petabyt · hqnicolas · Aug 1, 2026 · Aug 1, 2026 · Aug 1, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1,19 +1,92 @@
-name: make all
+name: build and check
 
 on:
   push:
     branches: [ master ]
-  pull_request:
-    branches: [ master ]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RK_RUNNER_LABELS || '["self-hosted","Linux","X64"]') }}
+    timeout-minutes: 30
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v7
       with:
         submodules: recursive
+        persist-credentials: false
     - name: Install deps
-      run: sudo apt update && sudo apt install -y gcc make gcc-aarch64-linux-gnu libusb-1.0-0-dev device-tree-compiler
-    - name: make all
-      run: make SHELL=/bin/bash all -j`nproc`
+      run: sudo apt-get update && sudo apt-get install -y git gcc make gcc-aarch64-linux-gnu pkg-config libusb-1.0-0-dev device-tree-compiler python3 xxd xz-utils
+    - name: Clean-clone build and checks
+      run: make SHELL=/bin/bash check -j"$(nproc)"
+
+  chainload:
+    name: chainload (${{ matrix.board }})
+    runs-on: ${{ fromJSON(vars.RK_RUNNER_LABELS || '["self-hosted","Linux","X64"]') }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        board: [yy3568, rock3a]
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        submodules: recursive
+        persist-credentials: false
+    - name: Install U-Boot and firmware dependencies
+      run: >-
+        sudo apt-get update && sudo apt-get install -y
+        git gcc make gcc-aarch64-linux-gnu pkg-config bc bison flex swig
+        libssl-dev libgnutls28-dev python3 python3-dev python3-setuptools
+        python3-pyelftools device-tree-compiler libusb-1.0-0-dev xxd xz-utils
+    - name: Fetch manifest-pinned U-Boot source
+      shell: bash
+      env:
+        BOARD: ${{ matrix.board }}
+      run: |
+        set -euo pipefail
+        manifest=tools/chainload-manifest.py
+        repository=$(python3 "${manifest}" get "${BOARD}" uboot.repository)
+        ref=$(python3 "${manifest}" get "${BOARD}" uboot.ref)
+        commit=$(python3 "${manifest}" get "${BOARD}" uboot.commit)
+        source_dir=$(mktemp -d "${RUNNER_TEMP}/u-boot-${BOARD}.XXXXXX")
+        git init "${source_dir}"
+        git -C "${source_dir}" remote add origin "${repository}"
+        git -C "${source_dir}" fetch --depth=1 origin "${ref}"
+        git -C "${source_dir}" cat-file -e "${commit}^{commit}"
+        test "$(git -C "${source_dir}" rev-parse 'FETCH_HEAD^{commit}')" = "${commit}"
+        echo "UBOOT_SRC=${source_dir}" >> "${GITHUB_ENV}"
+    - name: Build twice and verify reproducibility
+      shell: bash
+      env:
+        BOARD: ${{ matrix.board }}
+      run: |
+        set -euo pipefail
+        make SHELL=/bin/bash chainload BOARD="${BOARD}" -j"$(nproc)"
+        read -ra first_outputs <<< "$(python3 tools/chainload-manifest.py artifacts "${BOARD}")"
+        for artifact in "${first_outputs[@]}"; do
+          cp "${artifact}" "${RUNNER_TEMP}/first-${artifact}"
+        done
+        make SHELL=/bin/bash clean
+        make SHELL=/bin/bash chainload BOARD="${BOARD}" -j"$(nproc)"
+        for artifact in "${first_outputs[@]}"; do
+          cmp "${RUNNER_TEMP}/first-${artifact}" "${artifact}"
+        done
+
+        mkimage="build/chainload/${BOARD}/source/tools/mkimage"
+        ddr=$(python3 tools/chainload-manifest.py get "${BOARD}" boot_media.ddr)
+        binary=$(python3 tools/chainload-manifest.py get "${BOARD}" artifacts.binary)
+        idblock=$(python3 tools/chainload-manifest.py get "${BOARD}" artifacts.idblock)
+        spi=$(python3 tools/chainload-manifest.py get "${BOARD}" artifacts.spi_nor)
+        "${mkimage}" -n rk3568 -T rksd -d "${ddr}:${binary}" \
+          "${RUNNER_TEMP}/reference-idblock.img"
+        "${mkimage}" -n rk3568 -T rkspi -d "${ddr}:${binary}" \
+          "${RUNNER_TEMP}/reference-spi.img"
+        cmp "${RUNNER_TEMP}/reference-idblock.img" "${idblock}"
+        cmp "${RUNNER_TEMP}/reference-spi.img" "${spi}"
+        make SHELL=/bin/bash chainload-check BOARD="${BOARD}"
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -1,15 +1,24 @@
 name: docs
+
 on:
   push:
     branches:
       - master
-      - main
+
+permissions:
+  contents: write
+
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: ${{ fromJSON(vars.RK_RUNNER_LABELS || '["self-hosted","Linux","X64"]') }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
-        with:
-          python-version: 3.x
-      - run: pip3 install mkdocs pymdown-extensions --break-system-packages && mkdocs gh-deploy --force
+      - uses: actions/checkout@v7
+      - name: Install documentation dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y python3 python3-pip python3-venv
+          python3 -m venv "${RUNNER_TEMP}/docs-venv"
+          "${RUNNER_TEMP}/docs-venv/bin/pip" install mkdocs pymdown-extensions
+      - name: Deploy documentation
+        run: |
+          "${RUNNER_TEMP}/docs-venv/bin/mkdocs" gh-deploy --force
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -0,0 +1,185 @@
+name: release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ${{ fromJSON(vars.RK_RUNNER_LABELS || '["self-hosted","Linux","X64"]') }}
+    timeout-minutes: 120
+    permissions:
+      contents: write
+    steps:
+      - name: Check out tagged source
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          submodules: recursive
+          persist-credentials: false
+
+      - name: Validate release tag
+        id: metadata
+        shell: bash
+        run: |
+          set -euo pipefail
+          tag=${GITHUB_REF_NAME}
+          if [[ ! ${tag} =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "release tags must use stable SemVer: vMAJOR.MINOR.PATCH" >&2
+            exit 1
+          fi
+
+          tag_commit=$(git rev-list -n 1 "${tag}")
+          if [[ $(git rev-parse HEAD) != "${tag_commit}" ]]; then
+            echo "checked-out commit does not match ${tag}" >&2
+            exit 1
+          fi
+          if ! git show-ref --verify --quiet refs/remotes/origin/master; then
+            echo "origin/master was not fetched by the full checkout" >&2
+            exit 1
+          fi
+          if ! git merge-base --is-ancestor "${tag_commit}" refs/remotes/origin/master; then
+            echo "${tag} does not point to a commit contained in origin/master" >&2
+            exit 1
+          fi
+
+          echo "version=${tag}" >> "${GITHUB_OUTPUT}"
+
+      - name: Install build dependencies
+        run: >-
+          sudo apt-get update && sudo apt-get install -y
+          git gh gcc make gcc-aarch64-linux-gnu pkg-config libusb-1.0-0-dev
+          device-tree-compiler python3 python3-dev python3-setuptools
+          python3-pyelftools bc bison flex swig libssl-dev libgnutls28-dev
+          xxd xz-utils
+
+      - name: Build and test tagged source
+        run: make SHELL=/bin/bash check -j"$(nproc)"
+
+      - name: Build release assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          make SHELL=/bin/bash chainload BOARD=yy3568 -j"$(nproc)"
+          make SHELL=/bin/bash chainload-check BOARD=yy3568
+          make SHELL=/bin/bash chainload BOARD=rock3a -j"$(nproc)"
+          make SHELL=/bin/bash chainload-check BOARD=rock3a
+          CHAINLOAD_RELEASE=1 make SHELL=/bin/bash release-dist \
+            VERSION="${{ steps.metadata.outputs.version }}" DIST_DIR=dist -j"$(nproc)"
+
+      - name: Verify release assets
+        shell: bash
+        run: |
+          set -euo pipefail
+          version=${{ steps.metadata.outputs.version }}
+          expected=(
+            "SHA256SUMS"
+            "rk-${version}-genbook.tar.xz"
+            "rk-${version}-pinebook-pro.tar.xz"
+            "rk-${version}-roc3566.tar.xz"
+            "rk-${version}-rock3a.tar.xz"
+            "rk-${version}-yy3568.tar.xz"
+          )
+          mapfile -t actual < <(find dist -mindepth 1 -maxdepth 1 -type f -printf '%f\n' | sort)
+          mapfile -t sorted_expected < <(printf '%s\n' "${expected[@]}" | sort)
+          diff -u <(printf '%s\n' "${sorted_expected[@]}") <(printf '%s\n' "${actual[@]}")
+          (cd dist && sha256sum -c SHA256SUMS)
+
+      - name: Publish GitHub release
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          VERSION: ${{ steps.metadata.outputs.version }}
+        run: |
+          set -euo pipefail
+
+          assets=(
+            "dist/rk-${VERSION}-genbook.tar.xz"
+            "dist/rk-${VERSION}-pinebook-pro.tar.xz"
+            "dist/rk-${VERSION}-roc3566.tar.xz"
+            "dist/rk-${VERSION}-rock3a.tar.xz"
+            "dist/rk-${VERSION}-yy3568.tar.xz"
+            "dist/SHA256SUMS"
+          )
+
+          load_release_record() {
+            local repo_owner=${GITHUB_REPOSITORY%%/*}
+            local repo_name=${GITHUB_REPOSITORY#*/}
+            local record
+            local query
+            release_id=
+            release_draft=
+            query='query($owner:String!,$name:String!,$tag:String!){repository(owner:$owner,name:$name){release(tagName:$tag){databaseId isDraft}}}'
+            record=$(gh api graphql \
+              -f query="${query}" \
+              -F owner="${repo_owner}" \
+              -F name="${repo_name}" \
+              -F tag="${VERSION}" \
+              --jq '.data.repository.release | select(. != null) | [.databaseId, .isDraft] | @tsv')
+            [[ -n ${record} ]] || return 0
+            IFS=$'\t' read -r release_id release_draft <<< "${record}"
+            if [[ ! ${release_id} =~ ^[0-9]+$ ]] ||
+              [[ ${release_draft} != true && ${release_draft} != false ]]; then
+              echo "GitHub returned malformed release metadata for ${VERSION}" >&2
+              exit 1
+            fi
+          }
+
+          compare_remote_assets() {
+            local release_id=$1
+            local local_assets=${RUNNER_TEMP}/local-release-assets.tsv
+            local remote_assets=${RUNNER_TEMP}/remote-release-assets.tsv
+            for asset in "${assets[@]}"; do
+              printf '%s\t%s\n' "$(basename "${asset}")" "$(stat -c %s "${asset}")"
+            done | sort > "${local_assets}"
+            gh api "repos/${GITHUB_REPOSITORY}/releases/${release_id}" \
+              --jq '.assets[] | [.name, (.size | tostring)] | @tsv' |
+              sort > "${remote_assets}"
+            diff -u "${local_assets}" "${remote_assets}"
+          }
+
+          load_release_record
+          if [[ -n ${release_id} ]]; then
+            if [[ ${release_draft} != true ]]; then
+              echo "published release ${VERSION} already exists and will not be modified"
+              compare_remote_assets "${release_id}"
+
+              published_dir=$(mktemp -d "${RUNNER_TEMP}/published-release.XXXXXX")
+              gh release download "${VERSION}" --dir "${published_dir}"
+              if ! cmp -s dist/SHA256SUMS "${published_dir}/SHA256SUMS"; then
+                echo "published release ${VERSION} has a different SHA256SUMS" >&2
+                exit 1
+              fi
+              (cd "${published_dir}" && sha256sum -c SHA256SUMS)
+              echo "published release ${VERSION} matches the rebuilt assets; retry is complete"
+              exit 0
+            fi
+            echo "removing stale unpublished draft for ${VERSION}"
+            gh release delete "${VERSION}" --yes
+          fi
+
+          draft_url=$(gh release create "${VERSION}" "${assets[@]}" \
+            --verify-tag \
+            --draft \
+            --generate-notes \
+            --title "rk ${VERSION}" \
+            --notes "Download the archive for your board and verify it with SHA256SUMS.")
+          printf '%s\n' "${draft_url}"
+
+          load_release_record
+          if [[ -z ${release_id} || ${release_draft} != true ]]; then
+            echo "new draft for ${VERSION} was not returned by GitHub's pending-tag lookup" >&2
+            exit 1
+          fi
+          compare_remote_assets "${release_id}"
+
+          gh release edit "${VERSION}" --draft=false --latest
diff --git a/.gitignore b/.gitignore
@@ -11,3 +11,8 @@ graveyard
 config.mk
 rk3588-drivers
 *.out.h
+/dist/
+/build/
+*.itb
+*-u-boot-source.tar.xz
+__pycache__/
diff --git a/Chainload-rk356x.ld b/Chainload-rk356x.ld
@@ -0,0 +1,41 @@
+ENTRY(_start)
+
+SECTIONS {
+	. = 0x00000000;
+	. = ALIGN(16);
+	.text : {
+		_text_start = .;
+		*(.text .text.*)
+		_text_end = .;
+	}
+	. = ALIGN(16);
+	.rodata : {
+		_rodata_start = .;
+		*(.rodata .rodata.*)
+		_rodata_end = .;
+	}
+	. = ALIGN(16);
+	.data : {
+		_data_start = .;
+		*(.data .data.*)
+		_data_end = .;
+	}
+	. = ALIGN(4096);
+	.bss : {
+		_bss_start = .;
+		*(.bss .bss.* COMMON)
+		_bss_end = .;
+	}
+	. = ALIGN(16);
+	.got : { *(.got .got.*) }
+	. = ALIGN(16);
+	_end_of_image = .;
+	_fit_start = .;
+	/DISCARD/ : {
+		*(.comment .comment.*)
+		*(.note .note.*)
+		*(.eh_frame .eh_frame.*)
+	}
+	ASSERT(_end_of_image < 0x00040000,
+		"RK356x chainloader exceeds the first BL31 load address")
+}