Merge remote-tracking branch 'public/master' into jp514

device-pkgs/default.nix

@@ -53,27 +53,27 @@ let
   };
 
   # Produces a script that boots a given kernel, initrd, and cmdline using the RCM boot method
-  mkRcmBootScript = { kernelPath, initrdPath, kernelCmdline }: mkFlashScriptAuto {
-    preFlashCommands = ''
-      cp ${kernelPath} kernel/Image
-      cp ${initrdPath} bootloader/l4t_initrd.img
+  mkRcmBootScript = { kernelPath, initrdPath, kernelCmdline, ... }@args: mkFlashScriptAuto (
+    builtins.removeAttrs args [ "kernelPath" "initrdPath" "kernelCmdline" ] // {
+      preFlashCommands = ''
+        cp ${kernelPath} kernel/Image
+        cp ${initrdPath} bootloader/l4t_initrd.img
 
-      export CMDLINE="${builtins.toString kernelCmdline}"
-      export INITRD_IN_BOOTIMG="yes"
-    '';
-    flashArgs = [ "--rcm-boot" ] ++ cfg.flashScriptOverrides.flashArgs;
-  };
+        export CMDLINE="${builtins.toString kernelCmdline}"
+        export INITRD_IN_BOOTIMG="yes"
+      '';
+      flashArgs = [ "--rcm-boot" ] ++ cfg.flashScriptOverrides.flashArgs;
+    }
+  );
 
   # Produces a script which boots into this NixOS system via RCM mode
-  # TODO: This doesn't work currently because `rcmBoot` would need to be built
-  # on x86_64, and the machine in `config` should be aarch64-linux
   rcmBoot = writeShellApplication {
     name = "rcmboot-nixos";
     text = mkRcmBootScript {
       # See nixpkgs nixos/modules/system/activatation/top-level.nix for standard usage of these paths
       kernelPath = "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
       initrdPath = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
-      kernelCmdline = "init=${config.system.build.toplevel}/init initrd=initrd ${toString config.boot.kernelParams}";
+      kernelCmdline = "init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}";
     };
     meta.platforms = [ "x86_64-linux" ];
   };
@@ -86,7 +86,20 @@ let
         ${mkRcmBootScript {
           kernelPath = "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
           initrdPath = "${flashInitrd}/initrd";
-          kernelCmdline = "initrd=initrd console=ttyTCU0,115200";
+          kernelCmdline = "console=ttyTCU0,115200";
+          # During the initrd flash script, we upload two edk2 builds to the
+          # board, one that is only used temporarily to boot into our
+          # kernel/initrd to perform the flashing, and another one that is
+          # persisted to the firmware storage medium for future booting. We
+          # don't want to influence the boot order of the temporary edk2 since
+          # this may cause that edk2 to boot from something other than our
+          # intended flashing kernel/initrd combo (e.g. disk or network). Since
+          # the edk2 build that we actually persist to the board is embedded in
+          # the initrd used for flashing, we have the desired boot order (as
+          # configured in nix) in there and is not affected dynamically during
+          # the flashing procedure. NVIDIA ensures that when the device is
+          # using RCM boot, only the boot mode named "boot.img" is used (see https://gist.github.com/jmbaur/1ca79436e69eadc0a38ec0b43b16cb2f#file-flash-sh-L1675).
+          additionalDtbOverlays = lib.filter (path: (path.name or "") != "DefaultBootOrder.dtbo") cfg.flashScriptOverrides.additionalDtbOverlays;
         }}
         echo
         echo "Jetson device should now be flashing and will reboot when complete."

flake.nix

@@ -7,6 +7,12 @@
     let
       inherit (nixpkgs) lib;
 
+      allSystems = [ "x86_64-linux" "aarch64-linux" ];
+      forAllSystems = f: nixpkgs.lib.genAttrs allSystems (system: f {
+        pkgs = nixpkgs.legacyPackages.${system};
+        inherit system;
+      });
+
       installer_minimal_config = {
         imports = [
           "${nixpkgs}/nixos/modules/installer/cd-dvd/installation-cd-minimal.nix"
@@ -77,14 +83,16 @@
         };
       };
 
-      checks = nixpkgs.lib.mapAttrs
-        (system: _: {
-          formatting = nixpkgs.legacyPackages.${system}.callPackage ./ci/formatting.nix { };
-        })
-        self.legacyPackages;
+      checks = forAllSystems ({ pkgs, ... }: {
+        formatting = pkgs.runCommand "repo-formatting" { nativeBuildInputs = with pkgs; [ nixpkgs-fmt ]; } ''
+          nixpkgs-fmt --check ${self} && touch $out
+        '';
+      });
+
+      formatter = forAllSystems ({ pkgs, ... }: pkgs.nixpkgs-fmt);
 
-      # Not everything here should be cross-compiled to aarch64-linux
-      legacyPackages.x86_64-linux = (import nixpkgs { system = "x86_64-linux"; overlays = [ self.overlays.default ]; }).nvidia-jetpack;
-      legacyPackages.aarch64-linux = (import nixpkgs { system = "aarch64-linux"; overlays = [ self.overlays.default ]; }).nvidia-jetpack;
+      legacyPackages = forAllSystems ({ system, ... }:
+        (import nixpkgs { inherit system; overlays = [ self.overlays.default ]; }).nvidia-jetpack
+      );
     };
 }

overlay-with-config.nix

@@ -107,11 +107,12 @@ final: prev: (
       mkFlashScript = flash-tools: args: import ./device-pkgs/flash-script.nix ({
         inherit lib flash-tools;
         inherit (cfg.firmware) eksFile;
-        inherit (cfg.flashScriptOverrides) additionalDtbOverlays flashArgs partitionTemplate;
+        inherit (cfg.flashScriptOverrides) flashArgs partitionTemplate;
         inherit (finalJetpack) tosImage socType uefi-firmware;
 
+        additionalDtbOverlays = args.additionalDtbOverlays or cfg.flashScriptOverrides.additionalDtbOverlays;
         dtbsDir = config.hardware.deviceTree.package;
-      } // args);
+      } // (builtins.removeAttrs args [ "additionalDtbOverlays" ]));
 
       bup = prev.runCommand "bup-${config.networking.hostName}-${finalJetpack.l4tVersion}"
         {

overlay.nix

@@ -68,6 +68,7 @@ in
       stdenv = prev.gcc9Stdenv;
       inherit (self) bspSrc gitRepos l4tVersion;
     }) buildTOS buildOpteeTaDevKit opteeClient;
+    genEkb = self.callPackage ./pkgs/optee/gen-ekb.nix { };
 
     flash-tools = self.callPackage ./pkgs/flash-tools { };
 

pkgs/flash-tools/default.nix

@@ -29,7 +29,7 @@
 , openssl
 , bspSrc
 , l4tVersion
-,
+, symlinkJoin
 }:
 
 let
@@ -121,13 +121,22 @@ let
       python3
       util-linux
       dosfstools
-      lz4
       bc
       openssl
 
       # Needed by bootloader/tegraflash_impl_t234.py
       gcc
       dtc
+
+      # flash.sh wants lz4c, which used to be a symlink to lz4, but does not
+      # exist in more recent nixpkgs.
+      (symlinkJoin {
+        inherit (lz4) name;
+        paths = [ (lib.getBin lz4) ];
+        postBuild = ''
+          ln -sf $out/bin/lz4{,c}
+        '';
+      })
     ];
   };
 

pkgs/optee/gen-ekb.nix

@@ -0,0 +1,21 @@
+{ gitRepos, l4tVersion, stdenv, python3 }:
+
+stdenv.mkDerivation {
+  pname = "gen_ekb.py";
+  src = gitRepos."tegra/optee-src/nv-optee";
+  version = l4tVersion;
+  dontBuild = true;
+  buildInputs = [
+    (python3.withPackages (p: with p; [
+      cryptography
+      pycryptodome
+    ]))
+  ];
+  installPhase = ''
+    runHook preInstall
+    install -D optee/samples/hwkey-agent/host/tool/gen_ekb/gen_ekb.py \
+      $out/bin/gen_ekb.py
+    patchShebangs --host $out/bin/gen_ekb.py
+    runHook postInstall
+  '';
+}