ''
-  + lib.optionalString (!isCCToolsLLVM) (
-    # cctools-port has a `libexec` folder for `as`, but cctools-llvm uses the clang
-    # assembler on both platforms. Only link it when cctools is cctools-port.
-    ''
-      ln -s ${cctools}/libexec $out/libexec
-    ''
-    # cctools-llvm uses the LLVM assembler on both architectures, so use the assembler
-    # from that instead of relinking it.
-    #
-    # On aarch64-darwin we must use clang, because "as" from cctools just doesn't
-    # handle the arch. Proxying calls to clang produces quite a bit of warnings,
-    # and using clang directly here is a better option than relying on cctools.
-    # On x86_64-darwin the Clang version is too old to support this mode.
-    + lib.optionalString stdenv.isAarch64 ''
-      rm $out/bin/${targetPrefix}as
-      makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
-        --add-flags "-x assembler -integrated-as -c"
-    ''
-    # x86-64 Darwin gnat-bootstrap emits assembly
-    # with MOVQ as the mnemonic for quadword interunit moves
-    # such as `movq %rbp, %xmm0`.
-    # The clang integrated assembler recognises this as valid,
-    # but unfortunately the cctools-port GNU assembler does not;
-    # it instead uses MOVD as the mnemonic.
-    # The assembly that a GCC build emits is determined at build time
-    # and cannot be changed afterwards.
-    #
-    # To build GNAT on x86-64 Darwin, therefore,
-    # we need both the clang _and_ the cctools-port assemblers to be available:
-    # the former to build at least the stage1 compiler,
-    # and the latter at least to be detectable
-    # as the target for the final compiler.
-    #
-    # We choose to match the Aarch64 case above,
-    # wrapping the clang integrated assembler as `as`.
-    # It then seems sensible to wrap the cctools GNU assembler as `gas`.
-    #
-    + lib.optionalString (stdenv.isx86_64 && dualAs) ''
-      mv $out/bin/${targetPrefix}as $out/bin/${targetPrefix}gas
-      makeWrapper "${clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
-        --add-flags "-x assembler -integrated-as -c"
-    ''
-  );
-
-  nativeBuildInputs = lib.optionals (!isCCToolsLLVM && (stdenv.isAarch64 || dualAs)) [ makeWrapper ];
+    ${
+      # These unprefixed because some tools expect to invoke them without it when cross-compiling to Darwin:
+      # - clang needs `dsymutil` when building with debug information;
+      # - meson needs `lipo` when cross-compiling to Darwin; and
+      # - meson also needs `install_name_tool` and `otool` when performing rpath cleanup on installation.
+      lib.optionalString (targetPrefix != "") ''
+        for bintool in dsymutil install_name_tool lipo otool; do
+          ln -s "$out/bin/${targetPrefix}$bintool" "$out/bin/$bintool"
+        done
+      ''
+    }
+    # Use the clang-integrated assembler. `as` in cctools is deprecated upstream and no longer built in nixpkgs.
+    makeWrapper "${lib.getBin clang-unwrapped}/bin/clang" "$out/bin/${targetPrefix}as" \
+      --add-flags "-x assembler -integrated-as -c"
+
+    ln -s '${lib.getBin cctools}/bin/${targetPrefix}ld' "$out/bin/${targetPrefix}ld"
+    ${linkManPages (lib.getMan cctools) "ld" "ld"}
+    # ${linkManPages (lib.getMan cctools) "ld-classic" "ld-classic"}
+    ${linkManPages (lib.getMan cctools) "ld64" "ld64"}
+  '';
+
+  __structuredAttrs = true;
 
   passthru = {
-    inherit targetPrefix;
-    isCCTools = true;
+    inherit cctools_cmds llvm_cmds targetPrefix;
+    isCCTools = true; # The fact ld64 is used instead of lld is why this isn’t `isLLVM`.
   };
 
   meta = {
-    maintainers = with lib.maintainers; [ matthewbauer ];
+    maintainers = with lib.maintainers; [ reckenrode ];
     priority = 10;
   };
 }
diff --git a/pkgs/os-specific/darwin/cctools/port.nix b/pkgs/os-specific/darwin/cctools/port.nix
index 377d84d9bf731..cc162d870a2e2 100644
--- a/pkgs/os-specific/darwin/cctools/port.nix
+++ b/pkgs/os-specific/darwin/cctools/port.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation {
     sha256 = "0ns12q7vg9yand4dmdsps1917cavfbw67yl5q7bm6kb4ia5kkx13";
   };
 
-  outputs = [ "out" "dev" "man" ];
+  outputs = [ "out" "dev" "gas" "man" ];
 
   nativeBuildInputs = [ autoconf automake libtool autoreconfHook installShellFiles ]
     ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ memstreamHook ];
@@ -178,6 +178,12 @@ stdenv.mkDerivation {
     popd
   '';
 
+  postInstall = ''
+    # Move GNU as to its own output to prevent it from being used accidentally.
+    moveToOutput bin/gas "$gas"
+    moveToOutput libexec "$gas"
+  '';
+
   passthru = {
     inherit targetPrefix;
   };
diff --git a/pkgs/os-specific/darwin/defaultbrowser/default.nix b/pkgs/os-specific/darwin/defaultbrowser/default.nix
index be3dcd4177319..2246efa0aa43d 100644
--- a/pkgs/os-specific/darwin/defaultbrowser/default.nix
+++ b/pkgs/os-specific/darwin/defaultbrowser/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     description = "Command line tool for getting and setting a default browser (HTTP handler) in Mac OS X";
     homepage = "https://github.com/kerma/defaultbrowser";
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/os-specific/darwin/karabiner-elements/default.nix b/pkgs/os-specific/darwin/karabiner-elements/default.nix
index 53847c75fccca..21500ad16d902 100644
--- a/pkgs/os-specific/darwin/karabiner-elements/default.nix
+++ b/pkgs/os-specific/darwin/karabiner-elements/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     description = "Karabiner-Elements is a powerful utility for keyboard customization on macOS Sierra (10.12) or later";
     homepage = "https://karabiner-elements.pqrs.org/";
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     license = licenses.unlicense;
   };
 }
diff --git a/pkgs/os-specific/darwin/pam-reattach/default.nix b/pkgs/os-specific/darwin/pam-reattach/default.nix
index 4350865080f00..b077ac031b62c 100644
--- a/pkgs/os-specific/darwin/pam-reattach/default.nix
+++ b/pkgs/os-specific/darwin/pam-reattach/default.nix
@@ -1,5 +1,8 @@
 { lib, stdenv, fetchFromGitHub, cmake, openpam, darwin }:
 
+let
+  sdkOlderThan11 = lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11.0";
+in
 stdenv.mkDerivation rec {
   pname = "pam_reattach";
   version = "1.3";
@@ -12,17 +15,12 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = [
-    "-DCMAKE_OSX_ARCHITECTURES=${
-      if stdenv.hostPlatform.system == "x86_64-darwin" then
-        "x86_64"
-      else
-        "arm64"
-    }"
+    "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
     "-DENABLE_CLI=ON"
-  ] ++ lib.optional (!stdenv.isAarch64) "-DCMAKE_LIBRARY_PATH=${darwin.apple_sdk.sdk}/usr/lib";
+  ] ++ lib.optional sdkOlderThan11 "-DCMAKE_LIBRARY_PATH=${darwin.apple_sdk.sdk}/usr/lib";
 
   buildInputs = [ openpam ]
-    ++ lib.optional (!stdenv.isAarch64) darwin.apple_sdk.sdk;
+    ++ lib.optional sdkOlderThan11 darwin.apple_sdk.sdk;
 
   nativeBuildInputs = [ cmake ];
 
diff --git a/pkgs/os-specific/darwin/raycast/default.nix b/pkgs/os-specific/darwin/raycast/default.nix
index 6e629432fda5c..17f7b47084005 100644
--- a/pkgs/os-specific/darwin/raycast/default.nix
+++ b/pkgs/os-specific/darwin/raycast/default.nix
@@ -11,12 +11,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.77.3";
+  version = "1.78.1";
 
   src = fetchurl {
     name = "Raycast.dmg";
     url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-KSIrK16JEAib0joprIm0SYwA2bKCEBLVn7WYfHV9YCg=";
+    hash = "sha256-le1IB55vAXv1e+ll/K24jZ2Z0lqtEt3xKhwPxY+Ibis=";
   };
 
   dontPatch = true;
diff --git a/pkgs/os-specific/darwin/rectangle/default.nix b/pkgs/os-specific/darwin/rectangle/default.nix
index 1e7be272d6ab9..fbf13963e49e2 100644
--- a/pkgs/os-specific/darwin/rectangle/default.nix
+++ b/pkgs/os-specific/darwin/rectangle/default.nix
@@ -37,7 +37,7 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://rectangleapp.com/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ Enzime Intuinewin wegank ];
+    maintainers = with maintainers; [ Intuinewin wegank ];
     license = licenses.mit;
   };
 }
diff --git a/pkgs/os-specific/darwin/shortcat/default.nix b/pkgs/os-specific/darwin/shortcat/default.nix
index dcf32a4fd9e32..81086bec3a778 100644
--- a/pkgs/os-specific/darwin/shortcat/default.nix
+++ b/pkgs/os-specific/darwin/shortcat/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     homepage = "https://shortcat.app/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     platforms = platforms.darwin;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     license = licenses.unfreeRedistributable;
   };
 }
diff --git a/pkgs/os-specific/darwin/swiftbar/default.nix b/pkgs/os-specific/darwin/swiftbar/default.nix
index 4a12dc2dfea73..bb7d7ad8ee61a 100644
--- a/pkgs/os-specific/darwin/swiftbar/default.nix
+++ b/pkgs/os-specific/darwin/swiftbar/default.nix
@@ -4,14 +4,16 @@
   stdenvNoCC,
   makeWrapper,
 }:
-
+let
+  build = "520";
+in
 stdenvNoCC.mkDerivation rec {
   pname = "swiftbar";
-  version = "1.4.3";
+  version = "2.0.0";
 
   src = fetchzip {
-    url = "https://github.com/swiftbar/SwiftBar/releases/download/v${version}/SwiftBar.zip";
-    sha256 = "sha256-Ut+lr1E7bMp8Uz1aL7EV0ZsfdTh9t7zUjDU/DScRpHY=";
+    url = "https://github.com/swiftbar/SwiftBar/releases/download/v${version}/SwiftBar.v${version}.b${build}.zip";
+    hash = "sha256-eippK01Q+J9jdwvnGcnr7nw3KwyQQqh051lHN3Xmy+c=";
     stripRoot = false;
   };
 
diff --git a/pkgs/os-specific/darwin/xattr/default.nix b/pkgs/os-specific/darwin/xattr/default.nix
index 7fe0f84606ce1..eee87cdbeec7b 100644
--- a/pkgs/os-specific/darwin/xattr/default.nix
+++ b/pkgs/os-specific/darwin/xattr/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , fetchFromGitHub
 , buildPythonPackage
 , python
diff --git a/pkgs/os-specific/linux/anbox/default.nix b/pkgs/os-specific/linux/anbox/default.nix
index 8f963f34136ac..35d8a071fe111 100644
--- a/pkgs/os-specific/linux/anbox/default.nix
+++ b/pkgs/os-specific/linux/anbox/default.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
     owner = pname;
     repo = pname;
     rev = "ddf4c57ebbe3a2e46099087570898ab5c1e1f279";
-    sha256 = "sha256-QXWhatewiUDQ93cH1UZsYgbjUxpgB1ajtGFYZnKmabc=";
+    hash = "sha256-QXWhatewiUDQ93cH1UZsYgbjUxpgB1ajtGFYZnKmabc=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index 4c06ea352ee03..f70ba4c7aad18 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -1,4 +1,5 @@
 { stdenv, lib, fetchFromGitLab, fetchpatch, makeWrapper, autoreconfHook
+, autoconf-archive
 , pkg-config, which
 , flex, bison
 , linuxHeaders ? stdenv.cc.libc.linuxHeaders
@@ -22,7 +23,7 @@
 }:
 
 let
-  apparmor-version = "3.1.7";
+  apparmor-version = "4.0.1";
 
   apparmor-meta = component: with lib; {
     homepage = "https://apparmor.net/";
@@ -36,7 +37,7 @@ let
     owner = "apparmor";
     repo = "apparmor";
     rev = "v${apparmor-version}";
-    hash = "sha256-AzY05bcpNYXix2GL4Rhc9d3RBA1pd2fwOa7yoiwc2nQ=";
+    hash = "sha256-0S/P62wi3/aPATvJL6afu+SebjoSHsTMu/WV9m7E1OE=";
   };
 
   aa-teardown = writeShellScript "aa-teardown" ''
@@ -86,6 +87,7 @@ let
     strictDeps = false;
 
     nativeBuildInputs = [
+      autoconf-archive
       autoreconfHook
       bison
       flex
diff --git a/pkgs/os-specific/linux/atop/atop.service.patch b/pkgs/os-specific/linux/atop/atop.service.patch
index 3ef59e60cbc07..0516e5159b9d3 100644
--- a/pkgs/os-specific/linux/atop/atop.service.patch
+++ b/pkgs/os-specific/linux/atop/atop.service.patch
@@ -1,10 +1,16 @@
+diff --git a/atop.service b/atop.service
+index 6b11dea..f90935f 100644
 --- a/atop.service
 +++ b/atop.service
-@@ -9,5 +9,6 @@
- Environment=LOGPATH=/var/log/atop
+@@ -8,10 +8,10 @@ Environment="LOGOPTS="
+ Environment="LOGINTERVAL=600"
+ Environment="LOGGENERATIONS=28"
+ Environment="LOGPATH=/var/log/atop"
 -EnvironmentFile=/etc/default/atop
 +EnvironmentFile=-/etc/default/atop
+ ExecStartPre=/bin/sh -c 'test -d "${LOGPATH}" || mkdir -p "${LOGPATH}"'
  ExecStartPre=/bin/sh -c 'test -n "$LOGINTERVAL" -a "$LOGINTERVAL" -eq "$LOGINTERVAL"'
  ExecStartPre=/bin/sh -c 'test -n "$LOGGENERATIONS" -a "$LOGGENERATIONS" -eq "$LOGGENERATIONS"'
-+ExecStartPre=/bin/sh -c 'mkdir -p "${LOGPATH}"'
  ExecStart=/bin/sh -c 'exec @out@/bin/atop ${LOGOPTS} -w "${LOGPATH}/atop_$(date +%%Y%%m%%d)" ${LOGINTERVAL}'
+ ExecStartPost=@findutils@/bin/find "${LOGPATH}" -name "atop_*" -mtime +${LOGGENERATIONS} -exec rm -v {} \;
+ KillSignal=SIGUSR2
diff --git a/pkgs/os-specific/linux/atop/atopacct.service.patch b/pkgs/os-specific/linux/atop/atopacct.service.patch
deleted file mode 100644
index 9f2cd8f2e9cad..0000000000000
--- a/pkgs/os-specific/linux/atop/atopacct.service.patch
+++ /dev/null
@@ -1,7 +0,0 @@
---- a/atopacct.service
-+++ b/atopacct.service
-@@ -9,3 +9,3 @@
- Type=forking
--PIDFile=/var/run/atopacctd.pid
-+PIDFile=/run/atopacctd.pid
- ExecStart=@out@/bin/atopacctd
diff --git a/pkgs/os-specific/linux/atop/default.nix b/pkgs/os-specific/linux/atop/default.nix
index 808d1bc423763..df6bc7c3d7fb8 100644
--- a/pkgs/os-specific/linux/atop/default.nix
+++ b/pkgs/os-specific/linux/atop/default.nix
@@ -1,8 +1,10 @@
 { lib
 , stdenv
 , fetchurl
+, glib
 , zlib
 , ncurses
+, pkg-config
 , findutils
 , systemd
 , python3
@@ -12,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "atop";
-  version = "2.8.1";
+  version = "2.10.0";
 
   src = fetchurl {
     url = "https://www.atoptool.nl/download/atop-${version}.tar.gz";
-    sha256 = "sha256-lwBYoZt5w0RPlx+FRXKg5jiR3C1fcDf/g3VwhUzg2h4=";
+    hash = "sha256-56ZzzyyCV4592C7LDeyD/Z7LMIKLJWHCip+lqvddX5M=";
   };
 
   nativeBuildInputs = lib.optionals withAtopgpu [
@@ -24,8 +26,10 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    glib
     zlib
     ncurses
+    pkg-config
   ] ++ lib.optionals withAtopgpu [
     python3
   ];
@@ -51,8 +55,6 @@ stdenv.mkDerivation rec {
     ./fix-paths.patch
     # Don't fail on missing /etc/default/atop, make sure /var/log/atop exists pre-start
     ./atop.service.patch
-    # Specify PIDFile in /run, not /var/run to silence systemd warning
-    ./atopacct.service.patch
   ];
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/atop/fix-paths.patch b/pkgs/os-specific/linux/atop/fix-paths.patch
index e6cd631d3c116..0d4b8c9641c39 100644
--- a/pkgs/os-specific/linux/atop/fix-paths.patch
+++ b/pkgs/os-specific/linux/atop/fix-paths.patch
@@ -1,48 +1,68 @@
+diff --git a/atop-pm.sh b/atop-pm.sh
+index 3ff4ab5..c433b1a 100755
+--- a/atop-pm.sh
++++ b/atop-pm.sh
+@@ -1,10 +1,10 @@
+ #!/bin/sh
+ 
+ case "$1" in
+-	pre)	/usr/bin/systemctl stop atop
++	pre)	@systemd@/bin/systemctl stop atop
+ 		exit 0
+ 		;;
+-	post)	/usr/bin/systemctl start atop
++	post)	@systemd@/bin/systemctl start atop
+ 		exit 0
+ 		;;
+  	*)	exit 1
+diff --git a/atop-rotate.service b/atop-rotate.service
+index dbe8e0f..4eaa84d 100644
+--- a/atop-rotate.service
++++ b/atop-rotate.service
+@@ -4,4 +4,4 @@ Documentation=man:atop(1)
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/bin/systemctl restart atop.service
++ExecStart=@systemd@/bin/systemctl restart atop.service
+diff --git a/atop.service b/atop.service
+index 3e5bafd..6b11dea 100644
 --- a/atop.service
 +++ b/atop.service
-@@ -12,4 +12,4 @@
+@@ -12,8 +12,8 @@ EnvironmentFile=/etc/default/atop
+ ExecStartPre=/bin/sh -c 'test -d "${LOGPATH}" || mkdir -p "${LOGPATH}"'
+ ExecStartPre=/bin/sh -c 'test -n "$LOGINTERVAL" -a "$LOGINTERVAL" -eq "$LOGINTERVAL"'
  ExecStartPre=/bin/sh -c 'test -n "$LOGGENERATIONS" -a "$LOGGENERATIONS" -eq "$LOGGENERATIONS"'
 -ExecStart=/bin/sh -c 'exec /usr/bin/atop ${LOGOPTS} -w "${LOGPATH}/atop_$(date +%%Y%%m%%d)" ${LOGINTERVAL}'
 -ExecStartPost=/usr/bin/find "${LOGPATH}" -name "atop_*" -mtime +${LOGGENERATIONS} -exec rm -v {} \;
 +ExecStart=/bin/sh -c 'exec @out@/bin/atop ${LOGOPTS} -w "${LOGPATH}/atop_$(date +%%Y%%m%%d)" ${LOGINTERVAL}'
 +ExecStartPost=@findutils@/bin/find "${LOGPATH}" -name "atop_*" -mtime +${LOGGENERATIONS} -exec rm -v {} \;
  KillSignal=SIGUSR2
-
---- a/atop-rotate.service
-+++ b/atop-rotate.service
-@@ -4,3 +4,3 @@
- [Service]
- Type=oneshot
--ExecStart=/usr/bin/systemctl try-restart atop.service
-+ExecStart=@systemd@/bin/systemctl try-restart atop.service
-
+ 
+ [Install]
+diff --git a/atopacct.service b/atopacct.service
+index 3aa529d..b95db43 100644
+--- a/atopacct.service
++++ b/atopacct.service
+@@ -7,7 +7,7 @@ Before=atop.service
+ Type=forking
+ PIDFile=/run/atopacctd.pid
+ ExecStartPre=/bin/sh -c 'if systemctl -q is-active acct psacct; then echo "Process accounting already in use by (ps)acct"; exit 1; fi'
+-ExecStart=/usr/sbin/atopacctd
++ExecStart=@out@/bin/atopacctd
+ 
+ [Install]
+ WantedBy=multi-user.target
+diff --git a/atopgpu.service b/atopgpu.service
+index 4839235..8aae1c5 100644
 --- a/atopgpu.service
 +++ b/atopgpu.service
-@@ -6,5 +6,5 @@
-
+@@ -4,7 +4,7 @@ Documentation=man:atopgpud(8)
+ Before=atop.service
+ 
  [Service]
 -ExecStart=/usr/sbin/atopgpud
 +ExecStart=@out@/bin/atopgpud
  Type=oneshot
  RemainAfterExit=yes
-
---- a/atopacct.service
-+++ b/atopacct.service
-@@ -10,3 +10,3 @@
- PIDFile=/var/run/atopacctd.pid
--ExecStart=/usr/sbin/atopacctd
-+ExecStart=@out@/bin/atopacctd
-
---- a/atop-pm.sh
-+++ b/atop-pm.sh
-@@ -2,8 +2,8 @@
-
- case "$1" in
--	pre)	/usr/bin/systemctl stop atop
-+	pre)	@systemd@/bin/systemctl stop atop
- 		exit 0
- 		;;
--	post)	/usr/bin/systemctl start atop
-+	post)	@systemd@/bin/systemctl start atop
- 		exit 0
- 		;;
+ 
diff --git a/pkgs/os-specific/linux/audit/default.nix b/pkgs/os-specific/linux/audit/default.nix
index d5e38ea62fb8b..00afda1c605dd 100644
--- a/pkgs/os-specific/linux/audit/default.nix
+++ b/pkgs/os-specific/linux/audit/default.nix
@@ -1,12 +1,14 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , autoreconfHook
 , bash
 , buildPackages
 , linuxHeaders
 , python3
 , swig
+, pkgsCross
 
 # Enabling python support while cross compiling would be possible, but the
 # configure script tries executing python to gather info instead of relying on
@@ -16,13 +18,26 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "3.1.2";
+  version = "4.0";
 
   src = fetchurl {
     url = "https://people.redhat.com/sgrubb/audit/audit-${finalAttrs.version}.tar.gz";
-    hash = "sha256-wLF5LR8KiMbxgocQUJy7mHBZ/GhxLJdmnKkOrhA9KH0=";
+    hash = "sha256-v0ItQSard6kqTDrDneVHPyeNw941ck0lGKSMe+FdVNg=";
   };
 
+  patches = lib.optionals (!stdenv.hostPlatform.isGnu) [
+    (fetchpatch {
+      name = "musl.patch";
+      url = "https://github.com/linux-audit/audit-userspace/commit/64cb48e1e5137b8a389c7528e611617a98389bc7.patch";
+      hash = "sha256-DN2F5w+2Llm80FZntH9dvdyT00pVBSgRu8DDFILyrlU=";
+    })
+    (fetchpatch {
+      name = "musl.patch";
+      url = "https://github.com/linux-audit/audit-userspace/commit/4192eb960388458c85d76e5e385cfeef48f02c79.patch";
+      hash = "sha256-G6CJ9nBJSsTyJ0qq14PVo+YdInAvLLQtXcR25Q8V5/4=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace bindings/swig/src/auditswig.i \
       --replace "/usr/include/linux/audit.h" \
@@ -60,6 +75,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  passthru.tests = {
+    musl = pkgsCross.musl64.audit;
+  };
+
   meta = {
     homepage = "https://people.redhat.com/sgrubb/audit/";
     description = "Audit Library";
diff --git a/pkgs/os-specific/linux/below/default.nix b/pkgs/os-specific/linux/below/default.nix
index 286a92f0eb88d..dc7754a7793eb 100644
--- a/pkgs/os-specific/linux/below/default.nix
+++ b/pkgs/os-specific/linux/below/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , fetchFromGitHub
 , rustPlatform
 , clang
@@ -29,7 +28,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   # bpf code compilation
-  hardeningDisable = [ "stackprotector" ];
+  hardeningDisable = [ "stackprotector" "zerocallusedregs" ];
 
   nativeBuildInputs = [ clang pkg-config rustfmt ];
   buildInputs = [ elfutils zlib ];
diff --git a/pkgs/os-specific/linux/bpftune/default.nix b/pkgs/os-specific/linux/bpftune/default.nix
index cc97ed16faea1..830e214f6ba84 100644
--- a/pkgs/os-specific/linux/bpftune/default.nix
+++ b/pkgs/os-specific/linux/bpftune/default.nix
@@ -58,6 +58,7 @@ stdenv.mkDerivation rec {
 
   hardeningDisable = [
     "stackprotector"
+    "zerocallusedregs"
   ];
 
   passthru.tests = {
diff --git a/pkgs/os-specific/linux/brillo/default.nix b/pkgs/os-specific/linux/brillo/default.nix
index 237b6db65b026..658b15b70e930 100644
--- a/pkgs/os-specific/linux/brillo/default.nix
+++ b/pkgs/os-specific/linux/brillo/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     owner= "cameronnemo";
     repo= "brillo";
     rev= "v${version}";
-    sha256 = "sha256-dKGNioWGVAFuB4kySO+QGTnstyAD0bt4/6FBVwuRxJo=";
+    hash = "sha256-dKGNioWGVAFuB4kySO+QGTnstyAD0bt4/6FBVwuRxJo=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/catfs/Cargo.lock b/pkgs/os-specific/linux/catfs/Cargo.lock
index d79e0a9e168d7..5cb1147f91e8b 100644
--- a/pkgs/os-specific/linux/catfs/Cargo.lock
+++ b/pkgs/os-specific/linux/catfs/Cargo.lock
@@ -4,18 +4,18 @@ version = 3
 
 [[package]]
 name = "addr2line"
-version = "0.13.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b6a2d3371669ab3ca9797670853d61402b03d0b4b9ebf33d677dfa720203072"
+checksum = "8a30b2e23b9e17a9f90641c7ab1549cd9b44f296d3ccbf309d2863cfe398a0cb"
 dependencies = [
  "gimli",
 ]
 
 [[package]]
 name = "adler"
-version = "0.2.3"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee2a4ec343196209d6594e19543ae87a39f96d5534d7174822a3ad825dd6ed7e"
+checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
 
 [[package]]
 name = "aho-corasick"
@@ -28,9 +28,9 @@ dependencies = [
 
 [[package]]
 name = "ansi_term"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee49baf6cb617b853aa8d93bf420db2383fab46d314482ca2803b40d5fde979b"
+checksum = "d52a9bb7ec0cf484c551830a7ce27bd20d67eac647e1befb56b0be4ee39a55d2"
 dependencies = [
  "winapi",
 ]
@@ -41,25 +41,20 @@ version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
 dependencies = [
- "hermit-abi",
+ "hermit-abi 0.1.19",
  "libc",
  "winapi",
 ]
 
 [[package]]
-name = "autocfg"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cdb031dd78e28731d87d56cc8ffef4a8f36ca26c38fe2de700543e627f8a464a"
-
-[[package]]
 name = "backtrace"
-version = "0.3.51"
+version = "0.3.69"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec1931848a574faa8f7c71a12ea00453ff5effbb5f51afe7f77d7a48cace6ac1"
+checksum = "2089b7e3f35b9dd2d0ed921ead4f6d318c27680d4a5bd167b3ee120edb105837"
 dependencies = [
  "addr2line",
- "cfg-if",
+ "cc",
+ "cfg-if 1.0.0",
  "libc",
  "miniz_oxide",
  "object",
@@ -83,27 +78,20 @@ checksum = "02b4ff8b16e6076c3e14220b39fbc1fabb6737522281a388998046859400895f"
 
 [[package]]
 name = "bitflags"
-version = "1.2.1"
+version = "1.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "block-buffer"
-version = "0.2.0"
+version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1339a1042f5d9f295737ad4d9a6ab6bf81c84a933dba110b9200cd6d1448b814"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
- "byte-tools",
  "generic-array",
 ]
 
 [[package]]
-name = "byte-tools"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "560c32574a12a89ecd91f5e742165893f86e3ab98d21f8ea548658eb9eef5f40"
-
-[[package]]
 name = "catfs"
 version = "0.9.0"
 dependencies = [
@@ -128,12 +116,27 @@ dependencies = [
 ]
 
 [[package]]
+name = "cc"
+version = "1.0.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
 name = "cfg-if"
 version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
 
 [[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
 name = "chan"
 version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -156,9 +159,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "2.33.3"
+version = "2.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37e58ac78573c40708d45522f0d80fa2f01cc4f9b4e2bf749807255454312002"
+checksum = "a0610544180c38b88101fecf2dd634b174a62eef6946f84dfc6a7127512b381c"
 dependencies = [
  "ansi_term",
  "atty",
@@ -170,6 +173,25 @@ dependencies = [
 ]
 
 [[package]]
+name = "cpufeatures"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a17b76ff3a4162b0b27f354a0c87015ddad39d35f9c0c36607a3bdd175dde1f1"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
 name = "daemonize"
 version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -180,18 +202,19 @@ dependencies = [
 
 [[package]]
 name = "digest"
-version = "0.6.2"
+version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5b29bf156f3f4b3c4f610a25ff69370616ae6e0657d416de22645483e72af0a"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "generic-array",
+ "block-buffer",
+ "crypto-common",
 ]
 
 [[package]]
 name = "either"
-version = "1.6.1"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
 
 [[package]]
 name = "env_logger"
@@ -204,12 +227,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "fake-simd"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e88a8acf291dafb59c2d96e8f59828f3838bb1a70398823ade51a84de6a6deed"
-
-[[package]]
 name = "fd"
 version = "0.2.3"
 source = "git+https://github.com/stemjail/fd-rs.git?rev=3bc3e3587f8904cce8bf29163a2021c2f5906557#3bc3e3587f8904cce8bf29163a2021c2f5906557"
@@ -238,41 +255,47 @@ dependencies = [
 
 [[package]]
 name = "generic-array"
-version = "0.8.3"
+version = "0.14.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fceb69994e330afed50c93524be68c42fa898c2d9fd4ee8da03bd7363acd26f2"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
 dependencies = [
- "nodrop",
  "typenum",
+ "version_check",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.1.15"
+version = "0.2.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
 dependencies = [
- "cfg-if",
+ "cfg-if 1.0.0",
  "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
+ "wasi 0.11.0+wasi-snapshot-preview1",
 ]
 
 [[package]]
 name = "gimli"
-version = "0.22.0"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaf91faf136cb47367fa430cd46e37a788775e7fa104f8b4bcb3861dc389b724"
+checksum = "6fb8d784f27acf97159b40fc4db5ecd8aa23b9ad5ef69cdd136d3bc80665f0c0"
 
 [[package]]
 name = "hermit-abi"
-version = "0.1.16"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c30f6d0bc6b00693347368a67d41b58f2fb851215ff1da49e90fe2c5c667151"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
 dependencies = [
  "libc",
 ]
 
 [[package]]
+name = "hermit-abi"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
+
+[[package]]
 name = "itertools"
 version = "0.6.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -295,9 +318,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.78"
+version = "0.2.149"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa7087f49d294270db4e1928fc110c976cd4b9e5a16348e0a1df09afa99e6c98"
+checksum = "a08173bc88b7955d1b3145aa561539096c421ac8debde8cbc3612ec635fee29b"
 
 [[package]]
 name = "log"
@@ -305,67 +328,60 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e19e8d5c34a3e0e2223db8e060f9e8264aeeb5c5fc64a4ee9965c062211c024b"
 dependencies = [
- "log 0.4.11",
+ "log 0.4.20",
 ]
 
 [[package]]
 name = "log"
-version = "0.4.11"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
-dependencies = [
- "cfg-if",
-]
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
 
 [[package]]
 name = "memchr"
-version = "2.3.3"
+version = "2.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3728d817d99e5ac407411fa471ff9800a778d88a24685968b36824eaf4bee400"
+checksum = "f665ee40bc4a3c5590afb1e9677db74a508659dfd71e126420da8274909a0167"
 
 [[package]]
 name = "miniz_oxide"
-version = "0.4.2"
+version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c60c0dfe32c10b43a144bad8fc83538c52f58302c92300ea7ec7bf7b38d5a7b9"
+checksum = "e7810e0be55b428ada41041c41f32c9f1a42817901b4ccf45fa3d4b6561e74c7"
 dependencies = [
  "adler",
- "autocfg",
 ]
 
 [[package]]
-name = "nodrop"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
-
-[[package]]
 name = "num_cpus"
-version = "1.13.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05499f3756671c15885fee9034446956fff3f243d6077b91e5767df161f766b3"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
 dependencies = [
- "hermit-abi",
+ "hermit-abi 0.3.3",
  "libc",
 ]
 
 [[package]]
 name = "object"
-version = "0.20.0"
+version = "0.32.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ab52be62400ca80aa00285d25253d7f7c437b7375c4de678f5405d3afe82ca5"
+checksum = "9cf5f9dd3933bd50a9e1f149ec995f39ae2c496d31fd772c1fd45ebc27e902b0"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
 name = "pkg-config"
-version = "0.3.18"
+version = "0.3.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d36492546b6af1463394d46f0c834346f31548646f6ba10849802c9c9a27ac33"
+checksum = "26072860ba924cbfa98ea39c8c19b4dd6a4a25423dbdf219c1eca91aa0cf6964"
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.9"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c36fa947111f5c62a733b652544dd0016a43ce89619538a8ef92724a6f501a20"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
 
 [[package]]
 name = "rand"
@@ -392,25 +408,23 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.7.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
- "getrandom",
  "libc",
  "rand_chacha",
- "rand_core 0.5.1",
- "rand_hc",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
 name = "rand_chacha"
-version = "0.2.2"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.5.1",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -430,23 +444,14 @@ checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
 
 [[package]]
 name = "rand_core"
-version = "0.5.1"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
  "getrandom",
 ]
 
 [[package]]
-name = "rand_hc"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
-dependencies = [
- "rand_core 0.5.1",
-]
-
-[[package]]
 name = "rdrand"
 version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -479,24 +484,28 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.16"
+version = "0.1.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c691c0e608126e00913e33f0ccf3727d5fc84573623b8d65b2df340b5201783"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
 
 [[package]]
 name = "sha2"
-version = "0.6.0"
+version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d963c78ce367df26d7ea8b8cc655c651b42e8a1e584e869c1e17dae3ccb116a"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
 dependencies = [
- "block-buffer",
- "byte-tools",
+ "cfg-if 1.0.0",
+ "cpufeatures",
  "digest",
- "fake-simd",
- "generic-array",
 ]
 
 [[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
 name = "strsim"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -549,9 +558,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.1.44"
+version = "0.1.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+checksum = "1b797afad3f312d1c66a56d11d0316f916356d11bd158fbc6ca6389ff6bf805a"
 dependencies = [
  "libc",
  "wasi 0.10.0+wasi-snapshot-preview1",
@@ -560,30 +569,32 @@ dependencies = [
 
 [[package]]
 name = "twox-hash"
-version = "1.5.0"
+version = "1.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3bfd5b7557925ce778ff9b9ef90e3ade34c524b5ff10e239c69a42d546d2af56"
+checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
 dependencies = [
- "rand 0.7.3",
+ "cfg-if 1.0.0",
+ "rand 0.8.5",
+ "static_assertions",
 ]
 
 [[package]]
 name = "typenum"
-version = "1.12.0"
+version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "373c8a200f9e67a0c95e62a4f52fbf80c23b4381c05a17845531982fa99e6b33"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 
 [[package]]
 name = "ucd-util"
-version = "0.1.8"
+version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c85f514e095d348c279b1e5cd76795082cf15bd59b93207832abe0b1d8fed236"
+checksum = "abd2fc5d32b590614af8b0a20d837f32eca055edd0bbead59a9cfe80858be003"
 
 [[package]]
 name = "unicode-width"
-version = "0.1.8"
+version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9337591893a19b88d8d87f2cec1e73fad5cdfd10e5a6f349f498ad6ea2ffb1e3"
+checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
 
 [[package]]
 name = "unix_socket"
@@ -591,15 +602,15 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6aa2700417c405c38f5e6902d699345241c28c0b7ade4abaad71e35a87eb1564"
 dependencies = [
- "cfg-if",
+ "cfg-if 0.1.10",
  "libc",
 ]
 
 [[package]]
 name = "utf8-ranges"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ae116fef2b7fea257ed6440d3cfcff7f190865f170cdad00bb6465bf18ecba"
+checksum = "7fcfc827f90e53a02eaef5e535ee14266c1d569214c6aa70133a624d8a3164ba"
 
 [[package]]
 name = "vec_map"
@@ -608,10 +619,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
 
 [[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
+name = "version_check"
+version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
 
 [[package]]
 name = "wasi"
@@ -620,6 +631,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
 
 [[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
 name = "winapi"
 version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -643,9 +660,9 @@ checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
 
 [[package]]
 name = "xattr"
-version = "0.2.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "244c3741f4240ef46274860397c7c74e50eb23624996930e484c16679633a54c"
+checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc"
 dependencies = [
  "libc",
 ]
diff --git a/pkgs/os-specific/linux/catfs/default.nix b/pkgs/os-specific/linux/catfs/default.nix
index 52d87f4deb1c0..0530035ec3376 100644
--- a/pkgs/os-specific/linux/catfs/default.nix
+++ b/pkgs/os-specific/linux/catfs/default.nix
@@ -5,20 +5,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "catfs";
-  version = "0.9.0";
+  version = "0.9.0-unstable-2023-10-09";
 
   src = fetchFromGitHub {
     owner = "kahing";
     repo = pname;
-    rev = "v${version}";
-    hash = "sha256-OvmtU2jpewP5EqPwEFAf67t8UCI1WuzUO2QQj4cH1Ak=";
+    rev = "35430f800e68da18fb6bbd25a8f15bf32fa1f166";
+    hash = "sha256-hbv4SNe0yqjO6Oomev9uKqG29TiJeI8G7LH+Wxn7hnQ=";
   };
 
-  patches = [
-    # monitor https://github.com/kahing/catfs/issues/71
-    ./fix-for-rust-1.65.diff
-  ];
-
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
diff --git a/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff b/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff
deleted file mode 100644
index 4208c362ebcd5..0000000000000
--- a/pkgs/os-specific/linux/catfs/fix-for-rust-1.65.diff
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/catfs/file.rs b/src/catfs/file.rs
-index 6e781eb..92fdd80 100644
---- a/src/catfs/file.rs
-+++ b/src/catfs/file.rs
-@@ -569,7 +569,7 @@ impl Handle {
-         path: &dyn AsRef<Path>,
-         create: bool,
-     ) -> error::Result<()> {
--        let _ = self.page_in_res.0.lock().unwrap();
-+        drop(self.page_in_res.0.lock().unwrap());
- 
-         let mut buf = [0u8; 0];
-         let mut flags = rlibc::O_RDWR;
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
index 754f8e1396152..be11dff2bd356 100644
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , fetchFromGitHub
 , fetchpatch
 , buildPythonApplication
diff --git a/pkgs/os-specific/linux/cryptsetup/default.nix b/pkgs/os-specific/linux/cryptsetup/default.nix
index fb5a6ce28e1d8..39f03c475fdaa 100644
--- a/pkgs/os-specific/linux/cryptsetup/default.nix
+++ b/pkgs/os-specific/linux/cryptsetup/default.nix
@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "cryptsetup";
-  version = "2.7.1";
+  version = "2.7.3";
 
   outputs = [ "bin" "out" "dev" "man" ];
   separateDebugInfo = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/cryptsetup/v${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-2l0UGeKobgGqMv15WCzVTSCIV8tUG8ov1Cal/xqqu8M=";
+    hash = "sha256-t3KuT23wzucgCyjOqWDk2q/yogPS/VAr6rPBMXsHpFY=";
   };
 
   patches = [
diff --git a/pkgs/os-specific/linux/decklink/default.nix b/pkgs/os-specific/linux/decklink/default.nix
new file mode 100644
index 0000000000000..4916b8630ad4d
--- /dev/null
+++ b/pkgs/os-specific/linux/decklink/default.nix
@@ -0,0 +1,49 @@
+{ stdenv
+, lib
+, blackmagic-desktop-video
+, kernel
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "decklink";
+
+  # the download is a horrible curl mess. we reuse it between the kernel module
+  # and desktop service, since the version of the two have to match anyways.
+  # See pkgs/by-name/bl/blackmagic-desktop-video/package.nix for more.
+  inherit (blackmagic-desktop-video) src version;
+
+  KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  INSTALL_MOD_PATH = placeholder "out";
+
+  nativeBuildInputs =  kernel.moduleBuildDependencies;
+
+  postUnpack = let
+    arch = stdenv.hostPlatform.uname.processor;
+  in ''
+    tar xf Blackmagic_Desktop_Video_Linux_${lib.head (lib.splitString "a" finalAttrs.version)}/other/${arch}/desktopvideo-${finalAttrs.version}-${arch}.tar.gz
+    moduleRoot=$NIX_BUILD_TOP/desktopvideo-${finalAttrs.version}-${stdenv.hostPlatform.uname.processor}/usr/src
+    sourceRoot=$moduleRoot
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    make -C $moduleRoot/blackmagic-${finalAttrs.version} -j$NIX_BUILD_CORES
+    make -C $moduleRoot/blackmagic-io-${finalAttrs.version} -j$NIX_BUILD_CORES
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    make -C $KERNELDIR M=$moduleRoot/blackmagic-${finalAttrs.version} modules_install
+    make -C $KERNELDIR M=$moduleRoot/blackmagic-io-${finalAttrs.version} modules_install
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.blackmagicdesign.com/support/family/capture-and-playback";
+    maintainers = [ maintainers.naxdy ];
+    license = licenses.unfree;
+    description = "Kernel module for the Blackmagic Design Decklink cards";
+    sourceProvenance = with lib.sourceTypes; [ binaryFirmware ];
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/os-specific/linux/displaylink/default.nix b/pkgs/os-specific/linux/displaylink/default.nix
index 476ea57d44ecd..024cf5299b24c 100644
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -1,40 +1,55 @@
-{ stdenv
-, lib
-, unzip
-, util-linux
-, libusb1
-, evdi
-, makeBinaryWrapper
-, requireFile
+{
+  stdenv,
+  lib,
+  unzip,
+  util-linux,
+  libusb1,
+  evdi,
+  makeBinaryWrapper,
+  requireFile,
 }:
 
 let
   bins =
-    if stdenv.hostPlatform.system == "x86_64-linux" then "x64-ubuntu-1604"
-    else if stdenv.hostPlatform.system == "i686-linux" then "x86-ubuntu-1604"
-    else if stdenv.hostPlatform.system == "aarch64-linux" then "aarch64-linux-gnu"
-    else throw "Unsupported architecture";
-  libPath = lib.makeLibraryPath [ stdenv.cc.cc util-linux libusb1 evdi ];
+    if stdenv.hostPlatform.system == "x86_64-linux" then
+      "x64-ubuntu-1604"
+    else if stdenv.hostPlatform.system == "i686-linux" then
+      "x86-ubuntu-1604"
+    else if stdenv.hostPlatform.system == "aarch64-linux" then
+      "aarch64-linux-gnu"
+    else
+      throw "Unsupported architecture";
+  libPath = lib.makeLibraryPath [
+    stdenv.cc.cc
+    util-linux
+    libusb1
+    evdi
+  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "displaylink";
-  version = "5.8.0-63.33";
+  version = "6.0.0-24";
 
   src = requireFile rec {
-    name = "displaylink-580.zip";
-    sha256 = "05m8vm6i9pc9pmvar021lw3ls60inlmq92nling0vj28skm55i92";
+    name = "displaylink-600.zip";
+    sha256 = "1ixrklwk67w25cy77n7l0pq6j9i4bp4lkdr30kp1jsmyz8daaypw";
     message = ''
       In order to install the DisplayLink drivers, you must first
       comply with DisplayLink's EULA and download the binaries and
       sources from here:
 
-      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.8
+      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-6.0
 
       Once you have downloaded the file, please use the following
       commands and re-run the installation:
 
-      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu5.8-EXE.zip" \$PWD/${name}
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu6.0-EXE.zip" \$PWD/${name}
       nix-prefetch-url file://\$PWD/${name}
+
+      Alternatively, you can use the following command to download the
+      file directly:
+
+      nix-prefetch-url --name ${name} https://www.synaptics.com/sites/default/files/exe_files/2024-05/DisplayLink%20USB%20Graphics%20Software%20for%20Ubuntu6.0-EXE.zip
     '';
   };
 
@@ -73,13 +88,17 @@ stdenv.mkDerivation (finalAttrs: {
   dontPatchELF = true;
 
   meta = with lib; {
-    description = "DisplayLink DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
+    description = "DisplayLink DL-7xxx, DL-6xxx, DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
     homepage = "https://www.displaylink.com/";
-    hydraPlatforms = [];
+    hydraPlatforms = [ ];
     license = licenses.unfree;
     mainProgram = "DisplayLinkManager";
     maintainers = with maintainers; [ abbradar ];
-    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+      "aarch64-linux"
+    ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
 })
diff --git a/pkgs/os-specific/linux/fanctl/default.nix b/pkgs/os-specific/linux/fanctl/default.nix
index f55779bd91657..e5ae081d5a2d3 100644
--- a/pkgs/os-specific/linux/fanctl/default.nix
+++ b/pkgs/os-specific/linux/fanctl/default.nix
@@ -8,7 +8,7 @@ rustPlatform.buildRustPackage rec {
     owner = "mcoffin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XmawybmqRJ9Lj6ii8TZBFwqdQZVp0pOLN4xiSLkU/bw=";
+    hash = "sha256-XmawybmqRJ9Lj6ii8TZBFwqdQZVp0pOLN4xiSLkU/bw=";
   };
 
   cargoSha256 = "sha256-tj00DXQEqC/8+3uzTMWcph+1fNTTVZLSJbV/5lLFkFs=";
diff --git a/pkgs/os-specific/linux/ffado/default.nix b/pkgs/os-specific/linux/ffado/default.nix
index 610f9d31353e2..47112a26c203a 100644
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -1,39 +1,49 @@
-{ lib
-, stdenv
-, mkDerivation
-, argp-standalone
-, dbus
-, dbus_cplusplus
-, desktop-file-utils
-, fetchurl
-, fetchpatch
-, glibmm
-, libavc1394
-, libconfig
-, libiec61883
-, libraw1394
-, libxmlxx3
-, pkg-config
-, python3
-, scons
-, which
-, wrapQtAppsHook
+{
+  lib,
+  stdenv,
+  mkDerivation,
+  argp-standalone,
+  dbus,
+  dbus_cplusplus,
+  desktop-file-utils,
+  fetchurl,
+  fetchpatch,
+  glibmm,
+  libavc1394,
+  libconfig,
+  libiec61883,
+  libraw1394,
+  libxmlxx3,
+  pkg-config,
+  python311,
+  scons,
+  which,
+  wrapQtAppsHook,
 }:
 
 let
-  python = python3.withPackages (pkgs: with pkgs; [ pyqt5 dbus-python ]);
+  python = python311.withPackages (
+    pkgs: with pkgs; [
+      pyqt5
+      dbus-python
+    ]
+  );
 in
 mkDerivation rec {
   pname = "ffado";
   version = "2.4.8";
 
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+  ];
+
   src = fetchurl {
     url = "http://www.ffado.org/files/libffado-${version}.tgz";
-    hash = "sha256-f0x561ehKw6uMSri0RZip+v1JHZuhixtywl0PVU/N44=";
+    hash = "sha256-0iFXYyGctOoHCdc232Ud80/wV81tiS7ItiS0uLKyq2Y=";
   };
 
-  sourceRoot = "libffado-${version}/libffado";
-
   prePatch = ''
     substituteInPlace ./support/tools/ffado-diag.in \
       --replace /lib/modules/ "/run/booted-system/kernel-modules/lib/modules/"
@@ -51,15 +61,13 @@ mkDerivation rec {
     })
   ];
 
-  outputs = [ "out" "bin" "dev" ];
-
   nativeBuildInputs = [
     desktop-file-utils
-    scons
+    (scons.override { python3 = python311; })
     pkg-config
     which
     python
-    python3.pkgs.pyqt5
+    python.pkgs.pyqt5
     wrapQtAppsHook
   ];
 
@@ -71,7 +79,7 @@ mkDerivation rec {
     "WILL_DEAL_WITH_XDG_MYSELF=True"
     "BUILD_MIXER=True"
     "UDEVDIR=${placeholder "out"}/lib/udev/rules.d"
-    "PYPKGDIR=${placeholder "out"}/${python3.sitePackages}"
+    "PYPKGDIR=${placeholder "out"}/${python.sitePackages}"
     "BINDIR=${placeholder "bin"}/bin"
     "INCLUDEDIR=${placeholder "dev"}/include"
     "PYTHON_INTERPRETER=${python.interpreter}"
@@ -116,7 +124,10 @@ mkDerivation rec {
     homepage = "http://www.ffado.org";
     description = "FireWire audio drivers";
     license = licenses.gpl3;
-    maintainers = with maintainers; [ goibhniu michojel ];
+    maintainers = with maintainers; [
+      goibhniu
+      michojel
+    ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/ffado/fix-build.patch b/pkgs/os-specific/linux/ffado/fix-build.patch
index 7e360932613f7..db4c47fa38d5f 100644
--- a/pkgs/os-specific/linux/ffado/fix-build.patch
+++ b/pkgs/os-specific/linux/ffado/fix-build.patch
@@ -1,9 +1,14 @@
 From b0f2b20b23780dd2e67a01c15462070dd86c4ac1 Mon Sep 17 00:00:00 2001
 From: Jan Tojnar <jtojnar@gmail.com>
 Date: Sun, 3 Mar 2019 11:50:27 +0100
-Subject: [PATCH] Fix build on Nix
+Subject: [PATCH] build: Add datadir option for /usr/share
 
-We do not have global /usr.
+Hardcoded /usr/share does not work for platforms that do not have global /usr like Nix.
+Let’s introduce a new DATADIR option, that allows overriding the directory and use it for metainfodir.
+
+While at it, let’s also use it for SHAREDIR and MANDIR for consistency,
+following the GNU directory convention:
+https://www.gnu.org/prep/standards/html_node/Directory-Variables.html
 ---
  SConstruct | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
@@ -12,15 +17,48 @@ diff --git a/SConstruct b/SConstruct
 index 05755e4b..3fbdc1d8 100644
 --- a/SConstruct
 +++ b/SConstruct
-@@ -537,7 +537,7 @@ env['mandir'] = Template( env.destdir + env['MANDIR'] ).safe_substitute( env )
+@@ -49,9 +49,10 @@
+     PathVariable( "BINDIR", "Overwrite the directory where apps are installed to.", "$PREFIX/bin", PathVariable.PathAccept ),
+     PathVariable( "LIBDIR", "Overwrite the directory where libs are installed to.", "$PREFIX/lib", PathVariable.PathAccept ),
+     PathVariable( "INCLUDEDIR", "Overwrite the directory where headers are installed to.", "$PREFIX/include", PathVariable.PathAccept ),
+-    PathVariable( "SHAREDIR", "Overwrite the directory where misc shared files are installed to.", "$PREFIX/share/libffado", PathVariable.PathAccept ),
++    PathVariable( "DATADIR", "Overwrite the directory where platform-independent files are installed to.", "$PREFIX/share", PathVariable.PathAccept ),
++    PathVariable( "SHAREDIR", "Overwrite the directory where misc shared files are installed to.", "$DATADIR/libffado", PathVariable.PathAccept ),
+     PathVariable( "LIBDATADIR", "Location for architecture-dependent data.", "$LIBDIR/libffado", PathVariable.PathAccept ),
+-    PathVariable( "MANDIR", "Overwrite the directory where manpages are installed", "$PREFIX/man", PathVariable.PathAccept ),
++    PathVariable( "MANDIR", "Overwrite the directory where manpages are installed", "$DATADIR/man", PathVariable.PathAccept ),
+     PathVariable( "PYPKGDIR", "The directory where the python modules get installed.",
+         distutils.sysconfig.get_python_lib( prefix="$PREFIX" ), PathVariable.PathAccept ),
+     PathVariable( "UDEVDIR", "Overwrite the directory where udev rules are installed to.", "/lib/udev/rules.d/", PathVariable.PathAccept ),
+@@ -523,6 +524,7 @@
+ env['BINDIR'] = Template( env['BINDIR'] ).safe_substitute( env )
+ env['LIBDIR'] = Template( env['LIBDIR'] ).safe_substitute( env )
+ env['INCLUDEDIR'] = Template( env['INCLUDEDIR'] ).safe_substitute( env )
++env['DATADIR'] = Template( env['DATADIR'] ).safe_substitute( env )
+ env['SHAREDIR'] = Template( env['SHAREDIR'] ).safe_substitute( env )
+ env['LIBDATADIR'] = Template( env['LIBDATADIR'] ).safe_substitute( env )
+ env['UDEVDIR'] = Template( env['UDEVDIR'] ).safe_substitute( env )
+@@ -531,18 +533,21 @@
+ env['bindir'] = Template( env.destdir + env['BINDIR'] ).safe_substitute( env )
+ env['libdir'] = Template( env.destdir + env['LIBDIR'] ).safe_substitute( env )
+ env['includedir'] = Template( env.destdir + env['INCLUDEDIR'] ).safe_substitute( env )
++env['datadir'] = Template( env.destdir + env['DATADIR'] ).safe_substitute( env )
+ env['sharedir'] = Template( env.destdir + env['SHAREDIR'] ).safe_substitute( env )
+ env['libdatadir'] = Template( env.destdir + env['LIBDATADIR'] ).safe_substitute( env )
+ env['mandir'] = Template( env.destdir + env['MANDIR'] ).safe_substitute( env )
  env['pypkgdir'] = Template( env.destdir + env['PYPKGDIR'] ).safe_substitute( env )
  env['udevdir'] = Template( env.destdir + env['UDEVDIR'] ).safe_substitute( env )
  env['PYPKGDIR'] = Template( env['PYPKGDIR'] ).safe_substitute( env )
 -env['metainfodir'] = Template( env.destdir + "/usr/share/metainfo" ).safe_substitute( env )
-+env['metainfodir'] = Template( env.destdir + env['SHAREDIR'] + "/metainfo" ).safe_substitute( env )
- 
+-
++env['metainfodir'] = Template( env.destdir + env['DATADIR'] + "/metainfo" ).safe_substitute( env )
++
++env.Command( target=env['datadir'], source="", action=Mkdir( env['datadir'] ) )
  env.Command( target=env['sharedir'], source="", action=Mkdir( env['sharedir'] ) )
  
--- 
-2.19.2
-
+ env.Alias( "install", env['libdir'] )
+ env.Alias( "install", env['includedir'] )
++env.Alias( "install", env['datadir'] )
+ env.Alias( "install", env['sharedir'] )
+ env.Alias( "install", env['libdatadir'] )
+ env.Alias( "install", env['bindir'] )
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
index ae04c6a9ce32a..f106f77626e51 100644
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@@ -1,20 +1,17 @@
-let
-  source = import ./source.nix;
-in {
-  stdenvNoCC,
-  fetchzip,
-  lib,
-  rdfind,
-  which,
+{ stdenvNoCC
+, fetchzip
+, lib
+, rdfind
+, which
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = source.version;
+  version = "20240709";
 
   src = fetchzip {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${source.revision}.tar.gz";
-    hash = source.sourceHash;
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${version}.tar.gz";
+    hash = "sha256-BopPZDVQMmhLo9qTpozIea2amaZNQvwhgEIcpKMPAKs=";
   };
 
   nativeBuildInputs = [
@@ -27,10 +24,6 @@ stdenvNoCC.mkDerivation rec {
   # Firmware blobs do not need fixing and should not be modified
   dontFixup = true;
 
-  outputHashMode = "recursive";
-  outputHashAlgo = "sha256";
-  outputHash = source.outputHash;
-
   meta = with lib; {
     description = "Binary firmware collection packaged by kernel.org";
     homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
@@ -39,6 +32,5 @@ stdenvNoCC.mkDerivation rec {
     maintainers = with maintainers; [ fpletz ];
     priority = 6; # give precedence to kernel firmware
   };
-
   passthru.updateScript = ./update.sh;
 }
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix b/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
deleted file mode 100644
index adaa4968fd565..0000000000000
--- a/pkgs/os-specific/linux/firmware/linux-firmware/source.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-# This file is autogenerated! Run ./update.sh to regenerate.
-{
-  version = "20240610";
-  revision = "20240610";
-  sourceHash = "sha256-tjDqviOMvrBoEG8+Yn+XqdBlIDfQUX0KK2kpW6/jed8=";
-  outputHash = "sha256-2VxzN778TLov5N1DPSnnkT7wQnLg85PyKsljZOoSoNM=";
-}
diff --git a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
index 4b28d6e1374f4..7886e93571ab4 100755
--- a/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/update.sh
@@ -1,47 +1,10 @@
-#!/usr/bin/env bash
-set -euo pipefail
-cd "$(dirname "$(readlink -f "$0")")" || exit
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p git -p common-updater-scripts
 
-repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
-
-# step 1: figure out the latest version from the tags
-if [ -z "${1:-}" ]; then
-  revision="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
-  version=$revision
-else
-  revision=$1
-  if [ -z "${2:-}" ]; then
-    version="unstable-$(date "+%Y-%m-%d")"
-  else
-    version=$2
-  fi
-fi
+set -eu -o pipefail
 
-# step 2: prefetch the source tarball
-snapshotUrl="$repo/snapshot/linux-firmware-$revision.tar.gz"
-hash="$(nix-prefetch-url --unpack "$snapshotUrl")"
-sriHash="$(nix --experimental-features nix-command hash to-sri "sha256:$hash")"
-
-# step 3: rebuild as a non-FO derivation to get the right hash
-cat > source.nix << EOF
-{
-  version = "$version";
-  revision = "$revision";
-  sourceHash = "$sriHash";
-  outputHash = null;
-}
-EOF
+repo="https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git"
 
-outPath="$(nix --experimental-features "nix-command flakes" build ".#linux-firmware" --no-link --print-out-paths)"
-outHash="$(nix --experimental-features nix-command hash path "$outPath")"
+revision="$(git ls-remote --refs --tags --sort refname "$repo" | tail -n1 | cut -f2 | cut -d '/' -f3)"
 
-# step 4: generate the final file
-cat > source.nix << EOF
-# This file is autogenerated! Run ./update.sh to regenerate.
-{
-  version = "$version";
-  revision = "$revision";
-  sourceHash = "$sriHash";
-  outputHash = "$outHash";
-}
-EOF
+update-source-version linux-firmware "$revision"
diff --git a/pkgs/os-specific/linux/hostapd/0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch b/pkgs/os-specific/linux/hostapd/0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch
new file mode 100644
index 0000000000000..e895e47925679
--- /dev/null
+++ b/pkgs/os-specific/linux/hostapd/0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch
@@ -0,0 +1,101 @@
+From 58097123ec5ea6f8276b38cb9b07669ec368a6c1 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 17 Mar 2024 10:42:56 +0200
+Subject: [PATCH 7/8] RADIUS: Require Message-Authenticator attribute in MAC
+ ACL cases
+
+hostapd required Message-Authenticator attribute to be included in EAP
+authentication cases, but that requirement was not in place for MAC ACL
+cases. Start requiring Message-Authenticator attribute for MAC ACL by
+default. Unlike the EAP case, this can still be disabled with
+radius_require_message_authenticator=1 to maintain compatibility with
+some RADIUS servers when used in a network where the connection to such
+a server is secure.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ hostapd/config_file.c    |  3 +++
+ hostapd/hostapd.conf     | 11 +++++++++++
+ src/ap/ap_config.c       |  1 +
+ src/ap/ap_config.h       |  1 +
+ src/ap/ieee802_11_auth.c |  4 +++-
+ 5 files changed, 19 insertions(+), 1 deletion(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 96c28aea2..3fb059770 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2988,6 +2988,9 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ #endif /* CONFIG_RADIUS_TLS */
+ 	} else if (os_strcmp(buf, "radius_retry_primary_interval") == 0) {
+ 		bss->radius->retry_primary_interval = atoi(pos);
++	} else if (os_strcmp(buf,
++			     "radius_require_message_authenticator") == 0) {
++		bss->radius_require_message_authenticator = atoi(pos);
+ 	} else if (os_strcmp(buf, "radius_acct_interim_interval") == 0) {
+ 		bss->acct_interim_interval = atoi(pos);
+ 	} else if (os_strcmp(buf, "radius_request_cui") == 0) {
+diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
+index e3367b708..3f0e66beb 100644
+--- a/hostapd/hostapd.conf
++++ b/hostapd/hostapd.conf
+@@ -1620,6 +1620,17 @@ own_ip_addr=127.0.0.1
+ # currently used secondary server is still working.
+ #radius_retry_primary_interval=600
+ 
++# Message-Authenticator attribute requirement for non-EAP cases
++# hostapd requires Message-Authenticator attribute to be included in all cases
++# where RADIUS is used for EAP authentication. This is also required for cases
++# where RADIUS is used for MAC ACL (macaddr_acl=2) by default, but that case
++# can be configured to not require this for compatibility with RADIUS servers
++# that do not include the attribute. This is not recommended due to potential
++# security concerns, but can be used as a temporary workaround in networks where
++# the connection to the RADIUS server is secure.
++# 0 = Do not require Message-Authenticator in MAC ACL response
++# 1 = Require Message-Authenticator in all authentication cases (default)
++#radius_require_message_authenticator=1
+ 
+ # Interim accounting update interval
+ # If this is set (larger than 0) and acct_server is configured, hostapd will
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index 32b04ab35..0b5a16ef9 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -122,6 +122,7 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ #endif /* CONFIG_IEEE80211R_AP */
+ 
+ 	bss->radius_das_time_window = 300;
++	bss->radius_require_message_authenticator = 1;
+ 
+ 	bss->anti_clogging_threshold = 5;
+ 	bss->sae_sync = 5;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index fda937ecf..ced2181ab 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -309,6 +309,7 @@ struct hostapd_bss_config {
+ 	struct hostapd_ip_addr own_ip_addr;
+ 	char *nas_identifier;
+ 	struct hostapd_radius_servers *radius;
++	int radius_require_message_authenticator;
+ 	int acct_interim_interval;
+ 	int radius_request_cui;
+ 	struct hostapd_radius_attr *radius_auth_req_attr;
+diff --git a/src/ap/ieee802_11_auth.c b/src/ap/ieee802_11_auth.c
+index cc38044d8..913a99597 100644
+--- a/src/ap/ieee802_11_auth.c
++++ b/src/ap/ieee802_11_auth.c
+@@ -508,7 +508,9 @@ hostapd_acl_recv_radius(struct radius_msg *msg, struct radius_msg *req,
+ 	wpa_printf(MSG_DEBUG, "Found matching Access-Request for RADIUS "
+ 		   "message (id=%d)", query->radius_id);
+ 
+-	if (radius_msg_verify(msg, shared_secret, shared_secret_len, req, 0)) {
++	if (radius_msg_verify(
++		    msg, shared_secret, shared_secret_len, req,
++		    hapd->conf->radius_require_message_authenticator)) {
+ 		wpa_printf(MSG_INFO, "Incoming RADIUS packet did not have "
+ 			   "correct authenticator - dropped\n");
+ 		return RADIUS_RX_INVALID_AUTHENTICATOR;
+-- 
+2.45.1
+
diff --git a/pkgs/os-specific/linux/hostapd/default.nix b/pkgs/os-specific/linux/hostapd/default.nix
index 1187cd2194570..5988dc0436dcb 100644
--- a/pkgs/os-specific/linux/hostapd/default.nix
+++ b/pkgs/os-specific/linux/hostapd/default.nix
@@ -1,4 +1,14 @@
-{ lib, stdenv, fetchurl, pkg-config, libnl, openssl, sqlite ? null }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchpatch,
+  pkg-config,
+  libnl,
+  openssl,
+  nixosTests,
+  sqlite ? null,
+}:
 
 stdenv.mkDerivation rec {
   pname = "hostapd";
@@ -19,6 +29,53 @@ stdenv.mkDerivation rec {
       url = "https://raw.githubusercontent.com/openwrt/openwrt/eefed841b05c3cd4c65a78b50ce0934d879e6acf/package/network/services/hostapd/patches/300-noscan.patch";
       sha256 = "08p5frxhpq1rp2nczkscapwwl8g9nc4fazhjpxic5bcbssc3sb00";
     })
+
+    # Backported security patches for CVE-2024-3596 (https://blastradius.fail),
+    # these can be removed when updating to 2.11.
+
+    # RADIUS: Allow Message-Authenticator attribute as the first attribute
+    (fetchpatch {
+      url = "https://w1.fi/cgit/hostap/patch/?id=adac846bd0e258a0aa50750bbd2b411fa0085c46";
+      hash = "sha256-1jfSeVGL5tyZn8F2wpQ7KwaQaEKWsCOW/bavovMcdz4=";
+    })
+
+    # RADIUS server: Place Message-Authenticator attribute as the first one
+    (fetchpatch {
+      url = "https://w1.fi/cgit/hostap/patch/?id=54abb0d3cf35894e7d86e3f7555e95b106306803";
+      hash = "sha256-fVhQlOVETttVf1M9iKrXJrv7mxpxSjCt3w8kndRal08=";
+    })
+
+    # hostapd: Move Message-Authenticator attribute to be the first one in req
+    (fetchpatch {
+      url = "https://w1.fi/cgit/hostap/patch/?id=37fe8e48ab44d44fe3cf5dd8f52cb0a10be0cd17";
+      hash = "sha256-3eoAkXhieO3f0R5PTlH6g5wcgo/aLQN6XcPSITGgciE=";
+    })
+
+    # RADIUS DAS: Move Message-Authenticator attribute to be the first one
+    (fetchpatch {
+      url = "https://w1.fi/cgit/hostap/patch/?id=f54157077f799d84ce26bed6ad6b01c4a16e31cf";
+      hash = "sha256-dcaghKbKNFVSN6ONNaFt1s0S35mkqox2aykiExEXyPQ=";
+    })
+
+    # Require Message-Authenticator in Access-Reject even without EAP-Message
+    (fetchpatch {
+      url = "https://w1.fi/cgit/hostap/patch/?id=934b0c3a45ce0726560ccefbd992a9d385c36385";
+      hash = "sha256-9GquP/+lsghF81nMhOuRwlSz/pEnmk+mSex8aM3/qdA=";
+    })
+
+    # RADIUS: Require Message-Authenticator attribute in MAC ACL cases
+    #(fetchpatch {
+    #  url = "https://w1.fi/cgit/hostap/patch/?id=58097123ec5ea6f8276b38cb9b07669ec368a6c1";
+    #  hash = "sha256-mW+PAeAkNcrlFPsjxLvZ/1Smq6H6KXq5Le3HuLA2KKw=";
+    #})
+    # Needed to be fixed to apply correctly:
+    ./0007-RADIUS-Require-Message-Authenticator-attribute-in-MA.patch
+
+    # RADIUS: Check Message-Authenticator if it is present even if not required
+    (fetchpatch {
+      url = "https://w1.fi/cgit/hostap/patch/?id=f302d9f9646704cce745734af21d540baa0da65f";
+      hash = "sha256-6i0cq5YBm2w03yMrdYGaEqe1dTsmokZWOs4WPFX36qo=";
+    })
   ];
 
   outputs = [ "out" "man" ];
@@ -101,11 +158,15 @@ stdenv.mkDerivation rec {
     install -vD hostapd_cli.1 -t $man/share/man/man1
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) wpa_supplicant;
+  };
+
   meta = with lib; {
     homepage = "https://w1.fi/hostapd/";
     description = "User space daemon for access point and authentication servers";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ oddlama ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/hwdata/default.nix b/pkgs/os-specific/linux/hwdata/default.nix
index 320f10d551380..484e63bb357c9 100644
--- a/pkgs/os-specific/linux/hwdata/default.nix
+++ b/pkgs/os-specific/linux/hwdata/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hwdata";
-  version = "0.382";
+  version = "0.383";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${version}";
-    hash = "sha256-j7ITcLilcnV8QCUFC/Ybv1dX6Kl36P0G9vBlrzifhFQ=";
+    hash = "sha256-jYD1/sl9ffe+lmrICLe32NU1u0Hi7ZfZrD4zWH+bxsk=";
   };
 
   configureFlags = [ "--datadir=${placeholder "out"}/share" ];
diff --git a/pkgs/os-specific/linux/intel-cmt-cat/default.nix b/pkgs/os-specific/linux/intel-cmt-cat/default.nix
index 71f7735996ad9..5e1302dedd92b 100644
--- a/pkgs/os-specific/linux/intel-cmt-cat/default.nix
+++ b/pkgs/os-specific/linux/intel-cmt-cat/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
-  version = "23.11.1";
+  version = "24.05";
   pname = "intel-cmt-cat";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "intel-cmt-cat";
     rev = "v${version}";
-    sha256 = "sha256-cBsbXua3uOqzElkLcLrOnNXXukGn5zRF8ytWa9VzGdE=";
+    sha256 = "sha256-e4sbQNpUCZaZDhLLRVDXHXsEelZaZIdc8n3ksUnAkKQ=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/os-specific/linux/iproute/default.nix b/pkgs/os-specific/linux/iproute/default.nix
index effe5eb8526b9..15b8987b8cc05 100644
--- a/pkgs/os-specific/linux/iproute/default.nix
+++ b/pkgs/os-specific/linux/iproute/default.nix
@@ -6,17 +6,14 @@
 
 stdenv.mkDerivation rec {
   pname = "iproute2";
-  version = "6.8.0";
+  version = "6.9.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/net/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-A6bMo9cakI0fFfe0lb4rj+hR+UFFjcRmSQDX9F/PaM4=";
+    hash = "sha256-L2Q9CeoRpKKgQ8kuK0abX3MijL8kGugGdgKW7Q7EE9A=";
   };
 
   postPatch = ''
-    # Don't try to create /var/lib/arpd:
-    sed -e '/ARPDDIR/d' -i Makefile
-
     substituteInPlace Makefile \
       --replace "CC := gcc" "CC ?= $CC"
   '';
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 551d4cffbb923..e4d8706fb6a66 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -671,20 +671,29 @@ let
     };
 
     security = {
+      # Report BUG() conditions and kill the offending process.
+      BUG = yes;
+      BUG_ON_DATA_CORRUPTION = yes;
+
       FORTIFY_SOURCE                   = option yes;
 
       # https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html
       DEBUG_LIST                       = yes;
+
       HARDENED_USERCOPY                = yes;
       RANDOMIZE_BASE                   = option yes;
+      STRICT_KERNEL_RWX                = yes;
+      STRICT_MODULE_RWX                = yes;
       STRICT_DEVMEM                    = mkDefault yes; # Filter access to /dev/mem
       IO_STRICT_DEVMEM                 = mkDefault yes;
       SECURITY_SELINUX_BOOTPARAM_VALUE = whenOlder "5.1" (freeform "0"); # Disable SELinux by default
+
       # Prevent processes from ptracing non-children processes
       SECURITY_YAMA                    = option yes;
       # The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem access) for a set of processes.
       # This does not have any effect if a program does not support it
       SECURITY_LANDLOCK                = whenAtLeast "5.13" yes;
+
       DEVKMEM                          = whenOlder "5.13" no; # Disable /dev/kmem
 
       USER_NS                          = yes; # Support for user namespaces
@@ -719,6 +728,10 @@ let
 
       # Enable support for page poisoning. Still needs to be enabled on the command line to actually work.
       PAGE_POISONING                   = yes;
+      # Randomize page allocator when page_alloc.shuffle=1
+      SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
+
+      INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
 
       # Enable stack smashing protections in schedule()
       # See: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v4.8&id=0d9e26329b0c9263d4d9e0422d80a0e73268c52f
@@ -743,6 +756,10 @@ let
       # Mitigate straight line speculation at the cost of some file size
       SLS = whenBetween "5.17" "6.9" yes;
       MITIGATION_SLS = whenAtLeast "6.9" yes;
+
+      DEFAULT_MMAP_MIN_ADDR = freeform "65536";
+    } // optionalAttrs stdenv.hostPlatform.isAarch64 {
+      DEFAULT_MMAP_MIN_ADDR = freeform "32768";
     };
 
     microcode = {
diff --git a/pkgs/os-specific/linux/kernel/hardened/config.nix b/pkgs/os-specific/linux/kernel/hardened/config.nix
index d687366dbe2f8..0ab89d23952db 100644
--- a/pkgs/os-specific/linux/kernel/hardened/config.nix
+++ b/pkgs/os-specific/linux/kernel/hardened/config.nix
@@ -17,9 +17,6 @@ with (lib.kernel.whenHelpers version);
 assert (versionAtLeast version "4.9");
 
 {
-  # Report BUG() conditions and kill the offending process.
-  BUG = yes;
-
   # Mark LSM hooks read-only after init.  SECURITY_WRITABLE_HOOKS n
   # conflicts with SECURITY_SELINUX_DISABLE y; disabling the latter
   # implicitly marks LSM hooks read-only after init.
@@ -31,8 +28,6 @@ assert (versionAtLeast version "4.9");
   SECURITY_SELINUX_DISABLE = whenOlder "6.4" no; # On 6.4: error: unused option: SECURITY_SELINUX_DISABLE
   SECURITY_WRITABLE_HOOKS  = option no;
 
-  STRICT_KERNEL_RWX = yes;
-
   # Perform additional validation of commonly targeted structures.
   DEBUG_CREDENTIALS     = whenOlder "6.6" yes;
   DEBUG_NOTIFIERS       = yes;
@@ -51,16 +46,11 @@ assert (versionAtLeast version "4.9");
   # restricts loading of line disciplines via TIOCSETD ioctl to CAP_SYS_MODULE
   CONFIG_LDISC_AUTOLOAD = option no;
 
-  # Randomize page allocator when page_alloc.shuffle=1
-  SHUFFLE_PAGE_ALLOCATOR = whenAtLeast "5.2" yes;
-
   # Wipe higher-level memory allocations on free() with page_poison=1
-  PAGE_POISONING           = yes;
   PAGE_POISONING_NO_SANITY = whenOlder "5.11" yes;
   PAGE_POISONING_ZERO      = whenOlder "5.11" yes;
 
-  # Enable init_on_alloc and init_on_free by default
-  INIT_ON_ALLOC_DEFAULT_ON = whenAtLeast "5.3" yes;
+  # Enable init_on_free by default
   INIT_ON_FREE_DEFAULT_ON  = whenAtLeast "5.3" yes;
 
   # Wipe all caller-used registers on exit from a function
@@ -113,9 +103,6 @@ assert (versionAtLeast version "4.9");
   CC_STACKPROTECTOR_REGULAR = lib.mkForce (whenOlder "4.18" no);
   CC_STACKPROTECTOR_STRONG  = whenOlder "4.18" yes;
 
-  # Detect out-of-bound reads/writes and use-after-free
-  KFENCE = whenAtLeast "5.12" yes;
-
   # CONFIG_DEVMEM=n causes these to not exist anymore.
   STRICT_DEVMEM    = option no;
   IO_STRICT_DEVMEM = option no;
@@ -126,8 +113,4 @@ assert (versionAtLeast version "4.9");
 
   # not needed for less than a decade old glibc versions
   LEGACY_VSYSCALL_NONE = yes;
-
-  # Straight-Line-Speculation
-  # https://lwn.net/Articles/877845/
-  SLS = option yes;
 }
diff --git a/pkgs/os-specific/linux/kernel/hardened/update.py b/pkgs/os-specific/linux/kernel/hardened/update.py
index 1e34ca209aa90..8b46137afb37b 100755
--- a/pkgs/os-specific/linux/kernel/hardened/update.py
+++ b/pkgs/os-specific/linux/kernel/hardened/update.py
@@ -158,7 +158,7 @@ def fetch_patch(*, name: str, release_info: ReleaseInfo) -> Optional[Patch]:
 
 def parse_version(version_str: str) -> Version:
     version: Version = []
-    for component in re.split('\.|\-', version_str):
+    for component in re.split(r'\.|\-', version_str):
         try:
             version.append(int(component))
         except ValueError:
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 42a315b0fb84e..3891333d959d8 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,38 +1,42 @@
 {
     "testing": {
-        "version": "6.10-rc5",
-        "hash": "sha256:1bjqcgik4mgjshwy7p45msd62rmq8wjyz7b60n4fsm3kyk16imcd"
+        "version": "6.10-rc7",
+        "hash": "sha256:0i29ga9lzqd4zcsbr4bbb122i8nyfhcalihnq3bgsg04dwb36s19"
     },
     "6.1": {
-        "version": "6.1.96",
-        "hash": "sha256:1ab290vm6h8vj1qi1qhxzh9kc6dbgpkwybcwzw1aprz5kl3cjxry"
+        "version": "6.1.99",
+        "hash": "sha256:1lsdwdx7i7xw1rzq88k3bz8sar77gb4rnmjx11pbmvmiwaffx1n0"
     },
     "5.15": {
-        "version": "5.15.161",
-        "hash": "sha256:0k277hz6nq62v0xfc1n2hc69cyvmnxpl0qcbszinajywh23gfafn"
+        "version": "5.15.162",
+        "hash": "sha256:0z0s5gk8akcbpb99jp08px78fhr8r6kkb7dpl01b3rrc2pmc1gwi"
     },
     "5.10": {
-        "version": "5.10.220",
-        "hash": "sha256:16z1xqm7djm8pl15s5wvgc4pwq81gydcf00jpxfplw794kwszhvw"
+        "version": "5.10.221",
+        "hash": "sha256:09975sby114mwfb8x2rlpaps6vb60dvs8f20cmb7hkxcxdzx87fs"
     },
     "5.4": {
-        "version": "5.4.278",
-        "hash": "sha256:1245zf7vk2fyprw9fspljqy9wlzma9bayri7xx2g8iam2430d875"
+        "version": "5.4.279",
+        "hash": "sha256:0pja69n66hsl1r5jbzqww1hwsmqdlxmq6qv9rqx5qnrr4rml765j"
     },
     "4.19": {
-        "version": "4.19.316",
-        "hash": "sha256:0lmyhwr4la7kvim7jqdi29scjkvqp9crpvdbhpb4j8d7mj5kgzz4"
+        "version": "4.19.317",
+        "hash": "sha256:109mk4zscm8611xs3bchnr94gasvw3vxsi6zhp3f2y132g670aq6"
     },
     "6.6": {
-        "version": "6.6.36",
-        "hash": "sha256:1mfdw2prjb54r19y22sm37q8spnk6lyk162ima7gps1pnwl6hrxr"
+        "version": "6.6.40",
+        "hash": "sha256:0f7mmw5pzd174376m7r928xbi9mdcla0vy6plq0xdf2mq01kqfjw"
     },
     "6.8": {
         "version": "6.8.12",
         "hash": "sha256:0fb0m0fv4521g63gq04d7lm6hy8169s1rykiav5bkd99s9b1kcqr"
     },
     "6.9": {
-        "version": "6.9.7",
-        "hash": "sha256:1y01w26sas7pl24l09yczdr8mzzy2nadykz1wmhx9ygfj76qixg4"
+        "version": "6.9.9",
+        "hash": "sha256:1f8y88rif3z5lp1bq00g66fd0xs1227qlqkxd2zs6fdjgr45pq1b"
+    },
+    "6.10": {
+        "version": "6.10",
+        "hash": "sha256:09p2z3z8c3aq6ipqdc58x6s52sy0cmyg6mj4f0g5yk755r19hikp"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 2d9d51afe4e5a..db932be1a2d3f 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19584";
-    sha256 = "1vhk4jnx8f98lkj2isrms2jm9c5qrpgayxbhawslqrprq1pmzlif";
+    rev = "19607";
+    sha256 = "1kf1hm553g8sh7wyh0jw7nl2nmrzg74b62z1q17bznq5a7qf87pn";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index ec7f104bcb1d2..3d560d387ef92 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.218-rt110"; # updated by ./update-rt.sh
+  version = "5.10.221-rt113"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1mmj5hwm5i16gc1y4nzr1cs882vi6vrihrincdcivv63x11v4dlw";
+    sha256 = "09975sby114mwfb8x2rlpaps6vb60dvs8f20cmb7hkxcxdzx87fs";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0zam7hlcrphxv53jcza7sw0lv8a9mz15cl35adwb2rd2y1x9nhad";
+      sha256 = "1aaamfnlhzhi4lj1sk2m082fpgr3qxs3b3a1ikh8zwmy89kw9i9x";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
index 2fc18c76e5706..7863cf42f7dd7 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.4.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.4.271-rt89"; # updated by ./update-rt.sh
+  version = "5.4.278-rt91"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -15,14 +15,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "0l2qv4xlhnry9crs90rkihsxyny6jz8kxw08bfad7nys9hrn3g6d";
+    sha256 = "1245zf7vk2fyprw9fspljqy9wlzma9bayri7xx2g8iam2430d875";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "15k9jja5yd9zf5yhd7hhydwh4hksg2mybk66jhdjsryh4w9jav7z";
+      sha256 = "0s1ars3d18jg55kpvk6q5b6rk66c74d2khd2mxzdm5ifgm47047k";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 3154538ee74ae..1161162981ea1 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.95-rt34"; # updated by ./update-rt.sh
+  version = "6.1.96-rt35"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -19,14 +19,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "1gfz2j6iixbr0dfkb8jkwnb4gicrm5rc5lsa24wmyrkm3nmg0q19";
+    sha256 = "1ab290vm6h8vj1qi1qhxzh9kc6dbgpkwybcwzw1aprz5kl3cjxry";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1kz9j8d677vr5sfxrvfd2a8vpmz3vsrvb82rdvvf09ikpdvsa6iy";
+      sha256 = "1adjwxzx37w70h11ig6wcii8xb4dggw5x6si15zlsnr61dalys2d";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index a200edfb4161b..8eab0d2b45f8d 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.6.35-rt34"; # updated by ./update-rt.sh
+  version = "6.6.36-rt35"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -19,14 +19,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "17nxymy3r9q45cfzc9rqp937m37zr1b8fjn1m0x0dv8jhxrfxqzw";
+    sha256 = "1mfdw2prjb54r19y22sm37q8spnk6lyk162ima7gps1pnwl6hrxr";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0rijfk9n3fdrwg61ih2x95w4ffjs037hfjv3bza3xb7j04y7hxgy";
+      sha256 = "154wfx6aa9yxkavf05vka8spvx99pa4svq02b6kb1zfrq6r93bq6";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 
diff --git a/pkgs/os-specific/linux/kernel/mainline.nix b/pkgs/os-specific/linux/kernel/mainline.nix
index 4e1d5b8a9e87c..862ba8e8ddcce 100644
--- a/pkgs/os-specific/linux/kernel/mainline.nix
+++ b/pkgs/os-specific/linux/kernel/mainline.nix
@@ -1,7 +1,10 @@
+let
+  allKernels = builtins.fromJSON (builtins.readFile ./kernels-org.json);
+in
+
 { branch, lib, fetchurl, fetchzip, buildLinux, ... } @ args:
 
 let
-  allKernels = builtins.fromJSON (builtins.readFile ./kernels-org.json);
   thisKernel = allKernels.${branch};
   inherit (thisKernel) version;
 
diff --git a/pkgs/os-specific/linux/kernel/manual-config.nix b/pkgs/os-specific/linux/kernel/manual-config.nix
index 323b77e851404..5f20d14137c4b 100644
--- a/pkgs/os-specific/linux/kernel/manual-config.nix
+++ b/pkgs/os-specific/linux/kernel/manual-config.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, buildPackages, runCommand, nettools, bc, bison, flex, perl, rsync, gmp, libmpc, mpfr, openssl
-, cpio, elfutils, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
+, cpio, elfutils, hexdump, zstd, python3Minimal, zlib, pahole, kmod, ubootTools
 , fetchpatch
 , rustc, rust-bindgen, rustPlatform
 }:
@@ -121,6 +121,7 @@ let
         pahole
         perl
         elfutils
+        hexdump
         # module makefiles often run uname commands to find out the kernel version
         (buildPackages.deterministic-uname.override { inherit modDirVersion; })
       ]
@@ -312,7 +313,7 @@ let
       installTargets = [
         (kernelConf.installTarget or (
           /**/ if kernelConf.target == "uImage" && stdenv.hostPlatform.linuxArch == "arm" then "uinstall"
-          else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" then "zinstall"
+          else if kernelConf.target == "zImage" || kernelConf.target == "Image.gz" || kernelConf.target == "vmlinuz.efi" then "zinstall"
           else "install"))
       ];
 
diff --git a/pkgs/os-specific/linux/kernel/perf/default.nix b/pkgs/os-specific/linux/kernel/perf/default.nix
index 851a4c8d5d7b6..cff4dac83a5ed 100644
--- a/pkgs/os-specific/linux/kernel/perf/default.nix
+++ b/pkgs/os-specific/linux/kernel/perf/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , kernel
 , elfutils
 , python3
@@ -60,6 +61,23 @@ stdenv.mkDerivation {
 
   inherit (kernel) src;
 
+  # Fix 6.10.0 holding pkg-config completely wrong.
+  # Patches from perf-tools-next, should be in 6.11 or hopefully backported.
+  patches = lib.optionals (lib.versionAtLeast kernel.version "6.10") [
+    (fetchpatch {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/patch/?id=0f0e1f44569061e3dc590cd0b8cb74d8fd53706b";
+      hash = "sha256-9u/zhbsDgwOr4T4k9td/WJYRuSHIfbtfS+oNx8nbOlM=";
+    })
+    (fetchpatch {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/patch/?id=366e17409f1f17ad872259ce4a4f8a92beb4c4ee";
+      hash = "sha256-NZK1u40qvMwWcgkgJPGpEax2eMo9xHrCQxSYYOK0rbo=";
+    })
+    (fetchpatch {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/patch/?id=1d302f626c2a23e4fd05bb810eff300e8f2174fd";
+      hash = "sha256-KhCmof8LkyTcBBpfMEtolL3m3kmC5rukKzQvufVKCdI=";
+    })
+  ];
+
   postPatch = ''
     # Linux scripts
     patchShebangs scripts
@@ -128,17 +146,12 @@ stdenv.mkDerivation {
   ++ lib.optional (lib.versionAtLeast kernel.version "5.8") libpfm
   ++ lib.optional (lib.versionAtLeast kernel.version "6.0") python3.pkgs.setuptools;
 
-  env.NIX_CFLAGS_COMPILE = toString ([
+  env.NIX_CFLAGS_COMPILE = toString [
     "-Wno-error=cpp"
     "-Wno-error=bool-compare"
     "-Wno-error=deprecated-declarations"
     "-Wno-error=stringop-truncation"
-  ] ++ lib.optionals (stdenv.cc.isGNU && lib.versions.major stdenv.cc.version == "13") [
-    # Workaround gcc bug that causes enev simplest `perf top` runs to
-    # crash: https://gcc.gnu.org/PR111009.
-    # Can be removed once gcc-13 is updated past 13.2.0.
-    "-O1"
-  ]);
+  ];
 
   doCheck = false; # requires "sparse"
 
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index c2f7ef4447b7f..cb7054f07c4a9 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -6,14 +6,14 @@ let
   # NOTE: When updating these, please also take a look at the changes done to
   # kernel config in the xanmod version commit
   ltsVariant = {
-    version = "6.6.36";
-    hash = "sha256-8L8e5iP4pvIvgqHmQYhFRCbgLvuFOXr7nkBe0VnuCzw=";
+    version = "6.6.39";
+    hash = "sha256-s8rE92YVz+0SC/VRvItakp7Q6whFzskFkalqku6j43Y=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.9.7";
-    hash = "sha256-hmVcwC1PHjyCw43IpJ99y72qFXSX5lbbh6+1TqdXzag=";
+    version = "6.9.9";
+    hash = "sha256-ZEU1RIgJ0ckyITFWZndEzXYwnTF39OviLxL9S5dEea4=";
     variant = "main";
   };
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 77d66ecd1d440..3acf40121d27a 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,16 +4,16 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.9.7"; #zen
+    version = "6.9.8"; #zen
     suffix = "zen1"; #zen
-    sha256 = "1hs238vpwna8fry65x2909npw97b8zyvbadigl1yqm6f4ibcmhkj"; #zen
+    sha256 = "1ixrdx2a6jp1x8kryjmxnrgl0fsrjg6fngg5c48vbl2574nizlbz"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.9.7"; #lqx
+    version = "6.9.8"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "09z48hnjw0qfvn3b7gm9gs7ixki590wcgy7pm0cw2y41c67f725y"; #lqx
+    sha256 = "1r5ld2xibr0qkwi1yy7h746sclsmd8cq68z0zdpbbn2qrgyx302k"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {
@@ -31,7 +31,7 @@ let
 
     # This is based on the following sources:
     # - zen: https://gitlab.archlinux.org/archlinux/packaging/packages/linux-zen/-/blob/main/config
-    # - lqx: https://github.com/damentz/liquorix-package/blob/6.4/master/linux-liquorix/debian/config/kernelarch-x86/config-arch-64
+    # - lqx: https://github.com/damentz/liquorix-package/blob/6.8/master/linux-liquorix/debian/config/kernelarch-x86/config-arch-64
     # - Liquorix features: https://liquorix.net/
     # The list below is not exhaustive, so the kernels probably doesn't match
     # the upstream, but should bring most of the improvements that will be
@@ -43,7 +43,6 @@ let
       # FQ-Codel Packet Scheduling
       NET_SCH_DEFAULT = yes;
       DEFAULT_FQ_CODEL = yes;
-      DEFAULT_NET_SCH = freeform "fq_codel";
 
       # Preempt (low-latency)
       PREEMPT = lib.mkOverride 60 yes;
@@ -66,27 +65,41 @@ let
       RCU_BOOST_DELAY = freeform "500";
       RCU_NOCB_CPU = yes;
       RCU_LAZY = yes;
+      RCU_DOUBLE_CHECK_CB_TIME = yes;
+
+      # BFQ I/O scheduler
+      IOSCHED_BFQ = lib.mkOverride 60 yes;
 
       # Futex WAIT_MULTIPLE implementation for Wine / Proton Fsync.
       FUTEX = yes;
       FUTEX_PI = yes;
 
+      # NT synchronization primitive emulation
+      NTSYNC = yes;
+
       # Preemptive Full Tickless Kernel at 1000Hz
       HZ = freeform "1000";
       HZ_1000 = yes;
+
+      # Alternative zpool for zswap
+      Z3FOLD = yes;
     } // lib.optionalAttrs (isLqx) {
       # Google's BBRv3 TCP congestion Control
       TCP_CONG_BBR = yes;
       DEFAULT_BBR = yes;
-      DEFAULT_TCP_CONG = freeform "bbr";
 
       # PDS Process Scheduler
       SCHED_ALT = yes;
       SCHED_PDS = yes;
 
+      # https://github.com/damentz/liquorix-package/commit/a7055b936c0f4edb8f6afd5263fe1d2f8a5cd877
+      RCU_BOOST = no;
+      RCU_LAZY = no;
+
       # Swap storage is compressed with LZ4 using zswap
       ZSWAP_COMPRESSOR_DEFAULT_LZ4  = lib.mkOptionDefault yes;
       ZSWAP_COMPRESSOR_DEFAULT_ZSTD = lib.mkDefault no;
+      ZSWAP_ZPOOL_DEFAULT_Z3FOLD = yes;
 
       # Fix error: unused option: XXX.
       CFS_BANDWIDTH = lib.mkForce (option no);
@@ -96,9 +109,6 @@ let
       SCHED_CORE = lib.mkForce (option no);
       UCLAMP_TASK = lib.mkForce (option no);
       UCLAMP_TASK_GROUP = lib.mkForce (option no);
-
-      # ERROR: modpost: "sched_numa_hop_mask" [drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko] undefined!
-      MLX5_CORE = no;
     };
 
     passthru.updateScript = [ ./update-zen.py (if isLqx then "lqx" else "zen") ];
diff --git a/pkgs/os-specific/linux/kinect-audio-setup/default.nix b/pkgs/os-specific/linux/kinect-audio-setup/default.nix
index 94ae4806cf255..d8957f64dded7 100644
--- a/pkgs/os-specific/linux/kinect-audio-setup/default.nix
+++ b/pkgs/os-specific/linux/kinect-audio-setup/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   src = fetchgit {
     url = "git://git.ao2.it/kinect-audio-setup.git";
     rev = "v${version}";
-    sha256 = "sha256-bFwmWh822KvFwP/0Gu097nF5K2uCwCLMB1RtP7k+Zt0=";
+    hash = "sha256-bFwmWh822KvFwP/0Gu097nF5K2uCwCLMB1RtP7k+Zt0=";
   };
 
   # These patches are not upstream because the project has seen no
diff --git a/pkgs/os-specific/linux/libbpf/default.nix b/pkgs/os-specific/linux/libbpf/default.nix
index 6a0ee908347ca..032283711cf38 100644
--- a/pkgs/os-specific/linux/libbpf/default.nix
+++ b/pkgs/os-specific/linux/libbpf/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libbpf";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "libbpf";
     repo = "libbpf";
     rev = "v${version}";
-    sha256 = "sha256-PlGr/qZbKnaY37wikdmX/iYtP11WHShn1I7vACUgLG0=";
+    sha256 = "sha256-lcIOgghlBKrDCBDdO0hryjt8KADQd6aroQMun3ein2o=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/os-specific/linux/libzbc/default.nix b/pkgs/os-specific/linux/libzbc/default.nix
index 7bee9500429eb..5f8ec5529e942 100644
--- a/pkgs/os-specific/linux/libzbc/default.nix
+++ b/pkgs/os-specific/linux/libzbc/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libzbc";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchFromGitHub {
     owner = "westerndigitalcorporation";
     repo = "libzbc";
     rev = "v${version}";
-    sha256 = "sha256-5VqFTtWZJBP+uUKru46KKPSO+2Nh4EU4AmrA20czZOc=";
+    sha256 = "sha256-L3i3gBIfgu3mCNvCLxizwFNxBenSZsB6elCkGWdPc4Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix b/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
index d616675e497b9..8d7fb03499f55 100644
--- a/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
+++ b/pkgs/os-specific/linux/linux-wifi-hotspot/default.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "linux-wifi-hotspot";
-  version = "4.7.1";
+  version = "4.7.2";
 
   src = fetchFromGitHub {
     owner = "lakinduakash";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-yPTnv96n1mV7aN6hf7wSvJIBfT7v9+jjjSoEcpzLRB8=";
+    sha256 = "sha256-+WHYWQ4EyAt+Kq0LHEgC7Kk5HpIqThz6W3PIdW8Wojk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/nfs-utils/default.nix b/pkgs/os-specific/linux/nfs-utils/default.nix
index 88a4f33b2f3f0..e3b8bc97e4d7b 100644
--- a/pkgs/os-specific/linux/nfs-utils/default.nix
+++ b/pkgs/os-specific/linux/nfs-utils/default.nix
@@ -1,7 +1,7 @@
 { stdenv, fetchurl, fetchpatch, lib, pkg-config, util-linux, libcap, libtirpc, libevent
 , sqlite, libkrb5, kmod, libuuid, keyutils, lvm2, systemd, coreutils, tcp_wrappers
-, python3, buildPackages, nixosTests, rpcsvc-proto
-, enablePython ? true
+, python3, buildPackages, nixosTests, rpcsvc-proto, openldap
+, enablePython ? true, enableLdap ? true
 }:
 
 let
@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "nfs-utils";
-  version = "2.6.2";
+  version = "2.6.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/nfs-utils/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-UgCHPoHE1hDiRi/CYv4YE18tvni3l5+VrM0VmuZNUBE=";
+    hash = "sha256-AbOw+5x9C7q/URTHNlQgMHSMeI7C/Zc0dEIB6bChEZ0=";
   };
 
   # libnfsidmap is built together with nfs-utils from the same source,
@@ -26,7 +26,8 @@ stdenv.mkDerivation rec {
   buildInputs = [
     libtirpc libcap libevent sqlite lvm2
     libuuid keyutils libkrb5 tcp_wrappers
-  ] ++ lib.optional enablePython python3;
+  ] ++ lib.optional enablePython python3
+    ++ lib.optional enableLdap  openldap;
 
   enableParallelBuilding = true;
 
@@ -47,7 +48,7 @@ stdenv.mkDerivation rec {
       "--with-pluginpath=${placeholder "lib"}/lib/libnfsidmap" # this installs libnfsidmap
       "--with-rpcgen=${buildPackages.rpcsvc-proto}/bin/rpcgen"
       "--with-modprobedir=${placeholder "out"}/etc/modprobe.d"
-    ];
+    ] ++ lib.optional enableLdap "--with-ldap";
 
   patches = lib.optionals stdenv.hostPlatform.isMusl [
     # http://openwall.com/lists/musl/2015/08/18/10
@@ -68,7 +69,7 @@ stdenv.mkDerivation rec {
       substituteInPlace systemd/nfs-utils.service \
         --replace "/bin/true" "${coreutils}/bin/true"
 
-      substituteInPlace tools/nfsrahead/Makefile.in \
+      substituteInPlace tools/nfsrahead/Makefile.in systemd/Makefile.in \
         --replace "/usr/lib/udev/rules.d/" "$out/lib/udev/rules.d/"
 
       substituteInPlace utils/mount/Makefile.in \
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8 b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
index 89c8e511154d8..9ef46b564dda0 100644
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8
@@ -19,6 +19,8 @@
 .Op Fl -fast
 .Op Fl -rollback
 .br
+.Op Fl -file | f Ar path
+.Op Fl -attr | A Ar attrPath
 .Op Fl -flake Ar flake-uri
 .Op Fl -no-flake
 .Op Fl -recreate-lock-file
@@ -62,11 +64,15 @@
 .Sh DESCRIPTION
 This command updates the system so that it corresponds to the
 configuration specified in
-.Pa /etc/nixos/configuration.nix
-or
-.Pa /etc/nixos/flake.nix Ns
-\&. Thus, every time you modify the configuration or any other NixOS module, you
-must run
+.Pa /etc/nixos/configuration.nix Ns
+,
+.Pa /etc/nixos/flake.nix
+or the file and attribute specified by the
+.Fl -file
+and/or
+.Fl -attr
+options. Thus, every time you modify the configuration or any other NixOS
+module, you must run
 .Nm
 to make the changes take effect. It builds the new system in
 .Pa /nix/store Ns
@@ -386,6 +392,32 @@ system with
 .Ic sudo Ns
 \&. Setting this option allows deploying as a non-root user.
 .
+.It Fl -file Ar path , Fl f Ar path
+Enable and build the NixOS system from the specified file. The file must
+evaluate to an attribute set, and it must contain a valid NixOS configuration
+at attribute
+.Va attrPath Ns
+\&. This is useful for building a NixOS system from a nix file that is not
+a flake or a NixOS configuration module. Attribute set a with valid NixOS
+configuration can be made using
+.Va nixos
+function in nixpkgs or importing and calling
+.Pa nixos/lib/eval-config.nix
+from nixpkgs. If specified without
+.Fl -attr
+option, builds the configuration from the top-level
+attribute of the file.
+.
+.It Fl -attr Ar attrPath , Fl A Ar attrPath
+Enable and build the NixOS system from nix file and use the specified attribute
+path from file specified by the
+.Fl -file
+option. If specified without
+.Fl -file
+option, uses
+.Pa default.nix
+in current directory.
+.
 .It Fl -flake Va flake-uri Ns Op Va #name
 Build the NixOS system from the specified flake. It defaults to the directory
 containing the target of the symlink
diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index fb7c8b2322a7a..03b2dbfbeb66f 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -34,6 +34,9 @@ targetHost=
 remoteSudo=
 verboseScript=
 noFlake=
+attr=
+buildFile=default.nix
+buildingAttribute=1
 installBootloader=
 json=
 
@@ -58,6 +61,24 @@ while [ "$#" -gt 0 ]; do
         if [ -n "$action" ]; then showSyntax; fi
         action="$i"
         ;;
+      --file|-f)
+        if [ -z "$1" ]; then
+            log "$0: '$i' requires an argument"
+            exit 1
+        fi
+        buildFile="$1"
+        buildingAttribute=
+        shift 1
+        ;;
+      --attr|-A)
+        if [ -z "$1" ]; then
+            log "$0: '$i' requires an argument"
+            exit 1
+        fi
+        attr="$1"
+        buildingAttribute=
+        shift 1
+        ;;
       --install-grub)
         log "$0: --install-grub deprecated, use --install-bootloader instead"
         installBootloader=1
@@ -345,6 +366,12 @@ if [[ "$action" = switch || "$action" = boot || "$action" = test ]]; then
     canRun=1
 fi
 
+# Verify that user is not trying to use attribute building and flake
+# at the same time
+if [[ -z $buildingAttribute && -n $flake ]]; then
+    log "error: '--flake' cannot be used with '--file' or '--attr'"
+    exit 1
+fi
 
 # If ‘--upgrade’ or `--upgrade-all` is given,
 # run ‘nix-channel --update nixos’.
@@ -426,7 +453,10 @@ trap cleanup EXIT
 
 # Re-execute nixos-rebuild from the Nixpkgs tree.
 if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast ]]; then
-    if [[ -z $flake ]]; then
+    if [[ -z $buildingAttribute ]]; then
+        p=$(runCmd nix-build --no-out-link $buildFile -A "${attr:+$attr.}config.system.build.nixos-rebuild" "${extraBuildFlags[@]}")
+        SHOULD_REEXEC=1
+    elif [[ -z $flake ]]; then
         if p=$(runCmd nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then
             SHOULD_REEXEC=1
         fi
@@ -448,7 +478,10 @@ fi
 
 # Find configuration.nix and open editor instead of building.
 if [ "$action" = edit ]; then
-    if [[ -z $flake ]]; then
+    if [[ -n $attr || -n $buildFile ]]; then
+        log "error: '--file' and '--attr' are not supported with 'edit'"
+        exit 1
+    elif [[ -z $flake ]]; then
         NIXOS_CONFIG=${NIXOS_CONFIG:-$(runCmd nix-instantiate --find-file nixos-config)}
         if [[ -d $NIXOS_CONFIG ]]; then
             NIXOS_CONFIG=$NIXOS_CONFIG/default.nix
@@ -490,31 +523,38 @@ prebuiltNix() {
     fi
 }
 
-if [[ -n $buildNix && -z $flake ]]; then
-    log "building Nix..."
+getNixDrv() {
     nixDrv=
-    if ! nixDrv="$(runCmd nix-instantiate '<nixpkgs/nixos>' --add-root "$tmpDir/nix.drv" --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then
-        if ! nixDrv="$(runCmd nix-instantiate '<nixpkgs>' --add-root "$tmpDir/nix.drv" --indirect -A nix "${extraBuildFlags[@]}")"; then
-            if ! nixStorePath="$(runCmd nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A "$(nixSystem)" | sed -e 's/^"//' -e 's/"$//')"; then
-                nixStorePath="$(prebuiltNix "$(uname -m)")"
-            fi
-            if ! runCmd nix-store -r "$nixStorePath" --add-root "${tmpDir}/nix" --indirect \
-                --option extra-binary-caches https://cache.nixos.org/; then
-                log "warning: don't know how to get latest Nix"
-            fi
-            # Older version of nix-store -r don't support --add-root.
-            [ -e "$tmpDir/nix" ] || ln -sf "$nixStorePath" "$tmpDir/nix"
-            if [ -n "$buildHost" ]; then
-                remoteNixStorePath="$(runCmd prebuiltNix "$(buildHostCmd uname -m)")"
-                remoteNix="$remoteNixStorePath/bin"
-                if ! buildHostCmd nix-store -r "$remoteNixStorePath" \
-                  --option extra-binary-caches https://cache.nixos.org/ >/dev/null; then
-                    remoteNix=
-                    log "warning: don't know how to get latest Nix"
-                fi
-            fi
+
+    if [[ -z $buildingAttribute ]]; then
+        if nixDrv="$(runCmd nix-instantiate $buildFile --add-root "$tmpDir/nix.drv" --indirect -A ${attr:+$attr.}config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi
+    fi
+    if nixDrv="$(runCmd nix-instantiate '<nixpkgs/nixos>' --add-root "$tmpDir/nix.drv" --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then return; fi
+    if nixDrv="$(runCmd nix-instantiate '<nixpkgs>' --add-root "$tmpDir/nix.drv" --indirect -A nix "${extraBuildFlags[@]}")"; then return; fi
+
+    if ! nixStorePath="$(runCmd nix-instantiate --eval '<nixpkgs/nixos/modules/installer/tools/nix-fallback-paths.nix>' -A "$(nixSystem)" | sed -e 's/^"//' -e 's/"$//')"; then
+        nixStorePath="$(prebuiltNix "$(uname -m)")"
+    fi
+    if ! runCmd nix-store -r "$nixStorePath" --add-root "${tmpDir}/nix" --indirect \
+        --option extra-binary-caches https://cache.nixos.org/; then
+        log "warning: don't know how to get latest Nix"
+    fi
+    # Older version of nix-store -r don't support --add-root.
+    [ -e "$tmpDir/nix" ] || ln -sf "$nixStorePath" "$tmpDir/nix"
+    if [ -n "$buildHost" ]; then
+        remoteNixStorePath="$(runCmd prebuiltNix "$(buildHostCmd uname -m)")"
+        remoteNix="$remoteNixStorePath/bin"
+        if ! buildHostCmd nix-store -r "$remoteNixStorePath" \
+          --option extra-binary-caches https://cache.nixos.org/ >/dev/null; then
+            remoteNix=
+            log "warning: don't know how to get latest Nix"
         fi
     fi
+}
+
+if [[ -n $buildNix && -z $flake ]]; then
+    log "building Nix..."
+    getNixDrv
     if [ -a "$nixDrv" ]; then
         nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null
         if [ -n "$buildHost" ]; then
@@ -549,7 +589,9 @@ if [ "$action" = repl ]; then
     # This is a very end user command, implemented using sub-optimal means.
     # You should feel free to improve its behavior, as well as resolve tech
     # debt in "breaking" ways. Humans adapt quite well.
-    if [[ -z $flake ]]; then
+    if [[ -z $buildingAttribute ]]; then
+        exec nix repl --file $buildFile $attr "${extraBuildFlags[@]}"
+    elif [[ -z $flake ]]; then
         exec nix repl '<nixpkgs/nixos>' "${extraBuildFlags[@]}"
     else
         if [[ -n "${lockFlags[0]}" ]]; then
@@ -702,7 +744,9 @@ fi
 if [ -z "$rollback" ]; then
     log "building the system configuration..."
     if [[ "$action" = switch || "$action" = boot ]]; then
-        if [[ -z $flake ]]; then
+        if [[ -z $buildingAttribute ]]; then
+            pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")"
+        elif [[ -z $flake ]]; then
             pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
         else
             pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
@@ -710,19 +754,25 @@ if [ -z "$rollback" ]; then
         copyToTarget "$pathToConfig"
         targetHostSudoCmd nix-env -p "$profile" --set "$pathToConfig"
     elif [[ "$action" = test || "$action" = build || "$action" = dry-build || "$action" = dry-activate ]]; then
-        if [[ -z $flake ]]; then
+        if [[ -z $buildingAttribute ]]; then
+            pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.toplevel" "${extraBuildFlags[@]}")"
+        elif [[ -z $flake ]]; then
             pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
         else
             pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
         fi
     elif [ "$action" = build-vm ]; then
-        if [[ -z $flake ]]; then
+        if [[ -z $buildingAttribute ]]; then
+            pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vm" "${extraBuildFlags[@]}")"
+        elif [[ -z $flake ]]; then
             pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
         else
             pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vm" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
         fi
     elif [ "$action" = build-vm-with-bootloader ]; then
-        if [[ -z $flake ]]; then
+        if [[ -z $buildingAttribute ]]; then
+            pathToConfig="$(nixBuild $buildFile -A "${attr:+$attr.}config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}")"
+        elif [[ -z $flake ]]; then
             pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
         else
             pathToConfig="$(nixFlakeBuild "$flake#$flakeAttr.config.system.build.vmWithBootLoader" "${extraBuildFlags[@]}" "${lockFlags[@]}")"
diff --git a/pkgs/os-specific/linux/numad/default.nix b/pkgs/os-specific/linux/numad/default.nix
index 6ea970a11769d..0a52222cebcef 100644
--- a/pkgs/os-specific/linux/numad/default.nix
+++ b/pkgs/os-specific/linux/numad/default.nix
@@ -1,26 +1,29 @@
-{ lib, stdenv, fetchgit }:
+{ lib, stdenv, fetchgit, unstableGitUpdater, writeShellScript }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "numad";
-  version = "0.5";
+  version = "0.5-unstable-2023-09-06";
 
   src = fetchgit {
     url = "https://pagure.io/numad.git";
-    rev = "334278ff3d774d105939743436d7378a189e8693";
-    sha256 = "sha256-6nrbfooUI1ufJhsPf68li5584oKQcznXQlxfpStuX5I=";
+    rev = "3399d89305b6560e27e70aff4ad9fb403dedf947";
+    hash = "sha256-USEffVcakaAbilqijJmpro92ujvxbglcXxyBlntMxaI=";
   };
 
-  hardeningDisable = [ "format" ];
-
-  patches = [
-    ./numad-linker-flags.patch
-  ];
   postPatch = ''
     substituteInPlace Makefile --replace "install -m" "install -Dm"
   '';
 
   makeFlags = [ "prefix=$(out)" ];
 
+  passthru.updateScript = unstableGitUpdater {
+    tagConverter = writeShellScript "tagConverter" ''
+      read tag
+      test "$tag" = "0" \
+        && tag=0.5; echo "$tag"
+    '';
+  };
+
   meta = with lib; {
     description = "User-level daemon that monitors NUMA topology and processes resource consumption to facilitate good NUMA resource access";
     mainProgram = "numad";
diff --git a/pkgs/os-specific/linux/numad/numad-linker-flags.patch b/pkgs/os-specific/linux/numad/numad-linker-flags.patch
deleted file mode 100644
index 97f3dc8b6cf7f..0000000000000
--- a/pkgs/os-specific/linux/numad/numad-linker-flags.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 9eb3cc5c51d846c8c8b750a4eb55545d7b5fea6c Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Wed, 23 Apr 2014 15:41:26 -0400
-Subject: [PATCH] use LDLIBS for linker flags
-
-When you put -lfoo into the dependency line of make, it forces it to
-search /lib and /usr/lib for files to link against.  This can cause
-problems when trying to cross-compile or build for different ABIs.
-Use the standard LDLIBS variable instead.
-
-URL: https://bugs.gentoo.org/505760
-Reported-by: Georgi Georgiev <chutzimir@gmail.com>
-Signed-off-by: Mike Frysinger <vapier@gentoo.org>
----
- Makefile | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/Makefile b/Makefile
-index f3838b4..f2e9a6e 100644
---- a/Makefile
-+++ b/Makefile
-@@ -31,7 +31,8 @@ docdir := ${prefix}/share/doc
- 
- all: numad
- 
--numad: numad.o -lpthread
-+LDLIBS := -lpthread
-+numad: numad.o
- 
- AR ?= ar
- RANLIB ?= ranlib
--- 
-1.9.2
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index fe2e9951bf855..568027999efa3 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -33,12 +33,12 @@ rec {
   stable = if stdenv.hostPlatform.system == "i686-linux" then legacy_390 else latest;
 
   production = generic {
-    version = "550.90.07";
-    sha256_64bit = "sha256-Uaz1edWpiE9XOh0/Ui5/r6XnhB4iqc7AtLvq4xsLlzM=";
-    sha256_aarch64 = "sha256-uJa3auRlMHr8WyacQL2MyyeebqfT7K6VU0qR7LGXFXI=";
-    openSha256 = "sha256-VLmh7eH0xhEu/AK+Osb9vtqAFni+lx84P/bo4ZgCqj8=";
-    settingsSha256 = "sha256-sX9dHEp9zH9t3RWp727lLCeJLo8QRAGhVb8iN6eX49g=";
-    persistencedSha256 = "sha256-qe8e1Nxla7F0U88AbnOZm6cHxo57pnLCqtjdvOvq9jk=";
+    version = "550.100";
+    sha256_64bit = "sha256-imtfsoe/EfUFZzR4S9pkwQZKCcKqefayJewPtW0jgC0=";
+    sha256_aarch64 = "sha256-AWHdMtCci8i7maNjVapOT6kyVuFaP81jJyTRLjEyMzo=";
+    openSha256 = "sha256-3g0f88xGMTB0mx4kVan3ipLtnJFFIKi58ss/1lqC3Sw=";
+    settingsSha256 = "sha256-cDxhzZCDLtXOas5OlodNYGIuscpKmIGyvhC/kAQaxLc=";
+    persistencedSha256 = "sha256-gXHBR2+1+YZE2heRArfrZpEF3rO7R92ChuQN+ISpil8=";
   };
 
   latest = selectHighestVersion production (generic {
diff --git a/pkgs/os-specific/linux/oxtools/default.nix b/pkgs/os-specific/linux/oxtools/default.nix
index c16e12ab5e142..fcb5d17dee152 100644
--- a/pkgs/os-specific/linux/oxtools/default.nix
+++ b/pkgs/os-specific/linux/oxtools/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "0xtools";
-  version = "1.2.4";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "tanelpoder";
     repo = "0xtools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-h0/HIbwb1CvFUh/NpozDUCjYGCH647lC7JhbpDCvaLk=";
+    hash = "sha256-S2jGF6wyjE9okbren/+p37zDr+eHUE8gJe/sbsXX4f4=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/policycoreutils/default.nix b/pkgs/os-specific/linux/policycoreutils/default.nix
index bcb5dafa137b6..6a2296fda4fce 100644
--- a/pkgs/os-specific/linux/policycoreutils/default.nix
+++ b/pkgs/os-specific/linux/policycoreutils/default.nix
@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "policycoreutils";
-  version = "3.6";
+  version = "3.7";
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${se_url}/${version}/policycoreutils-${version}.tar.gz";
-    hash = "sha256-p2rEMepAo1qDFkzpAHkJwcbBL9EFZif2IhROSnBcCiw=";
+    hash = "sha256-WP5OSB7ftEVsEUklRC4ROJ3xc5SSWs26PeIRFFzl6pg=";
   };
 
   postPatch = ''
diff --git a/pkgs/os-specific/linux/power-profiles-daemon/default.nix b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
index f7145bc02ebe7..be984c5648607 100644
--- a/pkgs/os-specific/linux/power-profiles-daemon/default.nix
+++ b/pkgs/os-specific/linux/power-profiles-daemon/default.nix
@@ -127,6 +127,6 @@ stdenv.mkDerivation rec {
     mainProgram = "powerprofilesctl";
     platforms = platforms.linux;
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ mvnetbiz picnoir ];
+    maintainers = with maintainers; [ mvnetbiz picnoir lyndeno ];
   };
 }
diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 3a3016d14b4be..664e499cd1d45 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "19.4.0-54962";
+  version = "19.4.1-54985";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-c/MrWUvwY/Z38uOBbetJSVkZlwkdzFhw6wpk1L0BuQs=";
+    hash = "sha256-VBHCsxaMI6mfmc/iQ4hJW/592rKck9HilTX2Hq7Hb5s=";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/os-specific/linux/pscircle/default.nix b/pkgs/os-specific/linux/pscircle/default.nix
index b34a2d7914b32..a1e80ffac0b77 100644
--- a/pkgs/os-specific/linux/pscircle/default.nix
+++ b/pkgs/os-specific/linux/pscircle/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
     owner = "mildlyparallel";
     repo = "pscircle";
     rev = "v${version}";
-    sha256 = "sha256-bqbQBNscNfoqXprhoFUnUQO88YQs9xDhD4d3KHamtG0=";
+    hash = "sha256-bqbQBNscNfoqXprhoFUnUQO88YQs9xDhD4d3KHamtG0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/os-specific/linux/rtl8812au/default.nix b/pkgs/os-specific/linux/rtl8812au/default.nix
index d9fd92c4a9f09..6aab44d92c72e 100644
--- a/pkgs/os-specific/linux/rtl8812au/default.nix
+++ b/pkgs/os-specific/linux/rtl8812au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8812au";
-  version = "${kernel.version}-unstable-2024-03-20";
+  version = "${kernel.version}-unstable-2024-06-13";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "8812au-20210629";
-    rev = "8be3a1d7acf60f77c5d9c33b690b8d7301bdf127";
-    hash = "sha256-HchnRezJNzimOB72Sv5BwL4oXuxPxloAHVuaL+warj8=";
+    repo = "8812au-20210820";
+    rev = "c0efee9cd121d9f0c815d9771475f76339a8f7d3";
+    hash = "sha256-ZS0iUb77XnXR5BUMeQ1EDuly7hStRt430ECueFW4v4w=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     description = "Driver for Realtek 802.11ac, rtl8812au, provides the 8812au mod";
-    homepage = "https://github.com/morrownr/8812au-20210629";
+    homepage = "https://github.com/morrownr/8812au-20210820";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ moni ];
diff --git a/pkgs/os-specific/linux/rtl8814au/default.nix b/pkgs/os-specific/linux/rtl8814au/default.nix
index bef60b52814d8..fbe1d62f28d3d 100644
--- a/pkgs/os-specific/linux/rtl8814au/default.nix
+++ b/pkgs/os-specific/linux/rtl8814au/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "rtl8814au";
-  version = "${kernel.version}-unstable-2024-03-19";
+  version = "${kernel.version}-unstable-2024-05-26";
 
   src = fetchFromGitHub {
     owner = "morrownr";
     repo = "8814au";
-    rev = "d7945c1e0244c83cbbad4da331648246f12eaee9";
-    hash = "sha256-idjHlvyFpQgLGfNAPpZKRnLdXnAogUW3qGHC1WzGVmA=";
+    rev = "810573647b837d88c4191597a0ea6d226f69f64c";
+    hash = "sha256-AaOnUy3igocsCF/FNogn+z+QcQiid7U7XimE68wAco0=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
index b82a9e6816345..434397ebc7c1a 100644
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -1,19 +1,20 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, kernel
-, bc
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  bc,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rtl8821ce";
-  version = "${kernel.version}-unstable-2024-01-20";
+  version = "${kernel.version}-unstable-2024-03-26";
 
   src = fetchFromGitHub {
     owner = "tomaspinho";
     repo = "rtl8821ce";
-    rev = "66983b69120a13699acf40a12979317f29012111";
-    hash = "sha256-Zxb9cOgP67QdCeTNEme0tAsBqd9j/2k+gcE1QKkUQU4=";
+    rev = "f119398d868b1a3395f40c1df2e08b57b2c882cd";
+    hash = "sha256-EfpKa5ZRBVM5T8EVim3cVX1PP1UM9CyG6tN5Br8zYww=";
   };
 
   hardeningDisable = [ "pic" ];
@@ -34,12 +35,16 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     description = "Realtek rtl8821ce driver";
     homepage = "https://github.com/tomaspinho/rtl8821ce";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ hhm ];
-    broken = stdenv.isAarch64 || ((lib.versions.majorMinor kernel.version) == "5.4" && kernel.isHardened);
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      hhm
+      defelo
+    ];
+    broken =
+      stdenv.isAarch64 || ((lib.versions.majorMinor kernel.version) == "5.4" && kernel.isHardened);
   };
-}
+})
diff --git a/pkgs/os-specific/linux/rtl8852bu/default.nix b/pkgs/os-specific/linux/rtl8852bu/default.nix
index cc0f495b8122f..4b5366cab9d0c 100644
--- a/pkgs/os-specific/linux/rtl8852bu/default.nix
+++ b/pkgs/os-specific/linux/rtl8852bu/default.nix
@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, kernel, bc, nukeReferences }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "rtl8852bu";
-  version = "${kernel.version}-unstable-2024-03-28";
+  version = "${kernel.version}-unstable-2024-05-25";
 
   src = fetchFromGitHub {
     owner = "morrownr";
-    repo = "rtl8852bu";
-    rev = "f6aaa3c0094c541d9b0347926c76c1e9cc4a49d1";
-    hash = "sha256-Jbd6nixo873LU74klhhQU1qD3ahxEnywdqcF89LTRxc=";
+    repo = pname;
+    rev = "1acc7aa085bffec21a91fdc9e293378e06bf25e7";
+    hash = "sha256-22vzAdzzM5YnfU8kRWSK3HXxw6BA4FOWXLdWEb7T5IE=";
   };
 
   nativeBuildInputs = [ bc nukeReferences ] ++ kernel.moduleBuildDependencies;
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   meta = with lib; {
-    description = "Driver for Realtek rtl8852au and rtl8832bu chipsets, provides the 8852au mod";
+    description = "Driver for Realtek rtl8852bu and rtl8832bu chipsets, provides the 8852bu mod";
     homepage = "https://github.com/morrownr/rtl8852bu";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/sd-switch/default.nix b/pkgs/os-specific/linux/sd-switch/default.nix
index b8dfd36d5919c..f14595d655be4 100644
--- a/pkgs/os-specific/linux/sd-switch/default.nix
+++ b/pkgs/os-specific/linux/sd-switch/default.nix
@@ -1,6 +1,6 @@
 { lib, fetchFromSourcehut, rustPlatform, nix-update-script }:
 
-let version = "0.5.0";
+let version = "0.5.1";
 in rustPlatform.buildRustPackage {
   pname = "sd-switch";
   inherit version;
@@ -9,10 +9,10 @@ in rustPlatform.buildRustPackage {
     owner = "~rycee";
     repo = "sd-switch";
     rev = version;
-    hash = "sha256-TESS+CwwEugAz+grzndunAoKF9Or/Jl7tftL392fUaM=";
+    hash = "sha256-Kns49Qv3oWNmbLoLTKIcWIewDz4cR7uyMA3IHnhKyxA=";
   };
 
-  cargoHash = "sha256-QEnleFwEIoKATupj0sSV/GUztQoozEsb3SEgnfFzAfw=";
+  cargoHash = "sha256-r20dJMF+0q3XLm2hn9/LTv43ApmhjJNgeiMCLfwBnOk=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/os-specific/linux/sysdig/default.nix b/pkgs/os-specific/linux/sysdig/default.nix
index 1162b3363caee..f1abf6a7389c4 100644
--- a/pkgs/os-specific/linux/sysdig/default.nix
+++ b/pkgs/os-specific/linux/sysdig/default.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation {
     bpftools
   ] ++ lib.optionals (kernel != null) kernel.moduleBuildDependencies;
 
-  hardeningDisable = [ "pic" ];
+  hardeningDisable = [ "pic" "zerocallusedregs" ];
 
   postUnpack = ''
     cp -r ${
diff --git a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
index 211e03637d4ee..9f3d22c8a7077 100644
--- a/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
+++ b/pkgs/os-specific/linux/trace-cmd/kernelshark.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchzip, qtbase, qtscxml, cmake, asciidoc
-, docbook_xsl, json_c, mesa_glu, freeglut, trace-cmd, pkg-config
+, docbook_xsl, json_c, mesa_glu, libglut, trace-cmd, pkg-config
 , libtraceevent, libtracefs, freefont_ttf, wrapQtAppsHook, qtwayland
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];
 
-  buildInputs = [ qtbase qtscxml qtwayland json_c mesa_glu freeglut libtraceevent libtracefs trace-cmd ];
+  buildInputs = [ qtbase qtscxml qtwayland json_c mesa_glu libglut libtraceevent libtracefs trace-cmd ];
 
   cmakeFlags = [
     "-D_INSTALL_PREFIX=${placeholder "out"}"
diff --git a/pkgs/os-specific/linux/usbguard/default.nix b/pkgs/os-specific/linux/usbguard/default.nix
index 139d6b63d8dcd..755ea603e2a5b 100644
--- a/pkgs/os-specific/linux/usbguard/default.nix
+++ b/pkgs/os-specific/linux/usbguard/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     owner = "USBGuard";
     repo = pname;
     rev = "usbguard-${version}";
-    sha256 = "sha256-uwNoKczmVOMpkU4KcKTOtbcTHiYVGXjk/rVbqMl5pGk=";
+    hash = "sha256-uwNoKczmVOMpkU4KcKTOtbcTHiYVGXjk/rVbqMl5pGk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/os-specific/windows/mingw-w64/default.nix b/pkgs/os-specific/windows/mingw-w64/default.nix
index ba2b243a9408a..36cdaf84aab61 100644
--- a/pkgs/os-specific/windows/mingw-w64/default.nix
+++ b/pkgs/os-specific/windows/mingw-w64/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , windows
-, fetchurl
 , autoreconfHook
 , mingw_w64_headers
 }: