armTrustedFirmwareTools: 2.10.0 -> 2.12.0

[tlvince]

Bumps armTrustedFirmwareTools. Removes merged rk3588 override.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 25.05 Release Notes (or backporting 24.11 and 25.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[thefossguy]

The diff looked fine but none of the ATF targets I tried to build, build. The error message common across them is -x is not a recognized option by as.

       > as: unrecognized option '-x'                                                                                                                                     
       > make: *** [Makefile:1523: /build/source/build/sun50i_a64/release/libc/setjmp.o] Error 1
       For full logs, run 'nix log /nix/store/9v961hsc2m3nyzmsafp4kpqv5rz1aa9d-arm-trusted-firmware-sun50i_a64-2.12.0.drv'.

[thefossguy]

I think I found the "bad" commit:
ARM-software/arm-trusted-firmware@c8a992fda867f

[tlvince]

Strange. According to the tag list, that commit was also included in the previously packaged version in NixOS (2.10.0).

[thefossguy]

Please redact the previous comment. git-blame shows me this is the offending commit: ARM-software/arm-trusted-firmware@ffb7742. Given that I'm not familiar with this codebase, I am not aware of what an actual fix (which should be sent upstream) would look like.

[thefossguy]

Also tried building your patch on nixos-24.11 and nixos-24.05 assuming the recent GCC-14 bump might have something to do with it, but no; they all fail with the same error message. It's definitely an issue introduced by this commit.

[RadxaYuntian]

Search -x assembler-with-cpp in that commit and patch the usage with as?

[thefossguy]

cc: @lopsided98

[RadxaYuntian]

Tried to build ATF today. I think the issue is that the toolchain detection is pretty broken now. BTW I'm cross building right now, so issues might be different for native build/bin_fmt emulated build.

Here are the hacks I have applied so far just to investigate the build failure:

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: ZHANG Yuntian <[email protected]>
Date: Sun, 26 Jan 2025 17:53:39 +0800
Subject: [PATCH] HACK: build assembly with cc

Signed-off-by: ZHANG Yuntian <[email protected]>
---
 make_helpers/build_macros.mk | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/make_helpers/build_macros.mk b/make_helpers/build_macros.mk
index d454efd90..fcd6bcb1d 100644
--- a/make_helpers/build_macros.mk
+++ b/make_helpers/build_macros.mk
@@ -313,8 +313,8 @@ $(eval OBJ := $(1)/$(patsubst %.S,%.o,$(notdir $(2))))
 $(eval DEP := $(patsubst %.o,%.d,$(OBJ)))
 
 $(OBJ): $(2) $(filter-out %.d,$(MAKEFILE_LIST)) | $$$$(@D)/
-	$$(s)echo "  AS      $$<"
-	$$(q)$($(ARCH)-as) -x assembler-with-cpp $$(TF_CFLAGS_$(ARCH)) $$(ASFLAGS) $(MAKE_DEP) -c $$< -o $$@
+	$$(s)echo "  CC      $$<"
+	$$(q)$($(ARCH)-cc) -x assembler-with-cpp $$(TF_CFLAGS_$(ARCH)) $$(ASFLAGS) $(MAKE_DEP) -c $$< -o $$@
 
 -include $(DEP)
 
@@ -361,8 +361,8 @@ $(eval BL_CPPFLAGS := $($(4)_CPPFLAGS) $(addprefix -D,$(BL_DEFINES)) $(addprefix
 $(eval BL_ASFLAGS := $($(4)_ASFLAGS) $(PLAT_BL_COMMON_ASFLAGS))
 
 $(OBJ): $(2) $(filter-out %.d,$(MAKEFILE_LIST)) | $$$$(@D)/
-	$$(s)echo "  AS      $$<"
-	$$(q)$($(ARCH)-as) -x assembler-with-cpp $$(TF_CFLAGS_$(ARCH)) $$(ASFLAGS) $(BL_CPPFLAGS) $(BL_ASFLAGS) $(MAKE_DEP) -c $$< -o $$@
+	$$(s)echo "  CC      $$<"
+	$$(q)$($(ARCH)-cc) -x assembler-with-cpp $$(TF_CFLAGS_$(ARCH)) $$(ASFLAGS) $(BL_CPPFLAGS) $(BL_ASFLAGS) $(MAKE_DEP) -c $$< -o $$@
 
 -include $(DEP)
 
@@ -548,11 +548,11 @@ endif
 
 $(DUMP): $(ELF) | $$$$(@D)/
 	$$(s)echo "  OD      $$@"
-	$$(q)$($(ARCH)-od) -dx $$< > $$@
+	$$(q)aarch64-unknown-linux-gnu-$($(ARCH)-od) -dx $$< > $$@
 
 $(BIN): $(ELF) | $$$$(@D)/
 	$$(s)echo "  BIN     $$@"
-	$$(q)$($(ARCH)-oc) -O binary $$< $$@
+	$$(q)aarch64-unknown-linux-gnu-$($(ARCH)-oc) -O binary $$< $$@
 	$(s)echo
 	$(s)echo "Built $$@ successfully"
 	$(s)echo
-- 
2.48.1

Observed issues:

1. $(ARCH)-as was not provided by cc but actual as, so it cannot handle the cc specific flags: armTrustedFirmwareTools: 2.10.0 -> 2.12.0 #373685 (comment)
2. $(ARCH)-od and $(ARCH)-oc are host objdump and objcopy, no CROSS_COMPILE prefix applied, so they can't handle ARM binaries
3. If ENABLE_LTO is 1 (for example for armTrustedFirmwareAllwinner which uses sun50i_a64 ATF platform), then ld will faile with plugin needed to handle lto object
4. "LDFLAGS=-no-warn-rwx-segments" in makeFlags seems not working for RK3399 build, still getting arm-none-eabi-ld: warning: /build/source/build/rk3399/release/m0/rk3399m0.elf has a LOAD segment with RWX permissions (and $(rk3399-m0-oc) is also host objcopy so it actually failed here again)

A proper understanding of their build system is necessary.

[thefossguy]

Using the aarch64-unknown-linux-gnu- prefix for objdump and objcopy fails on aarch64-native compilation. Also, if we are overriding as with cc, following patch is how it should be done. Btw, it builds but haven't tested. Not sure if it will work.

diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
index f9d107f12ffa..bde5ec67cf6f 100644
--- a/pkgs/misc/arm-trusted-firmware/default.nix
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -26,13 +26,13 @@ let
            stdenv.mkDerivation (rec {
 
     pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}";
-    version = "2.10.0";
+    version = "2.12.0";
 
     src = fetchFromGitHub {
       owner = "ARM-software";
       repo = "arm-trusted-firmware";
       rev = "v${version}";
-      hash = "sha256-CAuftVST9Fje/DWaaoX0K2SfWwlGMaUFG4huuwsTOSU=";
+      hash = "sha256-PCUKLfmvIBiJqVmKSUKkNig1h44+4RypZ04BvJ+HP6M=";
     };
 
     patches = lib.optionals deleteHDCPBlobBeforeBuild [
@@ -52,6 +52,9 @@ let
     buildInputs = [ openssl ];
 
     makeFlags = [
+      "AS=$(CC_FOR_BUILD)"
+      "CC=$(CC_FOR_BUILD)"
+      "HOSTAS=$(CC_FOR_BUILD)"
       "HOSTCC=$(CC_FOR_BUILD)"
       "M0_CROSS_COMPILE=${pkgsCross.arm-embedded.stdenv.cc.targetPrefix}"
       "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
@@ -156,17 +159,6 @@ in {
     platform = "rk3588";
     extraMeta.platforms = ["aarch64-linux"];
     filesToInstall = [ "build/${platform}/release/bl31/bl31.elf"];
-
-    # TODO: remove this once the following get merged:
-    # 1: https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/21840
-    # 2: https://review.trustedfirmware.org/c/ci/tf-a-ci-scripts/+/21833
-    src = fetchFromGitLab {
-      domain = "gitlab.collabora.com";
-      owner = "hardware-enablement/rockchip-3588";
-      repo = "trusted-firmware-a";
-      rev = "002d8e85ce5f4f06ebc2c2c52b4923a514bfa701";
-      hash = "sha256-1XOG7ILIgWa3uXUmAh9WTfSGLD/76OsmWrUhIxm/zTg=";
-    };
   };
 
   armTrustedFirmwareS905 = buildArmTrustedFirmware rec {

[RadxaYuntian]

Using the aarch64-unknown-linux-gnu- prefix for objdump and objcopy fails on aarch64-native compilation.

It was not meant to be a final solution, but just checking if that's the only issue breaking the build.