Motivation for this change

This adds support for the ODROID-C2 to U-Boot in nixpkgs. It minimizes the use of binary blobs and vendor tools. It has been tested in combination with mainline Linux 5.4.1.

The Amlogic S905 uses 5 bootloader stages. The first (bl1.bin.hardkernel) is partially placed in the MBR bootstrap code area and partially in the sector after the MBR. The rest of the stages are stored in a FIP image placed at sector 97. bl30.bin and bl301.bin are binary blobs (sources are technically available for bl301.bin, but building them is more trouble than it's worth). The other two images are ATF and U-Boot, both of which have upstream support for the SoC/board.

Hardkernel's U-Boot tree has a custom version of the fip_create tool taken from ATF. It was modified to add padding to the BL301 image (to make room for a signature) and place the BL301 image between BL30 and BL31 (ATF) with a custom UUID. BL301 needs to be signed by the aml_encrypt_gxb tool which is only provided as a binary for x86_64-linux.

Upstream ATF has replaced fip_create with fiptool. It is possible to add images with custom UUIDs using fiptool, but they are always added to the end of the file. This is a problem because the bootloader blob responsible for loading the FIP only looks at the order of the images, not their UUIDs. fiptool can be patched to place the BL301 image at the right position, but it turns out that this is not really necessary. Since the bootloader doesn't care about UUIDs, we can simply put the images in the right order with the wrong UUIDs using an unmodified fiptool. See afaerber/meson-tools#3 for more information.

The meson-tools project contains a reverse engineered version of aml_encrypt_gxb, which can be used instead.

There is an opportunity for bikeshedding here: what should the ATF package be called?

• armTrustedFirmwareS905
• armTrustedFirmwareAmlogicS905
• armTrustedFirmwareMesonGxbb

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nix-review --run "nix-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

Notify maintainers

cc @samueldr @dezgeg @grahamc