rpi5: uefi & arm-tf current packaging state

[skip-ci arm64]

nixos/akamanto/default.nix

@@ -56,7 +56,7 @@ in {
         echo ''${path/\/nix\/store\/}
       }
 
-      cp ${pkgs.rpi5-uefi}/boot/* firmware
+      cp ${pkgs.rpi5-uefi-bin}/boot/* firmware
 
       mkdir -p firmware/EFI/nixos
       touch firmware/EFI/nixos-sd-system-image
@@ -237,6 +237,8 @@ in {
       bluez
       pipewire
       (v4l-utils.override { withGUI = false; })
+      
+      rpi5-arm-tf
     ];
   programs.nix-index.enable = lib.mkForce false;
   services.journald.extraConfig = ''

overlays/rpi5.nix

@@ -8,6 +8,8 @@ self: super: rec {
   };
 
   linuxPackages_rpi5 = self.linuxPackagesFor linux_rpi5;
-  
+
+  rpi5-arm-tf = self.callPackage ../pkgs/rpi5-arm-tf.nix { };
   rpi5-uefi = self.callPackage ../pkgs/rpi5-uefi.nix { };
+  rpi5-uefi-bin = self.callPackage ../pkgs/rpi5-uefi-bin.nix { };
 }

pkgs/rpi5-arm-tf.nix

@@ -0,0 +1,55 @@
+{ lib, stdenv, fetchFromGitHub, runCommand, buildPackages, pkgsCross, openssl }:
+
+stdenv.mkDerivation rec {
+  name = "arm-trusted-firmware-rpi5";
+  version = "20240316";
+  
+  # src = fetchFromGitHub {
+  #   owner = "worproject";
+  #   repo = "rpi5-uefi";
+  #   rev = "c1ca184c608dca75a346cc56b8eaf42648d83e86";
+  #   fetchSubmodules = true;
+  #   hash = "sha256-mGMqgJXsEFq79aHes8HUGcKrfbGjeAHTA/xzbq5qURs=";
+  # };
+  
+  src = fetchFromGitHub {
+    owner = "worproject";
+    repo = "arm-trusted-firmware";
+    rev = "682607fbd775e37fb5631508434dab9e60220c9a";
+    hash = "sha256-Kdn9xJtHhwxvqpzC6osW2xWdZrlOmowaxBLPYGmtHYQ=";
+  };
+  
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  nativeBuildInputs = [ pkgsCross.arm-embedded.stdenv.cc ];
+
+  makeFlags = [
+    "HOSTCC=$(CC_FOR_BUILD)"
+    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+    # binutils 2.39 regression
+    # `warning: /build/source/build/rk3399/release/bl31/bl31.elf has a LOAD segment with RWX permissions`
+    # See also: https://developer.trustedfirmware.org/T996
+    "LDFLAGS=-no-warn-rwx-segments"
+
+    "PLAT=rpi5"
+    "PRELOADED_BL33_BASE=0x20000"
+    "RPI3_PRELOADED_DTB_BASE=0x1F0000"
+    "SUPPORT_VFP=1"
+    "SMC_PCI_SUPPORT=1"
+  ];
+  
+  filesToInstall = [
+    "build/rpi5/release"
+  ];
+  
+  installPhase = ''
+    runHook preInstall
+    
+    mkdir -p $out
+    cp -r ${lib.concatStringsSep " " filesToInstall} $out
+    
+    runHook postInstall
+  '';
+
+  hardeningDisable = [ "all" ];
+  dontStrip = true;
+}

pkgs/rpi5-uefi-bin.nix

@@ -0,0 +1,28 @@
+{ stdenv, lib, fetchzip }:
+
+let
+  version = "v0.3";
+in
+stdenv.mkDerivation {
+  pname = "rpi5-uefi";
+  version = version;
+  
+  src = fetchzip {
+    url = "https://github.com/worproject/rpi5-uefi/releases/download/${version}/RPi5_UEFI_Release_${version}.zip";
+    sha256 = "sha256-bjEvq7KlEFANnFVL0LyexXEeoXj7rHGnwQpq09PhIb0=";
+    stripRoot = false;
+  };
+  
+  installPhase = ''
+    runHook preInstall
+    
+    mkdir -p $out/boot
+    mv ./* $out/boot
+    
+    runHook postInstall
+  '';
+  
+  meta = with lib; {
+    description = "EDK2 port for raspberry pi 5";
+  };
+}

pkgs/rpi5-uefi.nix

@@ -1,28 +1,6 @@
-{ stdenv, lib, fetchzip }:
+{ lib, stdenv, fetchFromGitHub, fetchFromGitLab, openssl, pkgsCross, buildPackages }:
 
 let
-  version = "v0.3";
 in
 stdenv.mkDerivation {
-  pname = "rpi5-uefi";
-  version = version;
-  
-  src = fetchzip {
-    url = "https://github.com/worproject/rpi5-uefi/releases/download/${version}/RPi5_UEFI_Release_${version}.zip";
-    sha256 = "sha256-bjEvq7KlEFANnFVL0LyexXEeoXj7rHGnwQpq09PhIb0=";
-    stripRoot = false;
-  };
-  
-  installPhase = ''
-    runHook preInstall
-    
-    mkdir -p $out/boot
-    mv ./* $out/boot
-    
-    runHook postInstall
-  '';
-  
-  meta = with lib; {
-    description = "EDK2 port for raspberry pi 5";
-  };
 }