diff --git a/doc/contributing/reviewing-contributions.chapter.md b/doc/contributing/reviewing-contributions.chapter.md
index 0a90781d0c59..7a13a3f3b402 100644
--- a/doc/contributing/reviewing-contributions.chapter.md
+++ b/doc/contributing/reviewing-contributions.chapter.md
@@ -125,7 +125,7 @@ Reviewing process:
   - Type should be appropriate (string related types differs in their merging capabilities, `optionSet` and `string` types are deprecated).
   - Description, default and example should be provided.
 - Ensure that option changes are backward compatible.
-  - `mkRenamedOptionModule` and `mkAliasOptionModule` functions provide way to make option changes backward compatible.
+  - `mkRenamedOptionModuleWith` provides a way to make option changes backward compatible.
 - Ensure that removed options are declared with `mkRemovedOptionModule`
 - Ensure that changes that are not backward compatible are mentioned in release notes.
 - Ensure that documentations affected by the change is updated.
diff --git a/lib/default.nix b/lib/default.nix
index f8ab51c65794..6f7930c53430 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -67,7 +67,7 @@ let
     inherit (self.trivial) id const pipe concat or and bitAnd bitOr bitXor
       bitNot boolToString mergeAttrs flip mapNullable inNixShell isFloat min max
       importJSON importTOML warn warnIf throwIfNot checkListOfEnum
-      info showWarnings nixpkgsVersion version
+      info showWarnings nixpkgsVersion version isInOldestRelease
       mod compare splitByAndCompare functionArgs setFunctionArgs isFunction
       toHexString toBaseDigits;
     inherit (self.fixedPoints) fix fix' converge extends composeExtensions
@@ -120,7 +120,8 @@ let
       mkOptionDefault mkDefault mkImageMediaOverride mkForce mkVMOverride
       mkFixStrictness mkOrder mkBefore mkAfter mkAliasDefinitions
       mkAliasAndWrapDefinitions fixMergeModules mkRemovedOptionModule
-      mkRenamedOptionModule mkMergedOptionModule mkChangedOptionModule
+      mkRenamedOptionModule mkRenamedOptionModuleWith
+      mkMergedOptionModule mkChangedOptionModule
       mkAliasOptionModule mkDerivedConfig doRename;
     inherit (self.options) isOption mkEnableOption mkSinkUndeclaredOptions
       mergeDefaultOption mergeOneOption mergeEqualOption mergeUniqueOption
diff --git a/lib/modules.nix b/lib/modules.nix
index 01ba914ca80e..9bb8bfbbdf14 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -954,6 +954,26 @@ rec {
     use = builtins.trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
   };
 
+  mkRenamedOptionModuleWith = {
+    /* Old option path as list of strings. */
+    from,
+    /* New option path as list of strings. */
+    to,
+
+    /*
+      Release number of the first release that contains the rename, ignoring backports.
+      Set it to the upcoming release, matching the nixpkgs/.version file.
+    */
+    sinceRelease,
+
+  }: doRename {
+    inherit from to;
+    visible = false;
+    warn = lib.isInOldestRelease sinceRelease;
+    use = lib.warnIf (lib.isInOldestRelease sinceRelease)
+      "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
+  };
+
   /* Return a module that causes a warning to be shown if any of the "from"
      option is defined; the defined values can be used in the "mergeFn" to set
      the "to" value.
diff --git a/lib/trivial.nix b/lib/trivial.nix
index c68bac902e91..afae4f87254f 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -166,6 +166,30 @@ rec {
   /* Returns the current nixpkgs release number as string. */
   release = lib.strings.fileContents ../.version;
 
+  /* The latest release that is supported, at the time of release branch-off,
+     if applicable.
+
+     Ideally, out-of-tree modules should be able to evaluate cleanly with all
+     supported Nixpkgs versions (master, release and old release until EOL).
+     So if possible, deprecation warnings should take effect only when all
+     out-of-tree expressions/libs/modules can upgrade to the new way without
+     losing support for supported Nixpkgs versions.
+
+     This release number allows deprecation warnings to be implemented such that
+     they take effect as soon as the oldest release reaches end of life. */
+  oldestSupportedRelease =
+    # Update on master only. Do not backport.
+    2111;
+
+  /* Whether a feature is supported in all supported releases (at the time of
+     release branch-off, if applicable). See `oldestSupportedRelease`. */
+  isInOldestRelease =
+    /* Release number of feature introduction as an integer, e.g. 2111 for 21.11.
+       Set it to the upcoming release, matching the nixpkgs/.version file.
+    */
+    release:
+      release <= lib.trivial.oldestSupportedRelease;
+
   /* Returns the current nixpkgs release code name.
 
      On each release the first letter is bumped and a new animal is chosen
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
index 5ca87dece6a9..1a6670af0071 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@@ -67,6 +67,14 @@
           notes</link> for details.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Module authors can use
+          <literal>mkRenamedOptionModuleWith</literal> to automate the
+          deprecation cycle without annoying out-of-tree module authors
+          and their users.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.05-new-services">
@@ -1211,7 +1219,8 @@
               Legacy options have been mapped to the corresponding
               options under under
               <link xlink:href="options.html#opt-nix.settings">nix.settings</link>
-              but may be deprecated in the future.
+              and will be deprecated when NixOS 21.11 reaches end of
+              life.
             </para>
           </listitem>
           <listitem>
diff --git a/nixos/doc/manual/release-notes/rl-2205.section.md b/nixos/doc/manual/release-notes/rl-2205.section.md
index fd9ed13a9563..93ab60ec5e11 100644
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -23,6 +23,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [`kops`](https://kops.sigs.k8s.io) defaults to 1.22.4, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. This will increase security by default, but may break some types of workloads. See the [release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) for details.
 
+- Module authors can use `mkRenamedOptionModuleWith` to automate the deprecation cycle without annoying out-of-tree module authors and their users.
+
 ## New Services {#sec-release-22.05-new-services}
 
 - [aesmd](https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw), the Intel SGX Architectural Enclave Service Manager. Available as [services.aesmd](#opt-services.aesmd.enable).
@@ -452,7 +454,7 @@ In addition to numerous new and upgraded packages, this release has the followin
   Similarly [virtualisation.vmVariantWithBootloader](#opt-virtualisation.vmVariantWithBootLoader) was added.
 
 - The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings):
-  * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) but may be deprecated in the future.
+  * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life.
   * [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added.
 
 - The `writers.writePyPy2`/`writers.writePyPy3` and corresponding `writers.writePyPy2Bin`/`writers.writePyPy3Bin` convenience functions to create executable Python 2/3 scripts using the PyPy interpreter were added.
diff --git a/nixos/modules/services/misc/nix-daemon.nix b/nixos/modules/services/misc/nix-daemon.nix
index 2b21df91b82f..d56808c7564e 100644
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@@ -112,11 +112,11 @@ in
 
 {
   imports = [
-    (mkRenamedOptionModule [ "nix" "useChroot" ] [ "nix" "useSandbox" ])
-    (mkRenamedOptionModule [ "nix" "chrootDirs" ] [ "nix" "sandboxPaths" ])
-    (mkRenamedOptionModule [ "nix" "daemonIONiceLevel" ] [ "nix" "daemonIOSchedPriority" ])
+    (mkRenamedOptionModuleWith { sinceRelease = 2003; from = [ "nix" "useChroot" ]; to = [ "nix" "useSandbox" ]; })
+    (mkRenamedOptionModuleWith { sinceRelease = 2003; from = [ "nix" "chrootDirs" ]; to = [ "nix" "sandboxPaths" ]; })
+    (mkRenamedOptionModuleWith { sinceRelease = 2205; from = [ "nix" "daemonIONiceLevel" ]; to = [ "nix" "daemonIOSchedPriority" ]; })
     (mkRemovedOptionModule [ "nix" "daemonNiceLevel" ] "Consider nix.daemonCPUSchedPolicy instead.")
-  ] ++ mapAttrsToList (oldConf: newConf: mkRenamedOptionModule [ "nix" oldConf ] [ "nix" "settings" newConf ]) legacyConfMappings;
+  ] ++ mapAttrsToList (oldConf: newConf: mkRenamedOptionModuleWith { sinceRelease = 2205; from = [ "nix" oldConf ]; to = [ "nix" "settings" newConf ]; }) legacyConfMappings;
 
   ###### interface
 
diff --git a/pkgs/applications/emulators/yuzu/default.nix b/pkgs/applications/emulators/yuzu/default.nix
index 9e45ba0cd2cb..f212abb448a6 100644
--- a/pkgs/applications/emulators/yuzu/default.nix
+++ b/pkgs/applications/emulators/yuzu/default.nix
@@ -4,25 +4,25 @@ let
 in {
   mainline = libsForQt5.callPackage ./base.nix rec {
     pname = "yuzu-mainline";
-    version = "882";
+    version = "953";
     branchName = branch;
     src = fetchFromGitHub {
       owner = "yuzu-emu";
       repo = "yuzu-mainline";
       rev = "mainline-0-${version}";
-      sha256 = "17j845laxnaq50icwl32yisdivwcnwa59fxdr297yxrz4hmfzhxq";
+      sha256 = "0p07gybyhr6flzmhz92qlrwcq7l37c2wmcxw8sbrvhj2pgaaw9ic";
       fetchSubmodules = true;
     };
   };
   early-access = libsForQt5.callPackage ./base.nix rec {
     pname = "yuzu-ea";
-    version = "2432";
+    version = "2557";
     branchName = branch;
     src = fetchFromGitHub {
       owner = "pineappleEA";
       repo = "pineapple-src";
       rev = "EA-${version}";
-      sha256 = "0zqab61rphgjzyxk52idhr7dqwwxih0f8b9hig3zvrwkdry9wfh4";
+      sha256 = "013xxgyn8y5fv0xbrm0zfl9xmi0gx4hpflrbjskg1hcvb2bjqyvj";
     };
   };
 }.${branch}
diff --git a/pkgs/applications/misc/electron-cash/default.nix b/pkgs/applications/misc/electron-cash/default.nix
index 16f5673bed1b..7fe091cf7732 100644
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@@ -3,13 +3,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "electron-cash";
-  version = "4.2.5";
+  version = "4.2.7";
 
   src = fetchFromGitHub {
     owner = "Electron-Cash";
     repo = "Electron-Cash";
     rev = version;
-    sha256 = "sha256-ALIrNnhpX46xdQdfJdx/9e/QtdyBEgi5xLrbuOBJR7o=";
+    sha256 = "sha256-m8a3x5fPSrnrCH30MToT3aKtX35nFUbeerR7ubWgOOI=";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -40,6 +40,7 @@ python3Packages.buildPythonApplication rec {
     keepkey
     btchip
     hidapi
+    pyopenssl
     pyscard
     pysatochip
   ];
diff --git a/pkgs/applications/misc/faircamp/default.nix b/pkgs/applications/misc/faircamp/default.nix
new file mode 100644
index 000000000000..4486381b8b34
--- /dev/null
+++ b/pkgs/applications/misc/faircamp/default.nix
@@ -0,0 +1,56 @@
+{ lib
+, rustPlatform
+, fetchgit
+, makeWrapper
+, ffmpeg
+, callPackage
+, unstableGitUpdater
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "faircamp";
+  version = "unstable-2022-01-19";
+
+  # TODO when switching to a stable release, use fetchFromGitea and add a
+  # version test. Meanwhile, fetchgit is used to make unstableGitUpdater work.
+  src = fetchgit {
+    url = "https://codeberg.org/simonrepp/faircamp.git";
+    rev = "f8ffc7a35a12251b83966b35c63f72b4912f75a9";
+    sha256 = "sha256-9t42+813IPLUChbLkcwzoCr7FXSL1g+ZG6I3d+7pmec=";
+  };
+
+  cargoHash = "sha256-24ALBede3W8rjlBRdtL0aazRyK1RmNLdHF/bt5i4S5Y=";
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/faircamp \
+      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}
+  '';
+
+  passthru.tests.wav = callPackage ./test-wav.nix { };
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "A self-hostable, statically generated bandcamp alternative";
+    longDescription = ''
+      Faircamp takes a directory on your disk - your Catalog - and from it
+      produces a fancy-looking (and technically simple and completely static)
+      website, which presents your music in a way similar to how popular
+      commercial service bandcamp does it.
+
+      You can upload the files faircamp generates to any webspace - no database
+      and no programming language support (PHP or such) is required. If your
+      webspace supports SSH access, faircamp can be configured to upload your
+      website for you automatically, otherwise you can use FTP or whichever
+      means you prefer to do that manually.
+    '';
+    homepage = "https://codeberg.org/simonrepp/faircamp";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/applications/misc/faircamp/test-wav.nix b/pkgs/applications/misc/faircamp/test-wav.nix
new file mode 100644
index 000000000000..8a9d2eaa2f35
--- /dev/null
+++ b/pkgs/applications/misc/faircamp/test-wav.nix
@@ -0,0 +1,14 @@
+{ stdenv
+, faircamp
+, ffmpeg
+}:
+
+stdenv.mkDerivation {
+  name = "faircamp-test-wav";
+  meta.timeout = 60;
+  buildCommand = ''
+    mkdir album
+    ${ffmpeg}/bin/ffmpeg -f lavfi -i "sine=frequency=440:duration=1" album/track.wav
+    ${faircamp}/bin/faircamp --build-dir $out
+  '';
+}
diff --git a/pkgs/applications/networking/browsers/firefox/librewolf/src.json b/pkgs/applications/networking/browsers/firefox/librewolf/src.json
index bf1e1e2f4e43..9e40e459d329 100644
--- a/pkgs/applications/networking/browsers/firefox/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/firefox/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "97.0.2-1",
+  "packageVersion": "98.0-1",
   "source": {
-    "rev": "97.0.2-1",
-    "sha256": "0pk9ci0wvz61879w3fvy8p1w4w8anv5s7rfiimz21m351gcf3d7m"
+    "rev": "98.0-1",
+    "sha256": "1z42a42d6z0gyc5i0pamcqq5bak6pgg1ldvlrjdyjnpvda74s0fn"
   },
   "firefox": {
-    "version": "97.0.2",
-    "sha512": "efbf33723f5979025454b6cc183927afb4bc72a51c00b5d45940122da596b8ac99080f3a6a59f5dd85a725e356349ec57e7eba1c36cdab7d55a28b04895d274c"
+    "version": "98.0",
+    "sha512": "5b9186dd2a5dee5f2d2a2ce156fc06e2073cf71a70891a294cf3358218592f19ec3413d33b68d6f38e3cc5f940213e590a188e2b6efc39f416e90a55f89bfd9b"
   }
 }
diff --git a/pkgs/applications/networking/mailreaders/himalaya/default.nix b/pkgs/applications/networking/mailreaders/himalaya/default.nix
index 27779c969830..91161e5ab14a 100644
--- a/pkgs/applications/networking/mailreaders/himalaya/default.nix
+++ b/pkgs/applications/networking/mailreaders/himalaya/default.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "himalaya";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchFromGitHub {
     owner = "soywod";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-g+ySsHnJ4FpmJLEjlutuiJmMkKI3Jb+HkWi1WBIo1aw=";
+    sha256 = "sha256-CXchZbXX7NH2ZXeAoPph3qxxdcAdDVZLBmOMwxFu+Yo=";
   };
 
-  cargoSha256 = "sha256-NkkONl57zSilElVAOXUBxWnims4+EIVkkTdExbeBAaQ=";
+  cargoSha256 = "sha256-sSQX7DHDgh1eO1Dwn1f0m51Bl2ZG1daRtrnYvsvPOkg=";
 
   nativeBuildInputs = lib.optionals enableCompletions [ installShellFiles ]
     ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ pkg-config ];
diff --git a/pkgs/applications/networking/p2p/fragments/default.nix b/pkgs/applications/networking/p2p/fragments/default.nix
index a07869209c7d..ebeba4c010e8 100644
--- a/pkgs/applications/networking/p2p/fragments/default.nix
+++ b/pkgs/applications/networking/p2p/fragments/default.nix
@@ -1,76 +1,89 @@
 { lib
 , stdenv
 , fetchFromGitLab
-, meson
-, vala
-, ninja
-, pkg-config
-, wrapGAppsHook
-, desktop-file-utils
+, fetchpatch
 , appstream-glib
-, python3
+, dbus
+, desktop-file-utils
+, git
 , glib
-, gtk3
-, libhandy
-, libtransmission
-, libb64
-, libutp
-, miniupnpc
-, dht
-, libnatpmp
-, libevent
-, curl
+, gtk4
+, libadwaita
+, meson
+, ninja
 , openssl
-, zlib
+, pkg-config
+, python3
+, rustPlatform
+, sqlite
+, transmission
+, wrapGAppsHook4
 }:
 
-stdenv.mkDerivation rec {
+let
+  patchedTransmission = transmission.overrideAttrs (oldAttrs: {
+    patches = (oldAttrs.patches or []) ++ [
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/flathub/de.haeckerfelix.Fragments/2aee477c8e26a24570f8dbbdbd1c49e017ae32eb/transmission_pdeathsig.patch";
+        sha256 = "sha256-/rCoA566tMmzqcIfffC082Y56TwEyyQJ0knxymtscbA=";
+      })
+    ];
+  });
+in stdenv.mkDerivation rec {
   pname = "fragments";
-  version = "1.5";
+  version = "2.0.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Fragments";
     rev = version;
-    sha256 = "0x1kafhlgyi65l4w67c24r8mpvasg3q3c4wlgnjc9sxvp6ki7xbn";
+    sha256 = "sha256-CMa1yka0kOxMhxSuazlJxTk4fzxuuwKYLBpEMwHbBUE=";
   };
 
-  patches = [
-    # Fix dependency resolution
-    ./dependency-resolution.patch
-  ];
+  postPatch = ''
+    patchShebangs build-aux/meson/postinstall.py
+  '';
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-/rFZcbpITYkpSCEZp9XH253u90RGmuVLEBGIRNBgI/o=";
+  };
 
   nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    git
     meson
-    vala
     ninja
     pkg-config
-    wrapGAppsHook
-    desktop-file-utils
-    appstream-glib
     python3
-  ];
+    wrapGAppsHook4
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
 
   buildInputs = [
+    dbus
     glib
-    gtk3
-    libhandy
-    libtransmission
-    libb64
-    libutp
-    miniupnpc
-    dht
-    libnatpmp
-    libevent
-    curl
+    gtk4
+    libadwaita
     openssl
-    zlib
+    sqlite
   ];
 
+  preFixup =  ''
+    gappsWrapperArgs+=(
+      --prefix PATH : "${lib.makeBinPath [ patchedTransmission ]}"
+    )
+  '';
+
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/World/Fragments";
-    description = "A GTK3 BitTorrent Client";
+    description = "Easy to use BitTorrent client for the GNOME desktop environment";
     maintainers = with maintainers; [ emilytrau ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
diff --git a/pkgs/applications/networking/p2p/fragments/dependency-resolution.patch b/pkgs/applications/networking/p2p/fragments/dependency-resolution.patch
deleted file mode 100644
index 0446bc1390c7..000000000000
--- a/pkgs/applications/networking/p2p/fragments/dependency-resolution.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 5030d0c..6de7a20 100644
---- a/meson.build
-+++ b/meson.build
-@@ -32,10 +32,11 @@ transmission_dep = declare_dependency(
- 				meson.get_compiler('c').find_library('dht'),
- 				meson.get_compiler('c').find_library('natpmp'),
- 				meson.get_compiler('c').find_library('event'),
--				meson.get_compiler('c').find_library('libcurl'),
--				meson.get_compiler('c').find_library('libcrypto'),
-+				meson.get_compiler('c').find_library('curl'),
-+				meson.get_compiler('c').find_library('crypto'),
-+				meson.get_compiler('c').find_library('ssl'),
- 				meson.get_compiler('c').find_library('libpthread'),
--				meson.get_compiler('c').find_library('libz'),
-+				meson.get_compiler('c').find_library('z'),
- 				transmission_vapi,
- 				transmission_lib
- 			])
-@@ -45,4 +46,4 @@ subdir('data')
- subdir('po')
- subdir('src')
- 
--meson.add_install_script('build-aux/postinstall.py')
-+meson.add_install_script('python3', '../build-aux/postinstall.py')
diff --git a/pkgs/applications/science/astronomy/kstars/default.nix b/pkgs/applications/science/astronomy/kstars/default.nix
index 3cd98f1acadc..9f58de432596 100644
--- a/pkgs/applications/science/astronomy/kstars/default.nix
+++ b/pkgs/applications/science/astronomy/kstars/default.nix
@@ -14,11 +14,11 @@
 
 mkDerivation rec {
   pname = "kstars";
-  version = "3.5.7";
+  version = "3.5.8";
 
   src = fetchurl {
     url = "mirror://kde/stable/kstars/kstars-${version}.tar.xz";
-    sha256 = "sha256-qo8SLum46BM0QzGR6rJ2w2ERK53Lm8+N+ghR6HoQDQY=";
+    sha256 = "sha256-Zg2QKDe3q/OBDW4k9y/YTwREopvX1D4YlrGf7OHIjD8=";
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
diff --git a/pkgs/applications/virtualization/crosvm/Cargo.lock b/pkgs/applications/virtualization/crosvm/Cargo.lock
new file mode 100644
index 000000000000..3746d87cf0af
--- /dev/null
+++ b/pkgs/applications/virtualization/crosvm/Cargo.lock
@@ -0,0 +1,1491 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aarch64"
+version = "0.1.0"
+dependencies = [
+ "arch",
+ "base",
+ "data_model",
+ "devices",
+ "hypervisor",
+ "kernel_cmdline",
+ "kvm",
+ "kvm_sys",
+ "libc",
+ "minijail",
+ "remain",
+ "resources",
+ "sync",
+ "thiserror",
+ "vm_control",
+ "vm_memory",
+]
+
+[[package]]
+name = "acpi_tables"
+version = "0.1.0"
+dependencies = [
+ "data_model",
+ "tempfile",
+]
+
+[[package]]
+name = "android_log-sys"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85965b6739a430150bdd138e2374a98af0c3ee0d030b3bb7fc3bddff58d0102e"
+
+[[package]]
+name = "anyhow"
+version = "1.0.56"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4361135be9122e0870de935d7c439aef945b9f9ddd4199a553b5270b49c82a27"
+
+[[package]]
+name = "arch"
+version = "0.1.0"
+dependencies = [
+ "acpi_tables",
+ "base",
+ "devices",
+ "gdbstub_arch",
+ "hypervisor",
+ "kernel_cmdline",
+ "libc",
+ "minijail",
+ "power_monitor",
+ "remain",
+ "resources",
+ "sync",
+ "thiserror",
+ "vm_control",
+ "vm_memory",
+]
+
+[[package]]
+name = "argh"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbb41d85d92dfab96cb95ab023c265c5e4261bb956c0fb49ca06d90c570f1958"
+dependencies = [
+ "argh_derive",
+ "argh_shared",
+]
+
+[[package]]
+name = "argh_derive"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be69f70ef5497dd6ab331a50bd95c6ac6b8f7f17a7967838332743fbd58dc3b5"
+dependencies = [
+ "argh_shared",
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "argh_shared"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6f8c380fa28aa1b36107cd97f0196474bb7241bb95a453c5c01a15ac74b2eac"
+
+[[package]]
+name = "assertions"
+version = "0.1.0"
+
+[[package]]
+name = "async-task"
+version = "4.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30696a84d817107fc028e049980e09d5e140e8da8f1caeb17e8e950658a3cea9"
+
+[[package]]
+name = "async-trait"
+version = "0.1.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "061a7acccaa286c011ddc30970520b98fa40e00c9d644633fb26b5fc63a265e3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "audio_streams"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "cros_async",
+ "remain",
+ "sync",
+ "thiserror",
+]
+
+[[package]]
+name = "autocfg"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dde43e75fd43e8a1bf86103336bc699aa8d17ad1be60c76c0bdfd4828e19b78"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "base"
+version = "0.1.0"
+dependencies = [
+ "audio_streams",
+ "cros_async",
+ "data_model",
+ "libc",
+ "remain",
+ "serde",
+ "serde_json",
+ "smallvec",
+ "sync",
+ "sys_util",
+ "thiserror",
+]
+
+[[package]]
+name = "bit_field"
+version = "0.1.0"
+dependencies = [
+ "bit_field_derive",
+]
+
+[[package]]
+name = "bit_field_derive"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "cc"
+version = "1.0.73"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2fff2a6927b3bb87f9595d67196a70493f627687a71d87a0d692242c33f58c11"
+
+[[package]]
+name = "cfg-if"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "cloudabi"
+version = "0.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b540bd8bc810d3885c6ea91e2018302f68baba2129ab3e88f32389ee9370880d"
+dependencies = [
+ "cfg-if 1.0.0",
+]
+
+[[package]]
+name = "cros_async"
+version = "0.1.0"
+dependencies = [
+ "async-task",
+ "async-trait",
+ "data_model",
+ "futures",
+ "intrusive-collections",
+ "io_uring",
+ "libc",
+ "once_cell",
+ "paste",
+ "pin-utils",
+ "remain",
+ "slab",
+ "sync",
+ "sys_util",
+ "thiserror",
+]
+
+[[package]]
+name = "cros_fuzz"
+version = "0.1.0"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "crosvm"
+version = "0.1.0"
+dependencies = [
+ "aarch64",
+ "acpi_tables",
+ "anyhow",
+ "arch",
+ "assertions",
+ "audio_streams",
+ "base",
+ "bit_field",
+ "crosvm_plugin",
+ "data_model",
+ "devices",
+ "disk",
+ "enumn",
+ "gdbstub",
+ "gdbstub_arch",
+ "hypervisor",
+ "kernel_cmdline",
+ "kernel_loader",
+ "kvm",
+ "kvm_sys",
+ "libc",
+ "libcras",
+ "minijail",
+ "net_util",
+ "p9",
+ "protobuf",
+ "protos",
+ "remain",
+ "resources",
+ "rutabaga_gfx",
+ "scudo",
+ "serde_json",
+ "sync",
+ "tempfile",
+ "thiserror",
+ "vhost",
+ "vm_control",
+ "vm_memory",
+ "x86_64",
+]
+
+[[package]]
+name = "crosvm-fuzz"
+version = "0.0.1"
+dependencies = [
+ "base",
+ "cros_fuzz",
+ "data_model",
+ "devices",
+ "disk",
+ "fuse",
+ "hypervisor",
+ "kernel_loader",
+ "libc",
+ "rand",
+ "tempfile",
+ "usb_util",
+ "vm_memory",
+]
+
+[[package]]
+name = "crosvm_control"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "libc",
+ "vm_control",
+]
+
+[[package]]
+name = "crosvm_plugin"
+version = "0.17.0"
+dependencies = [
+ "base",
+ "kvm",
+ "kvm_sys",
+ "libc",
+ "protobuf",
+ "protos",
+]
+
+[[package]]
+name = "data_model"
+version = "0.1.0"
+dependencies = [
+ "assertions",
+ "libc",
+ "remain",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "dbus"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de0a745c25b32caa56b82a3950f5fec7893a960f4c10ca3b02060b0c38d8c2ce"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "winapi",
+]
+
+[[package]]
+name = "devices"
+version = "0.1.0"
+dependencies = [
+ "acpi_tables",
+ "anyhow",
+ "argh",
+ "async-task",
+ "audio_streams",
+ "base",
+ "bit_field",
+ "cros_async",
+ "data_model",
+ "dbus",
+ "disk",
+ "enumn",
+ "fuse",
+ "futures",
+ "gpu_display",
+ "hypervisor",
+ "kvm_sys",
+ "libc",
+ "libcras",
+ "libvda",
+ "linux_input_sys",
+ "minijail",
+ "net_sys",
+ "net_util",
+ "once_cell",
+ "p9",
+ "power_monitor",
+ "protobuf",
+ "protos",
+ "remain",
+ "resources",
+ "rutabaga_gfx",
+ "serde",
+ "serde_json",
+ "smallvec",
+ "sync",
+ "sys_util",
+ "system_api",
+ "tempfile",
+ "thiserror",
+ "tpm2",
+ "usb_util",
+ "vfio_sys",
+ "vhost",
+ "virtio_sys",
+ "vm_control",
+ "vm_memory",
+ "vmm_vhost",
+]
+
+[[package]]
+name = "disk"
+version = "0.1.0"
+dependencies = [
+ "async-trait",
+ "base",
+ "crc32fast",
+ "cros_async",
+ "data_model",
+ "futures",
+ "libc",
+ "protobuf",
+ "protos",
+ "remain",
+ "tempfile",
+ "thiserror",
+ "uuid",
+ "vm_memory",
+]
+
+[[package]]
+name = "downcast-rs"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ea835d29036a4087793836fa931b08837ad5e957da9e23886b29586fb9b6650"
+
+[[package]]
+name = "either"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e78d4f1cc4ae33bbfc157ed5d5a5ef3bc29227303d595861deb238fcec4e9457"
+
+[[package]]
+name = "enumn"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e58b112d5099aa0857c5d05f0eacab86406dd8c0f85fe5d320a13256d29ecf4"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "fastrand"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3fcf0cee53519c866c09b5de1f6c56ff9d647101f81c1964fa632e148896cdf"
+dependencies = [
+ "instant",
+]
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "fuse"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "bitflags",
+ "data_model",
+ "enumn",
+ "libc",
+ "remain",
+ "thiserror",
+]
+
+[[package]]
+name = "futures"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f73fe65f54d1e12b726f517d3e2135ca3125a437b6d998caf1962961f7172d9e"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3083ce4b914124575708913bca19bfe887522d6e2e6d0952943f5eac4a74010"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c09fd04b7e4073ac7156a9539b57a484a8ea920f79c7c675d05d289ab6110d3"
+
+[[package]]
+name = "futures-io"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc4045962a5a5e935ee2fdedaa4e08284547402885ab326734432bed5d12966b"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33c1e13800337f4d4d7a316bf45a567dbcb6ffe087f16424852d97e97a91f512"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21163e139fa306126e6eedaf49ecdb4588f939600f0b1e770f4205ee4b7fa868"
+
+[[package]]
+name = "futures-task"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c66a976bf5909d801bbef33416c41372779507e7a6b3a5e25e4749c58f776a"
+
+[[package]]
+name = "futures-util"
+version = "0.3.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b7abd5d659d9b90c8cba917f6ec750a74e2dc23902ef9cd4cc8c8b22e6036a"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "gdbstub"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e135587d3f6eee6fa02c4ba174270c2337424e6d852c156942c0840b3c0f5cc"
+dependencies = [
+ "cfg-if 0.1.10",
+ "log",
+ "managed",
+ "num-traits",
+ "paste",
+]
+
+[[package]]
+name = "gdbstub_arch"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e358b9c0e1468eae66099062e47bb502849308b987b74b5e72f1936397c33c16"
+dependencies = [
+ "gdbstub",
+ "num-traits",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d39cd93900197114fa1fcb7ae84ca742095eed9442088988ae74fa744e930e77"
+dependencies = [
+ "cfg-if 1.0.0",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "gpu_display"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "cc",
+ "data_model",
+ "libc",
+ "linux_input_sys",
+ "pkg-config",
+ "remain",
+ "thiserror",
+]
+
+[[package]]
+name = "heck"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "hypervisor"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "bit_field",
+ "data_model",
+ "downcast-rs",
+ "enumn",
+ "kvm",
+ "kvm_sys",
+ "libc",
+ "serde",
+ "sync",
+ "vm_memory",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a5bbe824c507c5da5956355e86a746d82e0e1464f65d862cc5e71da70e94b2c"
+dependencies = [
+ "cfg-if 1.0.0",
+]
+
+[[package]]
+name = "integration_tests"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "arch",
+ "base",
+ "crosvm",
+ "libc",
+ "tempfile",
+]
+
+[[package]]
+name = "intrusive-collections"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb484b70a4ebad7f571bf84e9cd06b5bfb6a7e4db0c36e13dd1570c6b449c10d"
+dependencies = [
+ "memoffset",
+]
+
+[[package]]
+name = "io_uring"
+version = "0.1.0"
+dependencies = [
+ "data_model",
+ "libc",
+ "remain",
+ "sync",
+ "sys_util",
+ "thiserror",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aab8fc367588b89dcee83ab0fd66b72b50b72fa1904d7095045ace2b0c81c35"
+
+[[package]]
+name = "kernel_cmdline"
+version = "0.1.0"
+dependencies = [
+ "libc",
+ "remain",
+ "thiserror",
+]
+
+[[package]]
+name = "kernel_loader"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "data_model",
+ "libc",
+ "remain",
+ "tempfile",
+ "thiserror",
+ "vm_memory",
+]
+
+[[package]]
+name = "kvm"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "data_model",
+ "kvm_sys",
+ "libc",
+ "sync",
+ "vm_memory",
+]
+
+[[package]]
+name = "kvm_sys"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "data_model",
+ "libc",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.120"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad5c14e80759d0939d013e6ca49930e59fc53dd8e5009132f76240c179380c09"
+
+[[package]]
+name = "libcras"
+version = "0.1.0"
+
+[[package]]
+name = "libdbus-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c185b5b7ad900923ef3a8ff594083d4d9b5aea80bb4f32b8342363138c0d456b"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libvda"
+version = "0.1.0"
+dependencies = [
+ "enumn",
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "linux_input_sys"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "data_model",
+ "libc",
+]
+
+[[package]]
+name = "log"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
+dependencies = [
+ "cfg-if 1.0.0",
+]
+
+[[package]]
+name = "managed"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ca88d725a0a943b096803bd34e73a4437208b6077654cc4ecb2947a5f91618d"
+
+[[package]]
+name = "memchr"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+
+[[package]]
+name = "memoffset"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "043175f069eda7b85febe4a74abbaeff828d9f8b448515d3151a14a3542811aa"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "minijail"
+version = "0.2.3"
+dependencies = [
+ "libc",
+ "minijail-sys",
+]
+
+[[package]]
+name = "minijail-sys"
+version = "0.0.13"
+dependencies = [
+ "libc",
+ "pkg-config",
+ "which",
+]
+
+[[package]]
+name = "net_sys"
+version = "0.1.0"
+dependencies = [
+ "base",
+]
+
+[[package]]
+name = "net_util"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "cros_async",
+ "data_model",
+ "libc",
+ "net_sys",
+ "remain",
+ "thiserror",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a64b1ec5cda2586e284722486d802acf1f7dbdc623e2bfc57e65ca1cd099290"
+dependencies = [
+ "autocfg 1.1.0",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f3e037eac156d1775da914196f0f37741a274155e34a0b7e427c35d2a2ecb9"
+
+[[package]]
+name = "p9"
+version = "0.1.0"
+dependencies = [
+ "libc",
+ "sys_util",
+ "wire_format_derive",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0744126afe1a6dd7f394cb50a716dbe086cb06e255e53d8d0185d82828358fb5"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e280fbe77cc62c91527259e9442153f4688736748d24660126286329742b4c6c"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58893f751c9b0412871a09abd62ecd2a00298c6c83befa223ef98c52aef40cbe"
+
+[[package]]
+name = "poll_token_derive"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "power_monitor"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "dbus",
+ "protobuf",
+ "protoc-rust",
+ "remain",
+ "thiserror",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7342d5883fbccae1cc37a2353b09c87c9b0f3afd73f5fb9bba687a1f733b029"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "protobuf"
+version = "2.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf7e6d18738ecd0902d30d1ad232c9125985a3422929b16c65517b38adc14f96"
+
+[[package]]
+name = "protobuf-codegen"
+version = "2.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aec1632b7c8f2e620343439a7dfd1f3c47b18906c4be58982079911482b5d707"
+dependencies = [
+ "protobuf",
+]
+
+[[package]]
+name = "protoc"
+version = "2.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2ef1dc036942fac2470fdb8a911f125404ee9129e9e807f3d12d8589001a38f"
+dependencies = [
+ "log",
+ "which",
+]
+
+[[package]]
+name = "protoc-rust"
+version = "2.27.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a9e315121c8e7e21396e940a3d27f92280a6d28e3931213bf6cbfea76c5cc94"
+dependencies = [
+ "protobuf",
+ "protobuf-codegen",
+ "protoc",
+ "tempfile",
+]
+
+[[package]]
+name = "protos"
+version = "0.1.0"
+dependencies = [
+ "kvm_sys",
+ "protobuf",
+ "protoc-rust",
+]
+
+[[package]]
+name = "qcow_utils"
+version = "0.1.0"
+dependencies = [
+ "argh",
+ "base",
+ "disk",
+ "libc",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "864d3e96a899863136fc6e99f3d7cae289dafe43bf2c5ac19b70df7210c0a145"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d71dacdc3c88c1fde3885a3be3fbab9f35724e6ce99467f7d9c5026132184ca"
+dependencies = [
+ "autocfg 0.1.8",
+ "libc",
+ "rand_chacha",
+ "rand_core 0.4.2",
+ "rand_hc",
+ "rand_isaac",
+ "rand_jitter",
+ "rand_os",
+ "rand_pcg",
+ "rand_xorshift",
+ "winapi",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "556d3a1ca6600bfcbab7c7c91ccb085ac7fbbcd70e008a98742e7847f4f7bcef"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_hc"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b40677c7be09ae76218dc623efbf7b18e34bced3f38883af07bb75630a21bc4"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_isaac"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ded997c9d5f13925be2a6fd7e66bf1872597f759fd9dd93513dd7e92e5a5ee08"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rand_jitter"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1166d5c91dc97b88d1decc3285bb0a99ed84b05cfd0bc2341bdf2d43fc41e39b"
+dependencies = [
+ "libc",
+ "rand_core 0.4.2",
+ "winapi",
+]
+
+[[package]]
+name = "rand_os"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b75f676a1e053fc562eafbb47838d67c84801e38fc1ba459e8f180deabd5071"
+dependencies = [
+ "cloudabi",
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.4.2",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand_pcg"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "abf9b09b01790cfe0364f52bf32995ea3c39f4d2dd011eac241d2914146d0b44"
+dependencies = [
+ "autocfg 0.1.8",
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cbf7e9e623549b0e21f6e97cf8ecf247c1a8fd2e8a992ae265314300b2455d5c"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8380fe0152551244f0747b1bf41737e0f8a74f97a14ccefd1148187271634f3c"
+dependencies = [
+ "bitflags",
+]
+
+[[package]]
+name = "remain"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ba1e78fa68412cb93ef642fd4d20b9a941be49ee9333875ebaf13112673ea7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "resources"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "libc",
+ "remain",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "rutabaga_gfx"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base",
+ "data_model",
+ "libc",
+ "pkg-config",
+ "remain",
+ "sync",
+ "thiserror",
+]
+
+[[package]]
+name = "rutabaga_gfx_ffi"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "data_model",
+ "libc",
+ "rutabaga_gfx",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73b4b750c782965c211b42f022f59af1fbceabdd026623714f104152f1ec149f"
+
+[[package]]
+name = "scudo"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a043122e575636c0e47121917446b4f40803fc6defd8797369e7d2d47086d8e3"
+dependencies = [
+ "libc",
+ "scudo-sys",
+]
+
+[[package]]
+name = "scudo-sys"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7aedac72a22df5e73d23abf6b26a9b124a3e10f0e5cc74b9aa8121c7e14cf106"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.136"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce31e24b01e1e524df96f1c2fdd054405f8d7376249a5110886fb4b658484789"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.136"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08597e7152fcd306f41838ed3e37be9eaeed2b61c42e2117266a554fab4662f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.79"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e8d9fa5c3b304765ce1fd9c4c8a3de2c8db365a5b91be52f186efc675681d95"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "slab"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9def91fd1e018fe007022791f865d0ccc9b3a0d5001e01aabb8b40e46000afb5"
+
+[[package]]
+name = "smallvec"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
+
+[[package]]
+name = "syn"
+version = "1.0.88"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebd69e719f31e88618baa1eaa6ee2de5c9a1c004f1e9ecdb58e8352a13f20a01"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "sync"
+version = "0.1.0"
+
+[[package]]
+name = "sys_util"
+version = "0.1.0"
+dependencies = [
+ "android_log-sys",
+ "data_model",
+ "libc",
+ "poll_token_derive",
+ "remain",
+ "serde",
+ "serde_json",
+ "sync",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "system_api"
+version = "0.1.0"
+
+[[package]]
+name = "tempfile"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cdb1ef4eaeeaddc8fbd371e5017057064af0911902ef36b39801f67cc6d79e4"
+dependencies = [
+ "cfg-if 1.0.0",
+ "fastrand",
+ "libc",
+ "redox_syscall",
+ "remove_dir_all",
+ "winapi",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tpm2"
+version = "0.1.0"
+dependencies = [
+ "tpm2-sys",
+]
+
+[[package]]
+name = "tpm2-sys"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "pkg-config",
+]
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e8820f5d777f6224dc4be3632222971ac30164d4a258d595640799554ebfd99"
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "usb_sys"
+version = "0.1.0"
+dependencies = [
+ "base",
+]
+
+[[package]]
+name = "usb_util"
+version = "0.1.0"
+dependencies = [
+ "assertions",
+ "base",
+ "data_model",
+ "libc",
+ "remain",
+ "thiserror",
+ "usb_sys",
+]
+
+[[package]]
+name = "uuid"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5cf98d8186244414c848017f0e2676b3fcb46807f6668a97dfe67359a3c4b7"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "vfio_sys"
+version = "0.1.0"
+dependencies = [
+ "base",
+]
+
+[[package]]
+name = "vhost"
+version = "0.1.0"
+dependencies = [
+ "assertions",
+ "base",
+ "libc",
+ "net_util",
+ "remain",
+ "thiserror",
+ "virtio_sys",
+ "vm_memory",
+]
+
+[[package]]
+name = "virtio_sys"
+version = "0.1.0"
+dependencies = [
+ "base",
+]
+
+[[package]]
+name = "vm_control"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "data_model",
+ "gdbstub_arch",
+ "hypervisor",
+ "libc",
+ "remain",
+ "resources",
+ "rutabaga_gfx",
+ "serde",
+ "serde_json",
+ "sync",
+ "thiserror",
+ "vm_memory",
+]
+
+[[package]]
+name = "vm_memory"
+version = "0.1.0"
+dependencies = [
+ "base",
+ "bitflags",
+ "cros_async",
+ "data_model",
+ "libc",
+ "remain",
+ "thiserror",
+]
+
+[[package]]
+name = "vmm_vhost"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "bitflags",
+ "data_model",
+ "libc",
+ "remain",
+ "sys_util",
+ "tempfile",
+ "thiserror",
+]
+
+[[package]]
+name = "wasi"
+version = "0.10.2+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd6fbd9a79829dd1ad0cc20627bf1ed606756a7f77edff7b66b7064f9cb327c6"
+
+[[package]]
+name = "which"
+version = "4.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a5a7e487e921cf220206864a94a89b6c6905bfc19f1057fa26a4cb360e5c1d2"
+dependencies = [
+ "either",
+ "lazy_static",
+ "libc",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "wire_format_derive"
+version = "0.1.0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "x86_64"
+version = "0.1.0"
+dependencies = [
+ "acpi_tables",
+ "arch",
+ "assertions",
+ "base",
+ "data_model",
+ "devices",
+ "gdbstub_arch",
+ "hypervisor",
+ "kernel_cmdline",
+ "kernel_loader",
+ "libc",
+ "minijail",
+ "remain",
+ "resources",
+ "sync",
+ "thiserror",
+ "vm_control",
+ "vm_memory",
+]
diff --git a/pkgs/applications/virtualization/crosvm/default.nix b/pkgs/applications/virtualization/crosvm/default.nix
index 697741e21f14..2afbe123b55b 100644
--- a/pkgs/applications/virtualization/crosvm/default.nix
+++ b/pkgs/applications/virtualization/crosvm/default.nix
@@ -1,5 +1,6 @@
-{ stdenv, lib, rustPlatform, fetchgit, runCommand, symlinkJoin
-, pkg-config, minijail, dtc, libusb1, libcap, linux
+{ stdenv, lib, rustPlatform, fetchgit
+, pkg-config, wayland-scanner, libcap, minijail, wayland, wayland-protocols
+, linux
 }:
 
 let
@@ -11,55 +12,26 @@ let
     else if isx86_64 then "x86_64"
     else throw "no seccomp policy files available for host platform";
 
-  crosvmSrc = fetchgit {
-    inherit (upstreamInfo.components."chromiumos/platform/crosvm")
-      url rev sha256 fetchSubmodules;
-  };
-
-  adhdSrc = fetchgit {
-    inherit (upstreamInfo.components."chromiumos/third_party/adhd")
-      url rev sha256 fetchSubmodules;
-  };
-
 in
 
   rustPlatform.buildRustPackage rec {
     pname = "crosvm";
     inherit (upstreamInfo) version;
 
-    unpackPhase = ''
-      runHook preUnpack
-
-      mkdir -p chromiumos/platform chromiumos/third_party
-
-      pushd chromiumos/platform
-      unpackFile ${crosvmSrc}
-      mv ${crosvmSrc.name} crosvm
-      popd
-
-      pushd chromiumos/third_party
-      unpackFile ${adhdSrc}
-      mv ${adhdSrc.name} adhd
-      popd
-
-      chmod -R u+w -- "$sourceRoot"
-
-      runHook postUnpack
-    '';
-
-    sourceRoot = "chromiumos/platform/crosvm";
+    src = fetchgit (builtins.removeAttrs upstreamInfo.src [ "date" "path" ]);
 
     patches = [
       ./default-seccomp-policy-dir.diff
     ];
 
-    cargoSha256 = "0aax0slg59afbyn3ygswwap2anv11k6sr9hfpysb4f8rvymvx7hd";
+    cargoLock.lockFile = ./Cargo.lock;
 
-    nativeBuildInputs = [ pkg-config ];
+    nativeBuildInputs = [ pkg-config wayland-scanner ];
 
-    buildInputs = [ dtc libcap libusb1 minijail ];
+    buildInputs = [ libcap minijail wayland wayland-protocols ];
 
     postPatch = ''
+      cp ${./Cargo.lock} Cargo.lock
       sed -i "s|/usr/share/policy/crosvm/|$out/share/policy/|g" \
              seccomp/*/*.policy
     '';
@@ -77,11 +49,7 @@ in
       lib.optionalString (stdenv.buildPlatform == stdenv.hostPlatform)
         "${linux}/${stdenv.hostPlatform.linux-kernel.target}";
 
-    passthru = {
-      inherit adhdSrc;
-      src = crosvmSrc;
-      updateScript = ./update.py;
-    };
+    passthru.updateScript = ./update.py;
 
     meta = with lib; {
       description = "A secure virtual machine monitor for KVM";
diff --git a/pkgs/applications/virtualization/crosvm/update.py b/pkgs/applications/virtualization/crosvm/update.py
index 29e68b9f5790..6e36e524b78d 100755
--- a/pkgs/applications/virtualization/crosvm/update.py
+++ b/pkgs/applications/virtualization/crosvm/update.py
@@ -12,9 +12,7 @@ from lxml import etree
 from lxml.etree import HTMLParser
 from urllib.request import urlopen
 
-# ChromiumOS components required to build crosvm.
-components = ['chromiumos/platform/crosvm', 'chromiumos/third_party/adhd']
-
+git_path = 'chromiumos/platform/crosvm'
 git_root = 'https://chromium.googlesource.com/'
 manifest_versions = f'{git_root}chromiumos/manifest-versions'
 buildspecs_url = f'{manifest_versions}/+/refs/heads/master/full/buildspecs/'
@@ -54,32 +52,27 @@ with urlopen(f'{buildspecs_url}{chrome_major_version}/?format=TEXT') as resp:
     buildspecs.sort(reverse=True)
     buildspec = splitext(buildspecs[0])[0]
 
-revisions = {}
-
-# Read the buildspec, and extract the git revisions for each component.
+# Read the buildspec, and extract the git revision.
 with urlopen(f'{buildspecs_url}{chrome_major_version}/{buildspec}.xml?format=TEXT') as resp:
     xml = base64.decodebytes(resp.read())
     root = etree.fromstring(xml)
-    for project in root.findall('project'):
-        revisions[project.get('name')] = project.get('revision')
+    revision = root.find(f'./project[@name="{git_path}"]').get('revision')
 
 # Initialize the data that will be output from this script.  Leave the
 # rc number in buildspec so nobody else is subject to the same level
 # of confusion I have been.
-data = {'version': f'{chrome_major_version}.{buildspec}', 'components': {}}
+data = {'version': f'{chrome_major_version}.{buildspec}'}
 
-# Fill in the 'components' dictionary with the output from
-# nix-prefetch-git, which can be passed straight to fetchGit when
-# imported by Nix.
-for component in components:
-    argv = ['nix-prefetch-git',
-            '--url', git_root + component,
-            '--rev', revisions[component]]
+# Fill in the 'src' key with the output from nix-prefetch-git, which
+# can be passed straight to fetchGit when imported by Nix.
+argv = ['nix-prefetch-git',
+        '--fetch-submodules',
+        '--url', git_root + git_path,
+        '--rev', revision]
+output = subprocess.check_output(argv)
+data['src'] = json.loads(output.decode('utf-8'))
 
-    output = subprocess.check_output(argv)
-    data['components'][component] = json.loads(output.decode('utf-8'))
-
-# Find the path to crosvm's default.nix, so the srcs data can be
+# Find the path to crosvm's default.nix, so the src data can be
 # written into the same directory.
 argv = ['nix-instantiate', '--eval', '--json', '-A', 'crosvm.meta.position']
 position = json.loads(subprocess.check_output(argv).decode('utf-8'))
diff --git a/pkgs/applications/virtualization/crosvm/upstream-info.json b/pkgs/applications/virtualization/crosvm/upstream-info.json
index bb9cc8841b4a..437e8f418699 100644
--- a/pkgs/applications/virtualization/crosvm/upstream-info.json
+++ b/pkgs/applications/virtualization/crosvm/upstream-info.json
@@ -1,23 +1,14 @@
 {
-  "version": "81.12871.0.0-rc1",
-  "components": {
-    "chromiumos/platform/crosvm": {
-      "url": "https://chromium.googlesource.com/chromiumos/platform/crosvm",
-      "rev": "8b8c01e1ad31718932491e4aee63f56109a138e2",
-      "date": "2020-01-25T02:28:10+00:00",
-      "sha256": "1qmf1k06pwynh15c3nr9m6v90z2pkk930xniwvlvbvnazrk4rllg",
-      "fetchSubmodules": false,
-      "deepClone": false,
-      "leaveDotGit": false
-    },
-    "chromiumos/third_party/adhd": {
-      "url": "https://chromium.googlesource.com/chromiumos/third_party/adhd",
-      "rev": "f361d5b02623274723bff251dafa1e2a2887b013",
-      "date": "2020-01-23T18:37:46+00:00",
-      "sha256": "1p8iwjwgmcgmzri03ik2jaid8l0ch0bzn6z9z64dix1hlrvrlliw",
-      "fetchSubmodules": false,
-      "deepClone": false,
-      "leaveDotGit": false
-    }
+  "version": "99.14468.0.0-rc1",
+  "src": {
+    "url": "https://chromium.googlesource.com/chromiumos/platform/crosvm",
+    "rev": "410ea3a1980bfe96968a7dfb7a7d203d43b186b2",
+    "date": "2022-01-11T00:01:17-08:00",
+    "path": "/nix/store/y2rpzh1any8c4nwnwkvir7241kbcj8fn-crosvm-410ea3a",
+    "sha256": "1bgwndh2f60ka1f8c8yqnqqkra510ai9miyfvvm0b3dnsdpy77kd",
+    "fetchLFS": false,
+    "fetchSubmodules": true,
+    "deepClone": false,
+    "leaveDotGit": false
   }
 }
diff --git a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
index ad22fc4cc9f5..865dcad157bd 100644
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@@ -162,5 +162,6 @@ in stdenv.mkDerivation rec {
     license = "GPL";
     maintainers = [ lib.maintainers.sander ];
     platforms = lib.platforms.linux;
+    broken = kernel.kernelAtLeast "5.17";
   };
 }
diff --git a/pkgs/development/libraries/librtprocess/default.nix b/pkgs/development/libraries/librtprocess/default.nix
index 3e44bfd3d7dd..c7e9b3895d98 100644
--- a/pkgs/development/libraries/librtprocess/default.nix
+++ b/pkgs/development/libraries/librtprocess/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librtprocess";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "CarVac";
     repo = pname;
     rev = version;
-    sha256 = "1bivy3rymmmkdx5phbxq4qaq15hw633dgpks57z9ara15mh817xx";
+    sha256 = "sha256-/1o6SWUor+ZBQ6RsK2PoDRu03jcVRG58PNYFttriH2w=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/libvirt/0001-qemu-segmentation-fault-in-virtqemud-executing-qemuD.patch b/pkgs/development/libraries/libvirt/0001-qemu-segmentation-fault-in-virtqemud-executing-qemuD.patch
new file mode 100644
index 000000000000..375267dcda79
--- /dev/null
+++ b/pkgs/development/libraries/libvirt/0001-qemu-segmentation-fault-in-virtqemud-executing-qemuD.patch
@@ -0,0 +1,48 @@
+From 823a62ec8aac4fb75e6e281164f3eb56ae47597c Mon Sep 17 00:00:00 2001
+From: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Date: Tue, 1 Mar 2022 18:47:59 +0100
+Subject: [PATCH] qemu: segmentation fault in virtqemud executing
+ qemuDomainUndefineFlags
+
+Commit 5adfb3472342741c443ac91dee0abb18b5a3d038 causes a segmentation fault.
+
+Stack trace of thread 664419:
+ #0  0x000003ff62ec553c in qemuDomainUndefineFlags (dom=0x3ff6c002810, flags=<optimized out>) at ../src/qemu/qemu_driver.c:6618
+ #1  0x000003ff876a7e5c in virDomainUndefineFlags (domain=domain@entry=0x3ff6c002810, flags=<optimized out>) at ../src/libvirt-domain.c:6519
+ #2  0x000002aa2b64a808 in remoteDispatchDomainUndefineFlags (server=0x2aa2c3d7880, msg=0x2aa2c3d2770, args=<optimized out>, rerr=0x3ff8287b950, client=<optimized out>)
+        at src/remote/remote_daemon_dispatch_stubs.h:13080
+ #3  remoteDispatchDomainUndefineFlagsHelper (server=0x2aa2c3d7880, client=<optimized out>, msg=0x2aa2c3d2770, rerr=0x3ff8287b950, args=<optimized out>, ret=0x0)
+        at src/remote/remote_daemon_dispatch_stubs.h:13059
+ #4  0x000003ff8758bbf4 in virNetServerProgramDispatchCall (msg=0x2aa2c3d2770, client=0x2aa2c3e3050, server=0x2aa2c3d7880, prog=0x2aa2c3d8010)
+        at ../src/rpc/virnetserverprogram.c:428
+ #5  virNetServerProgramDispatch (prog=0x2aa2c3d8010, server=server@entry=0x2aa2c3d7880, client=0x2aa2c3e3050, msg=0x2aa2c3d2770) at ../src/rpc/virnetserverprogram.c:302
+ #6  0x000003ff8758c260 in virNetServerProcessMsg (msg=<optimized out>, prog=<optimized out>, client=<optimized out>, srv=0x2aa2c3d7880) at ../src/rpc/virnetserver.c:140
+ #7  virNetServerHandleJob (jobOpaque=0x2aa2c3e2d30, opaque=0x2aa2c3d7880) at ../src/rpc/virnetserver.c:160
+ #8  0x000003ff874c49aa in virThreadPoolWorker (opaque=<optimized out>) at ../src/util/virthreadpool.c:164
+ #9  0x000003ff874c3f62 in virThreadHelper (data=<optimized out>) at ../src/util/virthread.c:256
+ #10 0x000003ff86c1cf8c in start_thread () from /lib64/libc.so.6
+ #11 0x000003ff86c9650e in thread_start () from /lib64/libc.so.6
+
+Signed-off-by: Boris Fiuczynski <fiuczy@linux.ibm.com>
+Reviewed-by: Jim Fehlig <jfehlig@suse.com>
+Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
+---
+ src/qemu/qemu_driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
+index bcd9bdb436..8337eed510 100644
+--- a/src/qemu/qemu_driver.c
++++ b/src/qemu/qemu_driver.c
+@@ -6615,7 +6615,7 @@ qemuDomainUndefineFlags(virDomainPtr dom,
+         }
+     }
+ 
+-    if (vm->def->os.loader->nvram) {
++    if (vm->def->os.loader && vm->def->os.loader->nvram) {
+         nvram_path = g_strdup(vm->def->os.loader->nvram);
+     } else if (vm->def->os.firmware == VIR_DOMAIN_OS_DEF_FIRMWARE_EFI) {
+         qemuDomainNVRAMPathFormat(cfg, vm->def, &nvram_path);
+-- 
+2.35.1
+
diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix
index 14e0e478790c..9e39c2fd2a65 100644
--- a/pkgs/development/libraries/libvirt/default.nix
+++ b/pkgs/development/libraries/libvirt/default.nix
@@ -130,6 +130,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./0001-meson-patch-in-an-install-prefix-for-building-on-nix.patch
+    ./0001-qemu-segmentation-fault-in-virtqemud-executing-qemuD.patch
   ];
 
   # remove some broken tests
diff --git a/pkgs/development/ocaml-modules/ca-certs/default.nix b/pkgs/development/ocaml-modules/ca-certs/default.nix
index ce8993b465eb..0805edbafe84 100644
--- a/pkgs/development/ocaml-modules/ca-certs/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -1,28 +1,29 @@
 { lib, buildDunePackage, fetchurl
-, bos, fpath, rresult, ptime, mirage-crypto, x509, astring, logs
-, cacert, alcotest
+, bos, fpath, ptime, mirage-crypto, x509, astring, logs
+, cacert, alcotest, fmt
 }:
 
 buildDunePackage rec {
   pname = "ca-certs";
-  version = "0.2.1";
+  version = "0.2.2";
 
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs/releases/download/v${version}/ca-certs-v${version}.tbz";
-    sha256 = "d43109496a5129feff967d557c556af96f8b10456896a405c43b7cf0c35d0af3";
+    sha256 = "sha256-Tx53zBJemZh3ODh/8izahxDoJvXvNFLyAA8LMM1mhlI=";
   };
 
   useDune2 = true;
 
-  propagatedBuildInputs = [ bos fpath rresult ptime mirage-crypto x509 astring logs ];
+  propagatedBuildInputs = [ bos fpath ptime mirage-crypto x509 astring logs ];
 
   # Assumes nss-cacert < 3.74 https://github.com/mirage/ca-certs/issues/21
   doCheck = false;
   checkInputs = [
     cacert    # for /etc/ssl/certs/ca-bundle.crt
     alcotest
+    fmt
   ];
 
   meta = with lib; {
diff --git a/pkgs/development/php-packages/php-cs-fixer/default.nix b/pkgs/development/php-packages/php-cs-fixer/default.nix
index 90bd1af00789..9104c0a0c8dd 100644
--- a/pkgs/development/php-packages/php-cs-fixer/default.nix
+++ b/pkgs/development/php-packages/php-cs-fixer/default.nix
@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
 let
   pname = "php-cs-fixer";
-  version = "3.7.0";
+  version = "3.8.0";
 in
 mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v${version}/php-cs-fixer.phar";
-    sha256 = "sha256-a7mKM++0iQm9hQFCDfyR6Jdb9h98YNHmbdQso8BU3WE=";
+    sha256 = "sha256-kOdJ2xuS095xVdPxoz4q/XM0BpyJEy6V/CtkuTN/Chk=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/development/python-modules/simplisafe-python/default.nix b/pkgs/development/python-modules/simplisafe-python/default.nix
index fa813c4b5fd1..1c2c206f87f0 100644
--- a/pkgs/development/python-modules/simplisafe-python/default.nix
+++ b/pkgs/development/python-modules/simplisafe-python/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "simplisafe-python";
-  version = "2022.02.1";
+  version = "2022.03.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "sha256-r+TcSzFkEGRsuTtEHBT/GMNa9r6GsIyvbLaF32cFfeQ=";
+    sha256 = "sha256-B4Tg122S2lJaBXBKUSN2ndt5EOiC5HyORTQXofZKUpw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 5bb5bc0652fe..f21808b1bf70 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -37,6 +37,8 @@ stdenv.mkDerivation rec {
   postPatch = if stdenv.isDarwin then ''
     substituteInPlace gdb/darwin-nat.c \
       --replace '#include "bfd/mach-o.h"' '#include "mach-o.h"'
+  '' else if stdenv.hostPlatform.isMusl then ''
+    substituteInPlace sim/ppc/emul_unix.c --replace sys/termios.h termios.h
   '' else null;
 
   patches = [
@@ -50,7 +52,11 @@ stdenv.mkDerivation rec {
     })
   ] ++ lib.optionals stdenv.isDarwin [
     ./darwin-target-match.patch
-  ];
+  ] ++ lib.optional stdenv.hostPlatform.isMusl (fetchpatch {
+    name = "musl-fix-pagesize-page_size.patch";
+    url = "https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=fd0975b96b16d96010dce439af9620d3dfb65426";
+    hash = "sha256-M3U7uIIFJnYu0g8/sMLJPhm02q7cGOi6pLjgsUUjeKI=";
+  });
 
   nativeBuildInputs = [ pkg-config texinfo perl setupDebugInfoDirs ];
 
diff --git a/pkgs/games/steam/fhsenv.nix b/pkgs/games/steam/fhsenv.nix
index 37ec8ef8c7e2..10709102ecf2 100644
--- a/pkgs/games/steam/fhsenv.nix
+++ b/pkgs/games/steam/fhsenv.nix
@@ -131,7 +131,6 @@ in buildFHSUserEnv rec {
     rtmpdump
 
     # dependencies for mesa drivers, needed inside pressure-vessel
-    mesa.drivers
     mesa.llvmPackages.llvm.lib
     vulkan-loader
     expat
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 784b6a887506..458f70a6a04b 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -550,7 +550,7 @@ let
       UPROBE_EVENT          = { optional = true; tristate = whenOlder "4.11" "y";};
       UPROBE_EVENTS         = { optional = true; tristate = whenAtLeast "4.11" "y";};
       BPF_SYSCALL           = yes;
-      BPF_UNPRIV_DEFAULT_OFF = whenBetween "5.10" "5.15" yes;
+      BPF_UNPRIV_DEFAULT_OFF = whenBetween "5.10" "5.16" yes;
       BPF_EVENTS            = yes;
       FUNCTION_PROFILER     = yes;
       RING_BUFFER_BENCHMARK = no;
diff --git a/pkgs/os-specific/linux/r8168/default.nix b/pkgs/os-specific/linux/r8168/default.nix
index 680cc531af42..bcf5fb8956ab 100644
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@@ -10,7 +10,7 @@ in stdenv.mkDerivation rec {
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
-  # [1] http://www.realtek.com.tw/downloads/downloadsView.aspx?PFid=5&Level=5&Conn=4&DownTypeID=3
+  # [1] https://www.realtek.com/en/component/zoo/category/network-interface-controllers-10-100-1000m-gigabit-ethernet-pci-express-software
   # I've verified manually (`diff -r`) that the source code for version 8.046.00
   # is the same as the one available on the realtek website.
   src = fetchFromGitHub {
@@ -54,5 +54,6 @@ in stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ timokau ];
+    broken = kernel.kernelAtLeast "5.17";
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8189es/default.nix b/pkgs/os-specific/linux/rtl8189es/default.nix
index d6b5785210b0..c1032473db10 100644
--- a/pkgs/os-specific/linux/rtl8189es/default.nix
+++ b/pkgs/os-specific/linux/rtl8189es/default.nix
@@ -42,5 +42,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ danielfullmer lheckemann ];
+    broken = kernel.kernelAtLeast "5.17";
   };
 }
diff --git a/pkgs/os-specific/linux/rtl8821ce/default.nix b/pkgs/os-specific/linux/rtl8821ce/default.nix
index 27303c029802..62743c226889 100644
--- a/pkgs/os-specific/linux/rtl8821ce/default.nix
+++ b/pkgs/os-specific/linux/rtl8821ce/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/tomaspinho/rtl8821ce";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
-    broken = stdenv.isAarch64;
+    broken = stdenv.isAarch64 || kernel.kernelAtLeast "5.17";
     maintainers = with maintainers; [ hhm ivar ];
   };
 }
diff --git a/pkgs/servers/headscale/default.nix b/pkgs/servers/headscale/default.nix
index 82b443c01159..8249eb6d9876 100644
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "headscale";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "juanfont";
     repo = "headscale";
     rev = "v${version}";
-    sha256 = "sha256-9nBFBvYAhybg97oU4mi899ss4/nzBCY95KfdkSs2f8s=";
+    sha256 = "sha256-ZgChln6jcxyEHbCy89kNnwd9qWcB0yDq05xFkM69WLs=";
   };
 
-  vendorSha256 = "sha256-qFoSK27D6bznksdm7Fl4SsVt13g2LSwuGe0As/MUo5o=";
+  vendorSha256 = "sha256-0jZ37tmBG8E0HS/wbQyQvAKo1UKQdaZDa+OTGfGDAi4=";
 
   ldflags = [ "-s" "-w" "-X github.com/juanfont/headscale/cmd/headscale/cli.Version=v${version}" ];
 
diff --git a/pkgs/servers/openafs/1.8/module.nix b/pkgs/servers/openafs/1.8/module.nix
index 02966d2ac70d..53834e5ccc1f 100644
--- a/pkgs/servers/openafs/1.8/module.nix
+++ b/pkgs/servers/openafs/1.8/module.nix
@@ -70,6 +70,6 @@ stdenv.mkDerivation {
     license = licenses.ipl10;
     platforms = platforms.linux;
     maintainers = with maintainers; [ maggesi spacefrogg ];
-    broken = versionOlder kernel.version "3.18" || kernel.isHardened;
+    broken = kernel.kernelOlder "3.18" || kernel.kernelAtLeast "5.17" || kernel.isHardened;
   };
 }
diff --git a/pkgs/tools/graphics/astc-encoder/default.nix b/pkgs/tools/graphics/astc-encoder/default.nix
index cecc52b9df2d..2b55113b4f95 100644
--- a/pkgs/tools/graphics/astc-encoder/default.nix
+++ b/pkgs/tools/graphics/astc-encoder/default.nix
@@ -31,13 +31,13 @@ with rec {
 
 gccStdenv.mkDerivation rec {
   pname = "astc-encoder";
-  version = "3.4";
+  version = "3.5";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     rev = version;
-    sha256 = "sha256-blOfc/H64UErjPjkdZQNp2H/Hw57RbQRFBcUo/C2b0Q=";
+    sha256 = "sha256-vsnU592UDQfBuh9XWzw12wANkQBoUxznpOD9efCUKA0=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/tools/security/nwipe/default.nix b/pkgs/tools/security/nwipe/default.nix
index 8cfa47b5d44a..50a8cf83db22 100644
--- a/pkgs/tools/security/nwipe/default.nix
+++ b/pkgs/tools/security/nwipe/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nwipe";
-  version = "0.32";
+  version = "0.33";
 
   src = fetchFromGitHub {
     owner = "martijnvanbrummelen";
     repo = "nwipe";
     rev = "v${version}";
-    sha256 = "sha256-O3kYiai+5KMHWd2om4+HrTIw9lB2wLJF3Mrr6iY2+I8=";
+    sha256 = "sha256-i+cK2XTdWc3ByG9i+rfwL3Ds8Sl15/wZwEc5nrcWdeY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9af779552b81..a47763682aa8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6559,7 +6559,9 @@ with pkgs;
 
   heimdall-gui = heimdall.override { enableGUI = true; };
 
-  headscale = callPackage ../servers/headscale { };
+  headscale = callPackage ../servers/headscale {
+    buildGoModule = buildGo118Module;
+  };
 
   heisenbridge = callPackage ../servers/heisenbridge { };
 
@@ -25606,6 +25608,8 @@ with pkgs;
 
   f1viewer = callPackage ../applications/video/f1viewer {};
 
+  faircamp = callPackage ../applications/misc/faircamp { };
+
   fasttext = callPackage ../applications/science/machine-learning/fasttext { };
 
   fbmenugen = callPackage ../applications/misc/fbmenugen { };