Merge branch 'master' into 24.04

2026-09-30 19:33:46 +08:00 · 2024-07-25 23:48:02 +03:00
parent 1ecdaf964b 48ea05d6db
commit 05405d8174
20 changed files with 3447 additions and 5178 deletions
@@ -0,0 +1,84 @@
+name: build
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && github.run_id || github.head_ref || github.ref }}-${{ github.workflow }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: build kernel and system
+    runs-on: namespace-profile-arm64-8x16-2004-caching
+    timeout-minutes: 60
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        lfs: true
+
+    - name: Get commit message
+      run: |
+        {
+          echo 'LAST_COMMIT_MESSAGE<<EOF'
+          if [ "${{ github.event_name }}" == "push" ]; then
+            echo "${{ github.event.head_commit.message }}"
+          elif [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            COMMIT_URL=$(echo "${{ github.event.repository.commits_url }}" | sed "s|{/sha}|/${{ github.sha }}|")
+            echo "$(curl -s "$COMMIT_URL" | jq -r '.commit.message')"
+          elif [ "${{ github.event_name }}" == "pull_request" ]; then
+            PR_COMMIT_URL=$(echo "${{ github.event.repository.commits_url }}" | sed "s|{/sha}|/${{ github.event.pull_request.head.sha }}|")
+            echo "$(curl -s "$PR_COMMIT_URL" | jq -r '.commit.message')"
+          fi
+          echo EOF
+        } | tee -a $GITHUB_ENV
+
+    - name: Get kernel submodule ref
+      id: kernel-submodule
+      run: echo "ref=$(git ls-tree HEAD | awk '$4 == "agnos-kernel-sdm845"' | awk '{print $3}')" | tee -a $GITHUB_OUTPUT
+
+    - name: Checkout agnos-kernel-sdm845
+      uses: actions/checkout@v4
+      with:
+        repository: commaai/agnos-kernel-sdm845
+        ref: ${{ steps.kernel-submodule.outputs.ref }}
+        path: agnos-kernel-sdm845
+
+    - name: ccache
+      uses: hendrikmuhs/ccache-action@c92f40bee50034e84c763e33b317c77adaa81c92
+      with:
+        key: kernel-${{ steps.kernel-submodule.outputs.ref }}
+        restore-keys: kernel-
+
+    - name: Build kernel
+      run: ./build_kernel.sh
+
+    - name: Upload artifact boot.img
+      uses: actions/upload-artifact@v4
+      if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
+      with:
+        name: boot.img
+        path: output/boot.img
+
+    - name: Upload artifact kernel modules
+      uses: actions/upload-artifact@v4
+      if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
+      with:
+        name: kernel-modules
+        path: output/*.ko
+
+    - name: Build system
+      run: ./build_system.sh
+
+    - name: Upload artifact system.img
+      uses: actions/upload-artifact@v4
+      if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
+      with:
+        name: system.img
+        path: output/system.img
@@ -1,17 +1,17 @@
 name: tests
 on:
  push:
+    branches: [ master ]
  pull_request:

 jobs:
  precommit:
    name: pre-commit
    runs-on: ubuntu-latest
-    timeout-minutes: 8
+    timeout-minutes: 1
    steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
      with:
-        python-version: '3.11.4'
-    - run: 'pip install pre-commit'
-    - run: 'pre-commit run --all'
+        python-version: '3.11'
+    - uses: pre-commit/action@v3.0.1
@@ -7,6 +7,7 @@ output/
 build/
 tmp/
 qdl/
+.ccache/
 .qemu_registered

 .vscode
@@ -19,7 +19,7 @@ repos:
    rev: v2.2.4
    hooks:
    -   id: codespell
-        exclude: '^(userspace/files/serviceproviders.xml)|(tools/)|(userspace/poetry.lock)'
+        exclude: '^(userspace/files/serviceproviders.xml)|(tools/)|(userspace/uv.lock)'
        args:
        # if you've got a short variable name that's getting flagged, add it here
        - -L bu,ro,te,ue,alo,hda,ois,nam,nams,ned,som,parm,setts,inout,warmup
@@ -36,11 +36,3 @@ repos:
        - --select=F,E112,E113,E304,E502,E701,E702,E703,E71,E72,E731,W191,W6
        - --statistics
        - -j4
-   repo: https://github.com/python-poetry/poetry
-    rev: '1.6.0'
-    hooks:
-    -   id: poetry-check
-        entry: bash -c "cd userspace && poetry check"
-        name: validate poetry lock
-        args:
-        - --lock
@@ -52,10 +52,6 @@ FROM agnos-compiler as agnos-compiler-ffmpeg
 COPY ./userspace/compile-ffmpeg.sh /tmp/agnos/
 RUN /tmp/agnos/compile-ffmpeg.sh

-FROM agnos-compiler as agnos-compiler-mapbox-gl-native
-COPY ./userspace/compile-mapbox-gl-native.sh /tmp/agnos/
-RUN /tmp/agnos/compile-mapbox-gl-native.sh
-
 FROM agnos-compiler as agnos-compiler-qtwayland5
 COPY ./userspace/compile-qtwayland5.sh /tmp/agnos/
 COPY ./userspace/qtwayland/patch* /tmp/agnos/
@@ -87,7 +83,6 @@ RUN /tmp/agnos/openpilot_python_dependencies.sh
 # Use other pre-compiled packages
 COPY --from=agnos-compiler-ffmpeg /tmp/ffmpeg.deb /tmp/ffmpeg.deb
 RUN cd /tmp && apt-get -o Dpkg::Options::="--force-overwrite" install -yq ./ffmpeg.deb
-COPY --from=agnos-compiler-mapbox-gl-native /tmp/libqmapboxgl.so /lib/aarch64-linux-gnu/libqmapboxgl.so

 RUN export PATH="/usr/local/pyenv/bin:/usr/local/pyenv/shims:$PATH" && \
    export PYENV_ROOT="/usr/local/pyenv" && \
@@ -99,18 +94,15 @@ RUN export PATH="/usr/local/pyenv/bin:/usr/local/pyenv/shims:$PATH" && \
    pyenv rehash

 # Install openpilot python packages
-COPY ./userspace/pyproject.toml ./userspace/poetry.lock /tmp/agnos/
+RUN mkdir -p /tmp/agnos/uv
+COPY ./userspace/pyproject.toml ./userspace/uv.lock /tmp/agnos/uv
 RUN export PATH="/usr/local/pyenv/bin:/usr/local/pyenv/shims:$PATH" && \
    export PYENV_ROOT="/usr/local/pyenv" && \
    eval "$(pyenv init -)" && \
    eval "$(pyenv virtualenv-init -)" && \
-    cd /tmp/agnos && \
-    poetry config virtualenvs.prefer-active-python true --local && \
-    poetry config virtualenvs.create false --local && \
+    cd /tmp/agnos/uv && \
    export PYOPENCL_CL_PRETEND_VERSION="2.0" && \
-    export POETRY_VIRTUALENVS_CREATE=false && \
-    MAKEFLAGS="-j$(nproc)" poetry install --no-cache --no-root && \
-    pyenv rehash
+    MAKEFLAGS="-j$(nproc)" UV_NO_CACHE=1 uv pip install --no-cache-dir --system .

 # Install nice to haves
 COPY ./userspace/install_extras.sh /tmp/agnos/
@@ -0,0 +1,35 @@
+FROM ubuntu:20.04
+
+ARG UNAME
+ARG UID
+ARG GID
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    python2 \
+    build-essential \
+    libssl-dev \
+    bc \
+    python-is-python2 \
+    openssl \
+    ccache \
+    android-sdk-libsparse-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN if [ ${UID:-0} -ne 0 ] && [ ${GID:-0} -ne 0 ]; then \
+    userdel -r `getent passwd ${UID} | cut -d : -f 1` > /dev/null 2>&1; \
+    groupdel -f `getent group ${GID} | cut -d : -f 1` > /dev/null 2>&1; \
+    groupadd -g ${GID} -o ${UNAME} && \
+    useradd -u $UID -g $GID ${UNAME} \
+;fi
+
+RUN CCACHE_PATH=$(which ccache) && \
+    ln -s $CCACHE_PATH /usr/local/bin/gcc && \
+    ln -s $CCACHE_PATH /usr/local/bin/g++ && \
+    ln -s $CCACHE_PATH /usr/local/bin/cc && \
+    ln -s $CCACHE_PATH /usr/local/bin/c++ && \
+    ln -s $CCACHE_PATH /usr/local/bin/clang
+
+ENTRYPOINT ["tail", "-f", "/dev/null"]
@@ -1,45 +1,77 @@
 # agnos-builder

-This is the tool to build AGNOS, our Ubuntu based OS. AGNOS runs on the [comma three devkit](https://comma.ai/shop/products/three).
+This is the buidler repo for AGNOS, our Ubuntu based OS. AGNOS runs on the comma three devkit and [comma 3X](https://comma.ai/shop/comma-3x).

 NOTE: the `edk2_tici` and `agnos-firmware` submodules are internal, private repos.

-## Setup
+## Development

-These tools are developed on and targeted for Ubuntu 24.04.
+Any system that supports a recent [Docker](https://docs.docker.com/get-docker/) should work.

 Run once to set things up:
 ```sh
+git clone https://github.com/commaai/agnos-builder.git
+
+cd agnos-builder
 git submodule update --init agnos-kernel-sdm845
 ./tools/extract_tools.sh
 sudo apt install img2simg
 ```

-## Build the userspace
-
-build:
-```sh
+Building
+```
+./build_kernel.sh
 ./build_system.sh
 ```

-load:
-```sh
+Flashing to a comma 3/3X:
+```
+./flash_kernel.sh
 ./flash_system.sh
 ```

-## Build the kernel
+Validating changes:
+* Running openpilot is a good smoketest for general AGNOS functionality
+* [CI](https://github.com/commaai/agnos-builder/blob/master/.github/workflows/build.yaml) ensures the kernel and system builds work (and pushes the images for you to download)
+* [this](https://github.com/commaai/agnos-builder/blob/master/internal/README.md) is the checklist we go through before shipping new AGNOS releases to openpilot

-build:
-```sh
-./build_kernel.sh
+### macOS
+
+Building the kernel on macOS requires `agnos-builder` to be in a [Case-sensitive](https://support.apple.com/lv-lv/guide/disk-utility/dsku19ed921c/mac) filesystem.
+
+Use this to set it up:
 ```
-
-load:
-```sh
-# flash over fastboot
-./flash_kernel.sh
-
-# or load into running system via ssh
-# ssh config needs host named 'tici'
-./load_kernel.sh
+diskutil apfs addVolume <disk> "Case-sensitive APFS" agnos
 ```
+* replace `<disk>` with the `synthesized` disk in `diskutil list` that includes your main volume (e.g. Macintosh HD) - usually `disk3` on M-series Macs, `disk1` on Intel Macs
+* `agnos` is the name of the new volume - can be replaced with an arbitrary name
+* the volume is mounted automatically in `/Volumes/agnos`
+
+## Contributing
+
+Join us in the `#dev-agnos` channel on [Discord](https://discord.comma.ai).
+
+A comma 3/3X is helpful for working on AGNOS, but there's still lots of interesting work to do without one.
+
+* [Discord](https://discord.comma.ai)
+* [openpilot Docs](https://docs.comma.ai)
+* [Bounties](https://comma.ai/bounties)
+
+### Roadmap
+
+AGNOS's main priority is to provide a stable platform to [openpilot](https://github.com/commaai/openpilot).
+The second priority is to be a good platform for all sorts of [robotics development](https://blog.comma.ai/a-drive-in-the-office/).
+
+Now that AGNOS is good at running openpilot, the next things up are:
+* speedups: build system, CI, boot time, etc.
+* cleanups: Android kernel to mainline kernel, simplify the build system, etc.
+* open source: AGNOS started with a bunch blobs for various things, like the bootloaders and weston. We want to move everything we can to open source versions built in this repo.
+
+Some concrete things on the roadmap:
+- [ ] <10s boot time https://github.com/commaai/agnos-builder/issues/110, https://github.com/commaai/openpilot/issues/30894
+- [ ] make the image tiny, for fast updating and flashing https://github.com/commaai/agnos-builder/issues/225
+- [ ] update to Ubuntu 24.04 https://github.com/commaai/openpilot/issues/32386
+- [ ] mainline Linux kernel https://github.com/commaai/openpilot/issues/32386
+- [ ] fully open source
+  - [ ] anything from `agnos-firmware`: XBL, ABL, etc.
+  - [ ] open source Weston https://github.com/commaai/agnos-builder/issues/16
@@ -1,71 +1,112 @@
-#!/bin/bash -e
+#!/bin/bash
+set -e

 DEFCONFIG=tici_defconfig

 # Get directories and make sure we're in the correct spot to start the build
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
-ARCH=$(uname -m)
 TOOLS=$DIR/tools
 TMP_DIR=/tmp/agnos-builder-tmp
 OUTPUT_DIR=$DIR/output
 BOOT_IMG=./boot.img
 cd $DIR

+if [[ "$(uname)" == 'Darwin' ]]; then
+  BASE_VOLUME_PATH=$(echo $DIR | grep -o "^/Volumes/[^/]*" || echo "/")
+  if ! diskutil info -plist $BASE_VOLUME_PATH | grep -q "<string>Case-sensitive APFS</string>"; then
+    echo "---------------   macOS support   ---------------"
+    echo "Ensure you are in a Case-sensitive APFS volume to build the AGNOS kernel."
+    echo "https://github.com/commaai/agnos-builder?tab=readme-ov-file#macos"
+    echo "-------------------------------------------------"
+    exit 1
+  fi
+fi
+
+# Setup kernel build container
+echo "Building agnos-meta-builder docker image"
+docker build -f Dockerfile.builder -t agnos-meta-builder $DIR \
+  --build-arg UNAME=$(id -nu) \
+  --build-arg UID=$(id -u) \
+  --build-arg GID=$(id -g)
+echo "Starting agnos-meta-builder container"
+CONTAINER_ID=$(docker run -d -v $DIR:$DIR -w $DIR agnos-meta-builder)
+
+# Cleanup container on exit
+trap "echo \"Cleaning up container:\"; \
+docker container rm -f $CONTAINER_ID" EXIT
+
 # Clone kernel if not done already
 if git submodule status --cached agnos-kernel-sdm845/ | grep "^-"; then
+  echo "Cloning agnos-kernel-sdm845"
  git submodule update --init agnos-kernel-sdm845
 fi
-cd agnos-kernel-sdm845

-if [ "$ARCH" != "arm64" ] && [ "$ARCH" != "aarch64" ]; then
-  $DIR/tools/extract_tools.sh
+$DIR/tools/extract_tools.sh
+
+build_kernel() {
+  cd agnos-kernel-sdm845

  # Build parameters
+  ARCH=$(uname -m)
+  if [ "$ARCH" != "arm64" ] && [ "$ARCH" != "aarch64" ]; then
+    export CROSS_COMPILE=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-
+    export CC=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-gcc
+    export LD=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-ld.bfd
+  fi
+
+  # Build arm64 arch
  export ARCH=arm64
-  export CROSS_COMPILE=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-
-  export CC=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-gcc
-  export LD=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-ld.bfd
-fi

-# these do anything?
-export KCFLAGS="-w"
+  # Set ccache dir
+  export CCACHE_DIR=$DIR/.ccache

-# Load defconfig and build kernel
-echo "-- First make --"
-make $DEFCONFIG O=out
-echo "-- Second make: $(nproc --all) cores --"
-make -j$(nproc --all) O=out  # Image.gz-dtb
+  # Avoid LINUX_COMPILE_HOST to change on every run thus invalidating cache
+  # https://patchwork.kernel.org/project/linux-kbuild/patch/1302015561-21047-8-git-send-email-mmarek@suse.cz/
+  export KBUILD_BUILD_HOST="docker"

-# Turn on if you want perf
-# LDFLAGS=-static make -j$(nproc --all) -C tools/perf
+  # Disable all warnings
+  export KCFLAGS="-w"

-# Copy over Image.gz-dtb
-mkdir -p $TMP_DIR
-cd $TMP_DIR
-cp $DIR/agnos-kernel-sdm845/out/arch/arm64/boot/Image.gz-dtb .
+  # Load defconfig and build kernel
+  echo "-- First make --"
+  make $DEFCONFIG O=out
+  echo "-- Second make: $(nproc --all) cores --"
+  make -j$(nproc --all) O=out  # Image.gz-dtb

-# Make boot image
-$TOOLS/mkbootimg \
-  --kernel Image.gz-dtb \
-  --ramdisk /dev/null \
-  --cmdline "console=ttyMSM0,115200n8 quiet loglevel=3 earlycon=msm_geni_serial,0xA84000 androidboot.hardware=qcom androidboot.console=ttyMSM0 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 service_locator.enable=1 androidboot.selinux=permissive firmware_class.path=/lib/firmware/updates net.ifnames=0 dyndbg=\"\"" \
-  --pagesize 4096 \
-  --base 0x80000000 \
-  --kernel_offset 0x8000 \
-  --ramdisk_offset 0x8000 \
-  --tags_offset 0x100 \
-  --output $BOOT_IMG.nonsecure
+  # Turn on if you want perf
+  # LDFLAGS=-static make -j$(nproc --all) -C tools/perf

-# le signing
-openssl dgst -sha256 -binary $BOOT_IMG.nonsecure > $BOOT_IMG.sha256
-openssl pkeyutl -sign -in $BOOT_IMG.sha256 -inkey $DIR/vble-qti.key -out $BOOT_IMG.sig -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pkcs1
-dd if=/dev/zero of=$BOOT_IMG.sig.padded bs=2048 count=1
-dd if=$BOOT_IMG.sig of=$BOOT_IMG.sig.padded conv=notrunc
-cat $BOOT_IMG.nonsecure $BOOT_IMG.sig.padded > $BOOT_IMG
+  # Copy over Image.gz-dtb
+  mkdir -p $TMP_DIR
+  cd $TMP_DIR
+  cp $DIR/agnos-kernel-sdm845/out/arch/arm64/boot/Image.gz-dtb .

-# Copy to output dir
-mkdir -p $OUTPUT_DIR
-mv $BOOT_IMG $OUTPUT_DIR/
-cp $DIR/agnos-kernel-sdm845/out/techpack/audio/asoc/snd-soc-sdm845.ko $OUTPUT_DIR/
-cp $DIR/agnos-kernel-sdm845/out/techpack/audio/asoc/codecs/snd-soc-wcd9xxx.ko $OUTPUT_DIR/
-cp $DIR/agnos-kernel-sdm845/out/drivers/staging/qcacld-3.0/wlan.ko $OUTPUT_DIR/
+  # Make boot image
+  $TOOLS/mkbootimg \
+    --kernel Image.gz-dtb \
+    --ramdisk /dev/null \
+    --cmdline "console=ttyMSM0,115200n8 quiet loglevel=3 earlycon=msm_geni_serial,0xA84000 androidboot.hardware=qcom androidboot.console=ttyMSM0 ehci-hcd.park=3 lpm_levels.sleep_disabled=1 service_locator.enable=1 androidboot.selinux=permissive firmware_class.path=/lib/firmware/updates net.ifnames=0 dyndbg=\"\"" \
+    --pagesize 4096 \
+    --base 0x80000000 \
+    --kernel_offset 0x8000 \
+    --ramdisk_offset 0x8000 \
+    --tags_offset 0x100 \
+    --output $BOOT_IMG.nonsecure
+
+  # le signing
+  openssl dgst -sha256 -binary $BOOT_IMG.nonsecure > $BOOT_IMG.sha256
+  openssl pkeyutl -sign -in $BOOT_IMG.sha256 -inkey $DIR/vble-qti.key -out $BOOT_IMG.sig -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pkcs1
+  dd if=/dev/zero of=$BOOT_IMG.sig.padded bs=2048 count=1
+  dd if=$BOOT_IMG.sig of=$BOOT_IMG.sig.padded conv=notrunc
+  cat $BOOT_IMG.nonsecure $BOOT_IMG.sig.padded > $BOOT_IMG
+
+  # Copy to output dir
+  mkdir -p $OUTPUT_DIR
+  mv $BOOT_IMG $OUTPUT_DIR/
+  cp $DIR/agnos-kernel-sdm845/out/techpack/audio/asoc/snd-soc-sdm845.ko $OUTPUT_DIR/
+  cp $DIR/agnos-kernel-sdm845/out/techpack/audio/asoc/codecs/snd-soc-wcd9xxx.ko $OUTPUT_DIR/
+  cp $DIR/agnos-kernel-sdm845/out/drivers/staging/qcacld-3.0/wlan.ko $OUTPUT_DIR/
+}
+
+# Run build_kernel in container
+docker exec -u $(id -nu) $CONTAINER_ID bash -c "set -e; export DEFCONFIG=$DEFCONFIG DIR=$DIR TOOLS=$TOOLS TMP_DIR=$TMP_DIR OUTPUT_DIR=$OUTPUT_DIR BOOT_IMG=$BOOT_IMG; $(declare -f build_kernel); build_kernel"
@@ -4,12 +4,12 @@ set -e
 UBUNTU_BASE_URL="http://cdimage.ubuntu.com/ubuntu-base/releases/24.04/release"
 UBUNTU_FILE="ubuntu-base-24.04-base-arm64.tar.gz"

-export DOCKER_BUILDKIT=1
-
 # Make sure we're in the correct spot
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
 cd $DIR

+ARCH=$(uname -m)
+
 BUILD_DIR="$DIR/build"
 OUTPUT_DIR="$DIR/output"

@@ -22,9 +22,9 @@ SKIP_CHUNKS_IMAGE="$OUTPUT_DIR/system-skip-chunks.img"
 # Create temp dir if non-existent
 mkdir -p $BUILD_DIR $OUTPUT_DIR

-# Copy kernel modules over
+# Copy kernel modules
 if ! ls $OUTPUT_DIR/*.ko >/dev/null 2>&1; then
-  echo "kernel modules missing. run ./build_kernel.sh first"
+  echo "Kernel modules missing. Run ./build_kernel.sh first"
  exit 1
 fi
 cp $OUTPUT_DIR/wlan.ko $DIR/userspace/usr/comma
@@ -33,72 +33,102 @@ cp $OUTPUT_DIR/snd*.ko $DIR/userspace/usr/comma/sound/
 # Download Ubuntu Base if not done already
 if [ ! -f $UBUNTU_FILE ]; then
  echo -e "${GREEN}Downloading Ubuntu: $UBUNTU_FILE ${NO_COLOR}"
-  wget -c $UBUNTU_BASE_URL/$UBUNTU_FILE --quiet
+  curl -C - -o $UBUNTU_FILE $UBUNTU_BASE_URL/$UBUNTU_FILE --silent --remote-time
 fi

 # Register qemu multiarch
-if [ "$(uname -p)" != "aarch64" ]; then
-  docker run --rm --privileged multiarch/qemu-user-static:register --reset
+if [ "$ARCH" = "x86_64" ]; then
+  echo "Registering qemu-user-static"
+  docker run --rm --privileged multiarch/qemu-user-static:register --reset > /dev/null
 fi

-# Start docker build
-echo "Building image"
-export DOCKER_CLI_EXPERIMENTAL=enabled
+# Start agnos-builder docker build and create container
+echo "Building agnos-builder docker image"
 docker build -f Dockerfile.agnos -t agnos-builder $DIR
+echo "Creating agnos-builder container"
+CONTAINER_ID=$(docker container create --entrypoint /bin/bash agnos-builder:latest)
+
+# Setup mount container for macOS and CI support (namespace.so)
+echo "Building agnos-meta-builder docker image"
+docker build -f Dockerfile.builder -t agnos-meta-builder $DIR \
+  --build-arg UNAME=$(id -nu) \
+  --build-arg UID=$(id -u) \
+  --build-arg GID=$(id -g)
+echo "Starting agnos-meta-builder container"
+MOUNT_CONTAINER_ID=$(docker run -d --privileged -v $DIR:$DIR agnos-meta-builder)
+
+# Cleanup containers on possible exit
+trap "echo \"Cleaning up containers:\"; \
+docker container rm -f $CONTAINER_ID $MOUNT_CONTAINER_ID" EXIT
+
+# Define functions for docker execution
+exec_as_user() {
+  docker exec -u $(id -nu) $MOUNT_CONTAINER_ID "$@"
+}
+
+exec_as_root() {
+  docker exec $MOUNT_CONTAINER_ID "$@"
+}

 # Create filesystem ext4 image
 echo "Creating empty filesystem"
-fallocate -l $ROOTFS_IMAGE_SIZE $ROOTFS_IMAGE
-mkfs.ext4 $ROOTFS_IMAGE > /dev/null
+exec_as_user fallocate -l $ROOTFS_IMAGE_SIZE $ROOTFS_IMAGE
+exec_as_user mkfs.ext4 $ROOTFS_IMAGE &> /dev/null

 # Mount filesystem
 echo "Mounting empty filesystem"
-mkdir -p $ROOTFS_DIR
-sudo umount -l $ROOTFS_DIR > /dev/null || true
-sudo mount $ROOTFS_IMAGE $ROOTFS_DIR
+exec_as_root mkdir -p $ROOTFS_DIR
+exec_as_root mount $ROOTFS_IMAGE $ROOTFS_DIR
+
+# Also unmount filesystem (overwrite previous trap)
+trap "exec_as_root umount -l $ROOTFS_DIR &> /dev/null || true; \
+echo \"Cleaning up containers:\"; \
+docker container rm -f $CONTAINER_ID $MOUNT_CONTAINER_ID" EXIT

 # Extract image
 echo "Extracting docker image"
-CONTAINER_ID=$(docker container create --entrypoint /bin/bash agnos-builder:latest)
 docker container export -o $BUILD_DIR/filesystem.tar $CONTAINER_ID
-docker container rm $CONTAINER_ID > /dev/null
-cd $ROOTFS_DIR
-sudo tar -xf $BUILD_DIR/filesystem.tar > /dev/null
+exec_as_root tar -xf $BUILD_DIR/filesystem.tar -C $ROOTFS_DIR > /dev/null

-# Remove the .dockerenv file
+# Avoid detecting as container
 echo "Removing .dockerenv file"
-sudo rm -f $ROOTFS_DIR/.dockerenv
+exec_as_root rm -f $ROOTFS_DIR/.dockerenv

-# Add hostname and hosts. This cannot be done in the docker container...
 echo "Setting network stuff"
-HOST=comma
-sudo bash -c "ln -sf /proc/sys/kernel/hostname etc/hostname"
-sudo bash -c "echo \"127.0.0.1    localhost.localdomain localhost\" > etc/hosts"
-sudo bash -c "echo \"127.0.0.1    $HOST\" >> etc/hosts"
+set_network_stuff() {
+  cd $ROOTFS_DIR
+  # Add hostname and hosts. This cannot be done in the docker container...
+  HOST=comma
+  bash -c "ln -sf /proc/sys/kernel/hostname etc/hostname"
+  bash -c "echo \"127.0.0.1    localhost.localdomain localhost\" > etc/hosts"
+  bash -c "echo \"127.0.0.1    $HOST\" >> etc/hosts"

-# Fix resolv config
-sudo bash -c "ln -sf /run/systemd/resolve/stub-resolv.conf etc/resolv.conf"
+  # Fix resolv config
+  bash -c "ln -sf /run/systemd/resolve/stub-resolv.conf etc/resolv.conf"

-# Write build info
-DATETIME=$(date '+%Y-%m-%dT%H:%M:%S')
+  # Write build info
+  DATETIME=$(date '+%Y-%m-%dT%H:%M:%S')
+  bash -c "printf \"$GIT_HASH\n$DATETIME\" > BUILD"
+}
 GIT_HASH=$(git --git-dir=$DIR/.git rev-parse HEAD)
-sudo bash -c "printf \"$GIT_HASH\n$DATETIME\" > BUILD"
-
-cd $DIR
+exec_as_root bash -c "set -e; export ROOTFS_DIR=$ROOTFS_DIR GIT_HASH=$GIT_HASH; $(declare -f set_network_stuff); set_network_stuff"

 # Unmount image
 echo "Unmount filesystem"
-sudo umount -l $ROOTFS_DIR
+exec_as_root umount -l $ROOTFS_DIR

 # Sparsify
-echo "Sparsify image"
-TMP_SPARSE="$(mktemp)"
-img2simg $ROOTFS_IMAGE $TMP_SPARSE
-mv $TMP_SPARSE $SPARSE_IMAGE
+echo "Sparsify image $(basename $SPARSE_IMAGE)"
+exec_as_user bash -c "\
+TMP_SPARSE=\$(mktemp); \
+img2simg $ROOTFS_IMAGE \$TMP_SPARSE; \
+mv \$TMP_SPARSE $SPARSE_IMAGE"

 # Make image with skipped chunks
-TMP_SKIP="$(mktemp)"
-$DIR/tools/simg2dontcare.py $SPARSE_IMAGE $TMP_SKIP
-mv $TMP_SKIP $SKIP_CHUNKS_IMAGE
+echo "Sparsify image $(basename $SKIP_CHUNKS_IMAGE)"
+exec_as_user bash -c "\
+TMP_SKIP=\$(mktemp); \
+$DIR/tools/simg2dontcare.py $SPARSE_IMAGE \$TMP_SKIP; \
+mv \$TMP_SKIP $SKIP_CHUNKS_IMAGE"

 echo "Done!"
@@ -24,8 +24,21 @@ if [ "$(< .git/HEAD)" != "$VERSION" ]; then
  git checkout $VERSION
  git submodule update --depth=1 --init --recursive

-  pip3 install -r requirements.txt
+  # TODO: remove "--no-binary capstone" when capstone v5.0.2 is released
+  # https://github.com/capstone-engine/capstone/issues/2301#issuecomment-2026835275
+  pip3 install -r requirements.txt --no-binary capstone
 fi
 popd > /dev/null

 $EDL_PATH/edl "$@"
+
+################################################################################
+# On M-series macs, if you get "No backend available"
+# where python is installed with pyenv and libusb with brew
+# try this:
+#
+# brew install libusb
+# sudo mkdir -p /usr/local/lib
+# sudo ln -s /opt/homebrew/lib/libusb-1.0.0.dylib /usr/local/lib/libusb.dylib
+#
+################################################################################
@@ -1,7 +1,5 @@
 #!/bin/bash -e

-echo "Extracting tools..."
-
 git lfs &> /dev/null || {
  echo "ERROR: git lfs not installed"
  exit 1
@@ -13,11 +11,6 @@ ROOT=$DIR/..

 cd $DIR

-LINARO_GCC=aarch64-linux-gnu-gcc
-GOOGLE_GCC_4_9=aarch64-linux-android-4.9
-EDK2_LLVM=llvm-arm-toolchain-ship
-SEC_IMAGE=SecImage
-
 # grep for `-`, which stands for LFS pointer
 git lfs ls-files | awk '{print $2}' | grep "-" &>/dev/null && {
  echo "Pulling git lfs objects..."
@@ -27,23 +20,32 @@ git lfs ls-files | awk '{print $2}' | grep "-" &>/dev/null && {
  cd $DIR
 }

+LINARO_GCC=aarch64-linux-gnu-gcc
+GOOGLE_GCC_4_9=aarch64-linux-android-4.9
+EDK2_LLVM=llvm-arm-toolchain-ship
+SEC_IMAGE=SecImage
+
 LINARO_GCC_TARBALL=$LINARO_GCC.tar.gz
 GOOGLE_GCC_4_9_TARBALL=$GOOGLE_GCC_4_9.tar.gz
 EDK2_LLVM_TARBALL=$EDK2_LLVM.tar.gz
 SEC_IMAGE_TARBALL=$SEC_IMAGE.tar.gz

-if [ ! -d $LINARO_GCC ]; then
-  tar -xzf $LINARO_GCC_TARBALL &>/dev/null
-fi
+ARCH=$(uname -m)
+if [ "$ARCH" != "arm64" ] && [ "$ARCH" != "aarch64" ]; then
+  echo "Extracting tools..."
+  if [ ! -d $LINARO_GCC ]; then
+    tar -xzf $LINARO_GCC_TARBALL &>/dev/null
+  fi

-if [ ! -d $GOOGLE_GCC_4_9 ]; then
-  tar -xzf $GOOGLE_GCC_4_9_TARBALL &>/dev/null
-fi
+  if [ ! -d $GOOGLE_GCC_4_9 ]; then
+    tar -xzf $GOOGLE_GCC_4_9_TARBALL &>/dev/null
+  fi

-if [ ! -d $EDK2_LLVM ]; then
-  tar -xzf $EDK2_LLVM_TARBALL &>/dev/null
-fi
+  if [ ! -d $EDK2_LLVM ]; then
+    tar -xzf $EDK2_LLVM_TARBALL &>/dev/null
+  fi

-if [ ! -d $SEC_IMAGE ]; then
-  tar -xzf $SEC_IMAGE_TARBALL &>/dev/null
+  if [ ! -d $SEC_IMAGE ]; then
+    tar -xzf $SEC_IMAGE_TARBALL &>/dev/null
+  fi
 fi
@@ -1,23 +0,0 @@
-#!/bin/bash -e
-
-apt-get install --no-install-recommends -yq g++-11
-
-# https://github.com/commaai/agnos-builder/pull/188#issuecomment-1893380448
-export CXX=g++-11
-# Suppress warnings about deprecated declarations
-export CXXFLAGS="-Wno-deprecated-declarations"
-# TODO: remove no-deprecated-declarations and
-# replace QImage::byteCount() with QImage::sizeInBytes(). This is a direct replacement as suggested by the deprecation message.
-# replace QFontMetrics::width(QChar) with QFontMetrics::horizontalAdvance(QChar). This method is the recommended replacement for measuring the width of a character in the new versions of Qt.
-
-# Build mapbox-gl-native
-cd /tmp
-# TODO: switch back to "https://github.com/commaai/mapbox-gl-native.git" after "https://github.com/commaai/mapbox-gl-native/pull/1" is merged
-git clone --recursive https://github.com/andiradulescu/mapbox-gl-native.git
-cd mapbox-gl-native
-# removed commit pin
-# git checkout 69f41ffff655ee28834c167ad1353112f370e6e5
-mkdir build && cd build
-cmake -DMBGL_WITH_QT=ON ..
-make -j$(nproc) mbgl-qt
-mv libqmapboxgl.so /tmp/libqmapboxgl.so
@@ -2,7 +2,6 @@
 # See the sshd_config(5) manpage for details

 # Comma
-Port 8022
 StrictModes no
 AuthorizedKeysFile /data/params/d/GithubSshKeys
 PermitRootLogin no
@@ -68,6 +67,11 @@ TCPKeepAlive yes
 ClientAliveInterval 10
 ClientAliveCountMax 3

+# The default DSCP of 0x10 lumps ssh traffic in with all other potentially high
+# bandwidth traffic. Raise the priority to ensure that this interactive traffic
+# remains responsive even when we are bandwidth limited.
+IPQoS af42 # 36, HDD_LINUX_AC_VI with the minimum delay flag
+
 #MaxStartups 10:30:60
 #Banner /etc/issue.net

@@ -7,7 +7,7 @@ hide_threads=0
 hide_kernel_threads=0
 hide_userland_threads=0
 shadow_other_users=0
-show_thread_names=0
+show_thread_names=1
 show_program_path=1
 highlight_base_name=0
 highlight_megabytes=1
@@ -64,20 +64,26 @@ apt-get install --no-install-recommends -yq \
    zstd

 # TODO: put these back when updating weston & removing old qt-5.12.8.deb
-    # libqt5location5-plugin-mapboxgl \
    # libqt5opengl5-dev \
    # libqt5sql5-sqlite \
    # libqt5svg5-dev \
    # libqt5multimedia5-plugins \
    # qml-module-qtquick2 \
-    # qt5-qmake \
    # qtbase5-dev \
+    # qtchooser \
+    # qt5-qmake \
    # qtbase5-dev-tools \
    # qtbase5-private-dev \
-    # qtchooser \
    # qtdeclarative5-dev \
    # qtdeclarative5-private-dev \
    # qtlocation5-dev \
    # qtmultimedia5-dev \
    # qtpositioning5-dev \
    # qtwayland5 \
+
+# in case of uncertainty, qt5-default was a metapackage for:
+    # qtbase5-dev
+    # qtchooser
+    # qt5-qmake
+    # qtbase5-dev-tools
+# more info: https://packages.ubuntu.com/focal/qt5-default
@@ -18,4 +18,4 @@ fi
 echo "Setting global python version"
 pyenv global $PYTHON_VERSION

-pip3 install --no-cache-dir --upgrade pip poetry
+pip3 install --no-cache-dir --upgrade pip uv
@@ -1,104 +1,114 @@
-[tool.poetry]
+[project]
 name = "agnos"
 version = "0.1.0"
-authors = ["Vehicle Researcher <user@comma.ai>"]
+authors = [{name = "Vehicle Researcher", email = "user@comma.ai"}]
+requires-python = "~=3.11"
 description = ""
+dependencies = [
+  "aiohttp",
+  "aiortc",
+  "atomicwrites",
+  "casadi",
+  "cffi",
+  "crcmod",
+  "cryptography",
+  "cython",
+  "dbus-python",
+  "evdev",
+  "flake8",
+  "flask",
+  "future-fstrings",  # needed for acados
+  "gunicorn",
+  "hatanaka == 2.4",
+  "hexdump",
+  "hypothesis",
+  "jinja2",
+  "json-rpc",
+  "libusb1",
+  "markdown-it-py",
+  "nose",
+  "numpy < 2.0.0",  # pending bumping in openpilot
+  "onnx",
+  "onnxruntime >= 1.16.3",
+  "pillow",
+  "protobuf",
+  "psutil",
+  "pyaudio",
+  "pycapnp",
+  "pyclean",
+  "pycryptodome",
+  "pydub",
+  "pyjwt",
+  "pylint",
+  "pyopencl == 2024.1",  # pinned until cmake update coming with 24.04
+  "pyserial",
+  "pytest",
+  "pytest-cov",
+  "pytest-cpp",
+  "pytest-forked",
+  "pytest-mock",
+  "pytest-random-order",
+  "pytest-randomly",
+  "pytest-repeat",
+  "pytest-subtests",
+  "pytest-timeout",
+  "pytest-xdist",
+  "python-dateutil",
+  "pyyaml",
+  "pyzmq",
+  "pyzstd",
+  "requests",
+  "scons",
+  "sconscontrib",
+  "sentry-sdk",
+  "setproctitle",
+  "six",
+  "smbus2",
+  "sounddevice",
+  "spidev",
+  "spidev2",
+  "sympy != 1.6.1",
+  "timezonefinder",
+  "torch",
+  "tqdm",
+  "urllib3",
+  "utm",
+  "websocket-client",
+  "zstandard",
+  "zstd"
+]

-[tool.poetry.dependencies]
-python = "~3.11"
-atomicwrites = "*"
-cffi = "*"
-crcmod = "*"
-hexdump = "*"
-libusb1 = "*"
-numpy = "*"
-psutil = "*"
-pycapnp = "*"
-cryptography = "*"
-python-dateutil = "*"
-pyzmq = "*"
-requests = "*"
-setproctitle = "*"
-six = "*"
-smbus2 = "*"
-sympy = "!=1.6.1"
-tqdm = "*"
-Cython = "*"
-PyYAML = "*"
-websocket_client = "*"
-urllib3 = "*"
-gunicorn = "*"
-utm = "*"
-json-rpc = "*"
-Flask = "*"
-nose = "*"
-flake8 = "*"
-pyclean = "*"
-pylint = "*"
-pillow = "*"
-scons = "*"
-sconscontrib = {git = "https://github.com/SCons/scons-contrib"}
-pycryptodome = "*"
-Jinja2 = "*"
-PyJWT = "*"
-pyserial = "*"
-dbus-python = "*"
-timezonefinder = "*"
-sentry-sdk = "*"
-markdown-it-py = "*"
-onnx = "*"
-onnxruntime = ">=1.16.3"
-pyopencl = "*"
-hatanaka = "==2.4"
-protobuf = "*"
-torch = "*"
-spidev = "*"
-spidev2 = "*"
-sounddevice = "*"
-zstandard = "*"
-zstd = "*"
-pyzstd = "*"
-casadi = "*"
-pyaudio = "*"
-pydub = "*"
-aiohttp = "*"
-aiortc = "*"
-evdev = "*"
-hypothesis = "*"
-pytest = "*"
-pytest-cov = "*"
-pytest-cpp = "*"
-pytest-subtests = "*"
-pytest-xdist = "*"
-pytest-timeout = "*"
-pytest-random-order = "*"
-pytest-mock = "*"
-pytest-repeat = "*"
-pytest-randomly = "*"
-pytest-forked = "*"
+[project.optional-dependencies]
+dev = [
+  "ipython",
+  "azure-identity",
+  "azure-storage-blob",
+  "pycurl",
+  "git-pylint-commit-hook",
+  "tenacity",
+  "mock",
+  "dictdiffer",
+  "aenum",
+  "coverage",
+  "paramiko",
+  "lru-dict",
+  "pprofile",
+  "pyprof2calltree",
+  "pre-commit",
+  "mypy",
+  "parameterized",
+  "inputs",
+  "future-fstrings",
+  "tabulate",
+  "flaky"
+]
+
+[tool.uv.sources]
+sconscontrib = { git = "https://github.com/SCons/scons-contrib.git" }

-[tool.poetry.group.dev.dependencies]
-ipython = "*"
-azure-identity = "*"
-azure-storage-blob = "*"
-pycurl = "*"
-git-pylint-commit-hook = "*"
-tenacity = "*"
-mock = "*"
-dictdiffer = "*"
-aenum = "*"
-coverage = "*"
-paramiko = "*"
-lru-dict = "*"
-pprofile = "*"
-pyprof2calltree = "*"
-pre-commit = "*"
-mypy = "*"
-parameterized = "*"
-inputs = "*"
-future-fstrings = "*"
-tabulate = "*"
-flaky = "*"
 [build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = [ "." ]