genio/radxa-nio-12l: OPTEE/u-boot/TF-A/FIP bootloader + EXT=mtkflash + fixes

config/boards/radxa-nio-12l.conf

@@ -5,7 +5,41 @@ BOARDFAMILY="genio"
 BOARD_MAINTAINER="HeyMeco"
 KERNEL_TARGET="collabora"
 KERNEL_TEST_TARGET="collabora"
-BOOT_FDT_FILE="mediatek/mt8395-radxa-nio-12l.dtb"
+BOOT_FDT_FILE="mediatek/mt8395-radxa-nio-12l.dtb" # automatically patched by u-boot with autodetected memory size
 SERIALCON="ttyS0:921600"
+SRC_CMDLINE="splash plymouth.ignore-serial-consoles console=ttyS0,921600 console=tty0" # for extlinux/EXT=u-boot-menu
 HAS_VIDEO_OUTPUT="yes"
 declare -g BOARD_FIRMWARE_INSTALL="-full"
+declare -g BOOTCONFIG="genio_1200_radxa_nio_12l_d8_defconfig" # d4/d8/d16 are irrelevant, since we've patches to autodetect, for both u-boot and kernel
+declare -g BOOT_SOC="mt8395"                                  # the NIO-12L is a MT8395, but everything is named mt8195 in OPTEE/TF-A/Libbase/etc.
+declare -g MEDIATEK_GENIO_SOC_PLATFORM="mt8195"               # The actual PLAT= for TF-A, libbase, etc.
+# blobs live at https://github.com/armbian/mtkbin/tree/main/radxa-nio-12l
+
+# Important: we change u-boot's env offset to half-way through the UFS LUN, so we don't conflict or inherit env from
+#            vendor or Collabora version of u-boot, in case the user had ran `saveenv` previously. It would conflict
+#            with Armbian's version ("env default -f -a" to clean), which boots OS from SD cards first, Eth last, etc.
+function post_config_uboot_target__nio_12l_armbian_specific_environment_location() {
+	display_alert "u-boot for ${BOARD}/${BRANCH}" "u-boot: board-specific configs" "info"
+	run_host_command_logged scripts/config --set-val CONFIG_ENV_OFFSET "0x200000"
+
+	display_alert "u-boot for ${BOARD}/${BRANCH}" "u-boot: extra cmdline commands" "info"
+	run_host_command_logged scripts/config --enable CONFIG_CMD_ITEST   # itest expects integers on both sides, whereas regular test assumes strings
+	run_host_command_logged scripts/config --enable CONFIG_CMD_BOOTZ   # bootz allows booting zImages
+	run_host_command_logged scripts/config --enable CONFIG_CMD_MEMINFO # meminfo shows memory info in u-boot
+	run_host_command_logged scripts/config --enable CONFIG_CMD_SETEXPR # setexpr allows arithmetic expressions in setenv
+}
+
+# Include fw_setenv, configured to point to the correct spot on the UFS LUN number
+declare -g PACKAGE_LIST_BOARD="libubootenv-tool" # libubootenv-tool provides fw_printenv and fw_setenv, for talking to U-Boot environment
+function post_family_tweaks__config_radxa_nio_12l_fwenv() {
+	display_alert "Configuring fw_printenv and fw_setenv" "for ${BOARD}" "info"
+	# Addresses below come from CONFIG_ENV_OFFSET and CONFIG_ENV_SIZE in defconfig
+	cat <<- 'FW_ENV_CONFIG' > "${SDCARD}"/etc/fw_env.config
+		# UFS LUN 2 (scsi 1 in u-boot) u-boot env for the ${BOARD_NAME}
+		# The correct way to access the device would be /dev/disk/by-path/platform-11270000.ufshci-scsi-0:0:0:1
+		#   but unfortunately libubootenv-tool can't handle the colons in that path; so use /dev/sdb instead
+		# ATTENTION: Offset is set to 0x200000 to avoid conflict with Collabora/vendor build u-boot env area
+		# Device name    Device offset Env. size Flash sector size Number of sectors
+		/dev/sdb         0x200000      0x2000
+	FW_ENV_CONFIG
+}

config/bootscripts/boot-genio.cmd

@@ -13,14 +13,35 @@ setenv rootfstype "ext4"
 setenv docker_optimizations "on"
 setenv earlycon "off"
 
-# Set load address for temporary file loading (armbianEnv.txt, overlays, etc)
-# Using address that doesn't conflict with kernel (0x45000000) Note: on Arm64 it has to be 2mb aligned
-# Ramdisk (0x49000000),
-# or fdt (0x44000000)
+# U-Boot memory layout
+# ATTENTION: all hex references have to be quoted, even in comments, otherwise mkimage produces invalid .scr
+# Note: on arm64 must be 2mb aligned
+# Reserved areas:
+# low RAM "0x43200000" "0x43DFFFFF"
+# mid RAM "0x54600000" "0x547FFFFF"
+# mid RAM "0x60000000" "0x61FFFFFF"
+# Thus addresses using estimated max sizes
+
+# Script/load address (boot scripts, small)
+# "0x43000000" = 1,116,277,120 bytes = ~1 MB
+# Important: the u-boot standard is "loadaddr" (CONFIG_SYS_TEXT_BASE=="0x4c000000"), "not load_addr" - used specifically on below script
 setenv load_addr "0x43000000"
 
-# Move ramdisk further away to avoid kernel overwrite (176MB space for kernel)
-setenv ramdisk_addr_r "0x50000000"
+# FDT address (device tree, small)
+# "0x56000000" = 1,436,207,360 bytes = ~2 MB
+setenv fdt_addr_r "0x56000000"
+
+# Kernel load address (100 MB)
+# "0x40000000" - "0x46400000"
+# 1,073,741,824 - 1,173,637,760 bytes = 100 MB
+setenv kernel_addr_r "0x40000000"
+
+# Initramfs load address (500 MB)
+# "0x64000000" - "0x83800000"
+# 1,677,721,600 - 2,177,441,600 bytes = 500 MB
+# Positioned in high RAM to avoid reserved hole
+setenv ramdisk_addr_r "0x64000000"
+
 
 test -n "${distro_bootpart}" || distro_bootpart=1
 
@@ -57,12 +78,6 @@ fi
 
 echo "Final rootdev: ${rootdev}"
 
-if test "${bootlogo}" = "true" ; then
-	setenv consoleargs "splash plymouth.ignore-serial-consoles ${consoleargs}"
-else
-	setenv consoleargs "splash=verbose ${consoleargs}"
-fi
-
 if test "${console}" = "display" || test "${console}" = "both"; then setenv consoleargs "console=tty1"; fi
 if test "${console}" = "serial" || test "${console}" = "both"; then setenv consoleargs "console=ttyS0,921600 ${consoleargs}"; fi
 if test "${earlycon}" = "on"; then setenv consoleargs "earlycon ${consoleargs}"; fi

config/sources/families/genio.conf

@@ -5,9 +5,29 @@ declare -g GOVERNOR=performance
 declare -g INSTALL_ARMBIAN_FIRMWARE=yes
 
 # U-Boot bootscript configuration
-declare -g BOOTCONFIG="none" # Skip U-Boot compilation
+declare -g BOOTCONFIG="${BOOTCONFIG:-"none"}"   # Skip U-Boot compilation, unless specified by the board
 declare -g BOOTSCRIPT="boot-genio.cmd:boot.cmd" # Use custom boot script for Genio (compatible with U-Boot without itest/setexpr/bootz)
-declare -g BOOTENV_FILE="genio.txt" # Boot environment template for armbianEnv.txt
+declare -g BOOTENV_FILE="genio.txt"             # Boot environment template for armbianEnv.txt
+
+# U-Boot (Vendor, 2022.10 + heavily patched)
+declare -g BOOTSOURCE="https://gitlab.com/mediatek/aiot/bsp/u-boot.git"
+declare -g BOOTBRANCH="commit:40c563b0d2ba7e150085e195f23f4ed4adc81646"
+
+declare -g BOOTPATCHDIR="u-boot-genio"            # U-Boot patches from Collabora
+declare -g BOOTDIR="u-boot-${BOARD}-${BRANCH}"    # do not share u-boot directory
+declare -g UBOOT_TARGET_MAP="all;;fip.img lk.bin" # fip.img is produced by postprocess _after_ TF-A builds; see hooks; lk.bin is from mtkbin for convenience
+
+# Don't build ATF as regularly (before u-boot), it will be done in uboot postprocess; see hooks below
+declare -g ATFSOURCE="none"
+
+# Board-overridable params for OPTEE/ATF build; here default to 1200-compatible stuff and BOOT_SOC (that is already hashed in uboot version)
+declare -g MEDIATEK_GENIO_SOC_PLATFORM="${MEDIATEK_GENIO_SOC_PLATFORM:-"${BOOT_SOC:-"mt8195"}"}"
+declare -g MEDIATEK_GENIO_TFA_PLAT="${MEDIATEK_GENIO_TFA_PLAT:-"${MEDIATEK_GENIO_SOC_PLATFORM}"}"
+declare -g MEDIATEK_GENIO_OPTEE_PLAT="${MEDIATEK_GENIO_OPTEE_PLAT:-"mediatek-${MEDIATEK_GENIO_SOC_PLATFORM}"}"
+declare -g MEDIATEK_GENIO_OPTEE_DRAM_SIZE=${MEDIATEK_GENIO_OPTEE_DRAM_SIZE:-"0x200000000"} # default for genio-1200
+declare -g MEDIATEK_GENIO_TFA_SOC_SRAM_ADDR="0x201000"                                     # default for genio-1200
+declare -g MEDIATEK_GENIO_TFA_STORAGE="ufs"                                                # or "emmc"
+declare -g MEDIATEK_GENIO_LK_BIN="${MEDIATEK_GENIO_LK_BIN:-"${BOARD}/lk/lk.bin"}"          # default lk.bin name from mtkbin
 
 # Kernel configuration
 case $BRANCH in
@@ -34,8 +54,8 @@ case $BRANCH in
 		declare -g INSTALL_HEADERS="no" #Leads to build error bc custom ubuntu folder for oem drivers
 
 		family_tweaks() {
-			echo "blacklist snd-mixer-oss" > $SDCARD/etc/modprobe.d/blacklist-genio.conf
-			echo "blacklist snd-pcm-oss" >> $SDCARD/etc/modprobe.d/blacklist-genio.conf
+			echo "blacklist snd-mixer-oss" > "${SDCARD}/etc/modprobe.d/blacklist-genio.conf"
+			echo "blacklist snd-pcm-oss" >> "${SDCARD}/etc/modprobe.d/blacklist-genio.conf"
 		}
 		;;
 
@@ -44,3 +64,222 @@ esac
 # Version string control
 declare -g KERNEL_SKIP_MAKEFILE_VERSION="yes"
 declare -g LOCALVERSION="-${BRANCH}-${LINUXFAMILY}"
+
+# U-Boot build for genio
+# Based on Collabora's work at https://gitlab.collabora.com/mediatek/aiot/boot at 2a1ab81bb4094ef6b205ec835893af113ecad108
+# - uses 2 prebuilts: libbase-prebuilt and libdram-prebuilt straight from git
+# - builds u-boot _first_ (ATFSOURCE=none in global scope)
+# - in u-boot postprocess:
+#   - in a subshell (since it's in u-boot build context):
+#     - builts optee from source
+#     - builts ATF twice (bl2.bin/fip.bin), pointing it to libdram, libbase, optee, and u-boot
+#   - mashes ATF outputs into fip.img, which is the actual output of the "u-boot" build
+
+# This runs after regular fetch_sources_tools (500_) so boards have a chance to influence it.
+function fetch_sources_tools__700_genio_fetch_mediatek_prebuilts() {
+	# Fetch optee sources
+	# <project name="bsp/optee-os.git" path="optee-os" revision="ab5d0acf9447cb6b8ffc49917867c61265589ac1"/>
+	display_alert "Fetching optee-os" "for ${BOARD} ATF compile" "info"
+	fetch_from_repo "https://gitlab.com/mediatek/aiot/bsp/optee-os.git" "mediatek-optee/optee-os" "commit:ab5d0acf9447cb6b8ffc49917867c61265589ac1"
+
+	# Fetch armbian/mtkbin for libdram, libbase, and lk.bin
+	# Important: use a specific commit here (NOT branch), so when changes are made to this hook, the u-boot version hash changes too
+	fetch_from_repo "${MTKBIN_GIT_URL:-"${GITHUB_SOURCE}/armbian/mtkbin"}" "mtkbin" "commit:${MTKBIN_GIT_SHA1:-"ac66548f1c619813aa561d56d998206d3caaffba"}"
+}
+
+function post_uboot_custom_postprocess__genio_optee_atf_fip_build() {
+	display_alert "Genio u-boot postprocess" "Building OPTEE, 2xATF, and producing FIP" "info"
+
+	# <functions declared since hook, so hashing takes cares of changes>
+	function mediatek_genio_build_optee() {
+		display_alert "Building OPTEE" "for ${BOARD} ATF compile" "info"
+
+		declare optee_dir="${SRC}/cache/sources/mediatek-optee/optee-os"
+
+		(
+			cd "${optee_dir}" || exit 1
+			git clean -xfd                            # always pristine clean build
+			export CROSS_COMPILE="aarch64-linux-gnu-" # in a subshell, so, it's fine
+			run_host_command_logged ARCH=arm make "-j$(nproc --all)" \
+				"PLATFORM=${MEDIATEK_GENIO_OPTEE_PLAT}" \
+				"SOC_PLATFORM=${MEDIATEK_GENIO_SOC_PLATFORM}" \
+				ta-targets=ta_arm64 \
+				CFG_ARM64_core=y \
+				"CFG_DRAM_SIZE=${MEDIATEK_GENIO_OPTEE_DRAM_SIZE}" \
+				all
+		)
+
+		display_alert "OPTEE build complete" "for ${BOARD} ATF compile, locating built files" "info"
+		mediatek_genio_built_bl32_full_path="$(find "${optee_dir}" -type f -name tee.bin)" # outer scope/output var
+		run_host_command_logged ls -la "${mediatek_genio_built_bl32_full_path}"
+
+	}
+
+	function mediatek_genio_build_atf() {
+		display_alert "Building ATF" "for ${BOARD} ATF compile" "info"
+
+		# ATF will be called from uboot postprocess, not from it's normal location (which is before u-boot)
+		declare -g ATFSOURCE="https://gitlab.com/mediatek/aiot/bsp/trusted-firmware-a.git"
+		declare -g ATFBRANCH="commit:decacb88cfe882cb09ddd613ecaf1323d3fe6c22"
+		declare -g ATFSOURCEDIR="${ATFDIR}/$(branch2dir "${ATFBRANCH}")" # we're doing stuff out of the normal order, sorry.
+		declare -g ATFPATCHDIR="atf-genio"
+		declare -g ATF_SKIP_LDFLAGS_WL="yes" # this TF-A build passes TF_LDFLAGS directly to the linker, not to gcc
+
+		declare libbase_prebuilt_bin="${SRC}/cache/sources/mtkbin/${BOARD}/libbase/libbase.a"
+		declare libdram_prebuilt_bin="${SRC}/cache/sources/mtkbin/${BOARD}/libdram/libdram.a"
+
+		if [[ ! -f "${libdram_prebuilt_bin}" ]]; then
+			display_alert "ERROR: missing libdram prebuilt" "for ${BOARD} ATF compile: expected at ${libdram_prebuilt_bin}" "error"
+			return 1
+		fi
+
+		if [[ ! -f "${libbase_prebuilt_bin}" ]]; then
+			display_alert "ERROR: missing libbase prebuilt" "for ${BOARD} ATF compile: expected at ${libbase_prebuilt_bin}" "error"
+			return 1
+		fi
+
+		declare -a common_tfa_args=(
+			"E=0"
+			"PLAT=${MEDIATEK_GENIO_TFA_PLAT}"
+			"SPD=opteed"
+			"NEED_BL32=yes"
+			"BL32=${mediatek_genio_built_bl32_full_path}"
+			"NEED_BL33=yes"
+			"BL33=${mediatek_genio_built_bl33_full_path}"
+			"LIBBASE=${libbase_prebuilt_bin}"
+			"LIBDRAM=${libdram_prebuilt_bin}"
+			"PLAT_HW_CRYPTO=1"
+		)
+
+		if [[ "${MEDIATEK_GENIO_TFA_STORAGE}" == "ufs" ]]; then
+			# unrelated to ufs extension, as this is always needed per-board even for SD builds
+			# (genio always loads uboot from emmc/UFS and not SD)
+			display_alert "Adding UFS support to ATF build" "for ${BOARD} ATF compile: STORAGE_UFS=1" "info"
+			common_tfa_args+=("STORAGE_UFS=1")
+		fi
+
+		common_tfa_args+=(
+			STORAGE_APPEND_FIP=1
+			"STORAGE_FIP_OFFSET=0x100000"
+			"STORAGE_BOOT_LENGTH=0x300000"
+			"CFLAGS='-fdiagnostics-color=always ${mediatek_vendor_cflags_modern_gcc[*]}'"
+			"KCFLAGS='-fdiagnostics-color=always ${mediatek_vendor_cflags_modern_gcc[*]}'"
+		)
+
+		# Do it twice instead of trying to make idiotic _TARGET_MAP work; single target for bl2+fip doesn't work either
+		declare atftempdir="undetermined_atftempdir" # scope for compile_atf
+		# bl2.bin build
+		declare -g ATF_TARGET_MAP="${common_tfa_args[*]} bl2;;build/${MEDIATEK_GENIO_TFA_PLAT}/release/bl2.bin"
+		display_alert "ATF_TARGET_MAP: for ${BOARD} ATF compile" "${ATF_TARGET_MAP}" "info"
+		CLEAN_LEVEL="make-atf" compile_atf                                                 # core function; force make distclean for first build
+		run_host_command_logged cp -v "${atftempdir}/bl2.bin" "${uboot_build_dir}/bl2.bin" # collect from atftempdir to u-boot dir
+
+		# fip.bin build
+		declare -g ATF_TARGET_MAP="${common_tfa_args[*]} fip;;build/${MEDIATEK_GENIO_TFA_PLAT}/release/fip.bin"
+		display_alert "ATF_TARGET_MAP: for ${BOARD} ATF compile" "${ATF_TARGET_MAP}" "info"
+		compile_atf                                                                        # core function
+		run_host_command_logged cp -v "${atftempdir}/fip.bin" "${uboot_build_dir}/fip.bin" # collect from atftempdir to u-boot dir
+
+	}
+
+	function mediatek_genio_produce_fip() {
+		display_alert "Producing final FIP image" "for ${BOARD}" "info"
+		display_alert "Producing final FIP image" "for ${BOARD} uboot_build_dir:${uboot_build_dir}" "info"
+
+		declare bl2_bin="${uboot_build_dir}/bl2.bin"
+		declare bl2_img="${uboot_build_dir}/bl2.img"
+		declare fip_bin="${uboot_build_dir}/fip.bin"
+		declare fip_img="${uboot_build_dir}/fip.img"
+
+		declare -a mkimage_args=(
+			-T mtk_image
+			-a "${MEDIATEK_GENIO_TFA_SOC_SRAM_ADDR}"
+			-e "${MEDIATEK_GENIO_TFA_SOC_SRAM_ADDR}"
+			-n "media=${MEDIATEK_GENIO_TFA_STORAGE};arm64=1"
+			-d "${bl2_bin}" "${bl2_img}"
+		)
+		run_host_command_logged "${uboot_build_dir}/tools/mkimage" "${mkimage_args[*]@Q}"
+
+		truncate --size=1M "${bl2_img}"
+
+		cat "${bl2_img}" "${fip_bin}" > "${fip_img}"
+
+		# lk.bin (Little Kernel) is included in u-boot for convenience; it is not used in regular booting,
+		# but will be needed by users flashing the board. To support EXT=mtkflash too, as it extracts both
+		# fip.img and lk.bin from the image's uboot directory.
+		declare lk_bin="${SRC}/cache/sources/mtkbin/${MEDIATEK_GENIO_LK_BIN}"
+		if [[ ! -f "${lk_bin}" ]]; then
+			display_alert "ERROR: missing lk.bin" "for ${BOARD} Little Kernel" "error"
+			return 1
+		fi
+		run_host_command_logged cp -v "${lk_bin}" "${uboot_build_dir}/lk.bin"
+
+		# Lets also output stuff needed for flashing to ${SRC}/output/ for easier access for developers
+		run_host_command_logged cp -v "${fip_img}" "${SRC}/output/${BOARD}-${HOSTRELEASE}-fip.img"
+		run_host_command_logged cp -v "${lk_bin}" "${SRC}/output/${BOARD}-lk.bin"
+
+		return 0
+	}
+	# </functions declared since hook, so hashing takes cares of changes>
+
+	# control variable scope across function calls
+	declare uboot_build_dir="undetermined_uboot_build_dir"
+	declare mediatek_genio_built_bl32_full_path="undetermined_bl32"
+	declare mediatek_genio_built_bl33_full_path="undetermined_bl33"
+
+	# Find the u-boot.bin produced by the u-boot build; it's needed for the ATF build
+	display_alert "Locating built U-Boot binary" "for ${BOARD} ATF compile" "info"
+	uboot_build_dir="$(pwd)"
+	mediatek_genio_built_bl33_full_path="${uboot_build_dir}/u-boot.bin"
+	run_host_command_logged ls -la "${mediatek_genio_built_bl33_full_path}"
+
+	# Done in a subshell, as we're in u-boot build context/cwd here and would like to remain so after those builds
+	(
+		mediatek_genio_build_optee # sets mediatek_genio_built_bl32_full_path
+		mediatek_genio_build_atf   # uses mediatek_genio_built_bl32_full_path and mediatek_genio_built_bl33_full_path
+		mediatek_genio_produce_fip # uses ATF outputs in atftempdir set by compile_atf() and puts fip.img in uboot_build_dir
+	)
+}
+
+function post_config_uboot_target__downgrade_gcc_errors_to_warnings() {
+	declare -i gcc_major_version=0
+	gcc_major_version=$(gcc -dumpversion | cut -d. -f1)
+	display_alert "$BOARD" "GCC major version: ${gcc_major_version}" "debug"
+
+	if [[ ${gcc_major_version} -ge 13 ]]; then
+		display_alert "$BOARD" "Adding extra CFLAGS to fix vendor U-Boot building with GCC 13+" "info"
+		# Curb the compiler's warnings so it builds on trixie+ (original source is for bookworm)
+		declare -g -a mediatek_vendor_cflags_modern_gcc=(# Used for both ATF and u-boot builds, via global var
+			"-Wno-error=enum-int-mismatch"
+			"-Wno-error=int-conversion"
+			"-Wno-error=implicit-function-declaration"
+			"-Wno-error=incompatible-pointer-types"
+		)
+		uboot_cflags_array+=("${mediatek_vendor_cflags_modern_gcc[@]}")
+	fi
+	return 0
+}
+
+# This exports fip.img and lk.bin _from the image_ to DESTIMG, for easier flashing by users.
+# Those will end up being compressed (.xz/etc) by the compression code.
+# Note: this is exported _from the image_, not from the u-boot build output; image builds might use
+# a cached u-boot artifacts, so might not run the u-boot build at all; while we want to export those
+# files together with the image.
+function pre_umount_final_image__700_genio_export_flash_bins() {
+	: "${version:?"ERROR: version variable not defined"}"
+	run_host_command_logged ls -la "${MOUNT}"/usr/lib/linux-u-boot-*-"${BOARD}"/fip.img
+	run_host_command_logged ls -la "${MOUNT}"/usr/lib/linux-u-boot-*-"${BOARD}"/lk.bin
+	run_host_command_logged cp -v "${MOUNT}"/usr/lib/linux-u-boot-*-"${BOARD}"/fip.img "${DESTIMG}/${version}.fip.img"
+	run_host_command_logged cp -v "${MOUNT}"/usr/lib/linux-u-boot-*-"${BOARD}"/lk.bin "${DESTIMG}/${version}.lk.bin"
+	# shellcheck disable=SC2034 # used by the mtkflash extension
+	declare -g MEDIATEK_GENIO_EXPORTED_FIP_IMG="${version}.fip.img" MEDIATEK_GENIO_EXPORTED_LK_BIN="${version}.lk.bin"
+}
+
+function add_host_dependencies__genio_python3_deps_for_optee_build() {
+	display_alert "Preparing Genio OPTEE host-side dependencies" "for ATF/OPTEE build" "info"
+	declare -g EXTRA_BUILD_DEPS="${EXTRA_BUILD_DEPS} python3-cryptography python3-pyelftools"
+}
+
+function write_uboot_platform() {
+	: # noop; this means `armbian-install` can't be used to flash u-boot; users must use mtkflash or similar
+}