push sheeet

2025-10-09 14:15:47 +02:00
commit 646b892680
49168 changed files with 5897842 additions and 0 deletions
--- a/pkgs/os-specific/linux/acer-wmi-battery/default.nix
+++ b/pkgs/os-specific/linux/acer-wmi-battery/default.nix
@@ -0,0 +1,49 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+let
+  release = "0.1.0-unstable-2025-04-24";
+
+in
+stdenv.mkDerivation {
+  pname = "acer-wmi-battery";
+  version = "${kernel.version}-${release}";
+
+  src = fetchFromGitHub {
+    owner = "frederik-h";
+    repo = "acer-wmi-battery";
+    rev = "0889d3ea54655eaa88de552b334911ce7375952f";
+    hash = "sha256-mI6Ob9BmNfwqT3nndWf3jkz8f7tV10odkTnfApsNo+A=";
+  };
+
+  makeFlags = kernelModuleMakeFlags;
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail '/lib/modules/$(shell uname -r)/build' ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build
+  '';
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    find . -name '*.ko' -exec xz -f {} \;
+    install -Dm444 -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/platform/x86 *.ko.xz
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Driver for the Acer WMI battery health control interface";
+    homepage = "https://github.com/frederik-h/acer-wmi-battery";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ peterhoeg ];
+  };
+}
--- a/pkgs/os-specific/linux/acpi-call/default.nix
+++ b/pkgs/os-specific/linux/acpi-call/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "acpi-call";
+  version = "1.2.2";
+  name = "${pname}-${version}-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "nix-community";
+    repo = "acpi_call";
+    rev = "v${version}";
+    sha256 = "1s7h9y3adyfhw7cjldlfmid79lrwz3vqlvziw9nwd6x5qdj4w9vp";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    install -D acpi_call.ko $out/lib/modules/${kernel.modDirVersion}/misc/acpi_call.ko
+    install -D -m755 examples/turn_off_gpu.sh $out/bin/test_discrete_video_off.sh
+  '';
+
+  meta = with lib; {
+    maintainers = with maintainers; [
+      raskin
+      mic92
+    ];
+    homepage = "https://github.com/nix-community/acpi_call";
+    platforms = platforms.linux;
+    description = "Module allowing arbitrary ACPI calls; use case: hybrid video";
+    mainProgram = "test_discrete_video_off.sh";
+    license = licenses.gpl3Plus;
+  };
+}
--- a/pkgs/os-specific/linux/ajantv2/default.nix
+++ b/pkgs/os-specific/linux/ajantv2/default.nix
@@ -0,0 +1,49 @@
+{
+  stdenv,
+  kernel,
+  kernelModuleMakeFlags,
+  libajantv2,
+}:
+stdenv.mkDerivation {
+  name = "ajantv2-module-${libajantv2.version}-${kernel.version}";
+
+  inherit (libajantv2) src;
+  sourceRoot = "${libajantv2.src.name}/driver/linux";
+
+  patches = [
+    ./fix-linux-6.15.patch
+  ];
+  patchFlags = "-p3";
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags;
+
+  preBuild = ''
+    chmod -R +w ../../
+  '';
+
+  enableParallelBuilding = true;
+
+  buildFlags = [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    install -D ajantv2.ko $out/lib/modules/${kernel.modDirVersion}/misc/ajantv2.ko
+    install -D ajardma.ko $out/lib/modules/${kernel.modDirVersion}/misc/ajardma.ko
+  '';
+
+  meta = {
+    inherit (libajantv2.meta) license homepage maintainers;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    description = "AJA video driver";
+    # FTB for hardened 5.10/5.15 kernels
+    broken = kernel.kernelOlder "6" && kernel.isHardened;
+  };
+}
--- a/pkgs/os-specific/linux/ajantv2/fix-linux-6.15.patch
+++ b/pkgs/os-specific/linux/ajantv2/fix-linux-6.15.patch
@@ -0,0 +1,61 @@
+From 8eacfa908f7d9b366d68e0ea0516fdd867a1e492 Mon Sep 17 00:00:00 2001
+From: Luke Granger-Brown <git@lukegb.com>
+Date: Sun, 22 Jun 2025 19:38:10 +0100
+Subject: [PATCH 5/5] Use ccflags-y instead of EXTRA_CFLAGS, which stopped
+ working in Linux 6.15
+
+---
+ driver/linux/Makefile | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/driver/linux/Makefile b/driver/linux/Makefile
+index f714ff9b..da4ee90b 100644
+--- a/driver/linux/Makefile
+++ b/driver/linux/Makefile
+@@ -25,10 +25,10 @@ VERSIONING 	 = -DSDKVER_MAJ=$(SDKVER_MAJ) -DSDKVER_MIN=$(SDKVER_MIN) -DSDKVER_PN
+ DISTRO_INFO  = -DDISTRO_TYPE=$(DISTRO_TYPE) -DDISTRO_IS_RHEL_LIKE=$(DISTRO_IS_RHEL_LIKE) \
+ 			   -DDISTRO_MAJ_VERSION=$(DISTRO_MAJ_VERSION) -DDISTRO_MIN_VERSION=$(DISTRO_MIN_VERSION)  \
+ 			   -DDISTRO_KERNEL_PKG_MAJ=$(DISTRO_KERNEL_PKG_MAJ) -DDISTRO_KERNEL_PKG_MIN=$(DISTRO_KERNEL_PKG_MIN) -DDISTRO_KERNEL_PKG_PNT=$(DISTRO_KERNEL_PKG_PNT)
+-EXTRA_CFLAGS += -DAJALinux -DXENA2 $(DBG) -D$(NTV2TARGET) -D$(A_ARCH) $(EXTRA_DEPS) $(VERSIONING) $(DISTRO_INFO) $(INCLUDES) -Wall -Wno-implicit-fallthrough
+ccflags-y += -DAJALinux -DXENA2 $(DBG) -D$(NTV2TARGET) -D$(A_ARCH) $(EXTRA_DEPS) $(VERSIONING) $(DISTRO_INFO) $(INCLUDES) -Wall -Wno-implicit-fallthrough
+ 
+ ifdef AJA_HEVC
+-	EXTRA_CFLAGS += -DAJA_HEVC=$(AJA_HEVC)
+	ccflags-y += -DAJA_HEVC=$(AJA_HEVC)
+ endif
+ 
+ # if rdma is set
+@@ -73,7 +73,7 @@ ifeq ($(NVIDIA_KO),)
+ endif
+ 
+ ifdef NVIDIA_IGPU
+-	EXTRA_CFLAGS += -DAJA_IGPU=1
+	ccflags-y += -DAJA_IGPU=1
+ ifneq ($(NVIDIA_KO),)
+ ifeq ($(NVIDIA_SYMVERS),)
+ 	NVIDIA_GEN_SYMVERS := ./nvidia-ko-to-module-symvers $(NVIDIA_KO) $(A_LINUX_DRIVER_PATH)/nvidia.symvers
+@@ -91,17 +91,17 @@ endif
+ 
+ # determine if the ko is gpl - no ko is proprietary igpu
+ ifeq ($(NVIDIA_KO),)
+-	EXTRA_CFLAGS += -I$(NVIDIA_SRC_DIR) -DAJA_RDMA=1 -DNVIDIA_PROPRIETARY=1
+	ccflags-y += -I$(NVIDIA_SRC_DIR) -DAJA_RDMA=1 -DNVIDIA_PROPRIETARY=1
+ else
+ ifeq ($(shell modinfo $(NVIDIA_KO) | grep license: | grep GPL),)
+-	EXTRA_CFLAGS += -I$(NVIDIA_SRC_DIR) -DAJA_RDMA=1 -DNVIDIA_PROPRIETARY=1
+	ccflags-y += -I$(NVIDIA_SRC_DIR) -DAJA_RDMA=1 -DNVIDIA_PROPRIETARY=1
+ else
+-	EXTRA_CFLAGS += -I$(NVIDIA_SRC_DIR) -DAJA_RDMA=1
+	ccflags-y += -I$(NVIDIA_SRC_DIR) -DAJA_RDMA=1
+ endif
+ endif
+ 
+ ifdef AJA_CREATE_DEVICE_NODES
+-	EXTRA_CFLAGS += -DAJA_CREATE_DEVICE_NODES=$(AJA_CREATE_DEVICE_NODES)
+	ccflags-y += -DAJA_CREATE_DEVICE_NODES=$(AJA_CREATE_DEVICE_NODES)
+ endif
+ 
+ AJANTV2INCS = $(A_LIB_NTV2_INC)/ajaexport.h \
+-- 
+2.49.0
+
--- a/pkgs/os-specific/linux/akvcam/default.nix
+++ b/pkgs/os-specific/linux/akvcam/default.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "akvcam";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "webcamoid";
+    repo = "akvcam";
+    rev = version;
+    sha256 = "sha256-3fs+Kfafry77SQvsAidM29g9CcfjWirteS/VdNSWVCE=";
+  };
+  sourceRoot = "${src.name}/src";
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    install -m644 -b -D akvcam.ko $out/lib/modules/${kernel.modDirVersion}/akvcam.ko
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Virtual camera driver for Linux";
+    homepage = "https://github.com/webcamoid/akvcam";
+    maintainers = with maintainers; [ freezeboy ];
+    platforms = platforms.linux;
+    license = licenses.gpl2Only;
+  };
+}
--- a/pkgs/os-specific/linux/amdgpu-i2c/default.nix
+++ b/pkgs/os-specific/linux/amdgpu-i2c/default.nix
@@ -0,0 +1,40 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+}:
+
+let
+  KDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+in
+stdenv.mkDerivation {
+  pname = "amdgpu-i2c";
+  version = "0-unstable-2024-12-16";
+
+  src = fetchFromGitHub {
+    owner = "twifty";
+    repo = "amd-gpu-i2c";
+    rev = "06ca41fd12fb90f970d3ebd4785cc26cc0a3f3b0";
+    sha256 = "sha256-GVyrwnwNSBW4OCNDqQMU6e31C4bG14arC0MPkRWfiJQ=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  buildPhase = "make -C ${KDIR} M=/build/source modules";
+  installPhase = ''
+    make -C ${KDIR} M=/build/source INSTALL_MOD_PATH="$out" modules_install
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/twifty/amd-gpu-i2c";
+    downloadPage = "https://github.com/twifty/amd-gpu-i2c";
+    description = "Exposes i2c interface to set colors on AMD GPUs";
+    broken = kernel.kernelOlder "6.1.0" || kernel.isLibre;
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ thardin ];
+  };
+}
--- a/pkgs/os-specific/linux/amneziawg/default.nix
+++ b/pkgs/os-specific/linux/amneziawg/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  srcOnly,
+  kernel,
+  kernelModuleMakeFlags,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "amneziawg";
+  version = "1.0.20240711";
+
+  src = fetchFromGitHub {
+    owner = "amnezia-vpn";
+    repo = "amneziawg-linux-kernel-module";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WOcBTxetVz2Sr62c+2aGNyohG2ydi+R+az+4qHbKprI=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  buildFlags = [
+    "apply-patches"
+    "module"
+  ];
+
+  makeFlags =
+    kernelModuleMakeFlags
+    ++ [ "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" ]
+    ++ lib.optional (lib.versionAtLeast kernel.version "5.6") "KERNEL_SOURCE_DIR=${srcOnly kernel}";
+
+  enableParallelBuilding = true;
+
+  installFlags = [
+    "DEPMOD=true"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Kernel module for the AmneziaWG";
+    homepage = "https://amnezia.org";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ averyanalex ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/os-specific/linux/apfs/default.nix
+++ b/pkgs/os-specific/linux/apfs/default.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+  nixosTests,
+}:
+
+let
+  tag = "0.3.15";
+in
+stdenv.mkDerivation {
+  pname = "apfs";
+  version = "${tag}-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "linux-apfs";
+    repo = "linux-apfs-rw";
+    rev = "v${tag}";
+    hash = "sha256-/qJ8QvnVhVXvuxeZ/UYLTXGMPPVnC7fHOSWI1B15r/M=";
+  };
+
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+  ];
+
+  passthru = {
+    tests.apfs = nixosTests.apfs;
+
+    inherit tag;
+    updateScript = ./update.sh;
+  };
+
+  meta = with lib; {
+    description = "APFS module for linux";
+    longDescription = ''
+      The Apple File System (APFS) is the copy-on-write filesystem currently
+      used on all Apple devices. This module provides a degree of experimental
+      support on Linux.
+      If you make use of the write support, expect data corruption.
+      Read-only support is somewhat more complete, with sealed volumes,
+      snapshots, and all the missing compression algorithms recently added.
+      Encryption is still not in the works though.
+    '';
+    homepage = "https://github.com/linux-apfs/linux-apfs-rw";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ Luflosi ];
+  };
+}
--- a/pkgs/os-specific/linux/apfs/update.sh
+++ b/pkgs/os-specific/linux/apfs/update.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p ripgrep common-updater-scripts
+
+set -xeu -o pipefail
+
+PACKAGE_DIR="$(realpath "$(dirname "$0")")"
+cd "$PACKAGE_DIR/.."
+while ! test -f default.nix; do cd .. ; done
+NIXPKGS_DIR="$PWD"
+
+latest_version="$(
+  list-git-tags --url=https://github.com/linux-apfs/linux-apfs-rw \
+  | sort --version-sort \
+  | tail -n1
+)"
+
+latest_version_no_v_prefix="${latest_version#"v"}"
+
+cd "$NIXPKGS_DIR"
+update-source-version linuxPackages.apfs "$latest_version_no_v_prefix" \
+  --version-key=tag
--- a/pkgs/os-specific/linux/asus-ec-sensors/default.nix
+++ b/pkgs/os-specific/linux/asus-ec-sensors/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  name = "asus-ec-sensors-${version}-${kernel.version}";
+  version = "0.1.0-unstable-2025-01-10";
+
+  src = fetchFromGitHub {
+    owner = "zeule";
+    repo = "asus-ec-sensors";
+    rev = "619d505b7055be618e9ba9d5e146fd641dbf3015";
+    sha256 = "sha256-vS8wNS53m495hmsI267R5Kq/j8Mo5491PJkUKRUpqPQ=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
+  ];
+
+  installPhase = ''
+    install asus-ec-sensors.ko -Dm444 -t ${placeholder "out"}/lib/modules/${kernel.modDirVersion}/kernel/drivers/hwmon
+  '';
+
+  meta = with lib; {
+    description = "Linux HWMON sensors driver for ASUS motherboards to read sensor data from the embedded controller";
+    homepage = "https://github.com/zeule/asus-ec-sensors";
+    license = licenses.gpl2Only;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ nickhu ];
+    broken = kernel.kernelOlder "5.11";
+  };
+}
--- a/pkgs/os-specific/linux/ax99100/default.nix
+++ b/pkgs/os-specific/linux/ax99100/default.nix
@@ -0,0 +1,65 @@
+{
+  kernel,
+  stdenv,
+  kmod,
+  lib,
+  fetchzip,
+  dos2unix,
+}:
+
+stdenv.mkDerivation {
+  pname = "ax99100";
+  version = "1.8.0";
+
+  nativeBuildInputs = [
+    dos2unix
+    kmod
+  ]
+  ++ kernel.moduleBuildDependencies;
+
+  src = fetchzip {
+    url = "https://www.asix.com.tw/en/support/download/file/1229";
+    sha256 = "1rbp1m01qr6b3nbr72vpbw89pjh8mddc60im78z2yjd951xkbcjh";
+    extension = "tar.bz2";
+  };
+
+  prePatch = ''
+    # The sources come with Windows file endings and that makes
+    # applying patches hard without first fixing the line endings.
+    dos2unix *.c *.h
+  '';
+
+  # The patches are adapted from: https://aur.archlinux.org/packages/asix-ax99100
+  #
+  # We included them here instead of fetching them, because of line
+  # ending issues that are easier to fix manually. Also the
+  # set_termios patch needs to be applied for 6.1 not for 6.0.
+  patches = [
+    ./kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
+    ./kernel-6.1-set_termios-const-ktermios.patch
+  ]
+  ++ lib.optionals (lib.versionAtLeast kernel.version "6.2") [
+    ./kernel-6.2-fix-pointer-type.patch
+    ./kernel-6.4-fix-define-semaphore.patch
+  ];
+
+  patchFlags = [ "-p0" ];
+
+  makeFlags = [ "KDIR='${kernel.dev}/lib/modules/${kernel.modDirVersion}/build'" ];
+
+  installPhase = ''
+    mkdir -p $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/tty/serial
+    cp ax99100.ko $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/tty/serial
+  '';
+
+  meta = {
+    description = "ASIX AX99100 Serial and Parallel Port driver";
+    homepage = "https://www.asix.com.tw/en/product/Interface/PCIe_Bridge/AX99100";
+    # According to the source code in the tarball, the license is gpl2.
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+
+    # Older Linux versions need more patches to work.
+    broken = lib.versionOlder kernel.version "5.4.0";
+  };
+}
--- a/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
+++ b/pkgs/os-specific/linux/ax99100/kernel-5.18-pci_free_consistent-pci_alloc_consistent.patch
@@ -0,0 +1,14 @@
+diff -pNaru5 a/ax99100_sp.h b/ax99100_sp.h
+--- ax99100_sp.h	2022-06-07 16:55:26.621034945 -0400
+++ ax99100_sp.h	2022-06-07 16:58:32.488989767 -0400
+@@ -255,5 +255,10 @@ struct custom_eeprom {
+ #define _INLINE_
+ #endif
+ 
+ #define DEFAULT99100_BAUD 115200
+ #endif
+
+/* #if LINUX_VERSION_CODE >= KERNEL_VERSION(5,18,0) */
+#define pci_alloc_consistent(hwdev,size,dma_handle) dma_alloc_coherent(&hwdev->dev, size, dma_handle, GFP_ATOMIC)
+#define pci_free_consistent(hwdev,size,vaddr,dma_handle) dma_free_coherent(&hwdev->dev, size, vaddr, dma_handle)
+/* #endif */
--- a/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch
+++ b/pkgs/os-specific/linux/ax99100/kernel-6.1-set_termios-const-ktermios.patch
@@ -0,0 +1,18 @@
+diff -pNaru5 a/ax99100_sp.c b/ax99100_sp.c
+--- ax99100_sp.c	2023-01-02 23:44:46.707423858 -0500
+++ ax99100_sp.c	2023-01-02 23:44:27.171293092 -0500
+@@ -1915,11 +1915,13 @@ static unsigned int serial99100_get_divi
+ 	DEBUG("In %s quot=%u----baud=%u-----------------------------END\n",__FUNCTION__,quot,baud);
+ 	return quot;	
+ }
+ 
+ //This is a port ops function to set the terminal settings.
+-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(6,1,0)
+static void serial99100_set_termios(struct uart_port *port, struct ktermios *termios, const struct ktermios *old)
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,20)
+ static void serial99100_set_termios(struct uart_port *port, struct ktermios *termios, struct ktermios *old)
+ #else
+ static void serial99100_set_termios(struct uart_port *port, struct termios *termios, struct termios *old)
+ #endif
+ {
--- a/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch
+++ b/pkgs/os-specific/linux/ax99100/kernel-6.2-fix-pointer-type.patch
@@ -0,0 +1,11 @@
+--- ax99100_spi.c
+++ ax99100_spi.c
+@@ -76,7 +76,7 @@ int spi_suspend_count;
+ static unsigned int spi_major = 241;
+ static unsigned int spi_min_count = 0;
+ /* device Class */
+-static char *ax_devnode(struct device *dev, umode_t *mode)
+static char *ax_devnode(const struct device *dev, umode_t *mode)
+ {
+ 	return kasprintf(GFP_KERNEL, "%s", dev_name(dev));
+ }
--- a/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch
+++ b/pkgs/os-specific/linux/ax99100/kernel-6.4-fix-define-semaphore.patch
@@ -0,0 +1,14 @@
+--- ax99100_sp.c
+++ ax99100_sp.c
+@@ -2670,8 +2670,10 @@ static void serial99100_dma_tx_tasklet (unsigned long param)
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,37)
+ static DECLARE_MUTEX(serial99100_sem);
+-#else
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(6,4,0)
+ static DEFINE_SEMAPHORE(serial99100_sem);
+#else
+static DEFINE_SEMAPHORE(serial99100_sem, 1);
+ #endif
+ 
+ static struct uart_driver starex_serial_driver = {
--- a/pkgs/os-specific/linux/batman-adv/alfred.nix
+++ b/pkgs/os-specific/linux/batman-adv/alfred.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  gpsd,
+  libcap,
+  libnl,
+}:
+
+let
+  cfg = import ./version.nix;
+in
+
+stdenv.mkDerivation rec {
+  pname = "alfred";
+  inherit (cfg) version;
+
+  src = fetchurl {
+    url = "https://downloads.open-mesh.org/batman/releases/batman-adv-${version}/${pname}-${version}.tar.gz";
+    sha256 = cfg.sha256.${pname};
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    gpsd
+    libcap
+    libnl
+  ];
+
+  preBuild = ''
+    makeFlags="PREFIX=$out"
+  '';
+
+  meta = {
+    homepage = "https://www.open-mesh.org/projects/batman-adv/wiki/Wiki";
+    description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2, information distribution tool";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ fpletz ];
+    platforms = with lib.platforms; linux;
+  };
+}
--- a/pkgs/os-specific/linux/batman-adv/batctl.nix
+++ b/pkgs/os-specific/linux/batman-adv/batctl.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkg-config,
+  libnl,
+}:
+
+let
+  cfg = import ./version.nix;
+in
+
+stdenv.mkDerivation rec {
+  pname = "batctl";
+  inherit (cfg) version;
+
+  src = fetchurl {
+    url = "https://downloads.open-mesh.org/batman/releases/batman-adv-${version}/${pname}-${version}.tar.gz";
+    sha256 = cfg.sha256.${pname};
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ libnl ];
+
+  preBuild = ''
+    makeFlags="PREFIX=$out"
+  '';
+
+  meta = {
+    homepage = "https://www.open-mesh.org/projects/batman-adv/wiki/Wiki";
+    description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2, control tool";
+    mainProgram = "batctl";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ fpletz ];
+    platforms = with lib.platforms; linux;
+  };
+}
--- a/pkgs/os-specific/linux/batman-adv/default.nix
+++ b/pkgs/os-specific/linux/batman-adv/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  kernel,
+  kernelModuleMakeFlags,
+  nixosTests,
+}:
+
+let
+  cfg = import ./version.nix;
+in
+
+stdenv.mkDerivation rec {
+  pname = "batman-adv";
+  version = "${cfg.version}-${kernel.version}";
+
+  src = fetchurl {
+    url = "http://downloads.open-mesh.org/batman/releases/${pname}-${cfg.version}/${pname}-${cfg.version}.tar.gz";
+    sha256 = cfg.sha256.${pname};
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELPATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  hardeningDisable = [ "pic" ];
+
+  preBuild = ''
+    sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," \
+      -e /depmod/d Makefile
+  '';
+
+  passthru.tests = {
+    systemd-networkd-batadv = nixosTests.systemd-networkd-batadv;
+  };
+
+  meta = {
+    homepage = "https://www.open-mesh.org/projects/batman-adv/wiki/Wiki";
+    description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [
+      fpletz
+      philiptaron
+    ];
+    platforms = with lib.platforms; linux;
+  };
+}
--- a/pkgs/os-specific/linux/batman-adv/version.nix
+++ b/pkgs/os-specific/linux/batman-adv/version.nix
@@ -0,0 +1,14 @@
+{
+  version = "2025.3";
+
+  # To get these, run:
+  #
+  # ```
+  # for tool in alfred batctl batman-adv; do nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2025.3/$tool-2025.3.tar.gz --type sha256 | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri; done
+  # ```
+  sha256 = {
+    alfred = "sha256-+wTI22Y6bh0dyeRnEvyr6Ctz0MC0fkC00WEAAu9RCXU=";
+    batctl = "sha256-cERLGCyF0MJxTZFFdBJJgIAbt0PRYm7iehefoiBm/cI=";
+    batman-adv = "sha256-vggjoJNr9Z4q8tEVp+JjF/giC5mPSDMldGWvK2/+HOg=";
+  };
+}
--- a/pkgs/os-specific/linux/bbswitch/default.nix
+++ b/pkgs/os-specific/linux/bbswitch/default.nix
@@ -0,0 +1,75 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  kernel,
+  kernelModuleMakeFlags,
+  runtimeShell,
+}:
+
+let
+  baseName = "bbswitch";
+  version = "unstable-2021-11-29";
+  name = "${baseName}-${version}-${kernel.version}";
+
+in
+
+stdenv.mkDerivation {
+  inherit name;
+
+  src = fetchFromGitHub {
+    owner = "Bumblebee-Project";
+    repo = "bbswitch";
+    # https://github.com/Bumblebee-Project/bbswitch/tree/develop
+    rev = "23891174a80ea79c7720bcc7048a5c2bfcde5cd9";
+    hash = "sha256-50v1Jxem5kaI1dHOKmgBbPLxI82QeYxiaRHhrHpWRzU=";
+  };
+
+  patches = [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/0bd986055ba52887b81048de5c61e618eec06eb0/trunk/0003-kernel-5.18.patch";
+      sha256 = "sha256-va62/bR1qyBBMPg0lUwCH7slGG0XijxVCsFa4FCoHEQ=";
+    })
+  ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  hardeningDisable = [ "pic" ];
+
+  preBuild = ''
+    substituteInPlace Makefile \
+      --replace "/lib/modules" "${kernel.dev}/lib/modules"
+  '';
+
+  makeFlags = kernelModuleMakeFlags;
+
+  installPhase = ''
+    mkdir -p $out/lib/modules/${kernel.modDirVersion}/misc
+    cp bbswitch.ko $out/lib/modules/${kernel.modDirVersion}/misc
+
+    mkdir -p $out/bin
+    tee $out/bin/discrete_vga_poweroff << EOF
+    #!${runtimeShell}
+
+    echo -n OFF > /proc/acpi/bbswitch
+    EOF
+    tee $out/bin/discrete_vga_poweron << EOF
+    #!${runtimeShell}
+
+    echo -n ON > /proc/acpi/bbswitch
+    EOF
+    chmod +x $out/bin/discrete_vga_poweroff $out/bin/discrete_vga_poweron
+  '';
+
+  meta = with lib; {
+    description = "Module for powering off hybrid GPUs";
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+    homepage = "https://github.com/Bumblebee-Project/bbswitch";
+    maintainers = [ ];
+    license = licenses.gpl2Plus;
+  };
+}
--- a/pkgs/os-specific/linux/bionic-prebuilt/default.nix
+++ b/pkgs/os-specific/linux/bionic-prebuilt/default.nix
@@ -0,0 +1,161 @@
+{
+  stdenv,
+  stdenvNoCC,
+  lib,
+  fetchzip,
+  pkgs,
+  enableStatic ? stdenv.hostPlatform.isStatic,
+  enableShared ? !stdenv.hostPlatform.isStatic,
+}:
+let
+
+  choosePlatform =
+    let
+      pname = stdenv.hostPlatform.parsed.cpu.name;
+    in
+    pset: pset.${pname} or (throw "bionic-prebuilt: unsupported platform ${pname}");
+
+  prebuilt_crt = choosePlatform {
+    aarch64 = fetchzip {
+      url = "https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/aarch64/aarch64-linux-android-4.9/+archive/98dce673ad97a9640c5d90bbb1c718e75c21e071/lib/gcc/aarch64-linux-android/4.9.x.tar.gz";
+      sha256 = "sha256-LLD2OJi78sNN5NulOsJZl7Ei4F1EUYItGG6eUsKWULc=";
+      stripRoot = false;
+    };
+    x86_64 = fetchzip {
+      url = "https://android.googlesource.com/platform/prebuilts/gcc/linux-x86/x86/x86_64-linux-android-4.9/+archive/7e8507d2a2d4df3bced561b894576de70f065be4/lib/gcc/x86_64-linux-android/4.9.x.tar.gz";
+      sha256 = "sha256-y7CFLF76pTlj+oYev9taBnL2nlT3+Tx8c6wmicWmKEw=";
+      stripRoot = false;
+    };
+  };
+
+  prebuilt_libs = choosePlatform {
+    aarch64 = fetchzip {
+      url = "https://android.googlesource.com/platform/prebuilts/ndk/+archive/f2c77d8ba8a7f5c2d91771e31164f29be0b8ff98/platform/platforms/android-30/arch-arm64/usr/lib.tar.gz";
+      sha256 = "sha256-TZBV7+D1QvKOCEi+VNGT5SStkgj0xRbyWoLH65zSrjw=";
+      stripRoot = false;
+    };
+    x86_64 = fetchzip {
+      url = "https://android.googlesource.com/platform/prebuilts/ndk/+archive/f2c77d8ba8a7f5c2d91771e31164f29be0b8ff98/platform/platforms/android-30/arch-x86_64/usr/lib64.tar.gz";
+      sha256 = "sha256-n2EuOKy3RGKmEYofNlm+vDDBuiQRuAJEJT6wq6NEJQs=";
+      stripRoot = false;
+    };
+  };
+
+  prebuilt_ndk_crt = choosePlatform {
+    aarch64 = fetchzip {
+      url = "https://android.googlesource.com/toolchain/prebuilts/ndk/r23/+archive/6c5fa4c0d3999b9ee932f6acbd430eb2f31f3151/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/aarch64-linux-android/30.tar.gz";
+      sha256 = "sha256-KHw+cCwAwlm+5Nwp1o8WONqdi4BBDhFaVVr+7GxQ5uE=";
+      stripRoot = false;
+    };
+    x86_64 = fetchzip {
+      url = "https://android.googlesource.com/toolchain/prebuilts/ndk/r23/+archive/6c5fa4c0d3999b9ee932f6acbd430eb2f31f3151/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/x86_64-linux-android/30.tar.gz";
+      sha256 = "sha256-XEd7L3cBzn+1pKfji40V92G/uZhHSMMuZcRZaiKkLnk=";
+      stripRoot = false;
+    };
+  };
+
+  ndk_support_headers = fetchzip {
+    url = "https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/+archive/0e7f808fa26cce046f444c9616d9167dafbfb272/clang-r416183b/include/c++/v1/support.tar.gz";
+    sha256 = "sha256-NBv7Pk1CEaz8ns9moleEERr3x/rFmVmG33LgFSeO6fY=";
+    stripRoot = false;
+  };
+
+  kernelHeaders = pkgs.makeLinuxHeaders {
+    version = "android-common-11-5.4";
+    src = fetchzip {
+      url = "https://android.googlesource.com/kernel/common/+archive/48ffcbf0b9e7f0280bfb8c32c68da0aaf0fdfef6.tar.gz";
+      sha256 = "1y7cmlmcr5vdqydd9n785s139yc4aylc3zhqa59xsylmkaf5habk";
+      stripRoot = false;
+    };
+  };
+
+in
+stdenvNoCC.mkDerivation rec {
+  pname = "bionic-prebuilt";
+  version = "ndk-release-r23";
+  name = "${stdenv.hostPlatform.parsed.cpu.name}-${pname}-${version}";
+
+  src = fetchzip {
+    url = "https://android.googlesource.com/platform/bionic/+archive/00e8ce1142d8823b0d2fc8a98b40119b0f1f02cd.tar.gz";
+    sha256 = "10z5mp4w0acvjvgxv7wlqa7m70hcyarmjdlfxbd9rwzf4mrsr8d1";
+    stripRoot = false;
+  };
+
+  NIX_DONT_SET_RPATH = true;
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  patches = [
+    ./ndk-version.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace libc/include/sys/cdefs.h --replace \
+      "__has_builtin(__builtin_umul_overflow)" "1"
+    substituteInPlace libc/include/bits/ioctl.h --replace \
+      "!defined(BIONIC_IOCTL_NO_SIGNEDNESS_OVERLOAD)" "0"
+  '';
+
+  installPhase = ''
+    # copy the bionic headers
+    mkdir -p $out/include/support $out/include/android
+    cp -vr libc/include/* $out/include
+    # copy the kernel headers
+    cp -vr ${kernelHeaders}/include/*  $out/include/
+
+    chmod -R +w $out/include/linux
+
+    # fix a bunch of kernel headers so that things can actually be found
+    sed -i 's,struct epoll_event {,#include <bits/epoll_event.h>\nstruct Xepoll_event {,' $out/include/linux/eventpoll.h
+    sed -i 's,struct in_addr {,typedef unsigned int in_addr_t;\nstruct in_addr {,' $out/include/linux/in.h
+    sed -i 's,struct udphdr {,struct Xudphdr {,' $out/include/linux/udp.h
+    sed -i 's,union semun {,union Xsemun {,' $out/include/linux/sem.h
+    sed -i 's,struct __kernel_sockaddr_storage,#define sockaddr_storage __kernel_sockaddr_storage\nstruct __kernel_sockaddr_storage,' $out/include/linux/socket.h
+    sed -i 's,#ifndef __UAPI_DEF_.*$,#if 1,' $out/include/linux/libc-compat.h
+    substituteInPlace $out/include/linux/in.h --replace "__be32		imr_" "struct in_addr		imr_"
+    substituteInPlace $out/include/linux/in.h --replace "__be32		imsf_" "struct in_addr		imsf_"
+    substituteInPlace $out/include/linux/sysctl.h --replace "__unused" "_unused"
+
+    # what could possibly live in <linux/compiler.h>
+    touch $out/include/linux/compiler.h
+
+    # copy the support headers
+    cp -vr ${ndk_support_headers}* $out/include/support/
+
+    mkdir $out/lib
+    cp -v ${prebuilt_crt.out}/*.o $out/lib/
+    cp -v ${prebuilt_crt.out}/libgcc.a $out/lib/
+    cp -v ${prebuilt_ndk_crt.out}/*.o $out/lib/
+  ''
+  + lib.optionalString enableShared ''
+    for i in libc.so libm.so libdl.so liblog.so; do
+      cp -v ${prebuilt_libs.out}/$i $out/lib/
+    done
+  ''
+  + lib.optionalString enableStatic ''
+    # no liblog.a; while it's also part of the base libraries,
+    # it's only available as shared object in the prebuilts.
+    for i in libc.a libm.a libdl.a; do
+      cp -v ${prebuilt_ndk_crt.out}/$i $out/lib/
+    done
+  ''
+  + ''
+    mkdir -p $dev/include
+    cp -v $out/include/*.h $dev/include/
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+  passthru.linuxHeaders = kernelHeaders;
+
+  meta = with lib; {
+    description = "Android libc implementation";
+    homepage = "https://android.googlesource.com/platform/bionic/";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ s1341 ];
+  };
+}
--- a/pkgs/os-specific/linux/bionic-prebuilt/ndk-version.patch
+++ b/pkgs/os-specific/linux/bionic-prebuilt/ndk-version.patch
@@ -0,0 +1,42 @@
+--- a/libc/include/android/ndk-version.h	2021-04-01 16:08:03.109183965 +0300
+++ b/libc/include/android/ndk-version.h	2021-04-01 16:07:19.811424641 +0300
+@@ -0,0 +1,39 @@
+#pragma once
+
+/**
+ * Set to 1 if this is an NDK, unset otherwise. See
+ * https://android.googlesource.com/platform/bionic/+/master/docs/defines.md.
+ */
+#define __ANDROID_NDK__ 1
+
+/**
+ * Major version of this NDK.
+ *
+ * For example: 16 for r16.
+ */
+#define __NDK_MAJOR__ 22
+
+/**
+ * Minor version of this NDK.
+ *
+ * For example: 0 for r16 and 1 for r16b.
+ */
+#define __NDK_MINOR__ 0
+
+/**
+ * Set to 0 if this is a release build, or 1 for beta 1,
+ * 2 for beta 2, and so on.
+ */
+#define __NDK_BETA__ 0
+
+/**
+ * Build number for this NDK.
+ *
+ * For a local development build of the NDK, this is -1.
+ */
+#define __NDK_BUILD__ 7026061
+
+/**
+ * Set to 1 if this is a canary build, 0 if not.
+ */
+#define __NDK_CANARY__ 0
--- a/pkgs/os-specific/linux/broadcom-sta/default.nix
+++ b/pkgs/os-specific/linux/broadcom-sta/default.nix
@@ -0,0 +1,125 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchFromGitHub,
+  kernel,
+}:
+
+let
+  version = "6.30.223.271";
+  # Patchset release number from rpmfusion, to more easily differentiate
+  # versions and updates. See `wl-kmod.spec` file:
+  # https://github.com/rpmfusion/wl-kmod/blob/master/wl-kmod.spec#L19
+  release = "57";
+  hashes = {
+    i686-linux = "sha256-T4twspOsjMXHDlca1dGHjQ8p0TOkb+eGmGjZwZtQWM0=";
+    x86_64-linux = "sha256-X3l3TVvuyPdja1nA+wegMQju8eP9MkVjiyCFjHFBRL4=";
+  };
+
+  arch = lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux") "_64";
+  tarballVersion = lib.replaceStrings [ "." ] [ "_" ] version;
+  tarball = "hybrid-v35${arch}-nodebug-pcoem-${tarballVersion}.tar.gz";
+
+  rpmFusionPatches = fetchFromGitHub {
+    owner = "rpmfusion";
+    repo = "wl-kmod";
+    rev = "b0d19578ebd0daae9c5b7f9e9511a6d73ac4d957";
+    hash = "sha256-v7mZ2S/eVfGTEXrxpdiemHhrC+P3/sPOZqTBhRtins4=";
+  };
+  patchset = [
+    "wl-kmod-001_wext_workaround.patch"
+    "wl-kmod-002_kernel_3.18_null_pointer.patch"
+    "wl-kmod-003_gcc_4.9_remove_TIME_DATE_macros.patch"
+    "wl-kmod-004_kernel_4.3_rdtscl_to_rdtsc.patch"
+    "wl-kmod-005_kernel_4.7_IEEE80211_BAND_to_NL80211_BAND.patch"
+    "wl-kmod-006_gcc_6_fix_indentation_warnings.patch"
+    "wl-kmod-007_kernel_4.8_add_cfg80211_scan_info_struct.patch"
+    "wl-kmod-008_fix_kernel_warnings.patch"
+    "wl-kmod-009_kernel_4.11_remove_last_rx_in_net_device_struct.patch"
+    "wl-kmod-010_kernel_4.12_add_cfg80211_roam_info_struct.patch"
+    "wl-kmod-011_kernel_4.14_new_kernel_read_function_prototype.patch"
+    "wl-kmod-012_kernel_4.15_new_timer.patch"
+    "wl-kmod-013_gcc8_fix_bounds_check_warnings.patch"
+    "wl-kmod-014_kernel_read_pos_increment_fix.patch"
+    "wl-kmod-015_kernel_5.1_get_ds_removed.patch"
+    "wl-kmod-016_fix_unsupported_mesh_point.patch"
+    "wl-kmod-017_fix_gcc_fallthrough_warning.patch"
+    "wl-kmod-018_kernel_5.6_adaptations.patch"
+    "wl-kmod-019_kernel_5.9_segment_eq_removed.patch"
+    "wl-kmod-020_kernel_5.10_get_set_fs_removed.patch"
+    "wl-kmod-021_kernel_5.17_adaptation.patch"
+    "wl-kmod-022_kernel_5.18_adaptation.patch"
+    "wl-kmod-023_kernel_6.0_adaptation.patch"
+    "wl-kmod-024_kernel_6.1_adaptation.patch"
+    "wl-kmod-025_kernel_6.5_adaptation.patch"
+    "wl-kmod-026_kernel_6.10_fix_empty_body_in_if_warning.patch"
+    "wl-kmod-027_wpa_supplicant-2.11_add_max_scan_ie_len.patch"
+    "wl-kmod-028_kernel_6.12_adaptation.patch"
+    "wl-kmod-029_kernel_6.13_adaptation.patch"
+    "wl-kmod-030_kernel_6.14_adaptation.patch"
+    "wl-kmod-031_replace_EXTRA_CFLAGS_EXTRA_LDFLAGS_with_ccflags-y_ldflags-y.patch"
+    "wl-kmod-032_add_MODULE_DESCRIPTION_macro.patch"
+    "wl-kmod-033_disable_objtool_add_warning_unmaintained.patch"
+    "wl-kmod-034_kernel_6.15_adaptation_replace_del_timer_with_timer_delete.patch"
+  ];
+in
+stdenv.mkDerivation {
+  name = "broadcom-sta-${version}-${release}-${kernel.version}";
+
+  src = fetchurl {
+    url = "https://docs.broadcom.com/docs-and-downloads/docs/linux_sta/${tarball}";
+    hash =
+      hashes.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  patches = map (patch: "${rpmFusionPatches}/${patch}") patchset;
+
+  makeFlags = [ "KBASE=${kernel.dev}/lib/modules/${kernel.modDirVersion}" ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    sourceRoot=broadcom-sta
+    mkdir "$sourceRoot"
+    tar xvf "$src" -C "$sourceRoot"
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    binDir="$out/lib/modules/${kernel.modDirVersion}/kernel/net/wireless/"
+    docDir="$out/share/doc/broadcom-sta/"
+    mkdir -p "$binDir" "$docDir"
+    cp wl.ko "$binDir"
+    cp lib/LICENSE.txt "$docDir"
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Kernel module driver for some Broadcom's wireless cards";
+    homepage = "https://www.broadcom.com/support/download-search?pg=Legacy%20Products&pf=Legacy%20Wireless&pn&pa&po&dk&pl";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = with lib.maintainers; [
+      j0hax
+      nullcube
+    ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
+    knownVulnerabilities = [
+      "CVE-2019-9501: heap buffer overflow, potentially allowing remote code execution by sending specially-crafted WiFi packets"
+      "CVE-2019-9502: heap buffer overflow, potentially allowing remote code execution by sending specially-crafted WiFi packets"
+      (
+        "The Broadcom STA wireless driver is not maintained "
+        + "and is incompatible with Linux kernel security mitigations. "
+        + "It is heavily recommended to replace the hardware and remove the driver. "
+        + "Proceed at your own risk!"
+      )
+    ];
+  };
+}
--- a/pkgs/os-specific/linux/busybox/busybox-in-store.patch
+++ b/pkgs/os-specific/linux/busybox/busybox-in-store.patch
@@ -0,0 +1,23 @@
+Allow BusyBox to be invoked as "<something>-busybox". This is
+necessary when it's run from the Nix store as <hash>-busybox during
+stdenv bootstrap.
+--- a/libbb/appletlib.c
+++ b/libbb/appletlib.c
+@@ -947,7 +947,7 @@ void FAST_FUNC run_applet_no_and_exit(int applet_no, const char *name, char **ar
+ static NORETURN void run_applet_and_exit(const char *name, char **argv)
+ {
+ #  if ENABLE_BUSYBOX
+-	if (is_prefixed_with(name, "busybox"))
+	if (strstr(name, "busybox") != 0)
+ 		exit(busybox_main(/*unused:*/ 0, argv));
+ #  endif
+ #  if NUM_APPLETS > 0
+@@ -1045,7 +1045,7 @@ int main(int argc UNUSED_PARAM, char **argv)
+
+ 	lbb_prepare("busybox" IF_FEATURE_INDIVIDUAL(, argv));
+ # if !ENABLE_BUSYBOX
+-	if (argv[1] && is_prefixed_with(bb_basename(argv[0]), "busybox"))
+	if (argv[1] && strstr(bb_basename(argv[0]), "busybox") != 0)
+ 		argv++;
+ # endif
+ 	applet_name = argv[0];
--- a/pkgs/os-specific/linux/busybox/clang-cross.patch
+++ b/pkgs/os-specific/linux/busybox/clang-cross.patch
@@ -0,0 +1,37 @@
+diff --git a/Makefile b/Makefile
+index 6fedcffba..3385836c4 100644
+--- a/Makefile
+++ b/Makefile
+@@ -271,8 +271,8 @@ export quiet Q KBUILD_VERBOSE
+ # Look for make include files relative to root of kernel src
+ MAKEFLAGS += --include-dir=$(srctree)
+ 
+-HOSTCC  	= gcc
+-HOSTCXX  	= g++
+HOSTCC		= cc
+HOSTCXX	= c++
+ HOSTCFLAGS	:=
+ HOSTCXXFLAGS	:=
+ # We need some generic definitions
+@@ -289,7 +289,7 @@ MAKEFLAGS += -rR
+ # Make variables (CC, etc...)
+ 
+ AS		= $(CROSS_COMPILE)as
+-CC		= $(CROSS_COMPILE)gcc
+CC		= $(CROSS_COMPILE)cc
+ LD		= $(CC) -nostdlib
+ CPP		= $(CC) -E
+ AR		= $(CROSS_COMPILE)ar
+diff --git a/scripts/Makefile.IMA b/scripts/Makefile.IMA
+index f155108d7..185257064 100644
+--- a/scripts/Makefile.IMA
+++ b/scripts/Makefile.IMA
+@@ -39,7 +39,7 @@ ifndef HOSTCC
+ HOSTCC = cc
+ endif
+ AS              = $(CROSS_COMPILE)as
+-CC              = $(CROSS_COMPILE)gcc
+CC              = $(CROSS_COMPILE)cc
+ LD              = $(CC) -nostdlib
+ CPP             = $(CC) -E
+ AR              = $(CROSS_COMPILE)ar
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -0,0 +1,219 @@
+{
+  stdenv,
+  lib,
+  buildPackages,
+  fetchurl,
+  fetchpatch,
+  fetchFromGitLab,
+  enableStatic ? stdenv.hostPlatform.isStatic,
+  enableMinimal ? false,
+  enableAppletSymlinks ? true,
+  # Allow forcing musl without switching stdenv itself, e.g. for our bootstrapping:
+  # nix build -f pkgs/top-level/release.nix stdenvBootstrapTools.x86_64-linux.dist
+  useMusl ? stdenv.hostPlatform.libc == "musl",
+  musl,
+  extraConfig ? "",
+}:
+
+assert stdenv.hostPlatform.libc == "musl" -> useMusl;
+
+let
+  configParser = ''
+    function parseconfig {
+        while read LINE; do
+            NAME=`echo "$LINE" | cut -d \  -f 1`
+            OPTION=`echo "$LINE" | cut -d \  -f 2`
+
+            if ! [[ "$NAME" =~ ^CONFIG_ ]]; then continue; fi
+
+            echo "parseconfig: removing $NAME"
+            sed -i /$NAME'\(=\| \)'/d .config
+
+            echo "parseconfig: setting $NAME=$OPTION"
+            echo "$NAME=$OPTION" >> .config
+        done
+    }
+  '';
+
+  libcConfig = lib.optionalString useMusl ''
+    CONFIG_FEATURE_UTMP n
+    CONFIG_FEATURE_WTMP n
+  '';
+
+  # The debian version lags behind the upstream version and also contains
+  # a debian-specific suffix. We only fetch the debian repository to get the
+  # default.script
+  debianVersion = "1.30.1-6";
+  debianSource = fetchFromGitLab {
+    domain = "salsa.debian.org";
+    owner = "installer-team";
+    repo = "busybox";
+    rev = "debian/1%${debianVersion}";
+    sha256 = "sha256-6r0RXtmqGXtJbvLSD1Ma1xpqR8oXL2bBKaUE/cSENL8=";
+  };
+  debianDispatcherScript = "${debianSource}/debian/tree/udhcpc/etc/udhcpc/default.script";
+  outDispatchPath = "$out/default.script";
+in
+
+stdenv.mkDerivation rec {
+  pname = "busybox";
+  version = "1.36.1";
+
+  # Note to whoever is updating busybox: please verify that:
+  # nix-build pkgs/stdenv/linux/make-bootstrap-tools.nix -A test
+  # still builds after the update.
+  src = fetchurl {
+    url = "https://busybox.net/downloads/${pname}-${version}.tar.bz2";
+    sha256 = "sha256-uMwkyVdNgJ5yecO+NJeVxdXOtv3xnKcJ+AzeUOR94xQ=";
+  };
+
+  hardeningDisable = [
+    "format"
+    "pie"
+  ]
+  ++ lib.optionals enableStatic [ "fortify" ];
+
+  patches = [
+    ./busybox-in-store.patch
+    (fetchurl {
+      name = "CVE-2022-28391.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
+      sha256 = "sha256-yviw1GV+t9tbHbY7YNxEqPi7xEreiXVqbeRyf8c6Awo=";
+    })
+    (fetchurl {
+      name = "CVE-2022-28391.patch";
+      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
+      sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
+    })
+    (fetchpatch {
+      name = "CVE-2022-48174.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15216
+      url = "https://git.busybox.net/busybox/patch/?id=d417193cf37ca1005830d7e16f5fa7e1d8a44209";
+      hash = "sha256-mpDEwYncpU6X6tmtj9xM2KCrB/v2ys5bYxmPPrhm6es=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-42366.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15874
+      # This patch is also used by Alpine, see https://git.alpinelinux.org/aports/tree/main/busybox/0037-awk.c-fix-CVE-2023-42366-bug-15874.patch
+      url = "https://bugs.busybox.net/attachment.cgi?id=9697";
+      hash = "sha256-2eYfLZLjStea9apKXogff6sCAdG9yHx0ZsgUBaGfQIA=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-42363.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15865
+      url = "https://git.launchpad.net/ubuntu/+source/busybox/plain/debian/patches/CVE-2023-42363.patch?id=c9d8a323b337d58e302717d41796aa0242963d5a";
+      hash = "sha256-1W9Q8+yFkYQKzNTrvndie8QuaEbyAFL1ZASG2fPF+Z4=";
+    })
+    (fetchpatch {
+      name = "CVE-2023-42364_CVE-2023-42365.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15871 https://bugs.busybox.net/show_bug.cgi?id=15868
+      url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2023-42364-CVE-2023-42365.patch?id=8a4bf5971168bf48201c05afda7bee0fbb188e13";
+      hash = "sha256-nQPgT9eA1asCo38Z9X7LR9My0+Vz5YBPba3ARV3fWcc=";
+    })
+    (fetchurl {
+      url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-tar-fix-TOCTOU-symlink-race-condition.patch?id=9e42dea5fba84a8afad1f1910b7d3884128a567e";
+      hash = "sha256-GmXQhwB1/IPVjXXpGi5RjRvuGJgIMIb7lQKB63m306g=";
+    })
+  ]
+  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) ./clang-cross.patch;
+
+  separateDebugInfo = true;
+
+  postPatch = "patchShebangs .";
+
+  configurePhase = ''
+    export KCONFIG_NOTIMESTAMP=1
+    make ${if enableMinimal then "allnoconfig" else "defconfig"}
+
+    ${configParser}
+
+    cat << EOF | parseconfig
+
+    CONFIG_PREFIX "$out"
+    CONFIG_INSTALL_NO_USR y
+
+    CONFIG_LFS y
+
+    # More features for modprobe.
+    ${lib.optionalString (!enableMinimal) ''
+      CONFIG_FEATURE_MODPROBE_BLACKLIST y
+      CONFIG_FEATURE_MODUTILS_ALIAS y
+      CONFIG_FEATURE_MODUTILS_SYMBOLS y
+      CONFIG_MODPROBE_SMALL n
+    ''}
+
+    ${lib.optionalString enableStatic ''
+      CONFIG_STATIC y
+    ''}
+
+    ${lib.optionalString (!enableAppletSymlinks) ''
+      CONFIG_INSTALL_APPLET_DONT y
+      CONFIG_INSTALL_APPLET_SYMLINKS n
+    ''}
+
+    # Use the external mount.cifs program.
+    CONFIG_FEATURE_MOUNT_CIFS n
+    CONFIG_FEATURE_MOUNT_HELPERS y
+
+    # Set paths for console fonts.
+    CONFIG_DEFAULT_SETFONT_DIR "/etc/kbd"
+
+    # Bump from 4KB, much faster I/O
+    CONFIG_FEATURE_COPYBUF_KB 64
+
+    # Doesn't build with current kernel headers.
+    # https://bugs.busybox.net/show_bug.cgi?id=15934
+    CONFIG_TC n
+
+    # Set the path for the udhcpc script
+    CONFIG_UDHCPC_DEFAULT_SCRIPT "${outDispatchPath}"
+
+    ${extraConfig}
+    CONFIG_CROSS_COMPILER_PREFIX "${stdenv.cc.targetPrefix}"
+    ${libcConfig}
+    EOF
+
+    make oldconfig
+
+    runHook postConfigure
+  '';
+
+  postConfigure = lib.optionalString (useMusl && stdenv.hostPlatform.libc != "musl") ''
+    makeFlagsArray+=("CC=${stdenv.cc.targetPrefix}cc -isystem ${musl.dev}/include -B${musl}/lib -L${musl}/lib")
+  '';
+
+  makeFlags = [ "SKIP_STRIP=y" ];
+
+  postInstall = ''
+    sed -e '
+    1 a busybox() { '$out'/bin/busybox "$@"; }\
+    logger() { '$out'/bin/logger "$@"; }\
+    ' ${debianDispatcherScript} > ${outDispatchPath}
+    chmod 555 ${outDispatchPath}
+    HOST_PATH=$out/bin patchShebangs --host ${outDispatchPath}
+  '';
+
+  strictDeps = true;
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  buildInputs = lib.optionals (enableStatic && !useMusl && stdenv.cc.libc ? static) [
+    stdenv.cc.libc
+    stdenv.cc.libc.static
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = false; # tries to access the net
+
+  passthru.shellPath = "/bin/ash";
+
+  meta = with lib; {
+    description = "Tiny versions of common UNIX utilities in a single small executable";
+    homepage = "https://busybox.net/";
+    license = licenses.gpl2Only;
+    mainProgram = "busybox";
+    maintainers = with maintainers; [
+      TethysSvensson
+      qyliss
+    ];
+    platforms = platforms.linux;
+    priority = 15; # below systemd (halt, init, poweroff, reboot) and coreutils
+  };
+}
--- a/pkgs/os-specific/linux/busybox/sandbox-shell.nix
+++ b/pkgs/os-specific/linux/busybox/sandbox-shell.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  busybox,
+  musl,
+}:
+
+# Minimal shell for use as basic /bin/sh in sandbox builds
+busybox.override (
+  {
+    enableStatic = true;
+    enableMinimal = true;
+
+    extraConfig = ''
+      CONFIG_FEATURE_FANCY_ECHO y
+      CONFIG_FEATURE_SH_MATH y
+      CONFIG_FEATURE_SH_MATH_64 y
+      CONFIG_FEATURE_TEST_64 y
+
+      CONFIG_ASH y
+      CONFIG_ASH_OPTIMIZE_FOR_SIZE y
+
+      CONFIG_ASH_ALIAS y
+      CONFIG_ASH_BASH_COMPAT y
+      CONFIG_ASH_CMDCMD y
+      CONFIG_ASH_ECHO y
+      CONFIG_ASH_GETOPTS y
+      CONFIG_ASH_INTERNAL_GLOB y
+      CONFIG_ASH_JOB_CONTROL y
+      CONFIG_ASH_PRINTF y
+      CONFIG_ASH_TEST y
+    '';
+  }
+  // lib.optionalAttrs (stdenv.hostPlatform.isGnu && lib.meta.availableOn stdenv.hostPlatform musl) {
+    useMusl = true;
+  }
+)
--- a/pkgs/os-specific/linux/can-isotp/default.nix
+++ b/pkgs/os-specific/linux/can-isotp/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  kernel,
+  kernelModuleMakeFlags,
+  fetchFromGitHub,
+}:
+
+stdenv.mkDerivation {
+  pname = "can-isotp";
+  version = "20200910";
+
+  hardeningDisable = [ "pic" ];
+
+  src = fetchFromGitHub {
+    owner = "hartkopp";
+    repo = "can-isotp";
+    rev = "21a3a59e2bfad246782896841e7af042382fcae7";
+    sha256 = "1laax93czalclg7cy9iq1r7hfh9jigh7igj06y9lski75ap2vhfq";
+  };
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  buildFlags = [ "modules" ];
+  installTargets = [ "modules_install" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  meta = with lib; {
+    broken = kernel.kernelAtLeast "5.16";
+    description = "Kernel module for ISO-TP (ISO 15765-2)";
+    homepage = "https://github.com/hartkopp/can-isotp";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.evck ];
+  };
+}
--- a/pkgs/os-specific/linux/ch9344/default.nix
+++ b/pkgs/os-specific/linux/ch9344/default.nix
@@ -0,0 +1,55 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ch9344";
+  version = "2.3";
+
+  src = fetchFromGitHub {
+    owner = "WCHSoftGroup";
+    repo = "ch9344ser_linux";
+    rev = "e0a38c4f4f9d4c1f5e2e3a352b7b1010b33aa322";
+    hash = "sha256-ldYoGmG9DAjASl3xL8djeZ8jRHlcBQdAt0KYAr53epI=";
+  };
+
+  patches = [
+    ./fix-linux-6-12-build.patch
+    ./fix-linux-6-15-build.patch
+    ./fix-linux-6-16-build.patch
+  ];
+
+  sourceRoot = "${src.name}/driver";
+  hardeningDisable = [ "pic" ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "KERNELDIR :=" "KERNELDIR ?="
+  '';
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D ch9344.ko $out/lib/modules/${kernel.modDirVersion}/usb/serial/ch9344.ko
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.wch-ic.com/";
+    downloadPage = "https://github.com/WCHSoftGroup/ch9344ser_linux";
+    description = "WCH CH9344/CH348 UART driver";
+    longDescription = ''
+      A kernel module for WinChipHead CH9344/CH348 USB To Multi Serial Ports controller.
+    '';
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ RadxaYuntian ];
+  };
+}
--- a/pkgs/os-specific/linux/ch9344/fix-linux-6-12-build.patch
+++ b/pkgs/os-specific/linux/ch9344/fix-linux-6-12-build.patch
@@ -0,0 +1,16 @@
+diff --git a/ch9344.c b/ch9344.c
+index 8130334..b017faa 100644
+--- a/ch9344.c
+++ b/ch9344.c
+@@ -62,7 +62,11 @@
+ #include <linux/timer.h>
+ #include <linux/kfifo.h>
+ #include <asm/byteorder.h>
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 0))
+#include <linux/unaligned.h>
+#else
+ #include <asm/unaligned.h>
+#endif
+ 
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(4, 11, 0))
+ #include <linux/sched/signal.h>
--- a/pkgs/os-specific/linux/ch9344/fix-linux-6-15-build.patch
+++ b/pkgs/os-specific/linux/ch9344/fix-linux-6-15-build.patch
@@ -0,0 +1,16 @@
+diff --git a/ch9344.c b/ch9344.c
+index 36402c0..cb3efc2 100644
+--- a/ch9344.c
+++ b/ch9344.c
+@@ -1251,7 +1251,11 @@ static void ch9344_port_shutdown(struct tty_port *port)
+ 	struct ch9344 *ch9344 = tty_get_portdata(ttyport);
+ 	int portnum = ttyport->portnum;
+ 
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 15, 0))
+	timer_delete(&ttyport->timer);
+#else
+ 	del_timer(&ttyport->timer);
+#endif
+ 	ch9344_set_control(ch9344, portnum, 0x00);
+ 	ch9344_set_control(ch9344, portnum, 0x10);
+ 	ttyport->isopen = false;
--- a/pkgs/os-specific/linux/ch9344/fix-linux-6-16-build.patch
+++ b/pkgs/os-specific/linux/ch9344/fix-linux-6-16-build.patch
@@ -0,0 +1,16 @@
+diff --git a/ch9344.c b/ch9344.c
+index 36402c0..9f0df54 100644
+--- a/ch9344.c
+++ b/ch9344.c
+@@ -929,7 +929,11 @@ static void timer_function(unsigned long arg)
+ static void timer_function(struct timer_list *t)
+ {
+ 	unsigned char *buffer;
+#if (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 16, 0))
+	struct ch9344_ttyport *ttyport = timer_container_of(ttyport, t, timer);
+#else
+ 	struct ch9344_ttyport *ttyport = from_timer(ttyport, t, timer);
+#endif
+ 	int fifolen = kfifo_len(&ttyport->rfifo);
+ 	int len;
+ 
--- a/pkgs/os-specific/linux/conky/default.nix
+++ b/pkgs/os-specific/linux/conky/default.nix
@@ -0,0 +1,195 @@
+{
+  config,
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  pkg-config,
+  cmake,
+
+  # dependencies
+  glib,
+  libXinerama,
+  catch2,
+  gperf,
+
+  # lib.optional features without extra dependencies
+  mpdSupport ? true,
+  ibmSupport ? true, # IBM/Lenovo notebooks
+
+  # lib.optional features with extra dependencies
+
+  docsSupport ? true,
+  buildPackages,
+  pandoc,
+  python3,
+
+  ncursesSupport ? true,
+  ncurses ? null,
+  x11Support ? true,
+  freetype,
+  xorg,
+  waylandSupport ? true,
+  pango,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
+  xdamageSupport ? x11Support,
+  libXdamage ? null,
+  doubleBufferSupport ? x11Support,
+  imlib2Support ? x11Support,
+  imlib2 ? null,
+
+  luaSupport ? true,
+  lua ? null,
+  luaImlib2Support ? luaSupport && imlib2Support,
+  luaCairoSupport ? luaSupport && (x11Support || waylandSupport),
+  cairo ? null,
+  toluapp ? null,
+
+  wirelessSupport ? true,
+  wirelesstools ? null,
+  nvidiaSupport ? false,
+  libXNVCtrl ? null,
+  pulseSupport ? config.pulseaudio or false,
+  libpulseaudio ? null,
+
+  curlSupport ? true,
+  curl ? null,
+  rssSupport ? curlSupport,
+  journalSupport ? true,
+  systemd ? null,
+  libxml2 ? null,
+
+  extrasSupport ? true,
+
+  versionCheckHook,
+}:
+
+assert docsSupport -> pandoc != null && python3 != null;
+
+assert ncursesSupport -> ncurses != null;
+
+assert xdamageSupport -> x11Support && libXdamage != null;
+assert imlib2Support -> x11Support && imlib2 != null;
+assert luaSupport -> lua != null;
+assert luaImlib2Support -> luaSupport && imlib2Support && toluapp != null;
+assert luaCairoSupport -> luaSupport && toluapp != null && cairo != null;
+assert luaCairoSupport || luaImlib2Support -> lua.luaversion == "5.4";
+
+assert wirelessSupport -> wirelesstools != null;
+assert nvidiaSupport -> libXNVCtrl != null;
+assert pulseSupport -> libpulseaudio != null;
+
+assert curlSupport -> curl != null;
+assert rssSupport -> curlSupport && libxml2 != null;
+assert journalSupport -> systemd != null;
+
+assert extrasSupport -> python3 != null;
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "conky";
+  version = "1.22.2";
+
+  src = fetchFromGitHub {
+    owner = "brndnmtthws";
+    repo = "conky";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-tMnfdW1sbZkt8v6DITM2R0ZwyN+xs7VLGZDityYt38Q=";
+  };
+
+  # pkg-config doesn't detect wayland-scanner in cross-compilation for some reason
+  postPatch = ''
+    substituteInPlace cmake/ConkyPlatformChecks.cmake \
+      --replace-fail "pkg_get_variable(Wayland_SCANNER wayland-scanner wayland_scanner)" "set(Wayland_SCANNER ${lib.getExe buildPackages.wayland-scanner})"
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    gperf
+  ]
+  ++ lib.optional docsSupport pandoc
+  ++ lib.optional (docsSupport || extrasSupport) (
+    # Use buildPackages to work around https://github.com/NixOS/nixpkgs/issues/305858
+    buildPackages.python3.withPackages (ps: [
+      ps.jinja2
+      ps.pyyaml
+    ])
+  )
+  ++ lib.optional luaImlib2Support toluapp
+  ++ lib.optional luaCairoSupport toluapp;
+
+  buildInputs = [
+    glib
+    libXinerama
+  ]
+  ++ lib.optional ncursesSupport ncurses
+  ++ lib.optionals x11Support [
+    freetype
+    xorg.libICE
+    xorg.libX11
+    xorg.libXext
+    xorg.libXft
+    xorg.libSM
+  ]
+  ++ lib.optionals waylandSupport [
+    pango
+    wayland
+    wayland-protocols
+  ]
+  ++ lib.optional xdamageSupport libXdamage
+  ++ lib.optional imlib2Support imlib2
+  ++ lib.optional luaSupport lua
+  ++ lib.optional luaImlib2Support imlib2
+  ++ lib.optional luaCairoSupport cairo
+  ++ lib.optional wirelessSupport wirelesstools
+  ++ lib.optional curlSupport curl
+  ++ lib.optional rssSupport libxml2
+  ++ lib.optional nvidiaSupport libXNVCtrl
+  ++ lib.optional pulseSupport libpulseaudio
+  ++ lib.optional journalSupport systemd;
+
+  cmakeFlags = [
+    (lib.cmakeBool "REPRODUCIBLE_BUILD" true)
+    (lib.cmakeBool "RELEASE" true)
+    (lib.cmakeBool "BUILD_TESTING" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "BUILD_EXTRAS" extrasSupport)
+    (lib.cmakeBool "BUILD_DOCS" docsSupport)
+    (lib.cmakeBool "BUILD_CURL" curlSupport)
+    (lib.cmakeBool "BUILD_IBM" ibmSupport)
+    (lib.cmakeBool "BUILD_IMLIB2" imlib2Support)
+    (lib.cmakeBool "BUILD_LUA_CAIRO" luaCairoSupport)
+    (lib.cmakeBool "BUILD_LUA_IMLIB2" luaImlib2Support)
+    (lib.cmakeBool "BUILD_MPD" mpdSupport)
+    (lib.cmakeBool "BUILD_NCURSES" ncursesSupport)
+    (lib.cmakeBool "BUILD_RSS" rssSupport)
+    (lib.cmakeBool "BUILD_X11" x11Support)
+    (lib.cmakeBool "BUILD_WAYLAND" waylandSupport)
+    (lib.cmakeBool "BUILD_XDAMAGE" xdamageSupport)
+    (lib.cmakeBool "BUILD_XDBE" doubleBufferSupport)
+    (lib.cmakeBool "BUILD_WLAN" wirelessSupport)
+    (lib.cmakeBool "BUILD_NVIDIA" nvidiaSupport)
+    (lib.cmakeBool "BUILD_PULSEAUDIO" pulseSupport)
+    (lib.cmakeBool "BUILD_JOURNAL" journalSupport)
+    (lib.cmakeFeature "CMAKE_INSTALL_DATAROOTDIR" "${placeholder "out"}/share")
+  ];
+
+  doCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  meta = {
+    homepage = "https://conky.cc";
+    changelog = "https://github.com/brndnmtthws/conky/releases/tag/${finalAttrs.src.tag}";
+    description = "Advanced, highly configurable system monitor based on torsmo";
+    mainProgram = "conky";
+    maintainers = [ lib.maintainers.guibert ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/os-specific/linux/corefreq/default.nix
+++ b/pkgs/os-specific/linux/corefreq/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  # See the official readme for a list of optional flags:
+  # https://github.com/cyring/CoreFreq/blob/master/README.md
+  extraFlags ? [ ],
+}:
+
+stdenv.mkDerivation rec {
+  pname = "corefreq";
+  version = "2.0.8";
+
+  src = fetchFromGitHub {
+    owner = "cyring";
+    repo = "CoreFreq";
+    rev = version;
+    hash = "sha256-8uCs/Jj208qUtmpiorxtii+0VOfK/EgrcylmJMkcqUQ=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  env.NIX_CFLAGS_COMPILE = "-I${src}/${stdenv.hostPlatform.qemuArch}";
+  makeFlags = [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+  ]
+  ++ extraFlags;
+
+  preInstall = ''
+    mkdir -p $out/bin
+  '';
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = {
+    description = "CPU monitoring and tuning software designed for 64-bit processors";
+    homepage = "https://github.com/cyring/CoreFreq";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ mrene ];
+    mainProgram = "corefreq-cli";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+  };
+}
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -0,0 +1,109 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  buildPythonApplication,
+  appstream-glib,
+  dbus-python,
+  desktop-file-utils,
+  gettext,
+  glib,
+  gobject-introspection,
+  gtk3,
+  hicolor-icon-theme,
+  libappindicator,
+  libhandy,
+  meson,
+  ninja,
+  pkg-config,
+  pygobject3,
+  pyxdg,
+  systemd,
+  wrapGAppsHook3,
+}:
+
+buildPythonApplication rec {
+  pname = "cpupower-gui";
+  version = "1.0.0";
+
+  # This packages doesn't have a setup.py
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "vagnum08";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "05lvpi3wgyi741sd8lgcslj8i7yi3wz7jwl7ca3y539y50hwrdas";
+  };
+
+  patches = [
+    # Fix build with 0.61, can be removed on next update
+    # https://hydra.nixos.org/build/171052557/nixlog/1
+    (fetchpatch {
+      url = "https://github.com/vagnum08/cpupower-gui/commit/97f8ac02fe33e412b59d3f3968c16a217753e74b.patch";
+      sha256 = "XYnpm03kq8JLMjAT73BMCJWlzz40IAuHESm715VV6G0=";
+    })
+    # Fixes https://github.com/vagnum08/cpupower-gui/issues/86
+    (fetchpatch {
+      url = "https://github.com/vagnum08/cpupower-gui/commit/22ea668aa4ecf848149ea4c150aa840a25dc6ff8.patch";
+      sha256 = "sha256-Mri7Af1Y79lt2pvZl4DQSvrqSLIJLIjzyXwMPFEbGVI=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils # needed for update-desktop-database
+    gettext
+    glib # needed for glib-compile-schemas
+    gobject-introspection # need for gtk namespace to be available
+    hicolor-icon-theme # needed for postinstall script
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook3
+
+    # Python packages
+    dbus-python
+    libappindicator
+    pygobject3
+    pyxdg
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libhandy
+  ];
+
+  propagatedBuildInputs = [
+    dbus-python
+    libappindicator
+    pygobject3
+    pyxdg
+  ];
+
+  mesonFlags = [
+    "-Dsystemddir=${placeholder "out"}/lib/systemd"
+  ];
+
+  preConfigure = ''
+    patchShebangs build-aux/meson/postinstall.py
+  '';
+
+  strictDeps = false;
+  dontWrapGApps = true;
+
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
+  postFixup = ''
+    wrapPythonProgramsIn $out/lib "$out $propagatedBuildInputs"
+  '';
+
+  meta = with lib; {
+    description = "Change the frequency limits of your cpu and its governor";
+    mainProgram = "cpupower-gui";
+    homepage = "https://github.com/vagnum08/cpupower-gui/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ unode ];
+  };
+}
--- a/pkgs/os-specific/linux/cpupower/default.nix
+++ b/pkgs/os-specific/linux/cpupower/default.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  buildPackages,
+  kernel,
+  pciutils,
+  gettext,
+  which,
+}:
+
+stdenv.mkDerivation {
+  pname = "cpupower";
+  inherit (kernel) version src patches;
+
+  nativeBuildInputs = [
+    gettext
+    which
+  ];
+  buildInputs = [ pciutils ];
+
+  postPatch = ''
+    cd tools/power/cpupower
+    sed -i 's,/bin/true,${buildPackages.coreutils}/bin/true,' Makefile
+    sed -i 's,/bin/pwd,${buildPackages.coreutils}/bin/pwd,' Makefile
+    sed -i 's,/usr/bin/install,${buildPackages.coreutils}/bin/install,' Makefile
+  '';
+
+  makeFlags = [
+    "CROSS=${stdenv.cc.targetPrefix}"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "LD=${stdenv.cc.targetPrefix}cc"
+  ];
+
+  installFlags = lib.mapAttrsToList (n: v: "${n}dir=${placeholder "out"}/${v}") {
+    bin = "bin";
+    sbin = "sbin";
+    man = "share/man";
+    include = "include";
+    lib = "lib";
+    libexec = "libexec";
+    locale = "share/locale";
+    doc = "share/doc/cpupower";
+    conf = "etc";
+    bash_completion_ = "share/bash-completion/completions";
+    unit = "lib/systemd/system";
+  };
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Tool to examine and tune power saving features";
+    homepage = "https://www.kernel.org/";
+    license = licenses.gpl2Only;
+    mainProgram = "cpupower";
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/cryptodev/default.nix
+++ b/pkgs/os-specific/linux/cryptodev/default.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel ? false,
+  kernelModuleMakeFlags ? [ ],
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cryptodev-linux";
+  version = "1.14";
+
+  src = fetchFromGitHub {
+    owner = "cryptodev-linux";
+    repo = "cryptodev-linux";
+    rev = "cryptodev-linux-${finalAttrs.version}";
+    hash = "sha256-N7fGOMEWrb/gm1MDiJgq2QyTOni6n9w2H52baXmRA1g=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  hardeningDisable = [ "pic" ];
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)"
+    "prefix=$(out)"
+  ];
+
+  meta = {
+    description = "Device that allows access to Linux kernel cryptographic drivers";
+    homepage = "http://cryptodev-linux.org/";
+    maintainers = with lib.maintainers; [ moni ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/os-specific/linux/ddcci/default.nix
+++ b/pkgs/os-specific/linux/ddcci/default.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  kernel,
+  kernelModuleMakeFlags,
+  fetchpatch,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ddcci-driver";
+  version = "0.4.5-unstable-2024-09-26";
+  name = "${pname}-${kernel.version}-${version}";
+
+  src = fetchFromGitLab {
+    owner = "${pname}-linux";
+    repo = "${pname}-linux";
+    rev = "0233e1ee5eddb4b8a706464f3097bad5620b65f4";
+    hash = "sha256-Osvojt8UE+cenOuMoSY+T+sODTAAKkvY/XmBa5bQX88=";
+  };
+
+  patches = [
+    # See https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/merge_requests/17
+    (fetchpatch {
+      url = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux/-/commit/e0605c9cdff7bf3fe9587434614473ba8b7e5f63.patch";
+      hash = "sha256-sTq03HtWQBd7Wy4o1XbdmMjXQE2dG+1jajx4HtwBHjM=";
+    })
+  ];
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  prePatch = ''
+    substituteInPlace ./ddcci/Makefile \
+      --replace '"$(src)"' '$(PWD)' \
+      --replace depmod \#
+    substituteInPlace ./ddcci-backlight/Makefile \
+      --replace '"$(src)"' '$(PWD)' \
+      --replace depmod \#
+  '';
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "KVER=${kernel.modDirVersion}"
+    "KERNEL_MODLIB=$(out)/lib/modules/${kernel.modDirVersion}"
+    "INCLUDEDIR=$(out)/include"
+  ];
+
+  meta = with lib; {
+    description = "Kernel module driver for DDC/CI monitors";
+    homepage = "https://gitlab.com/ddcci-driver-linux/ddcci-driver-linux";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ kiike ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.1";
+  };
+}
--- a/pkgs/os-specific/linux/dddvb/default.nix
+++ b/pkgs/os-specific/linux/dddvb/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  kernel,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dddvb";
+  version = "0.9.38-pre.6";
+
+  src = fetchFromGitHub {
+    owner = "DigitalDevices";
+    repo = "dddvb";
+    tag = version;
+    hash = "sha256-bt/vMnqRWDDChZ6R4JbCr77cz3nlSPkx6siC9KLSEqs=";
+  };
+
+  patches = [
+    (fetchpatch {
+      # pci_*_dma_mask no longer exists in 5.18
+      url = "https://github.com/DigitalDevices/dddvb/commit/871821d6a0be147313bb52570591ce3853b3d370.patch";
+      hash = "sha256-wY05HrsduvsIdp/KpS9NWfL3hR9IvGjuNCDljFn7dd0=";
+    })
+  ];
+
+  postPatch = ''
+    sed -i '/depmod/d' Makefile
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  INSTALL_MOD_PATH = placeholder "out";
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/DigitalDevices/dddvb";
+    description = "Device driver for all Digital Devices DVB demodulator and modulator cards";
+    license = licenses.gpl2Only;
+    maintainers = [ ];
+    platforms = platforms.linux;
+    broken = lib.versionAtLeast kernel.version "6.2";
+  };
+}
--- a/pkgs/os-specific/linux/decklink/default.nix
+++ b/pkgs/os-specific/linux/decklink/default.nix
@@ -0,0 +1,54 @@
+{
+  stdenv,
+  lib,
+  blackmagic-desktop-video,
+  kernel,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "decklink";
+
+  # the download is a horrible curl mess. we reuse it between the kernel module
+  # and desktop service, since the version of the two have to match anyways.
+  # See pkgs/by-name/bl/blackmagic-desktop-video/package.nix for more.
+  inherit (blackmagic-desktop-video) src version;
+
+  KERNELDIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+  INSTALL_MOD_PATH = placeholder "out";
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  postUnpack =
+    let
+      arch = stdenv.hostPlatform.uname.processor;
+    in
+    ''
+      tar xf Blackmagic_Desktop_Video_Linux_${finalAttrs.version}/other/${arch}/desktopvideo-${finalAttrs.version}*-${arch}.tar.gz
+      bmVersion=$(ls -d $NIX_BUILD_TOP/desktopvideo-${finalAttrs.version}*-${arch}/usr/src | sed -e 's/.*desktopvideo-\([[:digit:]\.a-z]\+\).*/\1/')
+
+      moduleRoot=$NIX_BUILD_TOP/desktopvideo-$bmVersion-${arch}/usr/src
+      sourceRoot=$moduleRoot
+    '';
+
+  buildPhase = ''
+    runHook preBuild
+    make -C $moduleRoot/blackmagic-$bmVersion -j$NIX_BUILD_CORES
+    make -C $moduleRoot/blackmagic-io-$bmVersion -j$NIX_BUILD_CORES
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    make -C $KERNELDIR M=$moduleRoot/blackmagic-$bmVersion modules_install
+    make -C $KERNELDIR M=$moduleRoot/blackmagic-io-$bmVersion modules_install
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.blackmagicdesign.com/support/family/capture-and-playback";
+    maintainers = [ maintainers.naxdy ];
+    license = licenses.unfree;
+    description = "Kernel module for the Blackmagic Design Decklink cards";
+    sourceProvenance = with lib.sourceTypes; [ binaryFirmware ];
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/os-specific/linux/device-tree/apply_overlays.py
+++ b/pkgs/os-specific/linux/device-tree/apply_overlays.py
@@ -0,0 +1,121 @@
+from argparse import ArgumentParser
+from dataclasses import dataclass
+from functools import cached_property
+import json
+from pathlib import Path
+import shutil
+
+from libfdt import Fdt, FdtException, FDT_ERR_NOSPACE, FDT_ERR_NOTFOUND, fdt_overlay_apply
+
+
+@dataclass
+class Overlay:
+    name: str
+    filter: str
+    dtbo_file: Path
+
+    @cached_property
+    def fdt(self) -> Fdt:
+        with self.dtbo_file.open("rb") as fd:
+            return Fdt(fd.read())
+
+    @cached_property
+    def compatible(self) -> set[str]:
+        return get_compatible(self.fdt)
+
+
+def get_compatible(fdt) -> set[str]:
+    root_offset = fdt.path_offset("/")
+
+    try:
+        return set(fdt.getprop(root_offset, "compatible").as_stringlist())
+    except FdtException as e:
+        if e.err == -FDT_ERR_NOTFOUND:
+            return set()
+        else:
+            raise e
+
+
+def apply_overlay(dt: Fdt, dto: Fdt) -> Fdt:
+    while True:
+        # we need to copy the buffers because they can be left in an inconsistent state
+        # if the operation fails (ref: fdtoverlay source)
+        result = dt.as_bytearray().copy()
+        err = fdt_overlay_apply(result, dto.as_bytearray().copy())
+
+        if err == 0:
+            new_dt = Fdt(result)
+            # trim the extra space from the final tree
+            new_dt.pack()
+            return new_dt
+
+        if err == -FDT_ERR_NOSPACE:
+            # not enough space, add some blank space and try again
+            # magic number of more space taken from fdtoverlay
+            dt.resize(dt.totalsize() + 65536)
+            continue
+
+        raise FdtException(err)
+
+def process_dtb(rel_path: Path, source: Path, destination: Path, overlays_data: list[Overlay]):
+    source_dt = source / rel_path
+    print(f"Processing source device tree {rel_path}...")
+    with source_dt.open("rb") as fd:
+        dt = Fdt(fd.read())
+
+    for overlay in overlays_data:
+        if overlay.filter and overlay.filter not in str(rel_path):
+            print(f"  Skipping overlay {overlay.name}: filter does not match")
+            continue
+
+        dt_compatible = get_compatible(dt)
+        if len(dt_compatible) == 0:
+            print(f"  Device tree {rel_path} has no compatible string set. Assuming it's compatible with overlay")
+        elif not overlay.compatible.intersection(dt_compatible):
+            print(f"  Skipping overlay {overlay.name}: {overlay.compatible} is incompatible with {dt_compatible}")
+            continue
+
+        print(f"  Applying overlay {overlay.name}")
+        dt = apply_overlay(dt, overlay.fdt)
+
+    print(f"Saving final device tree {rel_path}...")
+    dest_path = destination / rel_path
+    dest_path.parent.mkdir(parents=True, exist_ok=True)
+    with dest_path.open("wb") as fd:
+        fd.write(dt.as_bytearray())
+
+def main():
+    parser = ArgumentParser(description='Apply a list of overlays to a directory of device trees')
+    parser.add_argument("--source", type=Path, help="Source directory")
+    parser.add_argument("--destination", type=Path, help="Destination directory")
+    parser.add_argument("--overlays", type=Path, help="JSON file with overlay descriptions")
+    args = parser.parse_args()
+
+    source: Path = args.source
+    destination: Path = args.destination
+    overlays: Path = args.overlays
+
+    with overlays.open() as fd:
+        overlays_data = [
+            Overlay(
+                name=item["name"],
+                filter=item["filter"],
+                dtbo_file=Path(item["dtboFile"]),
+            )
+            for item in json.load(fd)
+        ]
+
+    for dirpath, dirnames, filenames in source.walk():
+        for filename in filenames:
+            rel_path = (dirpath / filename).relative_to(source)
+            if filename.endswith(".dtb"):
+                process_dtb(rel_path, source, destination, overlays_data)
+            else:
+                # Copy other files through
+                dest_path = destination / rel_path
+                dest_path.parent.mkdir(parents=True, exist_ok=True)
+                shutil.copy(source / rel_path, dest_path)
+
+
+if __name__ == '__main__':
+    main()
--- a/pkgs/os-specific/linux/device-tree/default.nix
+++ b/pkgs/os-specific/linux/device-tree/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  stdenvNoCC,
+  dtc,
+  writers,
+  python3,
+}:
+
+{
+  # Compile single Device Tree overlay source
+  # file (.dts) into its compiled variant (.dtb)
+  compileDTS = (
+    {
+      name,
+      dtsFile,
+      includePaths ? [ ],
+      extraPreprocessorFlags ? [ ],
+    }:
+    stdenv.mkDerivation {
+      inherit name;
+
+      nativeBuildInputs = [ dtc ];
+
+      buildCommand =
+        let
+          includeFlagsStr = lib.concatMapStringsSep " " (includePath: "-I${includePath}") includePaths;
+          extraPreprocessorFlagsStr = lib.concatStringsSep " " extraPreprocessorFlags;
+        in
+        ''
+          $CC -E -nostdinc ${includeFlagsStr} -undef -D__DTS__ -x assembler-with-cpp ${extraPreprocessorFlagsStr} ${dtsFile} | \
+          dtc -I dts -O dtb -@ -o $out
+        '';
+    }
+  );
+
+  applyOverlays = (
+    base: overlays':
+    stdenvNoCC.mkDerivation {
+      name = "device-tree-overlays";
+      nativeBuildInputs = [
+        (python3.pythonOnBuildForHost.withPackages (ps: [ ps.libfdt ]))
+      ];
+      buildCommand = ''
+        python ${./apply_overlays.py} --source ${base} --destination $out --overlays ${writers.writeJSON "overlays.json" overlays'}
+      '';
+    }
+  );
+}
--- a/pkgs/os-specific/linux/device-tree/raspberrypi.nix
+++ b/pkgs/os-specific/linux/device-tree/raspberrypi.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenvNoCC,
+  raspberrypifw,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "raspberrypi-dtbs";
+  version = raspberrypifw.version;
+  nativeBuildInputs = [ raspberrypifw ];
+
+  # Rename DTBs so u-boot finds them, like linux-rpi.nix
+  buildCommand = ''
+    mkdir -p $out/broadcom/
+    cd $out/broadcom/
+
+    cp ${raspberrypifw}/share/raspberrypi/boot/bcm*.dtb .
+
+    cp bcm2708-rpi-zero-w.dtb bcm2835-rpi-zero-w.dtb
+    cp bcm2708-rpi-b.dtb bcm2835-rpi-a.dtb
+    cp bcm2708-rpi-b.dtb bcm2835-rpi-b.dtb
+    cp bcm2708-rpi-b.dtb bcm2835-rpi-b-rev2.dtb
+    cp bcm2708-rpi-b-plus.dtb bcm2835-rpi-a-plus
+    cp bcm2708-rpi-b-plus.dtb bcm2835-rpi-b-plus
+    cp bcm2708-rpi-b-plus.dtb bcm2835-rpi-zero.dtb
+    cp bcm2708-rpi-cm.dtb bcm2835-rpi-cm.dtb
+    cp bcm2709-rpi-2-b.dtb bcm2836-rpi-2-b.dtb
+    cp bcm2710-rpi-3-b.dtb bcm2837-rpi-3-b.dtb
+    cp bcm2710-rpi-3-b-plus.dtb bcm2837-rpi-3-b-plus.dtb
+    cp bcm2710-rpi-cm3.dtb bcm2837-rpi-cm3.dtb
+    cp bcm2711-rpi-4-b.dtb bcm2838-rpi-4-b.dtb
+  '';
+
+  passthru = {
+    # Compatible overlays that may be used
+    overlays = "${raspberrypifw}/share/raspberrypi/boot/overlays";
+  };
+  meta = {
+    inherit (raspberrypifw.meta) homepage license;
+    description = "DTBs for the Raspberry Pi";
+  };
+}
--- a/pkgs/os-specific/linux/digimend/default.nix
+++ b/pkgs/os-specific/linux/digimend/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation {
+  pname = "digimend";
+  version = "13-unstable-2025-01-02";
+
+  src = fetchFromGitHub {
+    owner = "digimend";
+    repo = "digimend-kernel-drivers";
+    rev = "f3c7c7f1179fc786a8e5aad027d4db904c31b42c";
+    hash = "sha256-5kJj3SJfzrQ3n9r1YOn5xt0KO9WcEf0YpNMjiZEYMEo=";
+  };
+
+  postPatch = ''
+    sed 's/udevadm /true /' -i Makefile
+    sed 's/depmod /true /' -i Makefile
+  '';
+
+  # Fix build on Linux kernel >= 5.18
+  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-error=implicit-fallthrough" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KVERSION=${kernel.modDirVersion}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "DESTDIR=${placeholder "out"}"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  meta = with lib; {
+    description = "DIGImend graphics tablet drivers for the Linux kernel";
+    homepage = "https://digimend.github.io/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ PuercoPop ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/displaylink/99-displaylink.rules
+++ b/pkgs/os-specific/linux/displaylink/99-displaylink.rules
@@ -0,0 +1 @@
+ACTION=="add", SUBSYSTEM=="usb", DRIVERS=="usb", ATTRS{idVendor}=="17e9", ATTR{bInterfaceClass}=="ff", ATTR{bInterfaceProtocol}=="03", TAG+="systemd", ENV{SYSTEMD_WANTS}="dlm.service"
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@@ -0,0 +1,106 @@
+{
+  stdenv,
+  lib,
+  unzip,
+  util-linux,
+  libusb1,
+  evdi,
+  makeBinaryWrapper,
+  requireFile,
+}:
+
+let
+  bins =
+    if stdenv.hostPlatform.system == "x86_64-linux" then
+      "x64-ubuntu-1604"
+    else if stdenv.hostPlatform.system == "i686-linux" then
+      "x86-ubuntu-1604"
+    else if stdenv.hostPlatform.system == "aarch64-linux" then
+      "aarch64-linux-gnu"
+    else
+      throw "Unsupported architecture";
+  libPath = lib.makeLibraryPath [
+    stdenv.cc.cc
+    util-linux
+    libusb1
+    evdi
+  ];
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "displaylink";
+  version = "6.2.0-30";
+
+  src = requireFile rec {
+    name = "displaylink-620.zip";
+    hash = "sha256-JQO7eEz4pdoPkhcn9tIuy5R4KyfsCniuw6eXw/rLaYE=";
+    message = ''
+      In order to install the DisplayLink drivers, you must first
+      comply with DisplayLink's EULA and download the binaries and
+      sources from here:
+
+      https://www.synaptics.com/products/displaylink-usb-graphics-software-ubuntu-62
+
+      Once you have downloaded the file, please use the following
+      commands and re-run the installation:
+
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu6.2-EXE.zip" \$PWD/${name}
+      nix-prefetch-url file://\$PWD/${name}
+
+      Alternatively, you can use the following command to download the
+      file directly:
+
+      nix-prefetch-url --name ${name} https://www.synaptics.com/sites/default/files/exe_files/2025-09/DisplayLink%20USB%20Graphics%20Software%20for%20Ubuntu6.2-EXE.zip
+    '';
+  };
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    unzip
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    unzip $src
+    chmod +x displaylink-driver-${finalAttrs.version}.run
+    ./displaylink-driver-${finalAttrs.version}.run --target . --noexec --nodiskspace
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dt $out/lib/displaylink *.spkg
+    install -Dm755 ${bins}/DisplayLinkManager $out/bin/DisplayLinkManager
+    mkdir -p $out/lib/udev/rules.d $out/share
+    cp ${./99-displaylink.rules} $out/lib/udev/rules.d/99-displaylink.rules
+    patchelf \
+      --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+      --set-rpath ${libPath} \
+      $out/bin/DisplayLinkManager
+    wrapProgram $out/bin/DisplayLinkManager \
+      --chdir "$out/lib/displaylink"
+
+    # We introduce a dependency on the source file so that it need not be redownloaded everytime
+    echo $src >> "$out/share/workspace_dependencies.pin"
+
+    runHook postInstall
+  '';
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = {
+    description = "DL-7xxx, DL-6xxx, DL-5xxx, DL-41xx and DL-3x00 Driver for Linux";
+    homepage = "https://www.displaylink.com/";
+    hydraPlatforms = [ ];
+    license = lib.licenses.unfree;
+    mainProgram = "DisplayLinkManager";
+    maintainers = [ ];
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+      "aarch64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/os-specific/linux/dmraid/default.nix
+++ b/pkgs/os-specific/linux/dmraid/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchpatch,
+  lvm2,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dmraid";
+  version = "1.0.0.rc16";
+
+  src = fetchurl {
+    url = "https://people.redhat.com/~heinzm/sw/dmraid/src/old/dmraid-${version}.tar.bz2";
+    sha256 = "0m92971gyqp61darxbiri6a48jz3wq3gkp8r2k39320z0i6w8jgq";
+  };
+
+  patches = [
+    ./hardening-format.patch
+    ./fix-dmevent_tool.patch
+
+    # Fix build with gcc15, based on
+    # https://gitlab.alpinelinux.org/alpine/aports/-/raw/dc5b3135517ede55f5e3530e538ca75048d26565/main/dmraid/008-gcc15.patch
+    ./dmraid-fix-build-with-gcc15.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isMusl [
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/fceed4b8e96b3c1da07babf6f67b6ed1588a28b2/srcpkgs/dmraid/patches/006-musl-libc.patch";
+      sha256 = "1j8xda0fpz8lxjxnqdidy7qb866qrzwpbca56yjdg6vf4x21hx6w";
+      stripLen = 2;
+      extraPrefix = "1.0.0.rc16/";
+    })
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/fceed4b8e96b3c1da07babf6f67b6ed1588a28b2/srcpkgs/dmraid/patches/007-fix-loff_t-musl.patch";
+      sha256 = "0msnq39qnzg3b1pdksnz1dgqwa3ak03g41pqh0lw3h7w5rjc016k";
+      stripLen = 2;
+      extraPrefix = "1.0.0.rc16/";
+    })
+  ];
+
+  postPatch = ''
+    sed -i 's/\[\[[^]]*\]\]/[ "''$''${n##*.}" = "so" ]/' */lib/Makefile.in
+  ''
+  + lib.optionalString stdenv.hostPlatform.isMusl ''
+    NIX_CFLAGS_COMPILE+=" -D_GNU_SOURCE"
+  '';
+
+  preConfigure = "cd */";
+
+  buildInputs = [ lvm2 ];
+
+  # Hand-written Makefile does not have full dependencies to survive
+  # parallel build:
+  #   tools/dmraid.c:12:10: fatal error: dmraid/dmraid.h: No such file
+  enableParallelBuilding = false;
+
+  meta = {
+    description = "Old-style RAID configuration utility";
+    longDescription = ''
+      Old RAID configuration utility (still under development, though).
+      It is fully compatible with modern kernels and mdadm recognizes
+      its volumes. May be needed for rescuing an older system or nuking
+      the metadata when reformatting.
+    '';
+    maintainers = [ lib.maintainers.raskin ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+  };
+}
--- a/pkgs/os-specific/linux/dmraid/dmraid-fix-build-with-gcc15.patch
+++ b/pkgs/os-specific/linux/dmraid/dmraid-fix-build-with-gcc15.patch
@@ -0,0 +1,33 @@
+diff --git a/1.0.0.rc16/lib/activate/activate.c b/1.0.0.rc16/lib/activate/activate.c
+index 1d71ea8c0a..0a4ec6afa1 100644
+--- a/1.0.0.rc16/lib/activate/activate.c
+++ b/1.0.0.rc16/lib/activate/activate.c
+@@ -866,7 +866,7 @@
+
+ #define LIB_NAME_LENGTH 255
+ static int
+-do_device(struct lib_context *lc, struct raid_set *rs, int (*f) ())
+do_device(struct lib_context *lc, struct raid_set *rs, int (*f)(char *, char *))
+ {
+        int ret = 0;
+        char lib_name[LIB_NAME_LENGTH];
+diff --git a/1.0.0.rc16/lib/misc/file.c b/1.0.0.rc16/lib/misc/file.c
+index fe74d5c9c2..c060b6e712 100644
+--- a/1.0.0.rc16/lib/misc/file.c
+++ b/1.0.0.rc16/lib/misc/file.c
+@@ -59,12 +59,12 @@
+ 	int fd, ret = 0;
+ 	loff_t o;
+ 	struct {
+-		ssize_t(*func) ();
+		ssize_t(*func)(int, void *, size_t);
+ 		const char *what;
+ 	} rw_spec[] = {
+ 		{
+ 		read, "read"}, {
+-	write, "writ"},}, *rw = rw_spec + ((flags & O_WRONLY) ? 1 : 0);
+	(ssize_t(*)(int, void *, size_t))write, "writ"},}, *rw = rw_spec + ((flags & O_WRONLY) ? 1 : 0);
+ 
+ 	if ((fd = open(path, flags, lc->mode)) == -1)
+ 		LOG_ERR(lc, 0, "opening \"%s\"", path);
+
--- a/pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch
+++ b/pkgs/os-specific/linux/dmraid/fix-dmevent_tool.patch
@@ -0,0 +1,20 @@
+--- a/1.0.0.rc16/tools/dmevent_tool.c.old	2024-12-26 18:39:04.294039876 -0700
+++ a/1.0.0.rc16/tools/dmevent_tool.c	2024-12-26 18:45:59.416784807 -0700
+@@ -123,7 +123,7 @@
+ }
+ 
+ /* Increment option counters. */
+-static _process_opt(int opt, const char *cmd)
+static int _process_opt(int opt, const char *cmd)
+ {
+ 	struct opt_def_struct {
+ 		const char opt;		/* Option character. */
+@@ -148,7 +148,7 @@
+ 
+ 			optc[o->type]++;
+ 			optc[OPT_SUM]++;
+-			return;
+			return 0;
+ 		}
+ 	}
+ 
--- a/pkgs/os-specific/linux/dmraid/hardening-format.patch
+++ b/pkgs/os-specific/linux/dmraid/hardening-format.patch
@@ -0,0 +1,18 @@
+--- a/1.0.0.rc16/lib/events/libdmraid-events-isw.c	2016-01-29 05:16:57.455425454 +0000
+++ b/1.0.0.rc16/lib/events/libdmraid-events-isw.c	2016-01-29 05:17:55.520564013 +0000
+@@ -838,13 +838,13 @@
+ 
+ 	sz = _log_all_devs(log_type, rs, NULL, 0);
+ 	if (!sz) {
+-		syslog(LOG_ERR, msg[0]);
+		syslog(LOG_ERR, "%s", msg[0]);
+ 		return;
+ 	}
+ 
+ 	str = dm_malloc(++sz);
+ 	if (!str) {
+-		syslog(LOG_ERR, msg[1]);
+		syslog(LOG_ERR, "%s", msg[1]);
+ 		return;
+ 	}
+ 
--- a/pkgs/os-specific/linux/dpdk-kmods/default.nix
+++ b/pkgs/os-specific/linux/dpdk-kmods/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "dpdk-kmods";
+  version = "2023-02-05";
+
+  src = fetchzip {
+    url = "https://git.dpdk.org/dpdk-kmods/snapshot/dpdk-kmods-e721c733cd24206399bebb8f0751b0387c4c1595.tar.xz";
+    sha256 = "sha256-AG5Lthp+CPR4R7I23DUmoWAmET8gLEFHHdjk2TUbQn4=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+  KSRC = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  preBuild = "cd linux/igb_uio";
+
+  installPhase = ''
+    make -C ${KSRC} M=$(pwd) modules_install $makeFlags
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Kernel modules for DPDK";
+    homepage = "https://git.dpdk.org/dpdk-kmods/";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.mic92 ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/drbd/driver.nix
+++ b/pkgs/os-specific/linux/drbd/driver.nix
@@ -0,0 +1,62 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  kernel,
+  kernelModuleMakeFlags,
+  nixosTests,
+  flex,
+  coccinelle,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "drbd";
+  version = "9.2.14";
+
+  src = fetchurl {
+    url = "https://pkg.linbit.com//downloads/drbd/9/drbd-${finalAttrs.version}.tar.gz";
+    hash = "sha256-x8onWPTyBnKt17xofivVlU+42nq1XtCo9i14kSOSd98=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = [
+    kernel.moduleBuildDependencies
+    flex
+    coccinelle
+    python3
+  ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "KVER=${kernel.version}"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+    "M=$(sourceRoot)"
+    "SPAAS=false"
+  ];
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+
+  postPatch = ''
+    patchShebangs .
+    substituteInPlace Makefile --replace 'SHELL=/bin/bash' 'SHELL=${builtins.getEnv "SHELL"}'
+  '';
+
+  passthru.tests.drbd-driver = nixosTests.drbd-driver;
+
+  meta = with lib; {
+    homepage = "https://github.com/LINBIT/drbd";
+    description = "LINBIT DRBD kernel module";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ birkb ];
+    longDescription = ''
+      DRBD is a software-based, shared-nothing, replicated storage solution
+      mirroring the content of block devices (hard disks, partitions, logical volumes, and so on) between hosts.
+    '';
+    broken = kernel.kernelAtLeast "6.16"; # several build errors with 6.16.x kernel versions
+  };
+})
--- a/pkgs/os-specific/linux/drbd/utils.nix
+++ b/pkgs/os-specific/linux/drbd/utils.nix
@@ -0,0 +1,145 @@
+{
+  lib,
+  stdenv,
+  docbook_xml_dtd_44,
+  docbook_xml_dtd_45,
+  docbook_xsl,
+  asciidoctor,
+  fetchurl,
+  flex,
+  kmod,
+  libxslt,
+  nixosTests,
+  perl,
+  perlPackages,
+  systemd,
+  keyutils,
+  udevCheckHook,
+
+  # drbd-utils are compiled twice, once with forOCF = true to extract
+  # its OCF definitions for use in the ocf-resource-agents derivation,
+  # then again with forOCF = false, where the ocf-resource-agents is
+  # provided as the OCF_ROOT.
+  forOCF ? false,
+  ocf-resource-agents,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "drbd";
+  version = "9.32.0";
+
+  src = fetchurl {
+    url = "https://pkg.linbit.com/downloads/drbd/utils/${pname}-utils-${version}.tar.gz";
+    hash = "sha256-szOM7jSbXEZZ4p1P73W6tK9Put0+wOZar+cUiUNC6M0=";
+  };
+
+  nativeBuildInputs = [
+    flex
+    libxslt
+    docbook_xsl
+    asciidoctor
+    keyutils
+    udevCheckHook
+  ];
+
+  buildInputs = [
+    perl
+    perlPackages.Po4a
+  ];
+
+  configureFlags = [
+    "--libdir=${placeholder "out"}/lib"
+    "--sbindir=${placeholder "out"}/bin"
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+    "--without-distro"
+  ];
+
+  makeFlags = [
+    "SOURCE_DATE_EPOCH=1"
+    "WANT_DRBD_REPRODUCIBLE_BUILD=1"
+  ]
+  ++ lib.optional (!forOCF) "OCF_ROOT=${ocf-resource-agents}/usr/lib/ocf}";
+
+  installFlags = [
+    "prefix="
+    "DESTDIR=${placeholder "out"}"
+    "localstatedir=/var"
+    "DRBD_LIB_DIR=/var/lib"
+    "INITDIR=/etc/init.d"
+    "udevrulesdir=/etc/udev/rules.d"
+    "sysconfdir=/etc"
+    "sbindir=/bin"
+    "datadir="
+    "LIBDIR=/lib/drbd"
+    "mandir=/share/man"
+  ];
+
+  postPatch = ''
+    patchShebangs .
+    substituteInPlace user/v84/drbdadm_usage_cnt.c \
+      --replace '"/lib/drbd");' \
+                '"${placeholder "out"}/lib/drbd");'
+    substituteInPlace user/v9/drbdsetup_linux.c \
+      --replace 'ret = system("/sbin/modprobe drbd");' \
+                'ret = system("${kmod}/bin/modprobe drbd");'
+    substituteInPlace user/v84/drbdsetup.c \
+      --replace 'system("/sbin/modprobe drbd")' \
+                'system("${kmod}/bin/modprobe drbd")'
+    substituteInPlace documentation/ra2refentry.xsl \
+      --replace "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" \
+                "${docbook_xml_dtd_44}/xml/dtd/docbook/docbookx.dtd"
+    function patch_docbook45() {
+      substituteInPlace $1 \
+        --replace "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" \
+                  "${docbook_xml_dtd_45}/xml/dtd/docbook/docbookx.dtd"
+    }
+    patch_docbook45 documentation/v9/drbd.conf.xml.in
+    patch_docbook45 documentation/v9/drbdsetup.xml.in
+    patch_docbook45 documentation/v84/drbdsetup.xml
+    patch_docbook45 documentation/v84/drbd.conf.xml
+    # The ja documentation is disabled because:
+    # make[1]: Entering directory '/build/drbd-utils-9.16.0/documentation/ja/v84'
+    # /nix/store/wyx2nn2pjcn50lc95c6qgsgm606rn0x2-perl5.32.1-po4a-0.62/bin/po4a-translate -f docbook -M utf-8 -L utf-8 -keep 0 -m ../../v84/drbdsetup.xml -p drbdsetup.xml.po -l drbdsetup.xml
+    # Use of uninitialized value $args[1] in sprintf at /nix/store/wyx2nn2pjcn50lc95c6qgsgm606rn0x2-perl5.32.1-po4a-0.62/lib/perl5/site_perl/Locale/Po4a/Common.pm line 134.
+    # Invalid po file drbdsetup.xml.po:
+    substituteInPlace Makefile.in \
+      --replace 'DOC_DIRS    := documentation/v9 documentation/ja/v9' \
+                'DOC_DIRS    := documentation/v9' \
+      --replace 'DOC_DIRS    += documentation/v84 documentation/ja/v84' \
+                'DOC_DIRS    += documentation/v84' \
+      --replace '$(MAKE) -C documentation/ja/v9 doc' \
+                "" \
+      --replace '$(MAKE) -C documentation/ja/v84 doc' \
+                ""
+    substituteInPlace user/v9/drbdtool_common.c \
+      --replace 'add_component_to_path("/lib/drbd");' \
+                'add_component_to_path("${placeholder "out"}/lib/drbd");'
+  '';
+
+  preConfigure = ''
+    export PATH=${systemd}/sbin:$PATH
+  '';
+
+  enableParallelBuilding = true;
+
+  doInstallCheck = true;
+
+  passthru.tests.drbd = nixosTests.drbd;
+
+  meta = with lib; {
+    homepage = "https://linbit.com/drbd/";
+    description = "Distributed Replicated Block Device, a distributed storage system for Linux (userspace utilities)";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [
+      ryantm
+      astro
+      birkb
+    ];
+    longDescription = ''
+      DRBD is a software-based, shared-nothing, replicated storage solution
+      mirroring the content of block devices (hard disks, partitions, logical volumes, and so on) between hosts.
+    '';
+  };
+}
--- a/pkgs/os-specific/linux/e1000e/default.nix
+++ b/pkgs/os-specific/linux/e1000e/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  kernel,
+}:
+
+assert lib.versionOlder kernel.version "4.10";
+
+stdenv.mkDerivation rec {
+  name = "e1000e-${version}-${kernel.version}";
+  version = "3.8.4";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/e1000/e1000e-${version}.tar.gz";
+    sha256 = "1q8dbqh14c7r15q6k6iv5k0d6xpi74i71d5r54py60gr099m2ha4";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  configurePhase = ''
+    cd src
+    kernel_version=${kernel.modDirVersion}
+    substituteInPlace common.mk \
+      --replace "/lib/modules" "${kernel.dev}/lib/modules"
+    export makeFlags="BUILD_KERNEL=$kernel_version"
+  '';
+
+  installPhase = ''
+    install -v -D -m 644 e1000e.ko "$out/lib/modules/$kernel_version/kernel/drivers/net/e1000e/e1000e.ko"
+  '';
+
+  dontStrip = true;
+
+  enableParallelBuilding = true;
+
+  meta = {
+    description = "Linux kernel drivers for Intel Ethernet adapters and LOMs (LAN On Motherboard)";
+    homepage = "http://e1000.sf.net/";
+    license = lib.licenses.gpl2Only;
+  };
+}
--- a/pkgs/os-specific/linux/ena/default.nix
+++ b/pkgs/os-specific/linux/ena/default.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gitUpdater,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+let
+  rev-prefix = "ena_linux_";
+  version = "2.15.0";
+in
+stdenv.mkDerivation {
+  inherit version;
+  name = "ena-${version}-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "amzn";
+    repo = "amzn-drivers";
+    rev = "${rev-prefix}${version}";
+    hash = "sha256-AwA7YduFACxmDk4+K/ghp39tdkjewgk4NLktnrSpK5k=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  makeFlags = kernelModuleMakeFlags;
+
+  env.KERNEL_BUILD_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";
+
+  configurePhase = ''
+    runHook preConfigure
+    cd kernel/linux/ena
+    export ENA_PHC_INCLUDE=1
+    runHook postConfigure
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    $STRIP -S ena.ko
+    dest=$out/lib/modules/${kernel.modDirVersion}/misc
+    mkdir -p $dest
+    cp ena.ko $dest/
+    xz $dest/ena.ko
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater {
+    inherit rev-prefix;
+  };
+
+  meta = with lib; {
+    description = "Amazon Elastic Network Adapter (ENA) driver for Linux";
+    homepage = "https://github.com/amzn/amzn-drivers";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [
+      sielicki
+      arianvp
+    ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/error-inject/default.nix
+++ b/pkgs/os-specific/linux/error-inject/default.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  bison,
+  flex,
+  rasdaemon,
+}:
+
+{
+  edac-inject = rasdaemon.inject;
+
+  mce-inject = stdenv.mkDerivation rec {
+    pname = "mce-inject";
+    version = "4cbe46321b4a81365ff3aafafe63967264dbfec5";
+
+    src = fetchzip {
+      url = "https://git.kernel.org/pub/scm/utils/cpu/mce/mce-inject.git/snapshot/mce-inject-${version}.tar.gz";
+      sha256 = "0gjapg2hrlxp8ssrnhvc19i3r1xpcnql7xv0zjgbv09zyha08g6z";
+    };
+
+    nativeBuildInputs = [
+      bison
+      flex
+    ];
+
+    makeFlags = [ "destdir=${placeholder "out"}" ];
+
+    postInstall = ''
+      mkdir $out/sbin
+      mv $out/usr/sbin/mce-inject $out/sbin/mce-inject
+
+      mkdir $out/test
+      cp test/* $out/test/.
+    '';
+
+    meta = with lib; {
+      description = "MCE error injection tool";
+      license = licenses.gpl2Only;
+      platforms = platforms.linux;
+      maintainers = [ ];
+    };
+  };
+
+  aer-inject = stdenv.mkDerivation rec {
+    pname = "aer-inject";
+    version = "9bd5e2c7886fca72f139cd8402488a2235957d41";
+
+    src = fetchzip {
+      url = "https://git.kernel.org/pub/scm/linux/kernel/git/gong.chen/aer-inject.git/snapshot/aer-inject-${version}.tar.gz";
+      sha256 = "0bh6mzpk2mr4xidkammmkfk21b4dbq793qjg25ryyxd1qv0c6cg4";
+    };
+
+    nativeBuildInputs = [
+      bison
+      flex
+    ];
+
+    # how is this necessary?
+    makeFlags = [ "DESTDIR=${placeholder "out"}" ];
+
+    postInstall = ''
+      mkdir $out/bin
+      mv $out/usr/local/aer-inject $out/bin/aer-inject
+
+      mkdir -p $out/examples
+      cp examples/* $out/examples/.
+    '';
+
+    meta = with lib; {
+      description = "PCIE AER error injection tool";
+      license = licenses.gpl2Only;
+      platforms = platforms.linux;
+      maintainers = [ ];
+    };
+  };
+}
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+  libdrm,
+  python3,
+}:
+
+let
+  python3WithLibs = python3.withPackages (
+    ps: with ps; [
+      pybind11
+    ]
+  );
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "evdi";
+  version = "1.14.11";
+
+  src = fetchFromGitHub {
+    owner = "DisplayLink";
+    repo = "evdi";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SxYUhu76vwgCQgjOYVpvdWsFpNcyzuSjZe3x/v566VU=";
+  };
+
+  prePatch = ''
+    substituteInPlace module/Makefile \
+      --replace-fail '/etc/os-release' '/dev/null'
+  '';
+
+  env.CFLAGS = toString [
+    "-Wno-error"
+    "-Wno-error=discarded-qualifiers" # for Linux 4.19 compatibility
+    "-Wno-error=sign-compare"
+  ];
+
+  postBuild = ''
+    # Don't use makeFlags for userspace stuff
+    make library pyevdi
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  buildInputs = [
+    kernel
+    libdrm
+    python3WithLibs
+  ];
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KVER=${kernel.modDirVersion}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "module"
+  ];
+
+  hardeningDisable = [
+    "format"
+    "pic"
+    "fortify"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 module/evdi.ko $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/gpu/drm/evdi/evdi.ko
+    install -Dm755 library/libevdi.so $out/lib/libevdi.so
+    runHook postInstall
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    broken = kernel.kernelOlder "4.19";
+    changelog = "https://github.com/DisplayLink/evdi/releases/tag/v${finalAttrs.version}";
+    description = "Extensible Virtual Display Interface";
+    homepage = "https://www.displaylink.com/";
+    license = with lib.licenses; [
+      lgpl21Only
+      gpl2Only
+    ];
+    maintainers = [ ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/os-specific/linux/facetimehd/default.nix
+++ b/pkgs/os-specific/linux/facetimehd/default.nix
@@ -0,0 +1,56 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  name = "facetimehd-${version}-${kernel.version}";
+  version = "0.6.13";
+
+  # Note: When updating this revision:
+  # 1. Also update pkgs/os-specific/linux/firmware/facetimehd-firmware/
+  # 2. Test the module and firmware change via:
+  #    a. Give some applications a try (Skype, Hangouts, Cheese, etc.)
+  #    b. Run: journalctl -f
+  #    c. Then close the lid
+  #    d. Then open the lid (and maybe press a key to wake it up)
+  #    e. see if the module loads back (apps using the camera won't
+  #       recover and will have to be restarted) and the camera
+  #       still works.
+  src = fetchFromGitHub {
+    owner = "patjak";
+    repo = "facetimehd";
+    rev = version;
+    sha256 = "sha256-3BDIQNMdNeZyuEgnAkJ0uy7b5lOOx1CfS3eamyZyZm8=";
+  };
+
+  preConfigure = ''
+    export INSTALL_MOD_PATH="$out"
+  '';
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/patjak/bcwc_pcie";
+    description = "Linux driver for the Facetime HD (Broadcom 1570) PCIe webcam";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [
+      womfoo
+      grahamc
+      kraem
+    ];
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ];
+  };
+}
--- a/pkgs/os-specific/linux/fanout/default.nix
+++ b/pkgs/os-specific/linux/fanout/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+  kmod,
+  nixosTests,
+}:
+
+stdenv.mkDerivation {
+  pname = "fanout";
+  version = "unstable-2022-10-17-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "bob-linuxtoys";
+    repo = "fanout";
+    rev = "69b1cc69bf425d1a5f83b4e84d41272f1caa0144";
+    hash = "sha256-Q19c88KDFu0A6MejZgKYei9J2693EjRkKtR9hcRcHa0=";
+  };
+
+  preBuild = ''
+    substituteInPlace Makefile --replace "modules_install" "INSTALL_MOD_PATH=$out modules_install"
+  '';
+
+  patches = [
+    ./remove_auto_mknod.patch
+  ];
+
+  hardeningDisable = [
+    "format"
+    "pic"
+  ];
+
+  nativeBuildInputs = [ kmod ] ++ kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  passthru.tests = { inherit (nixosTests) fanout; };
+
+  meta = with lib; {
+    description = "Kernel-based publish-subscribe system";
+    homepage = "https://github.com/bob-linuxtoys/fanout";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ therishidesai ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch
+++ b/pkgs/os-specific/linux/fanout/remove_auto_mknod.patch
@@ -0,0 +1,13 @@
+diff --git a/fanout.c b/fanout.c
+index f5d2a55..87125f4 100644
+--- a/fanout.c
+++ b/fanout.c
+@@ -13,7 +13,7 @@
+ /* Comment out to forgo the creation of /dev entries
+  * The companion udev rules 'fanout.rules' sets the special file mode
+  */
+-#define DEV_MKNOD
+// #define DEV_MKNOD
+ 
+ #include <linux/kernel.h>
+ #include <linux/module.h>
--- a/pkgs/os-specific/linux/ffado/default.nix
+++ b/pkgs/os-specific/linux/ffado/default.nix
@@ -0,0 +1,133 @@
+{
+  lib,
+  stdenv,
+  argp-standalone,
+  dbus,
+  dbus_cplusplus,
+  fetchurl,
+  glibmm,
+  libavc1394,
+  libconfig,
+  libiec61883,
+  libraw1394,
+  libxmlxx3,
+  pkg-config,
+  python3,
+  scons,
+  which,
+  withMixer ? false,
+  qt5,
+  udevCheckHook,
+}:
+
+let
+  python = python3.withPackages (
+    pkgs:
+    with pkgs;
+    (
+      [
+        distutils
+      ]
+      ++ lib.optionals withMixer [
+        pyqt5
+        dbus-python
+      ]
+    )
+  );
+in
+stdenv.mkDerivation rec {
+  pname = "ffado";
+  version = "2.4.9";
+
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+  ];
+
+  src = fetchurl {
+    url = "http://www.ffado.org/files/libffado-${version}.tgz";
+    hash = "sha256-xELFL60Ryv1VE7tOhGyFHxAchIT4karFRe0ZDo/U0Q8=";
+  };
+
+  prePatch = ''
+    substituteInPlace ./support/tools/ffado-diag.in \
+      --replace /lib/modules/ "/run/booted-system/kernel-modules/lib/modules/"
+
+    # prevent build tools from leaking into closure
+    substituteInPlace support/tools/SConscript --replace-fail \
+      'support/tools/ffado-diag --static' \
+      "echo '"'See `nix-store --query --tree ${placeholder "out"}`.'"'"
+  ''
+  + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # skip the CC sanity check, since that requires invoking cross-compiled binaries during build
+    substituteInPlace SConstruct \
+      --replace-fail 'conf.CompilerCheck()' 'True' \
+      --replace-fail "pkg-config" "$PKG_CONFIG"
+    substituteInPlace admin/pkgconfig.py \
+      --replace-fail "pkg-config" "$PKG_CONFIG"
+  '';
+
+  nativeBuildInputs = [
+    scons
+    pkg-config
+    which
+    udevCheckHook
+  ]
+  ++ lib.optionals withMixer [
+    python
+    python.pkgs.pyqt5
+    qt5.wrapQtAppsHook
+  ];
+
+  prefixKey = "PREFIX=";
+  sconsFlags = [
+    "CUSTOM_ENV=True" # tell SConstruct to use nixpkgs' CC/CXX/CFLAGS
+    "DETECT_USERSPACE_ENV=False"
+    "DEBUG=False"
+    "ENABLE_ALL=True"
+    "BUILD_TESTS=True"
+    "BUILD_MIXER=${if withMixer then "True" else "False"}"
+    "UDEVDIR=${placeholder "out"}/lib/udev/rules.d"
+    "PYPKGDIR=${placeholder "out"}/${python.sitePackages}"
+    "BINDIR=${placeholder "bin"}/bin"
+    "INCLUDEDIR=${placeholder "dev"}/include"
+    "PYTHON_INTERPRETER=${python.interpreter}"
+  ];
+
+  buildInputs = [
+    dbus
+    dbus_cplusplus
+    glibmm
+    libavc1394
+    libconfig
+    libiec61883
+    libraw1394
+    libxmlxx3
+    python
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isGnu) [
+    argp-standalone
+  ];
+
+  NIX_LDFLAGS = lib.optionalString (!stdenv.hostPlatform.isGnu) "-largp";
+
+  enableParallelBuilding = true;
+  dontWrapQtApps = true;
+  strictDeps = true;
+  doInstallCheck = true;
+
+  preFixup = lib.optionalString withMixer ''
+    wrapQtApp "$bin/bin/ffado-mixer"
+  '';
+
+  meta = with lib; {
+    homepage = "http://www.ffado.org";
+    description = "FireWire audio drivers";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [
+      michojel
+    ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/firmware/ath9k/default.nix
+++ b/pkgs/os-specific/linux/firmware/ath9k/default.nix
@@ -0,0 +1,190 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  fetchFromGitHub,
+  m4,
+  cmake,
+  perl,
+  writeScript,
+  enableUnstable ? false,
+}:
+
+let
+  stableVersion = "1.4.0";
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ath9k-htc-blobless-firmware";
+  version = if enableUnstable then "unstable-2022-05-22" else stableVersion;
+
+  src = fetchFromGitHub (
+    {
+      owner = "qca";
+      repo = "open-ath9k-htc-firmware";
+    }
+    // (
+      if enableUnstable then
+        {
+          rev = "d856466a068afe4069335257c0d28295ff777d92";
+          hash = "sha256-9OE6qYGABeXjf1r/Depd+811EJ2e8I0Ni5ePHSOh9G4=";
+        }
+      else
+        {
+          rev = finalAttrs.version;
+          hash = "sha256-Q/A0ryIC5E1pt2Sh7o79gxHbe4OgdlrwflOWtxWSS5o=";
+        }
+    )
+  );
+
+  postPatch = ''
+    patchShebangs target_firmware/firmware-crc.pl
+  '';
+
+  nativeBuildInputs = [
+    m4
+    cmake
+    perl
+  ];
+
+  env.NIX_CFLAGS_COMPILE =
+    # old libiberty emits fatal warnings
+    "-w"
+    # old gmp fails to compile with newer gcc
+    # FIXME remove when the normal version has moved on
+    + lib.optionalString (!enableUnstable) " -fpermissive";
+
+  dontUseCmakeConfigure = true;
+  enableParallelBuilding = true;
+
+  # The firmware repository builds its own toolchain, with patches
+  # applied to the xtensa support in both gcc and binutils.
+  preBuild =
+    let
+      inherit (lib)
+        toUpper
+        splitString
+        last
+        listToAttrs
+        pipe
+        ;
+      inherit (builtins) map;
+      urls-and-hashes = import (./. + "/urls-and-hashes-${finalAttrs.version}.nix");
+      make-links =
+        pipe
+          [ "gcc" "binutils" "gmp" "mpfr" "mpc" ]
+          [
+            (map (
+              vname:
+              fetchurl rec {
+                url = urls-and-hashes."${(toUpper vname) + "_URL"}";
+                sha256 = urls-and-hashes."${(toUpper vname) + "_SUM"}" or "";
+                name = last (splitString "/" url);
+              }
+            ))
+            (map (v: "ln -sT ${v} toolchain/dl/${v.name}"))
+            (lib.concatStringsSep "\n")
+          ];
+    in
+    ''
+      mkdir -p toolchain/dl
+      ${make-links}
+    '';
+
+  makeTargets = [
+    "toolchain"
+    "firmware"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt "$out/lib/firmware/ath9k_htc/" target_firmware/*.fw
+    # make symlinks so that firmware will be automatically found
+    ln -s htc_7010.fw "$out/lib/firmware/ath9k_htc/htc_7010-${stableVersion}.fw"
+    ln -s htc_9271.fw "$out/lib/firmware/ath9k_htc/htc_9271-${stableVersion}.fw"
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit (finalAttrs) src;
+    updateScript = writeScript "${finalAttrs.pname}-${finalAttrs.version}-updateScript" ''
+      nix-shell '<nixpkgs>' -A ${finalAttrs.pname}${lib.optionalString enableUnstable "-unstable"}.passthru.update \
+      > pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-${finalAttrs.version}.nix
+    '';
+    update = stdenv.mkDerivation {
+      name = "${finalAttrs.pname}-${finalAttrs.version}-update";
+      shellHook = ''
+        echo 'rec {'
+        echo '  BASEDIR="$NIX_BUILD_TOP";'
+        make --dry-run --print-data-base -f ${finalAttrs.src}/Makefile download \
+          | egrep    '^[A-Z]+_(VER|URL|SUM|DIR) = ' \
+          | sed 's_\([^ ]*\) = \(.*\)_\1 = "\2\";_' \
+          | tr \( \{ \
+          | tr \) \}
+      ''
+      # sha256 checksums were not added to upstream's Makefile until
+      # after the 1.4.0 release.  The following line is needed for
+      # the `enableUnstable==false` build but not for the
+      # `enableUnstable==true` build.  We can remove the lines below
+      # as soon as `enableUnstable==false` points to a version
+      # greater than 1.4.0.
+      + lib.optionalString (finalAttrs.version == "1.4.0") ''
+        echo 'GCC_SUM = "sha256-kuYcbcOgpEnmLXKjgYX9pVAWioZwLeoHEl69PsOZYoI=";'
+        echo 'MPFR_SUM = "sha256-e2bD8T3IOF8IJkyAWFPz4aju2rgHHVgvPmYZccms1f0=";'
+        echo 'MPC_SUM = "sha256-7VqBXP6lJdx3jfDLN0aLnBtVSq8w2TKLFDHKcFt0AP8=";'
+        echo 'GMP_SUM = "sha256-H1iKrMxBu5rtlG+f44Uhwm2LKQ0APF34B/ZWkPKq3sk=";'
+        echo 'BINUTILS_SUM = "sha256-KrLlsD4IbRLGKV+DGtrUaz4UEKOiNJM6Lo+sZssuehk=";'
+      ''
+      + ''
+        echo '}'
+        exit
+      '';
+    };
+  };
+
+  meta = {
+    description = "Blobless, open source wifi firmware for ath9k_htc.ko";
+    longDescription = ''
+      Firmware for Qualcomm Atheros cards which use the ath9k_htc.ko
+      Linux driver, supporting 802.11 abgn on both 2.4ghz and 5ghz
+      bands, 3x3-antenna MIMO, up to 600mbit/sec.
+
+      Most devices which use this driver are based on the Qualcomm
+      Atheros AR9271 chip, which is a PCIe device.  If your device
+      is connected via USB, it will also include a Qualcomm Atheros
+      AR7010, which bridges from a USB gadget interface to a PCIe
+      host interface.  This repository includes the firmware for
+      both chips.
+
+      This firmware is completely open source with no blobs, which
+      is quite rare in the wifi world.  Wifi chips have their own
+      dedicated general-purpose CPUs.  This source code allows you
+      to see what those CPUs are doing and modify their behavior.
+    '';
+    license = with lib.licenses; [
+      # see NOTICE.txt for details
+      bsd3 # almost everything; "the ClearBSD licence"
+      gpl2Plus # **/*cmnos_printf.c, only three files
+      classpathException20 # **/*cmnos_printf.c, only three files
+      mit # **/xtos, **/xtensa
+    ];
+
+    # release 1.4.0 vendors a GMP which uses an ancient version of
+    # autotools that does not work on aarch64 or powerpc.
+    # However, enableUnstable (unreleased upstream) works.
+    /*
+      # disabled until #195294 is merged
+      badPlatforms =
+        with lib.systems.inspect.patterns;
+        lib.optionals (!enableUnstable && lib.versionOlder finalAttrs.version "1.4.1") [
+          isAarch64
+          isPower64
+        ];
+    */
+
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    homepage = "http://lists.infradead.org/mailman/listinfo/ath9k_htc_fw";
+    downloadPage = "https://github.com/qca/open-ath9k-htc-firmware";
+    changelog = "https://github.com/qca/open-ath9k-htc-firmware/tags";
+  };
+})
--- a/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix
+++ b/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-1.4.0.nix
@@ -0,0 +1,26 @@
+rec {
+  BASEDIR = "$NIX_BUILD_TOP";
+  BINUTILS_URL = "https://ftp.gnu.org/gnu/binutils/binutils-${BINUTILS_VER}.tar.bz2";
+  DL_DIR = "${TOOLCHAIN_DIR}/dl";
+  GMP_URL = "https://ftp.gnu.org/gnu/gmp/gmp-${GMP_VER}.tar.bz2";
+  GCC_URL = "https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/gcc-${GCC_VER}.tar.bz2";
+  BINUTILS_DIR = "binutils-${BINUTILS_VER}";
+  GCC_VER = "4.7.4";
+  MPFR_URL = "https://ftp.gnu.org/gnu/mpfr/mpfr-${MPFR_VER}.tar.bz2";
+  MPC_VER = "1.0.1";
+  GMP_DIR = "gmp-${GMP_VER}";
+  MPC_URL = "https://ftp.gnu.org/gnu/mpc/mpc-${MPC_VER}.tar.gz";
+  GCC_DIR = "gcc-${GCC_VER}";
+  MPFR_DIR = "mpfr-${MPFR_VER}";
+  MPC_DIR = "mpc-${MPC_VER}";
+  MPFR_VER = "3.1.1";
+  GMP_VER = "5.0.5";
+  BINUTILS_VER = "2.23.1";
+  BUILD_DIR = "${TOOLCHAIN_DIR}/build";
+  TOOLCHAIN_DIR = "${BASEDIR}/toolchain";
+  GCC_SUM = "sha256-kuYcbcOgpEnmLXKjgYX9pVAWioZwLeoHEl69PsOZYoI=";
+  MPFR_SUM = "sha256-e2bD8T3IOF8IJkyAWFPz4aju2rgHHVgvPmYZccms1f0=";
+  MPC_SUM = "sha256-7VqBXP6lJdx3jfDLN0aLnBtVSq8w2TKLFDHKcFt0AP8=";
+  GMP_SUM = "sha256-H1iKrMxBu5rtlG+f44Uhwm2LKQ0APF34B/ZWkPKq3sk=";
+  BINUTILS_SUM = "sha256-KrLlsD4IbRLGKV+DGtrUaz4UEKOiNJM6Lo+sZssuehk=";
+}
--- a/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix
+++ b/pkgs/os-specific/linux/firmware/ath9k/urls-and-hashes-unstable-2022-05-22.nix
@@ -0,0 +1,26 @@
+rec {
+  BASEDIR = "$NIX_BUILD_TOP";
+  BINUTILS_URL = "https://ftp.gnu.org/gnu/binutils/binutils-${BINUTILS_VER}.tar.bz2";
+  DL_DIR = "${TOOLCHAIN_DIR}/dl";
+  GMP_SUM = "f51c99cb114deb21a60075ffb494c1a210eb9d7cb729ed042ddb7de9534451ea";
+  GMP_URL = "https://ftp.gnu.org/gnu/gmp/gmp-${GMP_VER}.tar.bz2";
+  GCC_URL = "https://ftp.gnu.org/gnu/gcc/gcc-${GCC_VER}/gcc-${GCC_VER}.tar.gz";
+  BINUTILS_DIR = "binutils-${BINUTILS_VER}";
+  GCC_VER = "10.2.0";
+  MPFR_URL = "https://ftp.gnu.org/gnu/mpfr/mpfr-${MPFR_VER}.tar.bz2";
+  MPC_VER = "1.1.0";
+  GMP_DIR = "gmp-${GMP_VER}";
+  MPC_URL = "https://ftp.gnu.org/gnu/mpc/mpc-${MPC_VER}.tar.gz";
+  GCC_DIR = "gcc-${GCC_VER}";
+  MPC_SUM = "6985c538143c1208dcb1ac42cedad6ff52e267b47e5f970183a3e75125b43c2e";
+  GCC_SUM = "27e879dccc639cd7b0cc08ed575c1669492579529b53c9ff27b0b96265fa867d";
+  BINUTILS_SUM = "7d24660f87093670738e58bcc7b7b06f121c0fcb0ca8fc44368d675a5ef9cff7";
+  MPFR_DIR = "mpfr-${MPFR_VER}";
+  MPC_DIR = "mpc-${MPC_VER}";
+  MPFR_VER = "4.1.0";
+  GMP_VER = "6.2.0";
+  BINUTILS_VER = "2.35";
+  BUILD_DIR = "${TOOLCHAIN_DIR}/build";
+  MPFR_SUM = "feced2d430dd5a97805fa289fed3fc8ff2b094c02d05287fd6133e7f1f0ec926";
+  TOOLCHAIN_DIR = "${BASEDIR}/toolchain";
+}
--- a/pkgs/os-specific/linux/firmware/b43-firmware/5.1.138.nix
+++ b/pkgs/os-specific/linux/firmware/b43-firmware/5.1.138.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  b43FirmwareCutter,
+}:
+
+let
+  version = "5.100.138";
+in
+
+stdenvNoCC.mkDerivation {
+  pname = "b43-firmware";
+  inherit version;
+
+  src = fetchurl {
+    url = "http://www.lwfinger.com/b43-firmware/broadcom-wl-${version}.tar.bz2";
+    sha256 = "0vz4ka8gycf72gmnaq61k8rh8y17j1wm2k3fidxvcqjvmix0drzi";
+  };
+
+  nativeBuildInputs = [ b43FirmwareCutter ];
+
+  installPhase = ''
+    mkdir -p $out/lib/firmware
+    b43-fwcutter -w $out/lib/firmware linux/wl_apsta.o
+  '';
+
+  meta = {
+    description = "Firmware for cards supported by the b43 kernel module";
+    homepage = "https://wireless.wiki.kernel.org/en/users/drivers/b43";
+    license = lib.licenses.unfree;
+  };
+}
--- a/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix
+++ b/pkgs/os-specific/linux/firmware/b43-firmware/6.30.163.46.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  b43FirmwareCutter,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "b43-firmware";
+  version = "6.30.163.46";
+
+  src = fetchurl {
+    url = "http://www.lwfinger.com/b43-firmware/broadcom-wl-${version}.tar.bz2";
+    sha256 = "0baw6gcnrhxbb447msv34xg6rmlcj0gm3ahxwvdwfcvq4xmknz50";
+  };
+
+  nativeBuildInputs = [ b43FirmwareCutter ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    mkdir -p $out/lib/firmware
+    b43-fwcutter -w $out/lib/firmware *.wl_apsta.o
+  '';
+
+  meta = with lib; {
+    description = "Firmware for cards supported by the b43 kernel module";
+    homepage = "https://wireless.wiki.kernel.org/en/users/drivers/b43";
+    downloadPage = "http://www.lwfinger.com/b43-firmware";
+    license = licenses.unfree;
+  };
+}
--- a/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/armstubs.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+}:
+
+let
+  inherit (lib) optionals;
+in
+stdenv.mkDerivation {
+  pname = "raspberrypi-armstubs";
+  version = "unstable-2022-07-11";
+
+  src = fetchFromGitHub {
+    owner = "raspberrypi";
+    repo = "tools";
+    rev = "439b6198a9b340de5998dd14a26a0d9d38a6bcac";
+    hash = "sha512-KMHgj73eXHT++IE8DbCsFeJ87ngc9R3XxMUJy4Z3s4/MtMeB9zblADHkyJqz9oyeugeJTrDtuVETPBRo7M4Y8A==";
+  };
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-march=armv8-a+crc"
+  ];
+
+  preConfigure = ''
+    cd armstubs
+  '';
+
+  makeFlags = [
+    "CC8=${stdenv.cc.targetPrefix}cc"
+    "LD8=${stdenv.cc.targetPrefix}ld"
+    "OBJCOPY8=${stdenv.cc.targetPrefix}objcopy"
+    "OBJDUMP8=${stdenv.cc.targetPrefix}objdump"
+    "CC7=${stdenv.cc.targetPrefix}cc"
+    "LD7=${stdenv.cc.targetPrefix}ld"
+    "OBJCOPY7=${stdenv.cc.targetPrefix}objcopy"
+    "OBJDUMP7=${stdenv.cc.targetPrefix}objdump"
+  ]
+  ++ optionals (stdenv.hostPlatform.isAarch64) [
+    "armstub8.bin"
+    "armstub8-gic.bin"
+  ]
+  ++ optionals (stdenv.hostPlatform.isAarch32) [
+    "armstub7.bin"
+    "armstub8-32.bin"
+    "armstub8-32-gic.bin"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -vp $out/
+    cp -v *.bin $out/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Firmware related ARM stubs for the Raspberry Pi";
+    homepage = "https://github.com/raspberrypi/tools";
+    license = licenses.bsd3;
+    platforms = [
+      "armv6l-linux"
+      "armv7l-linux"
+      "aarch64-linux"
+    ];
+    maintainers = [ ];
+  };
+}
--- a/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
+++ b/pkgs/os-specific/linux/firmware/raspberrypi/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  # NOTE: this should be updated with linux_rpi
+  pname = "raspberrypi-firmware";
+  version = "1.20250430";
+
+  src = fetchFromGitHub {
+    owner = "raspberrypi";
+    repo = "firmware";
+    rev = version;
+    hash = "sha256-U41EgEDny1R+JFktSC/3CE+2Qi7GJludj929ft49Nm0=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/raspberrypi/
+    mv boot "$out/share/raspberrypi/"
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  meta = with lib; {
+    description = "Firmware for the Raspberry Pi board";
+    homepage = "https://github.com/raspberrypi/firmware";
+    license = licenses.unfreeRedistributableFirmware; # See https://github.com/raspberrypi/firmware/blob/master/boot/LICENCE.broadcom
+    maintainers = with maintainers; [ dezgeg ];
+    # Hash mismatch on source, mystery.
+    # Maybe due to https://github.com/NixOS/nix/issues/847
+    broken = stdenvNoCC.hostPlatform.isDarwin;
+  };
+}
--- a/pkgs/os-specific/linux/framework-laptop-kmod/default.nix
+++ b/pkgs/os-specific/linux/framework-laptop-kmod/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  kernel,
+  kernelModuleMakeFlags,
+  fetchFromGitHub,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation {
+  pname = "framework-laptop-kmod";
+  version = "0-unstable-2024-09-15";
+
+  src = fetchFromGitHub {
+    owner = "DHowett";
+    repo = "framework-laptop-kmod";
+    rev = "6164bc3dec24b6bb2806eedd269df6a170bcc930";
+    hash = "sha256-OwtXQR0H4GNlYjVZ5UU5MEM6ZOjlV3B0x2auYawbS2U=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D framework_laptop.ko -t $out/lib/modules/${kernel.modDirVersion}/extra
+    runHook postInstall
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "Kernel module that exposes the Framework Laptop (13, 16)'s battery charge limit and LEDs to userspace";
+    homepage = "https://github.com/DHowett/framework-laptop-kmod";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ gaykitty ];
+    platforms = platforms.linux;
+    broken = lib.versionOlder kernel.version "6.1";
+  };
+}
--- a/pkgs/os-specific/linux/freefall/default.nix
+++ b/pkgs/os-specific/linux/freefall/default.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  kernel,
+}:
+
+stdenv.mkDerivation {
+  inherit (kernel) version src;
+
+  pname = "freefall";
+
+  postPatch = ''
+    cd tools/laptop/freefall
+
+    # Default time-out is a little low, probably because the AC/lid status
+    # functions were never implemented. Because no-one still uses HDDs, right?
+    substituteInPlace freefall.c --replace "alarm(2)" "alarm(5)"
+  '';
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    inherit (kernel.meta) homepage license;
+
+    description = "Free-fall protection for spinning HP/Dell laptop hard drives";
+    mainProgram = "freefall";
+    longDescription = ''
+      Provides a shock protection facility in modern laptops with spinning hard
+      drives, by stopping all input/output operations on the internal hard drive
+      and parking its heads on the ramp when critical situations are anticipated.
+      Requires support for the ATA/ATAPI-7 IDLE IMMEDIATE command with unload
+      feature, which should cause the drive to switch to idle mode and unload the
+      disk heads, and an accelerometer device. It has no effect on SSD devices!
+    '';
+
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/freeipa/default.nix
+++ b/pkgs/os-specific/linux/freeipa/default.nix
@@ -0,0 +1,195 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  fetchpatch,
+  pkg-config,
+  autoconf,
+  automake,
+  kerberos,
+  openldap,
+  popt,
+  sasl,
+  curl,
+  xmlrpc_c,
+  ding-libs,
+  p11-kit,
+  gettext,
+  nspr,
+  nss,
+  _389-ds-base,
+  svrcore,
+  libuuid,
+  talloc,
+  tevent,
+  samba,
+  libunistring,
+  libverto,
+  libpwquality,
+  systemd,
+  python3,
+  bind,
+  sssd,
+  jre,
+  rhino,
+  lesscpy,
+  jansson,
+  runtimeShell,
+  versionCheckHook,
+}:
+
+let
+  pythonInputs = with python3.pkgs; [
+    distutils
+    six
+    python-ldap
+    dnspython
+    netaddr
+    netifaces
+    gssapi
+    dogtag-pki
+    pyasn1
+    sssd
+    cffi
+    lxml
+    dbus-python
+    cryptography
+    python-memcached
+    qrcode
+    pyusb
+    yubico
+    setuptools
+    jinja2
+    augeas
+    samba
+    ifaddr
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "freeipa";
+  version = "4.12.5";
+
+  src = fetchurl {
+    url = "https://releases.pagure.org/freeipa/freeipa-${version}.tar.gz";
+    hash = "sha256-jvXS9Hx9VGFccFL19HogfH15JVIW7pc3/TY1pOvJglM=";
+  };
+
+  patches = [
+    (fetchpatch {
+      name = "support-pyca-44.0";
+      url = "https://github.com/freeipa/freeipa/pull/7619/commits/2dc4133920fe58ce414c545102c74173d40d1997.patch";
+      hash = "sha256-PROnPc/1qS3hcO8s5sel55tsyZ1VPjEKLcua8Pd4DP0=";
+    })
+    (fetchpatch {
+      name = "fix-tripledes-cipher-warnings";
+      url = "https://github.com/freeipa/freeipa/pull/7619/commits/e2bf6e4091c7b5320ec6387dab2d5cabe4a9a42d.patch";
+      hash = "sha256-AyMK0hjXMrFK4/qIcjPMFH9DKvnvYOK2QS83Otcc+l4=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    python3.pkgs.wrapPython
+    jre
+    rhino
+    lesscpy
+    automake
+    autoconf
+    gettext
+    pkg-config
+  ];
+
+  buildInputs = [
+    kerberos
+    openldap
+    popt
+    sasl
+    curl
+    xmlrpc_c
+    ding-libs
+    p11-kit
+    python3
+    nspr
+    nss
+    _389-ds-base
+    svrcore
+    libuuid
+    talloc
+    tevent
+    samba
+    libunistring
+    libverto
+    systemd
+    bind
+    libpwquality
+    jansson
+  ]
+  ++ pythonInputs;
+
+  postPatch = ''
+    patchShebangs makeapi makeaci install/ui/util
+
+    substituteInPlace ipasetup.py.in \
+      --replace 'int(v)' 'int(v.replace("post", ""))'
+
+    substituteInPlace client/ipa-join.c \
+      --replace /usr/sbin/ipa-getkeytab $out/bin/ipa-getkeytab
+
+    substituteInPlace ipaplatform/nixos/paths.py \
+      --subst-var out \
+      --subst-var-by bind ${bind.dnsutils} \
+      --subst-var-by curl ${curl} \
+      --subst-var-by kerberos ${kerberos}
+  '';
+
+  NIX_CFLAGS_COMPILE = "-I${_389-ds-base}/include/dirsrv";
+  pythonPath = pythonInputs;
+
+  # Building and installing the server fails with silent Rhino errors, skipping
+  # for now. Need a newer Rhino version.
+  #buildFlags = [ "client" "server" ]
+
+  configureFlags = [
+    "--with-systemdsystemunitdir=$out/lib/systemd/system"
+    "--with-ipaplatform=nixos"
+    "--disable-server"
+  ];
+
+  postInstall = ''
+    echo "
+     #!${runtimeShell}
+     echo 'ipa-client-install is not available on NixOS. Please see security.ipa, instead.'
+     exit 1
+    " > $out/sbin/ipa-client-install
+  '';
+
+  postFixup = ''
+    wrapPythonPrograms
+    rm -rf $out/etc/ipa $out/var/lib/ipa-client/sysrestore
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  meta = with lib; {
+    description = "Identity, Policy and Audit system";
+    longDescription = ''
+      IPA is an integrated solution to provide centrally managed Identity (users,
+      hosts, services), Authentication (SSO, 2FA), and Authorization
+      (host access control, SELinux user roles, services). The solution provides
+      features for further integration with Linux based clients (SUDO, automount)
+      and integration with Active Directory based infrastructures (Trusts).
+    '';
+    homepage = "https://www.freeipa.org/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [
+      s1341
+      benley
+    ];
+    platforms = platforms.linux;
+    mainProgram = "ipa";
+  };
+}
--- a/pkgs/os-specific/linux/fuse/common.nix
+++ b/pkgs/os-specific/linux/fuse/common.nix
@@ -0,0 +1,148 @@
+{ version, hash }:
+
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  fusePackages,
+  util-linux,
+  gettext,
+  shadow,
+  meson,
+  ninja,
+  pkg-config,
+  autoreconfHook,
+  runtimeShell,
+  udevCheckHook,
+}:
+
+let
+  isFuse3 = lib.hasPrefix "3" version;
+in
+stdenv.mkDerivation rec {
+  pname = "fuse";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "libfuse";
+    repo = "libfuse";
+    rev = "${pname}-${version}";
+    inherit hash;
+  };
+
+  patches =
+    lib.optional (!isFuse3 && (stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isLoongArch64))
+      (fetchpatch {
+        url = "https://github.com/libfuse/libfuse/commit/914871b20a901e3e1e981c92bc42b1c93b7ab81b.patch";
+        sha256 = "1w4j6f1awjrycycpvmlv0x5v9gprllh4dnbjxl4dyl2jgbkaw6pa";
+      })
+    ++ (
+      if isFuse3 then
+        [
+          ./fuse3-install.patch
+          ./fuse3-Do-not-set-FUSERMOUNT_DIR.patch
+        ]
+      else
+        [
+          ./fuse2-Do-not-set-FUSERMOUNT_DIR.patch
+          (fetchpatch {
+            url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/sys-fs/fuse/files/fuse-2.9.9-closefrom-glibc-2-34.patch?id=8a970396fca7aca2d5a761b8e7a8242f1eef14c9";
+            sha256 = "sha256-ELYBW/wxRcSMssv7ejCObrpsJHtOPJcGq33B9yHQII4=";
+          })
+          ./fuse2-gettext-0.25.patch
+        ]
+    );
+
+  nativeBuildInputs =
+    if isFuse3 then
+      [
+        meson
+        ninja
+        pkg-config
+      ]
+      ++ lib.optionals (!stdenv.hostPlatform.isMusl) [ udevCheckHook ] # inf rec on musl, so skip
+    else
+      [
+        autoreconfHook
+        gettext
+      ];
+
+  outputs = [
+    "bin"
+    "out"
+    "dev"
+    "man"
+  ]
+  ++ lib.optional isFuse3 "udev";
+
+  mesonFlags = lib.optionals isFuse3 [
+    "-Dudevrulesdir=/udev/rules.d"
+    "-Duseroot=false"
+    "-Dinitscriptdir="
+    "-Dexamples=false" # examples fail on musl and are just generally useless
+  ];
+
+  # Ensure that FUSE calls the setuid wrapper, not
+  # $out/bin/fusermount. It falls back to calling fusermount in
+  # $PATH, so it should also work on non-NixOS systems.
+  env.NIX_CFLAGS_COMPILE = ''-DFUSERMOUNT_DIR="/run/wrappers/bin"'';
+
+  preConfigure = ''
+    substituteInPlace lib/mount_util.c \
+      --replace-fail "/bin/mount" "${lib.getBin util-linux}/bin/mount" \
+      --replace-fail "/bin/umount" "${lib.getBin util-linux}/bin/umount"
+    substituteInPlace util/mount.fuse.c \
+      --replace-fail "/bin/sh" "${runtimeShell}"
+  ''
+  + lib.optionalString (!isFuse3) ''
+    export MOUNT_FUSE_PATH=$bin/bin
+
+    # Do not install these files for fuse2 which are not useful for NixOS.
+    export INIT_D_PATH=$TMPDIR/etc/init.d
+    export UDEV_RULES_PATH=$TMPDIR/etc/udev/rules.d
+
+    # This is for `setuid=`, and needs root permission anyway.
+    # No need to use the SUID wrapper.
+    substituteInPlace util/mount.fuse.c \
+      --replace-fail '"su"' '"${lib.getBin shadow.su}/bin/su"'
+  '';
+
+  # v2: no tests, v3: all tests get skipped in a sandbox
+  doCheck = false;
+  doInstallCheck = true;
+
+  # Drop `/etc/fuse.conf` because it is a no-op config and
+  # would conflict with our fuse module.
+  postInstall = lib.optionalString isFuse3 ''
+    rm $out/etc/fuse.conf
+    mkdir $udev
+    mv $out/etc $udev
+  '';
+
+  # Don't pull in SUID `fusermount{,3}` binaries into development environment.
+  propagatedBuildOutputs = [ "out" ];
+
+  meta = {
+    description = "Library that allows filesystems to be implemented in user space";
+    longDescription = ''
+      FUSE (Filesystem in Userspace) is an interface for userspace programs to
+      export a filesystem to the Linux kernel. The FUSE project consists of two
+      components: The fuse kernel module (maintained in the regular kernel
+      repositories) and the libfuse userspace library (this package). libfuse
+      provides the reference implementation for communicating with the FUSE
+      kernel module.
+    '';
+    homepage = "https://github.com/libfuse/libfuse";
+    changelog = "https://github.com/libfuse/libfuse/releases/tag/fuse-${version}";
+    platforms = lib.platforms.linux;
+    license = with lib.licenses; [
+      gpl2Only
+      lgpl21Only
+    ];
+    maintainers = with lib.maintainers; [
+      oxalica
+    ];
+    outputsToInstall = [ "bin" ];
+  };
+}
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@@ -0,0 +1,20 @@
+{ callPackage, util-linux }:
+
+let
+  mkFuse =
+    args:
+    callPackage (import ./common.nix args) {
+      inherit util-linux;
+    };
+in
+{
+  fuse_2 = mkFuse {
+    version = "2.9.9";
+    hash = "sha256-dgjM6M7xk5MHi9xPyCyvF0vq0KM8UCsEYBcMhkrdvfs=";
+  };
+
+  fuse_3 = mkFuse {
+    version = "3.17.4";
+    hash = "sha256-G3+cBp8q8S8oLIcgWp0p+TAtzqXlKYbRSY/5Y3L7QO4=";
+  };
+}
--- a/pkgs/os-specific/linux/fuse/fuse2-Do-not-set-FUSERMOUNT_DIR.patch
+++ b/pkgs/os-specific/linux/fuse/fuse2-Do-not-set-FUSERMOUNT_DIR.patch
@@ -0,0 +1,11 @@
+--- a/lib/Makefile.am
+++ b/lib/Makefile.am
+@@ -1,7 +1,7 @@
+ ## Process this file with automake to produce Makefile.in
+ 
+ AUTOMAKE_OPTIONS = subdir-objects
+-AM_CPPFLAGS = -I$(top_srcdir)/include -DFUSERMOUNT_DIR=\"$(bindir)\" \
+AM_CPPFLAGS = -I$(top_srcdir)/include \
+  -D_FILE_OFFSET_BITS=64 -D_REENTRANT -DFUSE_USE_VERSION=26
+ 
+ lib_LTLIBRARIES = libfuse.la libulockmgr.la
--- a/pkgs/os-specific/linux/fuse/fuse2-gettext-0.25.patch
+++ b/pkgs/os-specific/linux/fuse/fuse2-gettext-0.25.patch
@@ -0,0 +1,13 @@
+diff --git a/configure.ac b/configure.ac
+index 9946a0e..4621771 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -4,6 +4,8 @@ AC_PREREQ(2.59d)
+ AC_CONFIG_MACRO_DIR([m4])
+ AC_CANONICAL_TARGET
+ AM_INIT_AUTOMAKE([foreign])
+AM_GNU_GETTEXT_VERSION([0.25])
+AM_GNU_GETTEXT([external])
+ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES(yes)])
+ AC_CONFIG_HEADERS(include/config.h)
+ 
--- a/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-Do-not-set-FUSERMOUNT_DIR.patch
@@ -0,0 +1,13 @@
+--- a/lib/meson.build
+++ b/lib/meson.build
+@@ -37,8 +37,7 @@ libfuse = library('fuse3', libfuse_sources, version: meson.project_version(),
+                   include_directories: include_dirs,
+                   dependencies: deps,
+                   install: true,
+                   link_depends: 'fuse_versionscript',
+-                  c_args: [ '-DFUSE_USE_VERSION=317',
+-                            '-DFUSERMOUNT_DIR="@0@"'.format(fusermount_path) ],
+                  c_args: [ '-DFUSE_USE_VERSION=317' ],
+                   link_args: ['-Wl,--version-script,' + meson.current_source_dir()
+                               + '/fuse_versionscript' ])
+ 
--- a/pkgs/os-specific/linux/fuse/fuse3-install.patch
+++ b/pkgs/os-specific/linux/fuse/fuse3-install.patch
@@ -0,0 +1,27 @@
+--- a/util/install_helper.sh	2023-08-26 22:12:11.028651669 +0200
+++ b/util/install_helper.sh	2023-08-26 22:38:03.165058694 +0200
+@@ -39,12 +39,12 @@
+ 
+ if [ "${udevrulesdir}" != "" ]; then
+     install -D -m 644 "${MESON_SOURCE_ROOT}/util/udev.rules" \
+-        "${DESTDIR}${udevrulesdir}/99-fuse3.rules"
+        "${sysconfdir}${udevrulesdir}/99-fuse3.rules"
+ fi
+ 
+ if [ "$initscriptdir" != "" ]; then
+     install -D -m 755 "${MESON_SOURCE_ROOT}/util/init_script" \
+-            "${DESTDIR}${initscriptdir}/fuse3"
+            "${sysconfdir}${initscriptdir}/fuse3"
+ 
+     if test -x /usr/sbin/update-rc.d && test -z "${DESTDIR}"; then
+         /usr/sbin/update-rc.d fuse3 start 34 S . start 41 0 6 . || /bin/true
+diff --git a/util/meson.build b/util/meson.build
+index aa0e734..06d4378 100644
+--- a/util/meson.build
+++ b/util/meson.build
+@@ -1,4 +1,4 @@
+-fuseconf_path = join_paths(get_option('prefix'), get_option('sysconfdir'), 'fuse.conf')
+fuseconf_path = join_paths('/', get_option('sysconfdir'), 'fuse.conf')
+ 
+ executable('fusermount3', ['fusermount.c', '../lib/mount_util.c'],
+            include_directories: include_dirs,
--- a/pkgs/os-specific/linux/fwts/default.nix
+++ b/pkgs/os-specific/linux/fwts/default.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  autoreconfHook,
+  pkg-config,
+  glib,
+  pcre,
+  json_c,
+  flex,
+  bison,
+  dtc,
+  pciutils,
+  dmidecode,
+  acpica-tools,
+  libbsd,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fwts";
+  version = "24.09.00";
+
+  src = fetchzip {
+    url = "https://fwts.ubuntu.com/release/fwts-V${version}.tar.gz";
+    hash = "sha256-ZJSlx8O38e7bJYTgZacayslr28TLHHJsISXq9Uzsnyc=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    glib
+    pcre
+    json_c
+    flex
+    bison
+    dtc
+    pciutils
+    dmidecode
+    acpica-tools
+    libbsd
+  ];
+
+  postPatch = ''
+    substituteInPlace src/lib/include/fwts_binpaths.h \
+      --replace-fail "/usr/bin/lspci"      "${pciutils}/bin/lspci" \
+      --replace-fail "/usr/sbin/dmidecode" "${dmidecode}/bin/dmidecode" \
+      --replace-fail "/usr/bin/iasl"       "${acpica-tools}/bin/iasl"
+
+    substituteInPlace src/lib/src/fwts_devicetree.c \
+                      src/devicetree/dt_base/dt_base.c \
+      --replace-fail "dtc -I" "${dtc}/bin/dtc -I"
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = {
+    homepage = "https://wiki.ubuntu.com/FirmwareTestSuite";
+    description = "Firmware Test Suite";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ tadfisher ];
+  };
+}
--- a/pkgs/os-specific/linux/fwts/module.nix
+++ b/pkgs/os-specific/linux/fwts/module.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenv,
+  fwts,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fwts-efi-runtime";
+  version = "${fwts.version}-${kernel.version}";
+
+  inherit (fwts) src;
+
+  sourceRoot = "${src.name}/efi_runtime";
+
+  postPatch = ''
+    substituteInPlace Makefile --replace \
+      '/lib/modules/$(KVER)/build' \
+      '${kernel.dev}/lib/modules/${kernel.modDirVersion}/build'
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  hardeningDisable = [ "pic" ];
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  meta = with lib; {
+    inherit (fwts.meta) homepage license;
+    description = fwts.meta.description + "(efi-runtime kernel module)";
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/gasket/default.nix
+++ b/pkgs/os-specific/linux/gasket/default.nix
@@ -0,0 +1,66 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch2,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation {
+  pname = "gasket";
+  version = "1.0-18-unstable-2024-04-25";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "gasket-driver";
+    rev = "5815ee3908a46a415aac616ac7b9aedcb98a504c";
+    sha256 = "O17+msok1fY5tdX1DvqYVw6plkUDF25i8sqwd6mxYf8=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      # https://github.com/google/gasket-driver/issues/36
+      # https://github.com/google/gasket-driver/pull/35
+      name = "linux-6.12-compat.patch";
+      url = "https://github.com/google/gasket-driver/commit/4b2a1464f3b619daaf0f6c664c954a42c4b7ce00.patch";
+      hash = "sha256-UOoOSEnpUMa4QXWVFpGFxBoF5szXaLEfcWtfKatO5XY=";
+    })
+    (fetchpatch2 {
+      # https://github.com/google/gasket-driver/issues/39
+      # https://github.com/google/gasket-driver/pull/40
+      name = "linux-6.13-compat.patch";
+      url = "https://github.com/google/gasket-driver/commit/6fbf8f8f8bcbc0ac9c9bef7a56f495a2c9872652.patch";
+      hash = "sha256-roCo0/ETWuDVtZfbpFbrmy/icNI12A/ozOGQNLTtBUs=";
+    })
+  ];
+
+  postPatch = ''
+    cd src
+  '';
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "M=$(PWD)"
+  ];
+  buildFlags = [ "modules" ];
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+  installTargets = [ "modules_install" ];
+
+  hardeningDisable = [
+    "pic"
+    "format"
+  ];
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  meta = with lib; {
+    description = "Coral Gasket Driver allows usage of the Coral EdgeTPU on Linux systems";
+    homepage = "https://github.com/google/gasket-driver";
+    license = licenses.gpl2Only;
+    maintainers = [ lib.maintainers.kylehendricks ];
+    platforms = platforms.linux;
+    broken = versionOlder kernel.version "5.15";
+  };
+}
--- a/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
+++ b/pkgs/os-specific/linux/gcadapter-oc-kmod/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+  kmod,
+}:
+
+let
+  kerneldir = "lib/modules/${kernel.modDirVersion}";
+in
+stdenv.mkDerivation rec {
+  pname = "gcadapter-oc-kmod";
+  version = "unstable-2021-12-11";
+
+  src = fetchFromGitHub {
+    owner = "HannesMann";
+    repo = pname;
+    rev = "d4ddf15deb74c51dbdfc814d481ef127c371f444";
+    sha256 = "sha256-bHA1611rcO8/d48b1CHsiurEt3/n+5WErtHXAU7Eh1o=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNEL_SOURCE_DIR=${kernel.dev}/${kerneldir}/build"
+    "INSTALL_MOD_PATH=$(out)"
+  ];
+
+  installPhase = ''
+    install -D {,$out/${kerneldir}/extra/}gcadapter_oc.ko
+  '';
+
+  meta = with lib; {
+    description = "Kernel module for overclocking the Nintendo Wii U/Mayflash GameCube adapter";
+    homepage = "https://github.com/HannesMann/gcadapter-oc-kmod";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ r-burns ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/guvcview/default.nix
+++ b/pkgs/os-specific/linux/guvcview/default.nix
@@ -0,0 +1,79 @@
+{
+  config,
+  lib,
+  stdenv,
+  fetchurl,
+  cmake,
+  intltool,
+  pkg-config,
+  portaudio,
+  SDL2,
+  ffmpeg,
+  udev,
+  libusb1,
+  libv4l,
+  alsa-lib,
+  gsl,
+  libpng,
+  sfml_2,
+  pulseaudioSupport ? config.pulseaudio or stdenv.hostPlatform.isLinux,
+  libpulseaudio,
+  useQt ? false,
+  qtbase ? null,
+  wrapQtAppsHook ? null,
+  # can be turned off if used as a library
+  useGtk ? true,
+  gtk3,
+  wrapGAppsHook3 ? null,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "guvcview";
+  version = "2.2.1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/project/guvcview/source/guvcview-src-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-0q3HznYpYehTw+FrURutYVBEktEvPi634w2kovet5a8=";
+  };
+
+  nativeBuildInputs = [
+    intltool
+    pkg-config
+    cmake
+  ]
+  ++ lib.optionals useGtk [ wrapGAppsHook3 ]
+  ++ lib.optionals useQt [ wrapQtAppsHook ];
+
+  buildInputs = [
+    SDL2
+    alsa-lib
+    ffmpeg
+    libusb1
+    libv4l
+    portaudio
+    udev
+    gsl
+    libpng
+    sfml_2
+  ]
+  ++ lib.optionals pulseaudioSupport [ libpulseaudio ]
+  ++ lib.optionals useGtk [ gtk3 ]
+  ++ lib.optionals useQt [
+    qtbase
+  ];
+
+  configureFlags = [
+    "--enable-sfml"
+  ]
+  ++ lib.optionals useGtk [ "--enable-gtk3" ]
+  ++ lib.optionals useQt [ "--enable-qt5" ];
+
+  meta = {
+    description = "Simple interface for devices supported by the linux UVC driver";
+    mainProgram = "guvcview";
+    homepage = "https://guvcview.sourceforge.net";
+    maintainers = [ lib.maintainers.coconnor ];
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/os-specific/linux/hid-ite8291r3/default.nix
+++ b/pkgs/os-specific/linux/hid-ite8291r3/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hid-ite8291r3";
+  version = "unstable-2022-06-01";
+
+  src = fetchFromGitHub {
+    owner = "pobrn";
+    repo = "hid-ite8291r3";
+    rev = "48e04cb96517f8574225ebabb286775feb942ef5";
+    hash = "sha256-/69vvVbAVULDW8rwDYSj5706vrqJ6t4s/T6s3vmG9wk=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "VERSION=${version}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D hid-ite8291r3.ko -t $out/lib/modules/${kernel.modDirVersion}/extra
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Linux driver for the ITE 8291 RGB keyboard backlight controller";
+    homepage = "https://github.com/pobrn/hid-ite8291r3/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ aacebedo ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.9";
+  };
+}
--- a/pkgs/os-specific/linux/hid-t150/default.nix
+++ b/pkgs/os-specific/linux/hid-t150/default.nix
@@ -0,0 +1,41 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hid-t150";
+  #https://github.com/scarburato/t150_driver/blob/165d0601e11576186c9416c40144927549ef804d/install.sh#L3
+  version = "0.8a";
+
+  src = fetchFromGitHub {
+    owner = "scarburato";
+    repo = "t150_driver";
+    rev = "580b79b7b479076ba470fcc21fbd8484f5328546";
+    hash = "sha256-6xqm8500+yMXA/WonMv1JAOS/oIeSNDp9HFuYkEd03U=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  sourceRoot = "${src.name}/hid-t150";
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  installPhase = ''
+    make -C ${kernel.dev}/lib/modules/${kernel.modDirVersion}/build M=$(pwd) modules_install $makeFlags
+  '';
+
+  meta = with lib; {
+    description = "Linux kernel driver for Thrustmaster T150 and TMX Force Feedback wheel";
+    homepage = "https://github.com/scarburato/t150_driver";
+    license = licenses.gpl2;
+    maintainers = [ maintainers.dbalan ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/hid-tmff2/default.nix
+++ b/pkgs/os-specific/linux/hid-tmff2/default.nix
@@ -0,0 +1,44 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+  unstableGitUpdater,
+}:
+stdenv.mkDerivation {
+  pname = "hid-tmff2";
+  # https://github.com/Kimplul/hid-tmff2/blob/ca168637fbfb085ebc9ade0c47fa0653dac5d25b/dkms/dkms-install.sh#L12
+  version = "0-unstable-2025-07-28";
+
+  src = fetchFromGitHub {
+    owner = "Kimplul";
+    repo = "hid-tmff2";
+    rev = "e0a173f3265be8efcbd4a6f34df6c5713d988b15";
+    hash = "sha256-JZ7nNiNlUdzY9ZJ5AT/xMpSZYz8ej9LByybkBEaHHqk=";
+    # For hid-tminit. Source: https://github.com/scarburato/hid-tminit
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installFlags = [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  postPatch = "sed -i '/depmod -A/d' Makefile";
+
+  meta = with lib; {
+    description = "Linux kernel module for Thrustmaster T300RS, T248 and TX(experimental)";
+    homepage = "https://github.com/Kimplul/hid-tmff2";
+    license = licenses.gpl2Plus;
+    maintainers = [ maintainers.rayslash ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/hpuefi-mod/default.nix
+++ b/pkgs/os-specific/linux/hpuefi-mod/default.nix
@@ -0,0 +1,44 @@
+{
+  stdenv,
+  fetchzip,
+  kernel,
+  kernelModuleMakeFlags,
+  lib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hpuefi-mod";
+  version = "3.05";
+
+  src = fetchzip {
+    url = "https://ftp.hp.com/pub/softpaq/sp150501-151000/sp150953.tgz";
+    hash = "sha256-ofzqu5Y2g+QU0myJ4SF39ZJGXH1zXzX1Ys2FhXVTQKE=";
+    stripRoot = false;
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  strictDeps = true;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KVERS=${kernel.modDirVersion}"
+    "KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "DESTDIR=$(out)"
+  ];
+
+  unpackPhase = ''
+    tar -xzf "$src/non-rpms/hpuefi-mod-${finalAttrs.version}.tgz"
+    cd hpuefi-mod-${finalAttrs.version}
+  '';
+
+  prePatch = ''
+    substituteInPlace "Makefile" \
+      --replace depmod \#
+  '';
+
+  meta = {
+    homepage = "https://ftp.hp.com/pub/caps-softpaq/cmit/linuxtools/HP_LinuxTools.html";
+    description = "Kernel module for managing BIOS settings and updating BIOS firmware on supported HP computers";
+    license = lib.licenses.gpl2Only; # See "License" section in ./non-rpms/hpuefi-mod-*.tgz/README
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ tomodachi94 ];
+  };
+})
--- a/pkgs/os-specific/linux/hyperv-daemons/default.nix
+++ b/pkgs/os-specific/linux/hyperv-daemons/default.nix
@@ -0,0 +1,136 @@
+{
+  stdenv,
+  lib,
+  python3,
+  kernel,
+  makeWrapper,
+  writeText,
+  gawk,
+  iproute2,
+}:
+
+let
+  libexec = "libexec/hypervkvpd";
+
+  fcopy_name =
+    if lib.versionOlder kernel.version "6.10" then
+      "fcopy"
+    else
+      # The fcopy program is explicitly left out in the Makefile on aarch64
+      (if stdenv.hostPlatform.isAarch64 then null else "fcopy_uio");
+
+  daemons = stdenv.mkDerivation {
+    pname = "hyperv-daemons-bin";
+    inherit (kernel) src version;
+
+    nativeBuildInputs = [ makeWrapper ];
+    buildInputs = [ python3 ];
+
+    postPatch = ''
+      cd tools/hv
+      substituteInPlace hv_kvp_daemon.c \
+        --replace /usr/libexec/hypervkvpd/ $out/${libexec}/
+    '';
+
+    makeFlags = [
+      "ARCH=${stdenv.hostPlatform.parsed.cpu.name}"
+      "DESTDIR=$(out)"
+      "sbindir=/bin"
+      "libexecdir=/libexec"
+    ];
+
+    postFixup = ''
+      wrapProgram $out/bin/hv_kvp_daemon \
+        --prefix PATH : $out/bin:${
+          lib.makeBinPath [
+            gawk
+            iproute2
+          ]
+        }
+    '';
+  };
+
+  service =
+    bin: title: check:
+    writeText "hv-${bin}.service" ''
+      [Unit]
+      Description=Hyper-V ${title} daemon
+      ConditionVirtualization=microsoft
+      ${lib.optionalString (check != "") ''
+        ConditionPathExists=/dev/vmbus/${check}
+      ''}
+      [Service]
+      ExecStart=@out@/hv_${bin}_daemon -n
+      Restart=on-failure
+      PrivateTmp=true
+      Slice=hyperv.slice
+
+      [Install]
+      WantedBy=hyperv-daemons.target
+    '';
+
+in
+stdenv.mkDerivation {
+  pname = "hyperv-daemons";
+  inherit (kernel) version;
+
+  # we just stick the bins into out as well as it requires "out"
+  outputs = [
+    "bin"
+    "lib"
+    "out"
+  ];
+
+  buildInputs = [ daemons ];
+  passthru = {
+    inherit daemons;
+  };
+
+  buildCommand = ''
+    system=$lib/lib/systemd/system
+
+    ${lib.optionalString (fcopy_name != null) ''
+      install -Dm444 ${
+        service fcopy_name "file copy (FCOPY)"
+          "/sys/bus/vmbus/devices/eb765408-105f-49b6-b4aa-c123b64d17d4/uio"
+      } $system/hv-fcopy.service
+    ''}
+    install -Dm444 ${service "kvp" "key-value pair (KVP)" "hv_kvp"} $system/hv-kvp.service
+    install -Dm444 ${service "vss" "volume shadow copy (VSS)" "hv_vss"} $system/hv-vss.service
+
+    cat > $system/hyperv-daemons.target <<EOF
+    [Unit]
+    Description=Hyper-V Daemons
+    Wants=hv-kvp.service hv-vss.service
+    ${lib.optionalString (fcopy_name != null) ''
+      Wants=hv-fcopy.service
+    ''}
+    EOF
+
+    for f in $lib/lib/systemd/system/*.service ; do
+      substituteInPlace $f --replace @out@ ${daemons}/bin
+    done
+
+    # we need to do both $out and $bin as $out is required
+    for d in $out/bin $bin/bin ; do
+      # make user binaries available
+      mkdir -p $d
+      ln -s ${daemons}/bin/lsvmbus $d/lsvmbus
+    done
+  '';
+
+  meta = with lib; {
+    description = "Integration Services for running NixOS under HyperV";
+    mainProgram = "lsvmbus";
+    longDescription = ''
+      This packages contains the daemons that are used by the Hyper-V hypervisor
+      on the host.
+
+      Microsoft calls their guest agents "Integration Services" which is why
+      we use that name here.
+    '';
+    homepage = "https://kernel.org";
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = kernel.meta.platforms;
+  };
+}
--- a/pkgs/os-specific/linux/i7z/default.nix
+++ b/pkgs/os-specific/linux/i7z/default.nix
@@ -0,0 +1,64 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  fetchpatch,
+  ncurses,
+  withGui ? false,
+  qtbase,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "i7z";
+  version = "0.27.4";
+
+  src = fetchFromGitHub {
+    owner = "DimitryAndric";
+    repo = "i7z";
+    rev = "v${version}";
+    sha256 = "00c4ng30ry88hcya4g1i9dngiqmz3cs31x7qh1a10nalxn1829xy";
+  };
+
+  buildInputs = [ ncurses ] ++ lib.optional withGui qtbase;
+
+  patches = [
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/i7z/raw/ad1359764ee7a860a02e0c972f40339058fa9369/debian/patches/fix-insecure-tempfile.patch";
+      sha256 = "0ifg06xjw14y4fnzzgkhqm4sv9mcdzgi8m2wffq9z8b1r0znya3s";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/i7z/raw/ad1359764ee7a860a02e0c972f40339058fa9369/debian/patches/nehalem.patch";
+      sha256 = "1ys6sgm01jkqb6d4y7qc3h89dzph8jjjcfya5c5jcm7dkxlzjq8a";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/i7z/raw/ad1359764ee7a860a02e0c972f40339058fa9369/debian/patches/hyphen-used-as-minus-sign.patch";
+      sha256 = "1ji2qvdyq0594cpqz0dlsfggvw3rm63sygh0jxvwjgxpnhykhg1p";
+    })
+    ./qt5.patch
+  ];
+
+  enableParallelBuilding = true;
+
+  postBuild = lib.optionalString withGui ''
+    cd GUI
+    qmake
+    make clean
+    make
+    cd ..
+  '';
+
+  makeFlags = [ "prefix=${placeholder "out"}" ];
+
+  postInstall = lib.optionalString withGui ''
+    install -Dm755 GUI/i7z_GUI $out/bin/i7z-gui
+  '';
+
+  meta = with lib; {
+    description = "Better i7 (and now i3, i5) reporting tool for Linux";
+    mainProgram = "i7z";
+    homepage = "https://github.com/DimitryAndric/i7z";
+    license = licenses.gpl2Only;
+    # broken on ARM
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/os-specific/linux/i7z/qt5.patch
+++ b/pkgs/os-specific/linux/i7z/qt5.patch
@@ -0,0 +1,13 @@
+diff -Naur a/GUI/i7z_GUI.pro b/GUI/i7z_GUI.pro
+--- a/GUI/i7z_GUI.pro	2013-10-12 21:59:19.000000000 +0100
+++ b/GUI/i7z_GUI.pro	2016-11-05 13:54:30.118655672 +0000
+@@ -3,7 +3,8 @@
+ ######################################################################
+ 
+ TEMPLATE = app
+-TARGET = 
+TARGET = i7z_GUI
+QT += widgets
+ DEPENDPATH += .
+ INCLUDEPATH += .
+ CONFIG += debug
--- a/pkgs/os-specific/linux/iio-utils/default.nix
+++ b/pkgs/os-specific/linux/iio-utils/default.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  stdenv,
+  kernel,
+}:
+
+stdenv.mkDerivation {
+  pname = "iio-utils";
+  inherit (kernel) src version;
+
+  makeFlags = [ "bindir=${placeholder "out"}/bin" ];
+
+  postPatch = ''
+    cd tools/iio
+  '';
+
+  meta = with lib; {
+    description = "Userspace tool for interacting with Linux IIO";
+    homepage = "https://www.kernel.org/";
+    license = licenses.gpl2Only;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/os-specific/linux/intel-speed-select/default.nix
+++ b/pkgs/os-specific/linux/intel-speed-select/default.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  stdenv,
+  kernel,
+}:
+
+stdenv.mkDerivation {
+  pname = "intel-speed-select";
+  inherit (kernel) src version;
+
+  makeFlags = [ "bindir=${placeholder "out"}/bin" ];
+
+  postPatch = ''
+    cd tools/power/x86/intel-speed-select
+    sed -i 's,/usr,,g' Makefile
+  '';
+
+  meta = with lib; {
+    description = "Tool to enumerate and control the Intel Speed Select Technology features";
+    mainProgram = "intel-speed-select";
+    homepage = "https://www.kernel.org/";
+    license = licenses.gpl2Only;
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+    ]; # x86-specific
+    broken = kernel.kernelAtLeast "5.18";
+  };
+}
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoreconfHook,
+  pkg-config,
+  pruneLibtoolFiles,
+  flex,
+  bison,
+  libmnl,
+  libnetfilter_conntrack,
+  libnfnetlink,
+  libnftnl,
+  libpcap,
+  bash,
+  bashNonInteractive,
+  nftablesCompat ? true,
+  gitUpdater,
+}:
+
+stdenv.mkDerivation rec {
+  version = "1.8.11";
+  pname = "iptables";
+
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.xz";
+    sha256 = "2HMD1V74ySvK1N0/l4sm0nIBNkKwKUJXdfW60QCf57I=";
+  };
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+    "man"
+  ];
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    pruneLibtoolFiles
+    flex
+    bison
+  ];
+
+  buildInputs = [
+    libmnl
+    libnetfilter_conntrack
+    libnfnetlink
+    libnftnl
+    libpcap
+    bash
+  ];
+
+  configureFlags = [
+    "--enable-bpf-compiler"
+    "--enable-devel"
+    "--enable-libipq"
+    "--enable-nfsynproxy"
+    "--enable-shared"
+  ]
+  ++ lib.optional (!nftablesCompat) "--disable-nftables";
+
+  enableParallelBuilding = true;
+
+  postInstall = lib.optionalString nftablesCompat ''
+    rm $out/sbin/{iptables,iptables-restore,iptables-save,ip6tables,ip6tables-restore,ip6tables-save}
+    ln -sv xtables-nft-multi $out/bin/iptables
+    ln -sv xtables-nft-multi $out/bin/iptables-restore
+    ln -sv xtables-nft-multi $out/bin/iptables-save
+    ln -sv xtables-nft-multi $out/bin/ip6tables
+    ln -sv xtables-nft-multi $out/bin/ip6tables-restore
+    ln -sv xtables-nft-multi $out/bin/ip6tables-save
+  '';
+
+  outputChecks.lib.disallowedRequisites = [
+    bash
+    bashNonInteractive
+  ];
+
+  passthru = {
+    updateScript = gitUpdater {
+      url = "https://git.netfilter.org/iptables";
+      rev-prefix = "v";
+    };
+  };
+
+  meta = with lib; {
+    description = "Program to configure the Linux IP packet filtering ruleset";
+    homepage = "https://www.netfilter.org/projects/iptables/index.html";
+    platforms = platforms.linux;
+    mainProgram = "iptables";
+    maintainers = with maintainers; [ fpletz ];
+    license = licenses.gpl2Plus;
+    downloadPage = "https://www.netfilter.org/projects/iptables/files/";
+  };
+}
--- a/pkgs/os-specific/linux/ipu6-drivers/default.nix
+++ b/pkgs/os-specific/linux/ipu6-drivers/default.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  ivsc-driver,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ipu6-drivers";
+  version = "unstable-2025-09-16";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ipu6-drivers";
+    rev = "69b2fde9edcbc24128b91541fdf2791fbd4bf7a4";
+    hash = "sha256-uiRbbSw7tQ3Fn297D1I7i7hyaNtpOWER4lvPMSTpwpk=";
+  };
+
+  patches = [
+    "${src}/patches/0001-v6.10-IPU6-headers-used-by-PSYS.patch"
+  ];
+
+  postPatch = ''
+    cp --no-preserve=mode --recursive --verbose \
+      ${ivsc-driver.src}/backport-include \
+      ${ivsc-driver.src}/drivers \
+      ${ivsc-driver.src}/include \
+      .
+  '';
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," Makefile
+  '';
+
+  installTargets = [
+    "modules_install"
+  ];
+
+  meta = {
+    homepage = "https://github.com/intel/ipu6-drivers";
+    description = "IPU6 kernel driver";
+    license = lib.licenses.gpl2Only;
+    maintainers = [ ];
+    platforms = [ "x86_64-linux" ];
+    # requires 6.10
+    broken = kernel.kernelOlder "6.10";
+  };
+}
--- a/pkgs/os-specific/linux/iputils/default.nix
+++ b/pkgs/os-specific/linux/iputils/default.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  gettext,
+  libxslt,
+  docbook_xsl_ns,
+  libcap,
+  libidn2,
+  iproute2,
+  apparmorRulesFromClosure,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "iputils";
+  version = "20250605";
+
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = version;
+    hash = "sha256-AJgNPIE90kALu4ihANELr9Dh28LhJ4camLksOIRV8Xo=";
+  };
+
+  outputs = [
+    "out"
+    "apparmor"
+  ];
+
+  # We don't have the required permissions inside the build sandbox:
+  # /build/source/build/ping/ping: socket: Operation not permitted
+  doCheck = false;
+
+  mesonFlags = [
+    "-DNO_SETCAP_OR_SUID=true"
+    "-Dsystemdunitdir=etc/systemd/system"
+    "-DINSTALL_SYSTEMD_UNITS=true"
+    "-DSKIP_TESTS=${lib.boolToString (!doCheck)}"
+  ]
+  # Disable idn usage w/musl (https://github.com/iputils/iputils/pull/111):
+  ++ lib.optional stdenv.hostPlatform.isMusl "-DUSE_IDN=false";
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    libxslt.bin
+    docbook_xsl_ns
+  ];
+  buildInputs = [ libcap ] ++ lib.optional (!stdenv.hostPlatform.isMusl) libidn2;
+  nativeCheckInputs = [ iproute2 ];
+
+  postInstall = ''
+    mkdir $apparmor
+    cat >$apparmor/bin.ping <<EOF
+    include <tunables/global>
+    $out/bin/ping {
+      include <abstractions/base>
+      include <abstractions/consoles>
+      include <abstractions/nameservice>
+      include "${
+        apparmorRulesFromClosure { name = "ping"; } (
+          [ libcap ] ++ lib.optional (!stdenv.hostPlatform.isMusl) libidn2
+        )
+      }"
+      include <local/bin.ping>
+      capability net_raw,
+      network inet raw,
+      network inet6 raw,
+      mr $out/bin/ping,
+      r $out/share/locale/**,
+      r @{PROC}/@{pid}/environ,
+    }
+    EOF
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/iputils/iputils";
+    changelog = "https://github.com/iputils/iputils/releases/tag/${version}";
+    description = "Set of small useful utilities for Linux networking";
+    longDescription = ''
+      A set of small useful utilities for Linux networking including:
+
+      - arping: send ARP REQUEST to a neighbour host
+      - clockdiff: measure clock difference between hosts
+      - ping: send ICMP ECHO_REQUEST to network hosts
+      - tracepath: traces path to a network host discovering MTU along this path
+    '';
+    license = with licenses; [
+      gpl2Plus
+      bsd3
+    ];
+    platforms = platforms.linux;
+    maintainers = [ ];
+  };
+}
--- a/pkgs/os-specific/linux/isgx/default.nix
+++ b/pkgs/os-specific/linux/isgx/default.nix
@@ -0,0 +1,57 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  kernel,
+}:
+
+stdenv.mkDerivation rec {
+  name = "isgx-${version}-${kernel.version}";
+  version = "2.14";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "linux-sgx-driver";
+    rev = "sgx_diver_${version}"; # Typo is upstream's.
+    sha256 = "0kbbf2inaywp44lm8ig26mkb36jq3smsln0yp6kmrirdwc3c53mi";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = [
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -D isgx.ko -t $out/lib/modules/${kernel.modDirVersion}/kernel/drivers/intel/sgx
+    runHook postInstall
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Intel SGX Linux Driver";
+    longDescription = ''
+      The linux-sgx-driver project (isgx) hosts an out-of-tree driver
+      for the Linux* Intel(R) SGX software stack, which would be used
+      until the driver upstreaming process is complete (before 5.11.0).
+
+      It is used to support Enhanced Privacy Identification (EPID)
+      based attestation on the platforms without Flexible Launch Control.
+    '';
+    homepage = "https://github.com/intel/linux-sgx-driver";
+    license = with licenses; [
+      bsd3 # OR
+      gpl2Only
+    ];
+    maintainers = [ ];
+    platforms = [ "x86_64-linux" ];
+    # This kernel module is now in mainline so newer kernels should
+    # use that rather than this out-of-tree version (officially
+    # deprecated by Intel)
+    broken = kernel.kernelAtLeast "6.4";
+  };
+}
--- a/pkgs/os-specific/linux/it87/default.nix
+++ b/pkgs/os-specific/linux/it87/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  name = "it87-${version}-${kernel.version}";
+  version = "unstable-2024-06-09";
+
+  # Original is no longer maintained.
+  # This is the same upstream as the AUR uses.
+  src = fetchFromGitHub {
+    owner = "frankcrawford";
+    repo = "it87";
+    rev = "a82899557b4779b87d444a43caf126615e03bb4a";
+    hash = "sha256-aMMK3QoeXr6mPbo4SDXE8UuWc/oJ3lpgyK7wyEDKaEM=";
+  };
+
+  hardeningDisable = [ "pic" ];
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  preConfigure = ''
+    sed -i 's|depmod|#depmod|' Makefile
+  '';
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "TARGET=${kernel.modDirVersion}"
+    "KERNEL_MODULES=${kernel.dev}/lib/modules/${kernel.modDirVersion}"
+    "MODDESTDIR=$(out)/lib/modules/${kernel.modDirVersion}/kernel/drivers/hwmon"
+  ];
+
+  meta = with lib; {
+    description = "Patched module for IT87xx superio chip sensors support";
+    homepage = "https://github.com/frankcrawford/it87";
+    license = licenses.gpl2Plus;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+    teams = [ teams.lumiguide ];
+  };
+}
--- a/pkgs/os-specific/linux/ithc/default.nix
+++ b/pkgs/os-specific/linux/ithc/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ithc";
+  version = "unstable-2022-06-07";
+
+  src = fetchFromGitHub {
+    owner = "quo";
+    repo = "ithc-linux";
+    rev = "5af2a2213d2f3d944b19ec7ccdb96f16d56adddb";
+    hash = "sha256-p4TooWUOWPfNdePE18ESmRJezPDAl9nLb55LQtkJiSg=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "VERSION=${version}"
+    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  postPatch = ''
+    sed -i ./Makefile -e '/depmod/d'
+  '';
+
+  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
+
+  meta = with lib; {
+    description = "Linux driver for Intel Touch Host Controller";
+    homepage = "https://github.com/quo/ithc-linux";
+    license = licenses.publicDomain;
+    maintainers = with maintainers; [ aacebedo ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "5.9" || kernel.kernelAtLeast "6.10";
+  };
+}
--- a/pkgs/os-specific/linux/ivsc-driver/default.nix
+++ b/pkgs/os-specific/linux/ivsc-driver/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation {
+  pname = "ivsc-driver";
+  version = "unstable-2024-09-18";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "ivsc-driver";
+    rev = "10f440febe87419d5c82d8fe48580319ea135b54";
+    hash = "sha256-jc+8geVquRtaZeIOtadCjY9F162Rb05ptE7dk8kuof0=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "KERNEL_SRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  enableParallelBuilding = true;
+
+  preInstall = ''
+    sed -i -e "s,INSTALL_MOD_DIR=,INSTALL_MOD_PATH=$out INSTALL_MOD_DIR=," Makefile
+  '';
+
+  installTargets = [
+    "modules_install"
+  ];
+
+  meta = {
+    homepage = "https://github.com/intel/ivsc-driver";
+    description = "Intel Vision Sensing Controller kernel driver";
+    license = lib.licenses.gpl2Only;
+    maintainers = [ ];
+    platforms = [ "x86_64-linux" ];
+    # This module is in mainline now and upstream suggests using that
+    # with recent kernels rather than the out-of-tree module.
+    broken = kernel.kernelOlder "5.15" || kernel.kernelAtLeast "6.9";
+  };
+}
--- a/pkgs/os-specific/linux/ixgbevf/default.nix
+++ b/pkgs/os-specific/linux/ixgbevf/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  kernel,
+  kmod,
+}:
+
+stdenv.mkDerivation rec {
+  name = "ixgbevf-${version}-${kernel.version}";
+  version = "4.6.1";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/e1000/ixgbevf-${version}.tar.gz";
+    sha256 = "0h8a2g4hm38wmr13gvi2188r7nlv2c5rx6cal9gkf1nh6sla181c";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  hardeningDisable = [ "pic" ];
+
+  configurePhase = ''
+    cd src
+    makeFlagsArray+=(KSRC=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build INSTALL_MOD_PATH=$out MANDIR=/share/man)
+    substituteInPlace common.mk --replace /sbin/depmod ${kmod}/bin/depmod
+    # prevent host system kernel introspection
+    substituteInPlace common.mk --replace /boot/System.map /not-exists
+  '';
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Intel 82599 Virtual Function Driver";
+    homepage = "https://sourceforge.net/projects/e1000/files/ixgbevf%20stable/";
+    license = licenses.gpl2Only;
+    priority = 20;
+    # kernels ship ixgbevf driver for a long time already, maybe switch to a newest kernel?
+    broken = versionAtLeast kernel.version "5.2";
+  };
+}
--- a/pkgs/os-specific/linux/jool/cli.nix
+++ b/pkgs/os-specific/linux/jool/cli.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nixosTests,
+  autoreconfHook,
+  pkg-config,
+  libnl,
+  iptables,
+}:
+
+let
+  sourceAttrs = (import ./source.nix) { inherit fetchFromGitHub; };
+in
+
+stdenv.mkDerivation {
+  pname = "jool-cli";
+  version = sourceAttrs.version;
+
+  src = sourceAttrs.src;
+
+  patches = [ ./validate-config.patch ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+  buildInputs = [
+    libnl
+    iptables
+  ];
+
+  makeFlags = [
+    "-C"
+    "src/usr"
+  ];
+
+  prePatch = ''
+    sed -e 's%^XTABLES_SO_DIR = .*%XTABLES_SO_DIR = '"$out"'/lib/xtables%g' -i src/usr/iptables/Makefile
+  '';
+
+  passthru.tests = {
+    inherit (nixosTests) jool;
+  };
+
+  meta = {
+    homepage = "https://www.jool.mx/";
+    description = "Fairly compliant SIIT and Stateful NAT64 for Linux - CLI tools";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ fpletz ];
+  };
+}
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`ACTION=="add", SUBSYSTEM=="usb", DRIVERS=="usb", ATTRS{idVendor}=="17e9", ATTR{bInterfaceClass}=="ff", ATTR{bInterfaceProtocol}=="03", TAG+="systemd", ENV{SYSTEMD_WANTS}="dlm.service"`