Merge pull request #92 from nevesenin/master

Fix "resizing" wrong partition when having two disks

.github/workflows/update-flake-lock.yml

@@ -0,0 +1,23 @@
+name: update-flake-lock
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * 0'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Install nix
+        uses: DeterminateSystems/nix-installer-action@e50d5f73bfe71c2dd0aa4218de8f4afa59f8f81d # v16
+
+      - name: Update flake.lock
+        uses: DeterminateSystems/update-flake-lock@a2bbe0274e3a0c4194390a1e445f734c597ebc37 # v24

README.md

@@ -17,96 +17,29 @@ The important modules are `overlay/default.nix`, `rpi/default.nix`,
 and `rpi/config.nix`. The other modules are mostly wrappers that set
 `config.txt` settings and enable required kernel modules.
 
+## Stability note
+
+`master` is the development branch -- if you want to avoid breaking changes, you
+should pin your flake to a specific release and refer to the release notes when
+upgrading.
+
 ## Example
 
-See [the example
+See the `rpi-example` config in this flake for an example config built by CI.
-repo](https://github.com/tstat/raspberry-pi-nix-example) for a
-complete example.
-
-```nix
-{
-  description = "raspberry-pi-nix example";
-  nixConfig = {
-    extra-substituters = [ "https://raspberry-pi-nix.cachix.org" ];
-    extra-trusted-public-keys = [
-      "raspberry-pi-nix.cachix.org-1:WmV2rdSangxW0rZjY/tBvBDSaNFQ3DyEQsVw8EvHn9o="
-    ];
-  };
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11";
-    raspberry-pi-nix.url = "github:tstat/raspberry-pi-nix";
-  };
-
-  outputs = { self, nixpkgs, raspberry-pi-nix }:
-    let
-      inherit (nixpkgs.lib) nixosSystem;
-      basic-config = { pkgs, lib, ... }: {
-        time.timeZone = "America/New_York";
-        users.users.root.initialPassword = "root";
-        networking = {
-          hostName = "basic-example";
-          useDHCP = false;
-          interfaces = { wlan0.useDHCP = true; };
-        };
-        environment.systemPackages = with pkgs; [ bluez bluez-tools ];
-        hardware = {
-          bluetooth.enable = true;
-          raspberry-pi = {
-            config = {
-              all = {
-                base-dt-params = {
-                  # enable autoprobing of bluetooth driver
-                  # https://github.com/raspberrypi/linux/blob/c8c99191e1419062ac8b668956d19e788865912a/arch/arm/boot/dts/overlays/README#L222-L224
-                  krnbt = {
-                    enable = true;
-                    value = "on";
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-
-    in {
-      nixosConfigurations = {
-        rpi-example = nixosSystem {
-          system = "aarch64-linux";
-          modules = [ raspberry-pi-nix.nixosModules.raspberry-pi basic-config ];
-        };
-      };
-    };
-}
-```
 
 ## Using the provided cache to avoid compiling linux
-This repo uses the raspberry pi linux kernel fork, and compiling linux
+This repo uses the raspberry pi linux kernel fork, and compiling linux takes a
-takes a while. I do push my kernel builds to a cachix cache that you
+while. CI pushes kernel builds to the nix-community cachix cache that you may
-may use to avoid compiling linux yourself. The cache can be found
+use to avoid compiling linux yourself. The cache can be found at
-at https://raspberry-pi-nix.cachix.org, and you can follow the
+https://nix-community.cachix.org, and you can follow the instructions there
-instructions there to use this cache.
+to use this cache.
-
-You don't need the cachix binary to use the cachix cache though, you
-just need to add the relevant
-[`substituters`](https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#conf-substituters)
-and
-[`trusted-public-keys`](https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#conf-trusted-public-keys)
-settings settings to your `nix.conf`. You can do this directly by
-modifying your `/etc/nix/nix.conf`, or in the flake definition. In the
-above example flake these `nix.conf` settings are added by the
-`nixConfig` attribute ([doc
-link](https://nixos.org/manual/nix/stable/command-ref/new-cli/nix3-flake.html?highlight=flake#flake-format)).
-Note that this will only work if the user running `nix build` is in
-[`trusted-users`](https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#conf-trusted-users)
-or the substituter is in
-[`trusted-substituters`](https://nixos.org/manual/nix/stable/command-ref/conf-file.html?highlight=nix.conf#conf-trusted-substituters).
 
 ## Building an sd-card image
 
-An image suitable for flashing to an sd-card can be found at the
+Include the provided `sd-image` nixos module this flake provides, then an image
-attribute `config.system.build.sdImage`. For example, if you wanted to
+suitable for flashing to an sd-card can be found at the attribute
-build an image for `rpi-example` in the above configuration
+`config.system.build.sdImage`. For example, if you wanted to build an image for
-example you could run:
+`rpi-example` in the above configuration example you could run:
 
 ```
 nix build '.#nixosConfigurations.rpi-example.config.system.build.sdImage'
@@ -114,16 +47,15 @@ nix build '.#nixosConfigurations.rpi-example.config.system.build.sdImage'
 
 ## The firmware partition
 
-The image produced by this package is partitioned in the same way as
+The image produced by this package is partitioned in the same way as the aarch64
-the aarch64 installation media from nixpkgs: There is a firmware
+installation media from nixpkgs: There is a firmware partition that contains
-partition that contains necessary firmware, u-boot, and
+necessary firmware, the kernel or u-boot, and config.txt. Then there is another
-config.txt. Then there is another partition (labeled `NIXOS_SD`) that
+partition (labeled `NIXOS_SD`) that contains everything else. The firmware and
-contains everything else. The firmware and `config.txt` file are
+`config.txt` file are managed by NixOS modules defined in this
-managed by NixOS modules defined in this package. Additionally, a
+package. Additionally, a systemd service will update the firmware and
-systemd service will update the firmware and `config.txt` in the
+`config.txt` in the firmware partition __in place__. If uboot is enabled then
-firmware partition __in place__. Linux kernels are stored in the
+linux kernels are stored in the `NIXOS_SD` partition and will be booted by
-`NIXOS_SD` partition and will be booted by u-boot in the firmware
+u-boot in the firmware partition.
-partition.
 
 ## `config.txt` generation
 
@@ -258,37 +190,36 @@ nix build '.#nixosConfigurations.rpi-example.config.hardware.raspberry-pi.config
 
 ## Firmware partition implementation notes
 
-In Raspberry Pi devices the proprietary firmware manipulates the
+In Raspberry Pi devices the proprietary firmware manipulates the device tree in
-device tree in a number of ways before handing it off to the kernel
+a number of ways before handing it off to the kernel (or in our case, to
-(or in our case, to u-boot). The transformations that are performed
+u-boot). The transformations that are performed aren't documented so well
-aren't documented so well (although I have found [this
+(although I have found [this
-list](https://forums.raspberrypi.com/viewtopic.php?t=329799#p1974233)
+list](https://forums.raspberrypi.com/viewtopic.php?t=329799#p1974233) ).
-). 
 
-This manipulation makes it difficult to use the device tree configured
+This manipulation makes it difficult to use the device tree configured directly
-directly by NixOS as the proprietary firmware's manipulation must be
+by NixOS as the proprietary firmware's manipulation must be known and
-known and reproduced.
+reproduced.
 
-Even if the manipulation were successfully reproduced, some benefits
+Even if the manipulation were successfully reproduced, some benefits would be
-would be lost. For example, the firmware can detect connected hardware
+lost. For example, the firmware can detect connected hardware during boot and
-during boot and automatically configure the device tree accordingly
+automatically configure the device tree accordingly before passing it onto the
-before passing it onto the kernel. If this firmware device tree is
+kernel. If this firmware device tree is ignored then a NixOS system rebuild with
-ignored then a NixOS system rebuild with a different device tree would
+a different device tree would be required when swapping connected
-be required when swapping connected hardware. Examples of what I mean
+hardware. Examples of what I mean by hardware include: the specific Raspberry Pi
-by hardware include: the specific Raspberry Pi device booting the
+device booting the image, connected cameras, and connected displays.
-image, connected cameras, and connected displays.
 
-So, in order to avoid the headaches associated with failing to
+So, in order to avoid the headaches associated with failing to reproduce some
-reproduce some firmware device tree manipulation, and to reap the
+firmware device tree manipulation, and to reap the benefits afforded by the
-benefits afforded by the firmware device tree configuration, u-boot is
+firmware device tree configuration, the bootloader is configured to use the
-configured to use the device tree that it is given (i.e. the one that
+device tree that it is given (i.e. the one that the raspberry pi firmware loads
-the raspberry pi firmware loads and manipulates). As a consequence,
+and manipulates). As a consequence, device tree configuration is controlled via
-device tree configuration is controlled via the [config.txt
+the [config.txt
 file](https://www.raspberrypi.com/documentation/computers/config_txt.html).
 
-Additionally, the firmware, device trees, and overlays from the
+Additionally, the firmware, device trees, and overlays from the `raspberrypifw`
-`raspberrypifw` package populate the firmware partition. This package
+package populate the firmware partition. This package is kept up to date by the
-is kept up to date by the overlay applied by this package, so you
+overlay applied by this package, so you don't need configure this. However, if
-don't need configure this. However, if you want to use different
+you want to use different firmware you can override that package to do so.
-firmware you can override that package to do so.
 
+## What's not working?
+- [ ] Pi 5 u-boot devices other than sd-cards (i.e. usb, nvme).

example/default.nix

@@ -0,0 +1,44 @@
+{ pkgs, lib, ... }: {
+  time.timeZone = "America/New_York";
+  users.users.root.initialPassword = "root";
+  networking = {
+    hostName = "example";
+    useDHCP = false;
+    interfaces = {
+      wlan0.useDHCP = true;
+      eth0.useDHCP = true;
+    };
+  };
+  raspberry-pi-nix.board = "bcm2711";
+  hardware = {
+    raspberry-pi = {
+      config = {
+        all = {
+          base-dt-params = {
+            BOOT_UART = {
+              value = 1;
+              enable = true;
+            };
+            uart_2ndstage = {
+              value = 1;
+              enable = true;
+            };
+          };
+          dt-overlays = {
+            disable-bt = {
+              enable = true;
+              params = { };
+            };
+          };
+        };
+      };
+    };
+  };
+  security.rtkit.enable = true;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    pulse.enable = true;
+  };
+}

flake.lock

@@ -1,164 +1,186 @@
 {
   "nodes": {
-    "libcamera-apps-src": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1713431793,
-        "narHash": "sha256-uoewZMGf3vsBoRDfRz8KBKl+J6st/J44SHvNRMBdaUI=",
-        "owner": "raspberrypi",
-        "repo": "libcamera-apps",
-        "rev": "414a7383464b98f21f5e5381a16cc73ae0350ba6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "raspberrypi",
-        "ref": "v1.4.4",
-        "repo": "libcamera-apps",
-        "type": "github"
-      }
-    },
     "libcamera-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1713446223,
+        "lastModified": 1725630279,
-        "narHash": "sha256-p0/inkHPRUkxSIsTmj7VI7sIaX7OXdqjMGZ31W7cnt4=",
+        "narHash": "sha256-KH30jmHfxXq4j2CL7kv18DYECJRp9ECuWNPnqPZajPA=",
         "owner": "raspberrypi",
         "repo": "libcamera",
-        "rev": "eb00c13d7c9f937732305d47af5b8ccf895e700f",
+        "rev": "69a894c4adad524d3063dd027f5c4774485cf9db",
         "type": "github"
       },
       "original": {
         "owner": "raspberrypi",
         "repo": "libcamera",
-        "rev": "eb00c13d7c9f937732305d47af5b8ccf895e700f",
+        "rev": "69a894c4adad524d3063dd027f5c4774485cf9db",
         "type": "github"
       }
     },
     "libpisp-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1713362873,
+        "lastModified": 1724944683,
-        "narHash": "sha256-CHd44CH5dBcZuK+5fZtONZ8HE/lwGKwK5U0BYUK8gG4=",
+        "narHash": "sha256-Fo2UJmQHS855YSSKKmGrsQnJzXog1cdpkIOO72yYAM4=",
         "owner": "raspberrypi",
         "repo": "libpisp",
-        "rev": "999da5acb4f40cb8e93d22ec16e28edd55ec9414",
+        "rev": "28196ed6edcfeda88d23cc5f213d51aa6fa17bb3",
         "type": "github"
       },
       "original": {
         "owner": "raspberrypi",
-        "ref": "v1.0.5",
+        "ref": "v1.0.7",
         "repo": "libpisp",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1715218190,
+        "lastModified": 1736061677,
-        "narHash": "sha256-R98WOBHkk8wIi103JUVQF3ei3oui4HvoZcz9tYOAwlk=",
+        "narHash": "sha256-DjkQPnkAfd7eB522PwnkGhOMuT9QVCZspDpJJYyOj60=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9a9960b98418f8c385f52de3b09a63f9c561427a",
+        "rev": "cbd8ec4de4469333c82ff40d057350c30e9f7d36",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
-        "rev": "9a9960b98418f8c385f52de3b09a63f9c561427a",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "libcamera-apps-src": "libcamera-apps-src",
         "libcamera-src": "libcamera-src",
         "libpisp-src": "libpisp-src",
         "nixpkgs": "nixpkgs",
         "rpi-bluez-firmware-src": "rpi-bluez-firmware-src",
         "rpi-firmware-nonfree-src": "rpi-firmware-nonfree-src",
         "rpi-firmware-src": "rpi-firmware-src",
-        "rpi-linux-6_6-src": "rpi-linux-6_6-src",
+        "rpi-linux-6_12_17-src": "rpi-linux-6_12_17-src",
-        "u-boot-src": "u-boot-src"
+        "rpi-linux-6_6_78-src": "rpi-linux-6_6_78-src",
+        "rpi-linux-stable-src": "rpi-linux-stable-src",
+        "rpicam-apps-src": "rpicam-apps-src"
       }
     },
     "rpi-bluez-firmware-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1698157837,
+        "lastModified": 1708969706,
-        "narHash": "sha256-CjbZ3t3TW/iJ3+t9QKEtM9NdQU7SwcUCDYuTmFEwvhU=",
+        "narHash": "sha256-KakKnOBeWxh0exu44beZ7cbr5ni4RA9vkWYb9sGMb8Q=",
         "owner": "RPi-Distro",
         "repo": "bluez-firmware",
-        "rev": "d9d4741caba7314d6500f588b1eaa5ab387a4ff5",
+        "rev": "78d6a07730e2d20c035899521ab67726dc028e1c",
         "type": "github"
       },
       "original": {
         "owner": "RPi-Distro",
+        "ref": "bookworm",
         "repo": "bluez-firmware",
-        "rev": "d9d4741caba7314d6500f588b1eaa5ab387a4ff5",
         "type": "github"
       }
     },
     "rpi-firmware-nonfree-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1700058854,
+        "lastModified": 1723266537,
-        "narHash": "sha256-Yynww79LPPkau4YDSLI6IMOjH64nMpHUdGjnCfIR2+M=",
+        "narHash": "sha256-T7eTKXqY9cxEMdab8Snda4CEOrEihy5uOhA6Fy+Mhnw=",
         "owner": "RPi-Distro",
         "repo": "firmware-nonfree",
-        "rev": "88aa085bfa1a4650e1ccd88896f8343c22a24055",
+        "rev": "4b356e134e8333d073bd3802d767a825adec3807",
         "type": "github"
       },
       "original": {
         "owner": "RPi-Distro",
+        "ref": "bookworm",
         "repo": "firmware-nonfree",
-        "rev": "88aa085bfa1a4650e1ccd88896f8343c22a24055",
         "type": "github"
       }
     },
     "rpi-firmware-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1713970515,
+        "lastModified": 1728405098,
-        "narHash": "sha256-X5OinkLh/+mx34DM8mCk4tqOGuJdYxkvygv3gA77NJI=",
+        "narHash": "sha256-4gnK0KbqFnjBmWia9Jt2gveVWftmHrprpwBqYVqE/k0=",
         "owner": "raspberrypi",
         "repo": "firmware",
-        "rev": "969420b4121b522ab33c5001074cc4c2547dafaf",
+        "rev": "7bbb5f80d20a2335066a8781459c9f33e5eebc64",
         "type": "github"
       },
       "original": {
         "owner": "raspberrypi",
-        "ref": "1.20240424",
+        "ref": "1.20241008",
         "repo": "firmware",
         "type": "github"
       }
     },
-    "rpi-linux-6_6-src": {
+    "rpi-linux-6_12_17-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1713516936,
+        "lastModified": 1740765145,
-        "narHash": "sha256-mlsDuVczu0e57BlD/iq7IEEluOIgqbZ+W4Ju30E/zhw=",
+        "narHash": "sha256-hoCsGc4+RC/2LmxDtswLBL5ZhWlw4vSiL4Vkl39r2MU=",
         "owner": "raspberrypi",
         "repo": "linux",
-        "rev": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e",
+        "rev": "5985ce32e511f4e8279a841a1b06a8c7d972b386",
         "type": "github"
       },
       "original": {
         "owner": "raspberrypi",
-        "ref": "stable_20240423",
+        "ref": "rpi-6.12.y",
         "repo": "linux",
         "type": "github"
       }
     },
-    "u-boot-src": {
+    "rpi-linux-6_6_78-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1712055538,
+        "lastModified": 1740503700,
-        "narHash": "sha256-IlaDdjKq/Pq2orzcU959h93WXRZfvKBGDO/MFw9mZMg=",
+        "narHash": "sha256-Y8+ot4Yi3UKwlZK3ap15rZZ16VZDvmeFkD46+6Ku7bE=",
-        "type": "tarball",
+        "owner": "raspberrypi",
-        "url": "https://ftp.denx.de/pub/u-boot/u-boot-2024.04.tar.bz2"
+        "repo": "linux",
+        "rev": "2e071057fded90e789c0101498e45a1778be93fe",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "raspberrypi",
-        "url": "https://ftp.denx.de/pub/u-boot/u-boot-2024.04.tar.bz2"
+        "ref": "rpi-6.6.y",
+        "repo": "linux",
+        "type": "github"
+      }
+    },
+    "rpi-linux-stable-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1728403745,
+        "narHash": "sha256-phCxkuO+jUGZkfzSrBq6yErQeO2Td+inIGHxctXbD5U=",
+        "owner": "raspberrypi",
+        "repo": "linux",
+        "rev": "5aeecea9f4a45248bcf564dec924965e066a7bfd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "stable_20241008",
+        "repo": "linux",
+        "type": "github"
+      }
+    },
+    "rpicam-apps-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1727515047,
+        "narHash": "sha256-qCYGrcibOeGztxf+sd44lD6VAOGoUNwRqZDdAmcTa/U=",
+        "owner": "raspberrypi",
+        "repo": "rpicam-apps",
+        "rev": "a8ccf9f3cd9df49875dfb834a2b490d41d226031",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "v1.5.2",
+        "repo": "rpicam-apps",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -2,38 +2,42 @@
   description = "raspberry-pi nixos configuration";
 
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/9a9960b98418f8c385f52de3b09a63f9c561427a";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
-    u-boot-src = {
+    rpi-linux-stable-src = {
       flake = false;
-      url = "https://ftp.denx.de/pub/u-boot/u-boot-2024.04.tar.bz2";
+      url = "github:raspberrypi/linux/stable_20241008";
     };
-    rpi-linux-6_6-src = {
+    rpi-linux-6_6_78-src = {
       flake = false;
-      url = "github:raspberrypi/linux/stable_20240423";
+      url = "github:raspberrypi/linux/rpi-6.6.y";
+    };
+    rpi-linux-6_12_17-src = {
+      flake = false;
+      url = "github:raspberrypi/linux/rpi-6.12.y";
     };
     rpi-firmware-src = {
       flake = false;
-      url = "github:raspberrypi/firmware/1.20240424";
+      url = "github:raspberrypi/firmware/1.20241008";
     };
     rpi-firmware-nonfree-src = {
       flake = false;
-      url = "github:RPi-Distro/firmware-nonfree/88aa085bfa1a4650e1ccd88896f8343c22a24055";
+      url = "github:RPi-Distro/firmware-nonfree/bookworm";
     };
     rpi-bluez-firmware-src = {
       flake = false;
-      url = "github:RPi-Distro/bluez-firmware/d9d4741caba7314d6500f588b1eaa5ab387a4ff5";
+      url = "github:RPi-Distro/bluez-firmware/bookworm";
     };
-    libcamera-apps-src = {
+    rpicam-apps-src = {
       flake = false;
-      url = "github:raspberrypi/libcamera-apps/v1.4.4";
+      url = "github:raspberrypi/rpicam-apps/v1.5.2";
     };
     libcamera-src = {
       flake = false;
-      url = "github:raspberrypi/libcamera/eb00c13d7c9f937732305d47af5b8ccf895e700f"; # v0.2.0+rpt20240418
+      url = "github:raspberrypi/libcamera/69a894c4adad524d3063dd027f5c4774485cf9db"; # v0.3.1+rpt20240906
     };
     libpisp-src = {
       flake = false;
-      url = "github:raspberrypi/libpisp/v1.0.5";
+      url = "github:raspberrypi/libpisp/v1.0.7";
     };
   };
 
@@ -49,13 +53,39 @@
         core = import ./overlays (builtins.removeAttrs srcs [ "self" ]);
         libcamera = import ./overlays/libcamera.nix (builtins.removeAttrs srcs [ "self" ]);
       };
-      nixosModules.raspberry-pi = import ./rpi {
+      nixosModules = {
-        inherit pinned;
+        raspberry-pi = import ./rpi {
-        core-overlay = self.overlays.core;
+          inherit pinned;
-        libcamera-overlay = self.overlays.libcamera;
+          core-overlay = self.overlays.core;
+          libcamera-overlay = self.overlays.libcamera;
+        };
+        sd-image = import ./sd-image;
       };
-      packages.aarch64-linux = {
+      nixosConfigurations = {
-        linux = pinned.rpi-kernels.latest.kernel;
+        rpi-example = srcs.nixpkgs.lib.nixosSystem {
+          system = "aarch64-linux";
+          modules = [ self.nixosModules.raspberry-pi self.nixosModules.sd-image ./example ];
+        };
       };
+      checks.aarch64-linux = self.packages.aarch64-linux;
+      packages.aarch64-linux = with pinned.lib;
+        let
+          kernels =
+            foldlAttrs f { } pinned.rpi-kernels;
+          f = acc: kernel-version: board-attr-set:
+            foldlAttrs
+              (acc: board-version: drv: acc // {
+                "linux-${kernel-version}-${board-version}" = drv;
+              })
+              acc
+              board-attr-set;
+        in
+        {
+          example-sd-image = self.nixosConfigurations.rpi-example.config.system.build.sdImage;
+          firmware = pinned.raspberrypifw;
+          libcamera = pinned.libcamera;
+          wireless-firmware = pinned.raspberrypiWirelessFirmware;
+          uboot-rpi-arm64 = pinned.uboot-rpi-arm64;
+        } // kernels;
     };
 }

overlays/default.nix

@@ -1,5 +1,6 @@
-{ u-boot-src
+{ rpi-linux-stable-src
-, rpi-linux-6_6-src
+, rpi-linux-6_6_78-src
+, rpi-linux-6_12_17-src
 , rpi-firmware-src
 , rpi-firmware-nonfree-src
 , rpi-bluez-firmware-src
@@ -7,46 +8,85 @@
 }:
 final: prev:
 let
-  # The version to stick at `pkgs.rpi-kernels.latest'
+  versions = {
-  latest = "v6_6_28";
+    v6_6_51.src = rpi-linux-stable-src;
+    v6_6_78.src = rpi-linux-6_6_78-src;
+    v6_12_17 = {
+      src = rpi-linux-6_12_17-src;
+      patches = [
+        {
+          name = "remove-readme-target.patch";
+          patch = final.fetchpatch {
+            url = "https://github.com/raspberrypi/linux/commit/3c0fd51d184f1748b83d28e1113265425c19bcb5.patch";
+            hash = "sha256-v7uZOmPCUp2i7NGVgjqnQYe6dEBD+aATuP/oRs9jfuk=";
+          };
+        }
+      ];
+    };
+  };
+  boards = [ "bcm2711" "bcm2712" ];
 
   # Helpers for building the `pkgs.rpi-kernels' map.
-  rpi-kernel = { kernel, version, fw, wireless-fw, argsOverride ? null }:
+  rpi-kernel = { version, board }:
     let
-      new-kernel = prev.linux_rpi4.override {
+      kernel = builtins.getAttr version versions;
-        argsOverride = {
+      version-slug = builtins.replaceStrings [ "v" "_" ] [ "" "." ] version;
-          src = kernel;
-          inherit version;
-          modDirVersion = version;
-        } // (if builtins.isNull argsOverride then { } else argsOverride);
-      };
-      new-fw = prev.raspberrypifw.overrideAttrs (oldfw: { src = fw; });
-      new-wireless-fw = final.callPackage wireless-fw { };
-      version-slug = builtins.replaceStrings [ "." ] [ "_" ] version;
     in
     {
-      "v${version-slug}" = {
+      "${version}"."${board}" = (final.buildLinux {
-        kernel = new-kernel;
+        modDirVersion = version-slug;
-        firmware = new-fw;
+        version = version-slug;
-        wireless-firmware = new-wireless-fw;
+        pname = "linux-rpi";
-      };
+        src = kernel.src;
+        defconfig = "${board}_defconfig";
+        structuredExtraConfig = with final.lib.kernel; {
+          # The perl script to generate kernel options sets unspecified
+          # parameters to `m` if possible [1]. This results in the
+          # unspecified config option KUNIT [2] getting set to `m` which
+          # causes DRM_VC4_KUNIT_TEST [3] to get set to `y`.
+          #
+          # This vc4 unit test fails on boot due to a null pointer
+          # exception with the existing config. I'm not sure why, but in
+          # any case, the DRM_VC4_KUNIT_TEST config option itself states
+          # that it is only useful for kernel developers working on the
+          # vc4 driver. So, I feel no need to deviate from the standard
+          # rpi kernel and attempt to successfully enable this test and
+          # other unit tests because the nixos perl script has this
+          # sloppy "default to m" behavior. So, I set KUNIT to `n`.
+          #
+          # [1] https://github.com/NixOS/nixpkgs/blob/85bcb95aa83be667e562e781e9d186c57a07d757/pkgs/os-specific/linux/kernel/generate-config.pl#L1-L10
+          # [2] https://github.com/raspberrypi/linux/blob/1.20230405/lib/kunit/Kconfig#L5-L14
+          # [3] https://github.com/raspberrypi/linux/blob/bb63dc31e48948bc2649357758c7a152210109c4/drivers/gpu/drm/vc4/Kconfig#L38-L52
+          KUNIT = no;
+        };
+        features.efiBootStub = false;
+        kernelPatches =
+          if kernel ? "patches" then kernel.patches else [ ];
+        ignoreConfigErrors = true;
+      }).overrideAttrs
+        (oldAttrs: {
+          postConfigure = ''
+            # The v7 defconfig has this set to '-v7' which screws up our modDirVersion.
+            sed -i $buildRoot/.config -e 's/^CONFIG_LOCALVERSION=.*/CONFIG_LOCALVERSION=""/'
+            sed -i $buildRoot/include/config/auto.conf -e 's/^CONFIG_LOCALVERSION=.*/CONFIG_LOCALVERSION=""/'
+          '';
+        });
     };
-  rpi-kernels = builtins.foldl' (b: a: b // rpi-kernel a) { };
+  rpi-kernels = builtins.foldl'
+    (b: a: final.lib.recursiveUpdate b (rpi-kernel a))
+    { };
 in
 {
   # disable firmware compression so that brcm firmware can be found at
   # the path expected by raspberry pi firmware/device tree
   compressFirmwareXz = x: x;
+  compressFirmwareZstd = x: x;
 
   # provide generic rpi arm64 u-boot
-  uboot_rpi_arm64 = prev.buildUBoot rec {
+  uboot-rpi-arm64 = final.buildUBoot {
     defconfig = "rpi_arm64_defconfig";
     extraMeta.platforms = [ "aarch64-linux" ];
     filesToInstall = [ "u-boot.bin" ];
-    version = "2024.04";
-    patches = [ ];
-    makeFlags = [ ];
-    src = u-boot-src;
     # In raspberry pi sbcs the firmware manipulates the device tree in
     # a variety of ways before handing it off to the linux kernel. [1]
     # Since we have installed u-boot in place of a linux kernel we may
@@ -60,46 +100,23 @@ in
   };
 
   # default to latest firmware
-  raspberrypiWirelessFirmware = final.rpi-kernels.latest.wireless-firmware;
+  raspberrypiWirelessFirmware = final.callPackage
-  raspberrypifw = final.rpi-kernels.latest.firmware;
+    (
+      import ./raspberrypi-wireless-firmware.nix {
+        bluez-firmware = rpi-bluez-firmware-src;
+        firmware-nonfree = rpi-firmware-nonfree-src;
+      }
+    )
+    { };
+  raspberrypifw = prev.raspberrypifw.overrideAttrs (oldfw: { src = rpi-firmware-src; });
 
 } // {
   # rpi kernels and firmware are available at
-  # `pkgs.rpi-kernels.<VERSION>.{kernel,firmware,wireless-firmware}'. 
+  # `pkgs.rpi-kernels.<VERSION>.<BOARD>'. 
   #
-  # For example: `pkgs.rpi-kernels.v5_15_87.kernel'
+  # For example: `pkgs.rpi-kernels.v6_6_78.bcm2712'
-  rpi-kernels = rpi-kernels [{
+  rpi-kernels = rpi-kernels (
-    version = "6.6.28";
+    final.lib.cartesianProduct
-    kernel = rpi-linux-6_6-src;
+      { board = boards; version = (builtins.attrNames versions); }
-    fw = rpi-firmware-src;
+  );
-    wireless-fw = import ./raspberrypi-wireless-firmware.nix {
-      bluez-firmware = rpi-bluez-firmware-src;
-      firmware-nonfree = rpi-firmware-nonfree-src;
-    };
-    argsOverride = {
-      structuredExtraConfig = with prev.lib.kernel; {
-        # The perl script to generate kernel options sets unspecified
-        # parameters to `m` if possible [1]. This results in the
-        # unspecified config option KUNIT [2] getting set to `m` which
-        # causes DRM_VC4_KUNIT_TEST [3] to get set to `y`.
-        #
-        # This vc4 unit test fails on boot due to a null pointer
-        # exception with the existing config. I'm not sure why, but in
-        # any case, the DRM_VC4_KUNIT_TEST config option itself states
-        # that it is only useful for kernel developers working on the
-        # vc4 driver. So, I feel no need to deviate from the standard
-        # rpi kernel and attempt to successfully enable this test and
-        # other unit tests because the nixos perl script has this
-        # sloppy "default to m" behavior. So, I set KUNIT to `n`.
-        #
-        # [1] https://github.com/NixOS/nixpkgs/blob/85bcb95aa83be667e562e781e9d186c57a07d757/pkgs/os-specific/linux/kernel/generate-config.pl#L1-L10
-        # [2] https://github.com/raspberrypi/linux/blob/1.20230405/lib/kunit/Kconfig#L5-L14
-        # [3] https://github.com/raspberrypi/linux/blob/bb63dc31e48948bc2649357758c7a152210109c4/drivers/gpu/drm/vc4/Kconfig#L38-L52
-        KUNIT = no;
-        GPIO_PWM = no;
-      };
-    };
-  }] // {
-    latest = final.rpi-kernels."${latest}";
-  };
 }

overlays/libcamera-apps.nix

@@ -1,43 +0,0 @@
-{ libcamera-apps-src
-, lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, meson
-, pkg-config
-, libjpeg
-, libtiff
-, libpng
-, libcamera
-, libepoxy
-, boost
-, libexif
-, ninja
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libcamera-apps";
-  version = "v1.4.1";
-
-  src = libcamera-apps-src;
-
-  nativeBuildInputs = [ meson pkg-config ];
-  buildInputs = [ libjpeg libtiff libcamera libepoxy boost libexif libpng ninja ];
-  mesonFlags = [
-    "-Denable_qt=false"
-    "-Denable_opencv=false"
-    "-Denable_tflite=false"
-    "-Denable_drm=true"
-  ];
-  # Meson is no longer able to pick up Boost automatically.
-  # https://github.com/NixOS/nixpkgs/issues/86131
-  BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
-  BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
-
-  meta = with lib; {
-    description = "Userland tools interfacing with Raspberry Pi cameras";
-    homepage = "https://github.com/raspberrypi/libcamera-apps";
-    license = licenses.bsd2;
-    platforms = [ "aarch64-linux" ];
-  };
-}

overlays/libcamera.nix

@@ -1,17 +1,16 @@
-{ libcamera-apps-src
+{ rpicam-apps-src
 , libcamera-src
 , libpisp-src
 , ...
 }:
-final: prev:
+final: prev: {
-{
+  # A recent known working version of rpicam-apps
-  # A recent known working version of libcamera-apps
   libcamera-apps =
-    final.callPackage ./libcamera-apps.nix { inherit libcamera-apps-src; };
+    final.callPackage ./rpicam-apps.nix { inherit rpicam-apps-src; };
 
   libpisp = final.stdenv.mkDerivation {
     name = "libpisp";
-    version = "1.0.3";
+    version = "1.0.7";
     src = libpisp-src;
     nativeBuildInputs = with final; [ pkg-config meson ninja ];
     buildInputs = with final; [ nlohmann_json boost ];
@@ -22,9 +21,37 @@ final: prev:
   };
 
   libcamera = prev.libcamera.overrideAttrs (old: {
-    version = "0.1.0";
+    version = "0.3.1";
     src = libcamera-src;
-    buildInputs = old.buildInputs ++ (with final; [ libpisp ]);
+    buildInputs = old.buildInputs ++ (with final; [
+      libpisp
+      openssl
+      libtiff
+      (python3.withPackages (ps: with ps; [
+        python3-gnutls
+        pybind11
+        pyyaml
+        ply
+      ]))
+      libglibutil
+      gst_all_1.gst-plugins-base
+    ]);
     patches = [ ];
+    postPatch = ''
+      patchShebangs src/py/ utils/
+    '';
+    mesonFlags = [
+      "--buildtype=release"
+      "-Dpipelines=rpi/vc4,rpi/pisp"
+      "-Dipas=rpi/vc4,rpi/pisp"
+      "-Dv4l2=true"
+      "-Dgstreamer=enabled"
+      "-Dtest=false"
+      "-Dlc-compliance=disabled"
+      "-Dcam=disabled"
+      "-Dqcam=disabled"
+      "-Ddocumentation=enabled"
+      "-Dpycamera=enabled"
+    ];
   });
 }

overlays/raspberrypi-wireless-firmware.nix

@@ -1,9 +1,9 @@
 { bluez-firmware, firmware-nonfree }:
-{ lib, stdenvNoCC, fetchFromGitHub }:
+{ lib, stdenvNoCC }:
 
 stdenvNoCC.mkDerivation {
   pname = "raspberrypi-wireless-firmware";
-  version = "2023-11-15";
+  version = "2024-02-26";
 
   srcs = [ ];
 

overlays/rpicam-apps.nix

@@ -0,0 +1,30 @@
+{ rpicam-apps-src, lib, pkgs, stdenv }:
+
+stdenv.mkDerivation {
+  pname = "libcamera-apps";
+  version = "v1.5.0";
+
+  src = rpicam-apps-src;
+
+  nativeBuildInputs = with pkgs; [ meson pkg-config ];
+  buildInputs = with pkgs; [ libjpeg libtiff libcamera libepoxy boost libexif libpng ffmpeg libdrm ninja ];
+  mesonFlags = [
+    "-Denable_qt=disabled"
+    "-Denable_opencv=disabled"
+    "-Denable_tflite=disabled"
+    "-Denable_egl=disabled"
+    "-Denable_hailo=disabled"
+    "-Denable_drm=enabled"
+  ];
+  # Meson is no longer able to pick up Boost automatically.
+  # https://github.com/NixOS/nixpkgs/issues/86131
+  BOOST_INCLUDEDIR = "${lib.getDev pkgs.boost}/include";
+  BOOST_LIBRARYDIR = "${lib.getLib pkgs.boost}/lib";
+
+  meta = with lib; {
+    description = "Userland tools interfacing with Raspberry Pi cameras";
+    homepage = "https://github.com/raspberrypi/libcamera-apps";
+    license = licenses.bsd2;
+    platforms = [ "aarch64-linux" ];
+  };
+}

rpi/config.nix

@@ -93,7 +93,7 @@ in
                 };
               };
               base-dt-params = lib.mkOption {
-                type = with lib.types; attrsOf (submodule rpi-config-param);
+                type = with lib.types; attrsOf (submodule dt-param);
                 default = { };
                 example = {
                   i2c = {

rpi/default.nix

@@ -1,14 +1,37 @@
 { pinned, core-overlay, libcamera-overlay }:
 { lib, pkgs, config, ... }:
 
-let cfg = config.raspberry-pi-nix;
+let
+  cfg = config.raspberry-pi-nix;
+  version = cfg.kernel-version;
+  board = cfg.board;
+  kernel = config.system.build.kernel;
+  initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
 in
 {
-  imports = [ ../sd-image ./config.nix ./i2c.nix ];
+  imports = [ ./config.nix ./i2c.nix ];
 
   options = with lib; {
     raspberry-pi-nix = {
-      pin-kernel = {
+      kernel-version = mkOption {
+        default = "v6_6_51";
+        type = types.str;
+        description = "Kernel version to build.";
+      };
+      board = mkOption {
+        type = types.enum [ "bcm2711" "bcm2712" ];
+        description = ''
+          The kernel board version to build.
+          Examples at: https://www.raspberrypi.com/documentation/computers/linux_kernel.html#native-build-configuration
+          without the _defconfig part.
+        '';
+      };
+      firmware-partition-label = mkOption {
+        default = "FIRMWARE";
+        type = types.str;
+        description = "label of rpi firmware partition";
+      };
+      pin-inputs = {
         enable = mkOption {
           default = true;
           type = types.bool;
@@ -38,7 +61,7 @@ in
       };
       uboot = {
         enable = mkOption {
-          default = true;
+          default = false;
           type = types.bool;
           description = ''
             If enabled then uboot is used as the bootloader. If disabled
@@ -51,24 +74,25 @@ in
             cm4 with an nvme drive.
           '';
         };
+
+        package = mkPackageOption pkgs "uboot-rpi-arm64" { };
+      };
+      serial-console = {
+        enable = mkOption {
+          default = true;
+          type = types.bool;
+          description = ''
+            Whether to enable a console on serial0.
+
+            Corresponds with raspi-config's setting
+            "Would you like a login shell to be accessible over serial?"
+          '';
+        };
       };
     };
   };
 
   config = {
-    boot.kernelParams =
-      if cfg.uboot.enable then [ ]
-      else [
-        # This is ugly and fragile, but the sdImage image has an msdos
-        # table, so the partition table id is a 1-indexed hex
-        # number. So, we drop the hex prefix and stick on a "02" to
-        # refer to the root partition.
-        "root=PARTUUID=${lib.strings.removePrefix "0x" config.sdImage.firmwarePartitionID}-02"
-        "rootfstype=ext4"
-        "fsck.repair=yes"
-        "rootwait"
-        "init=/sbin/init"
-      ];
     systemd.services = {
       "raspberry-pi-firmware-migrate" =
         {
@@ -87,7 +111,7 @@ in
             {
               Type = "oneshot";
               MountImages =
-                "/dev/disk/by-label/${config.sdImage.firmwarePartitionName}:${firmware-path}";
+                "/dev/disk/by-label/${cfg.firmware-partition-label}:${firmware-path}";
               StateDirectory = "raspberrypi-firmware";
               ExecStart = pkgs.writeShellScript "migrate-rpi-firmware" ''
                 shopt -s nullglob
@@ -95,8 +119,7 @@ in
                 TARGET_FIRMWARE_DIR="${firmware-path}"
                 TARGET_OVERLAYS_DIR="$TARGET_FIRMWARE_DIR/overlays"
                 TMPFILE="$TARGET_FIRMWARE_DIR/tmp"
-                UBOOT="${pkgs.uboot_rpi_arm64}/u-boot.bin"
+                KERNEL="${kernel}/${config.system.boot.loader.kernelFile}"
-                KERNEL="${pkgs.rpi-kernels.latest.kernel}/Image"
                 SHOULD_UBOOT=${if cfg.uboot.enable then "1" else "0"}
                 SRC_FIRMWARE_DIR="${pkgs.raspberrypifw}/share/raspberrypi/boot"
                 STARTFILES=("$SRC_FIRMWARE_DIR"/start*.elf)
@@ -107,24 +130,28 @@ in
                 SRC_OVERLAYS=("$SRC_OVERLAYS_DIR"/*)
                 CONFIG="${config.hardware.raspberry-pi.config-output}"
 
-                migrate_uboot() {
+                ${lib.strings.optionalString cfg.uboot.enable ''
-                  echo "migrating uboot"
+                  UBOOT="${cfg.uboot.package}/u-boot.bin"
-                  touch "$STATE_DIRECTORY/uboot-migration-in-progress"
+
-                  cp "$UBOOT" "$TMPFILE"
+                  migrate_uboot() {
-                  mv -T "$TMPFILE" "$TARGET_FIRMWARE_DIR/u-boot-rpi-arm64.bin"
+                    echo "migrating uboot"
-                  echo "${
+                    touch "$STATE_DIRECTORY/uboot-migration-in-progress"
-                    builtins.toString pkgs.uboot_rpi_arm64
+                    cp "$UBOOT" "$TMPFILE"
-                  }" > "$STATE_DIRECTORY/uboot-version"
+                    mv -T "$TMPFILE" "$TARGET_FIRMWARE_DIR/u-boot-rpi-arm64.bin"
-                  rm "$STATE_DIRECTORY/uboot-migration-in-progress"
+                    echo "${builtins.toString cfg.uboot.package}" > "$STATE_DIRECTORY/uboot-version"
-                }
+                    rm "$STATE_DIRECTORY/uboot-migration-in-progress"
+                  }
+                ''}
 
                 migrate_kernel() {
                   echo "migrating kernel"
                   touch "$STATE_DIRECTORY/kernel-migration-in-progress"
                   cp "$KERNEL" "$TMPFILE"
                   mv -T "$TMPFILE" "$TARGET_FIRMWARE_DIR/kernel.img"
+                  cp "${initrd}" "$TMPFILE"
+                  mv -T "$TMPFILE" "$TARGET_FIRMWARE_DIR/initrd"
                   echo "${
-                    builtins.toString pkgs.rpi-kernels.latest.kernel
+                    builtins.toString kernel
                   }" > "$STATE_DIRECTORY/kernel-version"
                   rm "$STATE_DIRECTORY/kernel-migration-in-progress"
                 }
@@ -173,14 +200,16 @@ in
                   rm "$STATE_DIRECTORY/firmware-migration-in-progress"
                 }
 
-                if [[ "$SHOULD_UBOOT" -eq 1 ]] && [[ -f "$STATE_DIRECTORY/uboot-migration-in-progress" || ! -f "$STATE_DIRECTORY/uboot-version" || $(< "$STATE_DIRECTORY/uboot-version") != ${
+                ${lib.strings.optionalString cfg.uboot.enable ''
-                  builtins.toString pkgs.uboot_rpi_arm64
+                  if [[ "$SHOULD_UBOOT" -eq 1 ]] && [[ -f "$STATE_DIRECTORY/uboot-migration-in-progress" || ! -f "$STATE_DIRECTORY/uboot-version" || $(< "$STATE_DIRECTORY/uboot-version") != ${
-                } ]]; then
+                    builtins.toString cfg.uboot.package
-                  migrate_uboot
+                  } ]]; then
-                fi
+                    migrate_uboot
+                  fi
+                ''}
 
                 if [[ "$SHOULD_UBOOT" -ne 1 ]] && [[ ! -f "$STATE_DIRECTORY/kernel-version" || $(< "$STATE_DIRECTORY/kernel-version") != ${
-                  builtins.toString pkgs.rpi-kernels.latest.kernel
+                  builtins.toString kernel
                 } ]]; then
                   migrate_kernel
                 fi
@@ -234,6 +263,14 @@ in
             enable = true;
             value = if cfg.uboot.enable then "u-boot-rpi-arm64.bin" else "kernel.img";
           };
+          ramfsfile = {
+            enable = !cfg.uboot.enable;
+            value = "initrd";
+          };
+          ramfsaddr = {
+            enable = !cfg.uboot.enable;
+            value = -1;
+          };
           arm_64bit = {
             enable = true;
             value = true;
@@ -269,26 +306,50 @@ in
     };
 
     nixpkgs = {
-      overlays = [ core-overlay ]
+      overlays =
-        ++ (if config.raspberry-pi-nix.libcamera-overlay.enable
+        let
-      then [ libcamera-overlay ] else [ ]);
+          rpi-overlays = [ core-overlay ]
+            ++ (if config.raspberry-pi-nix.libcamera-overlay.enable
+          then [ libcamera-overlay ] else [ ]);
+          rpi-overlay = lib.composeManyExtensions rpi-overlays;
+          pin-prev-overlay = overlay: pinned-prev: final: prev:
+            let
+              # apply the overlay to pinned-prev and fix that so no references to the actual final
+              # and prev appear in applied-overlay
+              applied-overlay =
+                lib.fix (final: pinned-prev // overlay final pinned-prev);
+              # We only want to set keys that appear in the overlay, so restrict applied-overlay to
+              # these keys
+              restricted-overlay = lib.getAttrs (builtins.attrNames (overlay { } { })) applied-overlay;
+            in
+            prev // restricted-overlay;
+        in
+        if cfg.pin-inputs.enable
+        then [ (pin-prev-overlay rpi-overlay pinned) ]
+        else [ rpi-overlay ];
     };
     boot = {
-      initrd.availableKernelModules = [
+      kernelParams =
-        "usbhid"
+        if cfg.uboot.enable then [ ]
-        "usb_storage"
+        else builtins.concatLists [
-        "vc4"
+          [ "console=tty1" ]
-        "pcie_brcmstb" # required for the pcie bus to work
+          (if cfg.serial-console.enable then [
-        "reset-raspberrypi" # required for vl805 firmware to load
+            # https://github.com/raspberrypi/firmware/issues/1539#issuecomment-784498108
-      ];
+            "console=serial0,115200n8"
-      # This pin is not necessary, it would be fine to replace it with
+          ] else [ ]
-      # `pkgs.rpi-kernels.latest.kernel`. It is helpful to ensure
+          )
-      # cache hits for kernel builds though.
+          [ "init=/sbin/init" ]
-      kernelPackages =
+        ];
-        if cfg.pin-kernel.enable
+      initrd = {
-        then pinned.linuxPackagesFor (pinned.rpi-kernels.latest.kernel)
+        availableKernelModules = [
-        else pkgs.linuxPackagesFor (pkgs.rpi-kernels.latest.kernel);
+          "usbhid"
-
+          "usb_storage"
+          "vc4"
+          "pcie_brcmstb" # required for the pcie bus to work
+          "reset-raspberrypi" # required for vl805 firmware to load
+        ];
+      };
+      kernelPackages = pkgs.linuxPackagesFor pkgs.rpi-kernels."${version}"."${board}";
       loader = {
         grub.enable = lib.mkDefault false;
         initScript.enable = !cfg.uboot.enable;
@@ -302,6 +363,8 @@ in
     };
     hardware.enableRedistributableFirmware = true;
 
+    users.groups = builtins.listToAttrs (map (k: { name = k; value = { }; })
+      [ "input" "sudo" "plugdev" "games" "netdev" "gpio" "i2c" "spi" ]);
     services = {
       udev.extraRules =
         let shell = "${pkgs.bash}/bin/bash";

sd-image/default.nix

@@ -8,8 +8,16 @@
 
     boot.consoleLogLevel = lib.mkDefault 7;
 
-    # https://github.com/raspberrypi/firmware/issues/1539#issuecomment-784498108
+    boot.kernelParams = [
-    boot.kernelParams = [ "console=serial0,115200n8" "console=tty1" ];
+      # This is ugly and fragile, but the sdImage image has an msdos
+      # table, so the partition table id is a 1-indexed hex
+      # number. So, we drop the hex prefix and stick on a "02" to
+      # refer to the root partition.
+      "root=PARTUUID=${lib.strings.removePrefix "0x" config.sdImage.firmwarePartitionID}-02"
+      "rootfstype=ext4"
+      "fsck.repair=yes"
+      "rootwait"
+    ];
 
     sdImage =
       let
@@ -19,13 +27,19 @@
             ${lib.strings.concatStringsSep " " config.boot.kernelParams}
           '';
         };
+        cfg = config.raspberry-pi-nix;
+        version = cfg.kernel-version;
+        board = cfg.board;
+        kernel = "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
+        initrd = "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
         populate-kernel =
-          if config.raspberry-pi-nix.uboot.enable
+          if cfg.uboot.enable
           then ''
-            cp ${pkgs.uboot_rpi_arm64}/u-boot.bin firmware/u-boot-rpi-arm64.bin
+            cp ${cfg.uboot.package}/u-boot.bin firmware/u-boot-rpi-arm64.bin
           ''
           else ''
-            cp "${pkgs.rpi-kernels.latest.kernel}/Image" firmware/kernel.img
+            cp "${kernel}" firmware/kernel.img
+            cp "${initrd}" firmware/initrd
             cp "${kernel-params}" firmware/cmdline.txt
           '';
       in
@@ -36,7 +50,7 @@
           cp ${config.hardware.raspberry-pi.config-output} firmware/config.txt
         '';
         populateRootCommands =
-          if config.raspberry-pi-nix.uboot.enable
+          if cfg.uboot.enable
           then ''
             mkdir -p ./files/boot
             ${config.boot.loader.generic-extlinux-compatible.populateCmd} -c ${config.system.build.toplevel} -d ./files/boot

sd-image/sd-image.nix

@@ -30,7 +30,8 @@ let
   } // optionalAttrs (config.sdImage.rootPartitionUUID != null) {
     uuid = config.sdImage.rootPartitionUUID;
   });
-in {
+in
+{
   imports = [ ];
 
   options.sdImage = {
@@ -82,14 +83,6 @@ in {
       '';
     };
 
-    firmwarePartitionName = mkOption {
-      type = types.str;
-      default = "FIRMWARE";
-      description = ''
-        Name of the filesystem which holds the boot firmware.
-      '';
-    };
-
     rootPartitionUUID = mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -160,7 +153,7 @@ in {
   config = {
     fileSystems = {
       "/boot/firmware" = {
-        device = "/dev/disk/by-label/${config.sdImage.firmwarePartitionName}";
+        device = "/dev/disk/by-label/${config.raspberry-pi-nix.firmware-partition-label}";
         fsType = "vfat";
       };
       "/" = {
@@ -226,7 +219,7 @@ in {
             # Create a FAT32 /boot/firmware partition of suitable size into firmware_part.img
             eval $(partx $img -o START,SECTORS --nr 1 --pairs)
             truncate -s $((SECTORS * 512)) firmware_part.img
-            faketime "1970-01-01 00:00:00" mkfs.vfat -i ${config.sdImage.firmwarePartitionID} -n ${config.sdImage.firmwarePartitionName} firmware_part.img
+            faketime "1970-01-01 00:00:00" mkfs.vfat -i ${config.sdImage.firmwarePartitionID} -n ${config.raspberry-pi-nix.firmware-partition-label} firmware_part.img
 
             # Populate the files intended for /boot/firmware
             mkdir firmware
@@ -244,7 +237,8 @@ in {
                 zstd -T$NIX_BUILD_CORES --rm $img
             fi
           '';
-        }) { };
+        })
+      { };
 
     boot.postBootCommands = lib.mkIf config.sdImage.expandOnBoot ''
       # On the first boot do some maintenance tasks
@@ -254,7 +248,7 @@ in {
         # Figure out device names for the boot device and root filesystem.
         rootPart=$(${pkgs.util-linux}/bin/findmnt -n -o SOURCE /)
         bootDevice=$(lsblk -npo PKNAME $rootPart)
-        partNum=$(lsblk -npo MAJ:MIN $rootPart | ${pkgs.gawk}/bin/awk -F: '{print $2}')
+        partNum=$(lsblk -npo PARTN $rootPart)
 
         # Resize the root partition and the filesystem to fit the disk
         echo ",+," | sfdisk -N$partNum --no-reread $bootDevice