gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

buildArmTrustedFirmware: use lib.extendMkDerivation (#437813)

Browse Source
This commit is contained in:
Jared Baur
2025-08-30 16:44:51 +01:00
committed by GitHub
parent e1b49d58a8 1898fb4be4
commit 4092d0555e
3 changed files with 178 additions and 173 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/misc/arm-trusted-firmware/build-arm-trusted-firmware.nix
+128
View File
@@ -0,0 +1,128 @@
{
buildPackages,
fetchFromGitHub,
lib,
openssl,
pkgsCross,
stdenv,
# Warning: this blob (hdcp.bin) runs on the main CPU (not the GPU) at
# privilege level EL3, which is above both the kernel and the
# hypervisor.
#
# This parameter applies only to platforms which are believed to use
# hdcp.bin. On all other platforms, or if unfreeIncludeHDCPBlob=false,
# hdcp.bin will be deleted before building.
unfreeIncludeHDCPBlob ? true,
}:
lib.extendMkDerivation {
constructDrv = stdenv.mkDerivation;
excludeDrvArgNames = [ "extraMeta" ];
extendDrvArgs =
finalAttrs:
{
filesToInstall,
installDir ? "$out",
platform ? null,
platformCanUseHDCPBlob ? false, # set this to true if the platform is able to use hdcp.bin
...
}@args:
# delete hdcp.bin if either: the platform is thought to
# not need it or unfreeIncludeHDCPBlob is false
let
deleteHDCPBlobBeforeBuild = !platformCanUseHDCPBlob || !unfreeIncludeHDCPBlob;
in
{
pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
version = args.version or "2.13.0";
src =
args.src or (fetchFromGitHub {
owner = "ARM-software";
repo = "arm-trusted-firmware";
tag = "v${finalAttrs.version}";
hash = "sha256-rxm5RCjT/MyMCTxiEC8jQeFMrCggrb2DRbs/qDPXb20=";
});
patches =
lib.optionals deleteHDCPBlobBeforeBuild [
# this is a rebased version of https://gitlab.com/vicencb/kevinboot/-/blob/master/atf.patch
./remove-hdcp-blob.patch
]
++ args.patches or [ ];
postPatch =
lib.optionalString deleteHDCPBlobBeforeBuild ''
rm plat/rockchip/rk3399/drivers/dp/hdcp.bin
''
+ args.postPatch or "";
depsBuildBuild = [ buildPackages.stdenv.cc ] ++ args.depsBuildBuild or [ ];
nativeBuildInputs = [
pkgsCross.arm-embedded.stdenv.cc # For Cortex-M0 firmware in RK3399
openssl # For fiptool
]
++ args.nativeBuildInputs or [ ];
# Make the new toolchain guessing (from 2.11+) happy
# https://github.com/ARM-software/arm-trusted-firmware/blob/4ec2948fe3f65dba2f19e691e702f7de2949179c/make_helpers/toolchains/rk3399-m0.mk#L21-L22
rk3399-m0-oc = "${pkgsCross.arm-embedded.stdenv.cc.targetPrefix}objcopy";
buildInputs = [ openssl ] ++ args.buildInputs or [ ];
makeFlags = [
"HOSTCC=$(CC_FOR_BUILD)"
"M0_CROSS_COMPILE=${pkgsCross.arm-embedded.stdenv.cc.targetPrefix}"
"CROSS_COMPILE=${stdenv.cc.targetPrefix}"
# Make the new toolchain guessing (from 2.11+) happy
"CC=${stdenv.cc.targetPrefix}cc"
"LD=${stdenv.cc.targetPrefix}cc"
"AS=${stdenv.cc.targetPrefix}cc"
"OC=${stdenv.cc.targetPrefix}objcopy"
"OD=${stdenv.cc.targetPrefix}objdump"
# Passing OpenSSL path according to docs/design/trusted-board-boot-build.rst
"OPENSSL_DIR=${openssl}"
]
++ (lib.optional (platform != null) "PLAT=${platform}")
++ args.makeFlags or [ ]
++ (lib.warnIf (args ? extraMakeFlags)
"buildArmTrustedFirmware now accepts `makeFlags`, please switch from using `extraMakeFlags` to `makeFlags`"
args.extraMakeFlags or [ ]
);
installPhase = ''
runHook preInstall
mkdir -p ${installDir}
cp ${lib.concatStringsSep " " filesToInstall} ${installDir}
runHook postInstall
'';
hardeningDisable = [ "all" ];
dontStrip = true;
# breaks secondary CPU bringup on at least RK3588, maybe others
env.NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
meta = {
homepage = "https://github.com/ARM-software/arm-trusted-firmware";
description = "Reference implementation of secure world software for ARMv8-A";
license = [
lib.licenses.bsd3
]
++ lib.optionals (!deleteHDCPBlobBeforeBuild) [ lib.licenses.unfreeRedistributable ];
maintainers = [ lib.maintainers.lopsided98 ];
}
// (args.meta or { })
// (lib.warnIf (args ? extraMeta)
"buildArmTrustedFirmware now accepts `meta`, please switch from using `extraMeta` to `meta`"
args.extraMeta or { }
);
};
}
pkgs/misc/arm-trusted-firmware/default.nix
+46 -172
View File
@@ -1,134 +1,8 @@
{ buildArmTrustedFirmware, stdenv }:
{
lib,
stdenv,
fetchFromGitHub,
fetchFromGitLab,
openssl,
pkgsCross,
buildPackages,
# Warning: this blob (hdcp.bin) runs on the main CPU (not the GPU) at
# privilege level EL3, which is above both the kernel and the
# hypervisor.
#
# This parameter applies only to platforms which are believed to use
# hdcp.bin. On all other platforms, or if unfreeIncludeHDCPBlob=false,
# hdcp.bin will be deleted before building.
unfreeIncludeHDCPBlob ? true,
}:
let
buildArmTrustedFirmware = lib.makeOverridable (
{
filesToInstall,
installDir ? "$out",
platform ? null,
platformCanUseHDCPBlob ? false, # set this to true if the platform is able to use hdcp.bin
extraMakeFlags ? [ ],
extraMeta ? { },
...
}@args:
# delete hdcp.bin if either: the platform is thought to
# not need it or unfreeIncludeHDCPBlob is false
let
deleteHDCPBlobBeforeBuild = !platformCanUseHDCPBlob || !unfreeIncludeHDCPBlob;
in
stdenv.mkDerivation (
rec {
pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
version = "2.13.0";
src = fetchFromGitHub {
owner = "ARM-software";
repo = "arm-trusted-firmware";
tag = "v${version}";
hash = "sha256-rxm5RCjT/MyMCTxiEC8jQeFMrCggrb2DRbs/qDPXb20=";
};
patches = lib.optionals deleteHDCPBlobBeforeBuild [
# this is a rebased version of https://gitlab.com/vicencb/kevinboot/-/blob/master/atf.patch
./remove-hdcp-blob.patch
];
postPatch = lib.optionalString deleteHDCPBlobBeforeBuild ''
rm plat/rockchip/rk3399/drivers/dp/hdcp.bin
'';
depsBuildBuild = [ buildPackages.stdenv.cc ];
nativeBuildInputs = [
pkgsCross.arm-embedded.stdenv.cc # For Cortex-M0 firmware in RK3399
openssl # For fiptool
];
# Make the new toolchain guessing (from 2.11+) happy
# https://github.com/ARM-software/arm-trusted-firmware/blob/4ec2948fe3f65dba2f19e691e702f7de2949179c/make_helpers/toolchains/rk3399-m0.mk#L21-L22
rk3399-m0-oc = "${pkgsCross.arm-embedded.stdenv.cc.targetPrefix}objcopy";
buildInputs = [ openssl ];
makeFlags = [
"HOSTCC=$(CC_FOR_BUILD)"
"M0_CROSS_COMPILE=${pkgsCross.arm-embedded.stdenv.cc.targetPrefix}"
"CROSS_COMPILE=${stdenv.cc.targetPrefix}"
# Make the new toolchain guessing (from 2.11+) happy
"CC=${stdenv.cc.targetPrefix}cc"
"LD=${stdenv.cc.targetPrefix}cc"
"AS=${stdenv.cc.targetPrefix}cc"
"OC=${stdenv.cc.targetPrefix}objcopy"
"OD=${stdenv.cc.targetPrefix}objdump"
# Passing OpenSSL path according to docs/design/trusted-board-boot-build.rst
"OPENSSL_DIR=${openssl}"
]
++ (lib.optional (platform != null) "PLAT=${platform}")
++ extraMakeFlags;
installPhase = ''
runHook preInstall
mkdir -p ${installDir}
cp ${lib.concatStringsSep " " filesToInstall} ${installDir}
runHook postInstall
'';
hardeningDisable = [ "all" ];
dontStrip = true;
# breaks secondary CPU bringup on at least RK3588, maybe others
env.NIX_CFLAGS_COMPILE = "-fomit-frame-pointer";
meta =
with lib;
{
homepage = "https://github.com/ARM-software/arm-trusted-firmware";
description = "Reference implementation of secure world software for ARMv8-A";
license = [
licenses.bsd3
]
++ lib.optionals (!deleteHDCPBlobBeforeBuild) [ licenses.unfreeRedistributable ];
maintainers = with maintainers; [ lopsided98 ];
}
// extraMeta;
}
// builtins.removeAttrs args [ "extraMeta" ]
)
);
in
{
inherit buildArmTrustedFirmware;
armTrustedFirmwareTools = buildArmTrustedFirmware {
# Normally, arm-trusted-firmware builds the build tools for buildPlatform
# using CC_FOR_BUILD (or as it calls it HOSTCC). Since want to build them
# for the hostPlatform here, we trick it by overriding the HOSTCC setting
# and, to be safe, remove CC_FOR_BUILD from the environment.
depsBuildBuild = [ ];
extraMakeFlags = [
makeFlags = [
"HOSTCC=${stdenv.cc.targetPrefix}gcc"
"fiptool"
"certtool"
@@ -143,67 +17,67 @@ in
'';
};
armTrustedFirmwareAllwinner = buildArmTrustedFirmware rec {
armTrustedFirmwareAllwinner = buildArmTrustedFirmware (finalAttrs: {
platform = "sun50i_a64";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${platform}/release/bl31.bin" ];
};
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${finalAttrs.platform}/release/bl31.bin" ];
});
armTrustedFirmwareAllwinnerH616 = buildArmTrustedFirmware rec {
armTrustedFirmwareAllwinnerH616 = buildArmTrustedFirmware (finalAttrs: {
platform = "sun50i_h616";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${platform}/release/bl31.bin" ];
};
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${finalAttrs.platform}/release/bl31.bin" ];
});
armTrustedFirmwareAllwinnerH6 = buildArmTrustedFirmware rec {
armTrustedFirmwareAllwinnerH6 = buildArmTrustedFirmware (finalAttrs: {
platform = "sun50i_h6";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${platform}/release/bl31.bin" ];
};
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${finalAttrs.platform}/release/bl31.bin" ];
});
armTrustedFirmwareQemu = buildArmTrustedFirmware rec {
armTrustedFirmwareQemu = buildArmTrustedFirmware (finalAttrs: {
platform = "qemu";
extraMeta.platforms = [ "aarch64-linux" ];
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [
"build/${platform}/release/bl1.bin"
"build/${platform}/release/bl2.bin"
"build/${platform}/release/bl31.bin"
"build/${finalAttrs.platform}/release/bl1.bin"
"build/${finalAttrs.platform}/release/bl2.bin"
"build/${finalAttrs.platform}/release/bl31.bin"
];
};
});
armTrustedFirmwareRK3328 = buildArmTrustedFirmware rec {
extraMakeFlags = [ "bl31" ];
armTrustedFirmwareRK3328 = buildArmTrustedFirmware (finalAttrs: {
makeFlags = [ "bl31" ];
platform = "rk3328";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${platform}/release/bl31/bl31.elf" ];
};
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${finalAttrs.platform}/release/bl31/bl31.elf" ];
});
armTrustedFirmwareRK3399 = buildArmTrustedFirmware rec {
extraMakeFlags = [ "bl31" ];
armTrustedFirmwareRK3399 = buildArmTrustedFirmware (finalAttrs: {
makeFlags = [ "bl31" ];
platform = "rk3399";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${platform}/release/bl31/bl31.elf" ];
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${finalAttrs.platform}/release/bl31/bl31.elf" ];
platformCanUseHDCPBlob = true;
};
});
armTrustedFirmwareRK3568 = buildArmTrustedFirmware rec {
extraMakeFlags = [ "bl31" ];
armTrustedFirmwareRK3568 = buildArmTrustedFirmware (finalAttrs: {
makeFlags = [ "bl31" ];
platform = "rk3568";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${platform}/release/bl31/bl31.elf" ];
};
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${finalAttrs.platform}/release/bl31/bl31.elf" ];
});
armTrustedFirmwareRK3588 = buildArmTrustedFirmware rec {
extraMakeFlags = [ "bl31" ];
armTrustedFirmwareRK3588 = buildArmTrustedFirmware (finalAttrs: {
makeFlags = [ "bl31" ];
platform = "rk3588";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${platform}/release/bl31/bl31.elf" ];
};
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${finalAttrs.platform}/release/bl31/bl31.elf" ];
});
armTrustedFirmwareS905 = buildArmTrustedFirmware rec {
extraMakeFlags = [ "bl31" ];
armTrustedFirmwareS905 = buildArmTrustedFirmware (finalAttrs: {
makeFlags = [ "bl31" ];
platform = "gxbb";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${platform}/release/bl31.bin" ];
};
meta.platforms = [ "aarch64-linux" ];
filesToInstall = [ "build/${finalAttrs.platform}/release/bl31.bin" ];
});
}
pkgs/top-level/all-packages.nix
+4 -1
View File
@@ -10377,9 +10377,12 @@ with pkgs;
fftw = fftwFloat;
};
buildArmTrustedFirmware =
callPackage ../misc/arm-trusted-firmware/build-arm-trusted-firmware.nix
{ };
arm-trusted-firmware = callPackage ../misc/arm-trusted-firmware { };
inherit (arm-trusted-firmware)
buildArmTrustedFirmware
armTrustedFirmwareTools
armTrustedFirmwareAllwinner
armTrustedFirmwareAllwinnerH616