12 files changed, 200 insertions, 82 deletions
diff --git a/pkgs/os-specific/linux/ati-drivers/default.nix b/pkgs/os-specific/linux/ati-drivers/default.nix
index d5d42faa913e..cda7e03cd066 100644
--- a/pkgs/os-specific/linux/ati-drivers/default.nix
+++ b/pkgs/os-specific/linux/ati-drivers/default.nix
@@ -61,8 +61,8 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url =
     "https://www2.ati.com/drivers/linux/radeon-crimson-15.12-15.302-151217a-297685e.zip";
-    sha256 = "0n0ynqmjkjp5dl5q07as7ps3rlyyn63hq4mlwgd7c7v82ky2skvh";
-    curlOpts = "--referer http://support.amd.com/en-us/download/desktop?os=Linux+x86_64";
+    sha256 = "704f2dfc14681f76dae3b4120c87b1ded33cf43d5a1d800b6de5ca292bb61e58";
+    curlOpts = "--referer https://www.amd.com/en/support";
   };
 
   hardeningDisable = [ "pic" "format" ];
diff --git a/pkgs/os-specific/linux/bpftrace/bcc-source.patch b/pkgs/os-specific/linux/bpftrace/bcc-source.patch
new file mode 100644
index 000000000000..a4c9947f0c34
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftrace/bcc-source.patch
@@ -0,0 +1,32 @@
+From fc0a5bd2ddb5827c5288ee284c1f2d834d79e432 Mon Sep 17 00:00:00 2001
+From: Rodney Lorrimar <dev@rodney.id.au>
+Date: Tue, 16 Oct 2018 09:55:59 +1000
+Subject: [PATCH 1/3] Don't use ExternalProject for bcc sources
+
+---
+ CMakeLists.txt | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index eae850a..b20fb33 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -31,6 +31,15 @@ if (OFFLINE_BUILDS)
+     UPDATE_DISCONNECTED 1
+     BUILD_COMMAND ${CMAKE_COMMAND} --build . --target bcc-static
+     )
++elseif (NIX_BUILDS)
++  include(ExternalProject)
++  ExternalProject_Add(bcc
++    DOWNLOAD_COMMAND rmdir bcc && ln -sf $ENV{bccSrc} bcc
++    STEP_TARGETS build update
++    EXCLUDE_FROM_ALL 1
++    UPDATE_DISCONNECTED 1
++    BUILD_COMMAND ${CMAKE_COMMAND} --build . --target bcc-static
++    )
+ else()
+   include(ExternalProject)
+   ExternalProject_Add(bcc
+-- 
+2.17.1
+
diff --git a/pkgs/os-specific/linux/bpftrace/default.nix b/pkgs/os-specific/linux/bpftrace/default.nix
new file mode 100644
index 000000000000..12773a957165
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftrace/default.nix
@@ -0,0 +1,57 @@
+{ stdenv, fetchFromGitHub
+, cmake, pkgconfig, flex, bison
+, llvmPackages, kernel, linuxHeaders, elfutils, libelf, bcc
+}:
+
+stdenv.mkDerivation rec {
+  name = "bpftrace-unstable-${version}";
+  version = "2018-10-27";
+
+  src = fetchFromGitHub {
+    owner = "iovisor";
+    repo = "bpftrace";
+    rev = "c07b54f61fd7b7b49e0a254e746d6f442c5d780d";
+    sha256 = "1mpcjfyay9akmpqxag2ndwpz1qsdx8ii07jh9fky4w40wi9cipyg";
+  };
+
+  # bpftrace requires an unreleased version of bcc, added to the cmake
+  # build as an ExternalProject.
+  # https://github.com/iovisor/bpftrace/issues/184
+  bccSrc = fetchFromGitHub {
+    owner = "iovisor";
+    repo = "bcc";
+    rev = "afd00154865f3b2da6781cf92cecebaca4853950";
+    sha256 = "0ad78smrnipr1f377i5rv6ksns7v2vq54g5badbj5ldqs4x0hygd";
+  };
+
+  buildInputs = [
+    llvmPackages.llvm llvmPackages.clang-unwrapped kernel
+    elfutils libelf bccSrc
+  ];
+
+  nativeBuildInputs = [ cmake pkgconfig flex bison ]
+    # libelf is incompatible with elfutils-libelf
+    ++ stdenv.lib.filter (x: x != libelf) kernel.moduleBuildDependencies;
+
+  patches = [
+    ./bcc-source.patch
+    # https://github.com/iovisor/bpftrace/issues/184
+    ./disable-gtests.patch
+  ];
+
+  configurePhase = ''
+    mkdir build
+    cd build
+    cmake ../                                   \
+      -DKERNEL_HEADERS_DIR=${linuxHeaders}      \
+      -DNIX_BUILDS:BOOL=ON                      \
+      -DCMAKE_INSTALL_PREFIX=$out
+  '';
+
+  meta = with stdenv.lib; {
+    description = "High-level tracing language for Linux eBPF";
+    homepage = https://github.com/iovisor/bpftrace;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ rvl ];
+  };
+}
diff --git a/pkgs/os-specific/linux/bpftrace/disable-gtests.patch b/pkgs/os-specific/linux/bpftrace/disable-gtests.patch
new file mode 100644
index 000000000000..941d85a41126
--- /dev/null
+++ b/pkgs/os-specific/linux/bpftrace/disable-gtests.patch
@@ -0,0 +1,73 @@
+From 221eea24674fffb3b657b2bd0c923071b69d48a7 Mon Sep 17 00:00:00 2001
+From: Rodney Lorrimar <dev@rodney.id.au>
+Date: Tue, 16 Oct 2018 09:56:47 +1000
+Subject: [PATCH 2/3] Disable tests
+
+Would prefer to use gtest library in the normal way rather through
+ExternalProject.
+---
+ CMakeLists.txt       |  4 ++--
+ tests/CMakeLists.txt | 18 +++++++++++-------
+ 2 files changed, 13 insertions(+), 9 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b20fb33..7025d17 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -20,7 +20,7 @@ add_compile_options("-Wno-format-security")
+ #add_compile_options("-Wstrict-overflow=5")
+ #add_compile_options("-Wdisabled-optimization")
+ 
+-enable_testing()
++# enable_testing()
+ 
+ if (OFFLINE_BUILDS)
+   include(ExternalProject)
+@@ -79,7 +79,7 @@ include_directories(${CLANG_INCLUDE_DIRS})
+ add_subdirectory(src/arch)
+ add_subdirectory(src/ast)
+ add_subdirectory(src)
+-add_subdirectory(tests)
++# add_subdirectory(tests)
+ add_subdirectory(resources)
+ add_subdirectory(tools)
+ add_subdirectory(man)
+diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
+index c283efa..6b5bff0 100644
+--- a/tests/CMakeLists.txt
++++ b/tests/CMakeLists.txt
+@@ -45,6 +45,8 @@ if (OFFLINE_BUILDS)
+     EXCLUDE_FROM_ALL 1
+     UPDATE_DISCONNECTED 1
+     )
++elseif (NIX_BUILDS)
++
+ else()
+   include(ExternalProject)
+   ExternalProject_Add(gtest-git
+@@ -54,13 +56,15 @@ else()
+     EXCLUDE_FROM_ALL 1
+     )
+ endif()
+-add_dependencies(bpftrace_test gtest-git-build)
+-ExternalProject_Get_Property(gtest-git source_dir binary_dir)
+-target_include_directories(bpftrace_test PUBLIC ${source_dir}/googletest/include)
+-target_include_directories(bpftrace_test PUBLIC ${source_dir}/googlemock/include)
+-target_link_libraries(bpftrace_test ${binary_dir}/googlemock/gtest/libgtest.a)
+-target_link_libraries(bpftrace_test ${binary_dir}/googlemock/gtest/libgtest_main.a)
+-target_link_libraries(bpftrace_test ${binary_dir}/googlemock/libgmock.a)
++
++find_library(LIBGTEST "gtest")
++if(LIBGTEST)
++    set(LIBRARY_DEPENDENCIES
++        ${LIBRARY_DEPENDENCIES}
++       ${LIBGTEST}
++    )
++endif()
++
+ target_link_libraries(bpftrace_test ${CMAKE_THREAD_LIBS_INIT})
+ 
+ add_test(NAME bpftrace_test COMMAND bpftrace_test)
+-- 
+2.17.1
+
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index f4a728c9d25f..a5170edfa261 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.78";
+  version = "4.14.79";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0v2cwykgd2hxlqja4yl4pq45nhd5x8917ixqq7hj1r3ry304vnpl";
+    sha256 = "0flkkgfjzs6z7hkr15lga8jvxgwn6wi885yf5wyr0zxjrqg0f6an";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.18.nix b/pkgs/os-specific/linux/kernel/linux-4.18.nix
index d6c4b58b980a..add98cfb2faa 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.18.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.18.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.18.16";
+  version = "4.18.17";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1rjjkhl8lz4y4sn7icy8mp6p1x7rvapybp51p92sanbjy3i19fmy";
+    sha256 = "0353ns09i5y0fcygvly20z0qrp6gcqd453186ihm4r7ajgh43bz2";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 5aa033348d4e..d597818dab68 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19";
+  version = "4.19.1";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "18a92z17alh5kkvjv7l9z8wk5jgdb6raawdfkpwx9bi8amjzas0c";
+    sha256 = "0ac8w310p83z11ksmyad7by7cmacwg4vq68pzxchc88bbk33gmk4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-beagleboard.nix b/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
deleted file mode 100644
index e98104f11ca9..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-beagleboard.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{ stdenv, buildPackages, fetchFromGitHub, perl, buildLinux, ubootTools, dtc, ... } @ args:
-
-let
-  modDirVersion = "4.14.12";
-  tag = "r23";
-in
-stdenv.lib.overrideDerivation (buildLinux (args // rec {
-  version = "${modDirVersion}-ti-${tag}";
-  inherit modDirVersion;
-
-  src = fetchFromGitHub {
-    owner = "beagleboard";
-    repo = "linux";
-    rev = "${version}";
-    sha256 = "07hdv2h12gsgafxsqqr7b0fir10rv9k66riklpjba2cg6x0p2nr4";
-  };
-
-  kernelPatches = args.kernelPatches;
-
-  features = {
-    efiBootStub = false;
-  } // (args.features or {});
-
-  extraMeta.hydraPlatforms = [ "armv7l-linux" ];
-} // (args.argsOverride or {}))) (oldAttrs: {
-
-  # This kernel will run mkuboot.sh.
-  postPatch = ''
-    patchShebangs scripts/
-  '';
-
-  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ dtc ubootTools ];
-
-})
diff --git a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix b/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
deleted file mode 100644
index 0a936c6c053b..000000000000
--- a/pkgs/os-specific/linux/kernel/linux-samus-4.12.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{ stdenv, buildPackages, fetchFromGitHub, perl, buildLinux, ncurses, ... } @ args:
-
-buildLinux (args // rec {
-  version = "4.12.2";
-  extraMeta.branch = "4.12-2";
-
-  src =
-    let upstream = fetchFromGitHub {
-      owner = "raphael";
-      repo = "linux-samus";
-      rev = "v${extraMeta.branch}";
-      sha256 = "1dr74i79p8r13522w2ppi8gnjd9bhngc9d2hsn91ji6f5a8fbxx9";
-    }; in "${upstream}/build/linux";
-
-  extraMeta.platforms = [ "x86_64-linux" ];
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 44598588db9d..97e5b3aa70ad 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -19,10 +19,10 @@ rec {
   stable = if stdenv.hostPlatform.system == "x86_64-linux" then stable_410 else stable_390;
 
   stable_410 = generic {
-    version = "410.66";
-    sha256_64bit = "05xjzvj0fgmkpz36dbd7hy2vzl6xxiflzx7kml3k7ad9gy2svdlg";
-    settingsSha256 = "1nsxz1byshgjs3c03lyx6ya36dp0f2vg2l0d9pkh1i6cpzkp53kz";
-    persistencedSha256 = "0m4wdpb8w4y323d8py105p9hizwmf2ai8frkl7h77sn3ski17zw6";
+    version = "410.73";
+    sha256_64bit = "07pzq8rvbsx3v8rgz98amyw0k1mn5mkygpd1q5gfn6r0h7vrrg5y";
+    settingsSha256 = "19xc10b0c074wb9fv9n04dvmi8hrwl6srvvyrjfyj92gch49x6hw";
+    persistencedSha256 = "0vhr7pysv4vk7v96yima0i9zsvvgxaxihjzxlfifpsdki57n2jz7";
   };
 
   # Last one supporting x86
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 2a17a0a2875f..1d45109ac852 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchpatch, pkgconfig, intltool, gperf, libcap, kmod
+{ stdenv, lib, fetchFromGitHub, fetchpatch, fetchurl, pkgconfig, intltool, gperf, libcap, kmod
 , xz, pam, acl, libuuid, m4, utillinux, libffi
 , glib, kbd, libxslt, coreutils, libgcrypt, libgpgerror, libidn2, libapparmor
 , audit, lz4, bzip2, libmicrohttpd, pcre2
@@ -18,7 +18,7 @@ let
   pythonLxmlEnv = buildPackages.python3Packages.python.withPackages ( ps: with ps; [ python3Packages.lxml ]);
 
 in stdenv.mkDerivation rec {
-  version = "239.20181031";
+  version = "239";
   name = "systemd-${version}";
 
   # When updating, use https://github.com/systemd/systemd-stable tree, not the development one!
@@ -26,10 +26,26 @@ in stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "systemd";
-    rev = "nixos-v${version}";
-    sha256 = "1rzl0iqrpa4ajvama5k3cb3yc7893c55kzcxkl3cyavpdzsw5505";
+    rev = "31859ddd35fc3fa82a583744caa836d356c31d7f";
+    sha256 = "1xci0491j95vdjgs397n618zii3sgwnvanirkblqqw6bcvcjvir1";
   };
 
+  prePatch = let
+      # Upstream's maintenance branches are still too intrusive:
+      # https://github.com/systemd/systemd-stable/tree/v239-stable
+      patches-deb = fetchurl {
+        # When the URL disappears, it typically means that Debian has new patches
+        # (probably security) and updating to new tarball will apply them as well.
+        name = "systemd-debian-patches.tar.xz";
+        url = mirror://debian/pool/main/s/systemd/systemd_239-11~bpo9+1.debian.tar.xz;
+        sha256 = "136f6p4jbi4z94mf4g099dfcacwka8jwhza0wxxw2q5l5q3xiysh";
+      };
+      # Note that we skip debian-specific patches, i.e. ./debian/patches/debian/*
+    in ''
+      tar xf ${patches-deb}
+      patches="$patches $(cat debian/patches/series | grep -v '^debian/' | sed 's|^|debian/patches/|')"
+    '';
+
   outputs = [ "out" "lib" "man" "dev" ];
 
   nativeBuildInputs =
@@ -91,7 +107,6 @@ in stdenv.mkDerivation rec {
     "-Dsulogin-path=${utillinux}/bin/sulogin"
     "-Dmount-path=${utillinux}/bin/mount"
     "-Dumount-path=${utillinux}/bin/umount"
-    "-Ddns-over-tls=false"
   ];
 
   preConfigure = ''
diff --git a/pkgs/os-specific/linux/thunderbolt/default.nix b/pkgs/os-specific/linux/thunderbolt/default.nix
index ac687de8c9ab..faf47c96a5e6 100644
--- a/pkgs/os-specific/linux/thunderbolt/default.nix
+++ b/pkgs/os-specific/linux/thunderbolt/default.nix
@@ -16,22 +16,13 @@ stdenv.mkDerivation rec {
     sha256 = "02w1bfm7xvq0dzkhwqiq0camkzz9kvciyhnsis61c8vzp39cwx0x";
   };
 
-  buildInputs = [
-    boost
-    cmake
-    pkgconfig
-    txt2tags
-  ];
+  nativeBuildInputs = [ cmake pkgconfig txt2tags ];
+  buildInputs = [ boost ];
 
-  # These can't go in the normal nix cmakeFlags because $out needs to be
-  # expanded by the shell, not by cmake or nix.  $ENV{out} doesn't work right
-  # either; it results in /build/source/build//nix/store/blahblahblahblah/bin/
-  # TODO: use ${placeholder "out"} when possible.
-  #       See https://github.com/NixOS/nixpkgs/pull/37693
-  preConfigure = ''
-    cmakeFlags+=" -DUDEV_BIN_DIR=$out/bin"
-    cmakeFlags+=" -DUDEV_RULES_DIR=$out/etc/udev/rules.d"
-  '';
+  cmakeFlags = [
+    "-DUDEV_BIN_DIR=${placeholder "out"}/bin"
+    "-DUDEV_RULES_DIR=${placeholder "out"}/etc/udev/rules.d"
+  ];
 
   meta = {
     description = "Thunderbolt(TM) user-space components";