pkgs/misc/arm-trusted-firmware/default.nix

   1 { lib, stdenv, fetchFromGitHub, openssl, pkgsCross, buildPackages
   2
   3 # Warning: this blob (hdcp.bin) runs on the main CPU (not the GPU) at
   4 # privilege level EL3, which is above both the kernel and the
   5 # hypervisor.
   6 #
   7 # This parameter applies only to platforms which are believed to use
   8 # hdcp.bin. On all other platforms, or if unfreeIncludeHDCPBlob=false,
   9 # hdcp.bin will be deleted before building.
  10 , unfreeIncludeHDCPBlob ? true
  11 }:
  12
  13 let
  14   buildArmTrustedFirmware = { filesToInstall
  15             , installDir ? "$out"
  16             , platform ? null
  17             , platformCanUseHDCPBlob ? false  # set this to true if the platform is able to use hdcp.bin
  18             , extraMakeFlags ? []
  19             , extraMeta ? {}
  20             , ... } @ args:
  21
  22            # delete hdcp.bin if either: the platform is thought to
  23            # not need it or unfreeIncludeHDCPBlob is false
  24            let deleteHDCPBlobBeforeBuild = !platformCanUseHDCPBlob || !unfreeIncludeHDCPBlob; in
  25
  26            stdenv.mkDerivation (rec {
  27
  28     pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
  29     version = "2.9.0";
  30
  31     src = fetchFromGitHub {
  32       owner = "ARM-software";
  33       repo = "arm-trusted-firmware";
  34       rev = "v${version}";
  35       hash = "sha256-F7RNYNLh0ORzl5PmzRX9wGK8dZgUQVLKQg1M9oNd0pk=";
  36     };
  37
  38     patches = lib.optionals deleteHDCPBlobBeforeBuild [
  39       # this is a rebased version of https://gitlab.com/vicencb/kevinboot/-/blob/master/atf.patch
  40       ./remove-hdcp-blob.patch
  41     ];
  42
  43     postPatch = lib.optionalString deleteHDCPBlobBeforeBuild ''
  44       rm plat/rockchip/rk3399/drivers/dp/hdcp.bin
  45     '';
  46
  47     depsBuildBuild = [ buildPackages.stdenv.cc ];
  48
  49     # For Cortex-M0 firmware in RK3399
  50     nativeBuildInputs = [ pkgsCross.arm-embedded.stdenv.cc ];
  51
  52     buildInputs = [ openssl ];
  53
  54     makeFlags = [
  55       "HOSTCC=$(CC_FOR_BUILD)"
  56       "M0_CROSS_COMPILE=${pkgsCross.arm-embedded.stdenv.cc.targetPrefix}"
  57       "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
  58       # binutils 2.39 regression
  59       # `warning: /build/source/build/rk3399/release/bl31/bl31.elf has a LOAD segment with RWX permissions`
  60       # See also: https://developer.trustedfirmware.org/T996
  61       "LDFLAGS=-no-warn-rwx-segments"
  62     ] ++ (lib.optional (platform != null) "PLAT=${platform}")
  63       ++ extraMakeFlags;
  64
  65     installPhase = ''
  66       runHook preInstall
  67
  68       mkdir -p ${installDir}
  69       cp ${lib.concatStringsSep " " filesToInstall} ${installDir}
  70
  71       runHook postInstall
  72     '';
  73
  74     hardeningDisable = [ "all" ];
  75     dontStrip = true;
  76
  77     # Fatal error: can't create build/sun50iw1p1/release/bl31/sunxi_clocks.o: No such file or directory
  78     enableParallelBuilding = false;
  79
  80     meta = with lib; {
  81       homepage = "https://github.com/ARM-software/arm-trusted-firmware";
  82       description = "A reference implementation of secure world software for ARMv8-A";
  83       license = [ licenses.bsd3 ] ++ lib.optionals (!deleteHDCPBlobBeforeBuild) [ licenses.unfreeRedistributable ];
  84       maintainers = with maintainers; [ lopsided98 ];
  85     } // extraMeta;
  86   } // builtins.removeAttrs args [ "extraMeta" ]);
  87
  88 in {
  89   inherit buildArmTrustedFirmware;
  90
  91   armTrustedFirmwareTools = buildArmTrustedFirmware rec {
  92     # Normally, arm-trusted-firmware builds the build tools for buildPlatform
  93     # using CC_FOR_BUILD (or as it calls it HOSTCC). Since want to build them
  94     # for the hostPlatform here, we trick it by overriding the HOSTCC setting
  95     # and, to be safe, remove CC_FOR_BUILD from the environment.
  96     depsBuildBuild = [ ];
  97     extraMakeFlags = [
  98       "HOSTCC=${stdenv.cc.targetPrefix}gcc"
  99       "fiptool" "certtool"
 100     ];
 101     filesToInstall = [
 102       "tools/fiptool/fiptool"
 103       "tools/cert_create/cert_create"
 104     ];
 105     postInstall = ''
 106       mkdir -p "$out/bin"
 107       find "$out" -type f -executable -exec mv -t "$out/bin" {} +
 108     '';
 109   };
 110
 111   armTrustedFirmwareAllwinner = buildArmTrustedFirmware rec {
 112     platform = "sun50i_a64";
 113     extraMeta.platforms = ["aarch64-linux"];
 114     filesToInstall = ["build/${platform}/release/bl31.bin"];
 115   };
 116
 117   armTrustedFirmwareAllwinnerH616 = buildArmTrustedFirmware rec {
 118     platform = "sun50i_h616";
 119     extraMeta.platforms = ["aarch64-linux"];
 120     filesToInstall = ["build/${platform}/release/bl31.bin"];
 121   };
 122
 123   armTrustedFirmwareAllwinnerH6 = buildArmTrustedFirmware rec {
 124     platform = "sun50i_h6";
 125     extraMeta.platforms = ["aarch64-linux"];
 126     filesToInstall = ["build/${platform}/release/bl31.bin"];
 127   };
 128
 129   armTrustedFirmwareQemu = buildArmTrustedFirmware rec {
 130     platform = "qemu";
 131     extraMeta.platforms = ["aarch64-linux"];
 132     filesToInstall = [
 133       "build/${platform}/release/bl1.bin"
 134       "build/${platform}/release/bl2.bin"
 135       "build/${platform}/release/bl31.bin"
 136     ];
 137   };
 138
 139   armTrustedFirmwareRK3328 = buildArmTrustedFirmware rec {
 140     extraMakeFlags = [ "bl31" ];
 141     platform = "rk3328";
 142     extraMeta.platforms = ["aarch64-linux"];
 143     filesToInstall = [ "build/${platform}/release/bl31/bl31.elf"];
 144     platformCanUseHDCPBlob = true;
 145   };
 146
 147   armTrustedFirmwareRK3399 = buildArmTrustedFirmware rec {
 148     extraMakeFlags = [ "bl31" ];
 149     platform = "rk3399";
 150     extraMeta.platforms = ["aarch64-linux"];
 151     filesToInstall = [ "build/${platform}/release/bl31/bl31.elf"];
 152     platformCanUseHDCPBlob = true;
 153   };
 154
 155   armTrustedFirmwareS905 = buildArmTrustedFirmware rec {
 156     extraMakeFlags = [ "bl31" ];
 157     platform = "gxbb";
 158     extraMeta.platforms = ["aarch64-linux"];
 159     filesToInstall = [ "build/${platform}/release/bl31.bin"];
 160   };
 161 }