Link .efi applications using libgcc

Signed-off-by: Adriano Cordova <adriano.cordova@canonical.com>

commit ddf67daac39d ("efi_capsule: Move signature from DTB to .rodata")
was reverted in
commit 47a25e81d35c ("Revert "efi_capsule: Move signature from DTB to .rodata"")
because that's what U-Boot was usually doing -- using the DT to store
configuration and data. Some of the discussions can be found here [0].

(Ab)using the device tree to store random data isn't ideal though.
On top of that with new features introduced over the years, keeping
the certificates in the DT has proven to be problematic.
One of the reasons is that platforms might send U-Boot a DTB
from the previous stage loader using a transfer list which won't contain
the signatures since other loaders are not  aware of internal
U-Boot ABIs. On top of that QEMU creates the DTB on the fly, so adding
the capsule certificate there does not work and requires users to dump
it and re-create it injecting the public keys.

Now that we have proper memory permissions for arm64, move the certificate
to .rodata and read it from there.

[0] https://lore.kernel.org/u-boot/CAPnjgZ2uM=n8Qo-a=DUkx5VW5Bzp5Xy8=Wgmrw8ESqUBK00YJQ@mail.gmail.com/

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Tested-by: Jonathan Humphreys <j-humphreys@ti.com>  # on TI sk-am62p-lp
Tested-by: Neil Armstrong <neil.armstrong@linaro.org> # on AML-A311D-CC
Tested-by: Raymond Mao <raymond.mao@linaro.org>

This section is required by .dynamic and llvm-objcopy will exit with a
fatal error if it is not also preserved in the output.

Signed-off-by: Sam Edwards <CFSworks@gmail.com>

The linker uses the path specified with -L to search for linker scripts
and for linker script includes.

For out-of-tree builds specify the build directory with -L instead of
the absolute path of the linker script. This allows using an INCLUDE
statement.

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

Linux commits:
15d16d6dadf6 kbuild: Add generic rule to apply fdtoverlay
44f87191d105 kbuild: parameterize the .o part of suffix-search

The Linux commit 15d16d6dadf6 adds a generic rule in Makefile.lib
to automatically apply fdtoverlay, so that each platform doesn't
need to include a complex rule. This also automatically appends
DTC_FLAGS_foo_base += -@ to all base files

The platform's Makefile only needs to have this now:

foo-dtbs := foo_base.dtb foo_overlay1.dtbo foo_overlay2.dtbo
dtb-y := foo.dtb

Signed-off-by: Prasad Kummari <prasad.kummari@amd.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/r/20240906070808.1045991-2-prasad.kummari@amd.com

The commit mentioned in Fixes broke the
CONFIG_DEVICE_TREE_INCLUDES feature, with the result that any board
setting any non-empty value for that fails to build.

The parent of the mentioned commit refactoring a bit by introducing
the dtsi_include_list variable and changing cmd_dtc to loop over that
was fine.

However, the .dtsi files mentioned in CONFIG_DEVICE_TREE_INCLUDES are
not supposed to be generated via the build system. They are meant for
e.g. including a public key for verified boot (generated with the
key2dtsi script), or for injecting some stuff to the /config
node (say, a bootcmd or a load-environment setting or things like
that). The files can either live in-tree in a private branch or
completely outside, e.g. in some Yocto metadata.

But regardless, U-Boot's build system will never know anything about
them, so when the mentioned commit did

dtsi_include_list_deps = $(addprefix $(obj)/,$(subst $(quote),,$(dtsi_include_list)))

things broke, because if CONFIG_DEVICE_TREE_INCLUDES is for example
"/path/to/public_key.dtsi", this would add a dependency on
$(obj)//path/to/public_key.dtsi to each $(obj)/*.dtb target, yielding

make[3]: *** No rule to make target 'arch/arm/dts/imx6dl-aristainetos2c_7.dtb', needed by 'dtbs'.  Stop.

To fix that while preserving the introduced
CONFIG_EFI_CAPSULE_ESL_FILE behaviour, disentangle
CONFIG_DEVICE_TREE_INCLUDES from dtsi_include_list from which
dtsi_include_list_deps is built, and instead just add the items
directly to the $(foreach) loop.

Fixes: a958988b62 ("scripts/Makefile.lib: Add dtsi include files as deps for building DTB")
Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Tested-by: Emil Kronborg <emil.kronborg@protonmail.com>

Rasmus Villemoes <rasmus.villemoes@prevas.dk> says:

This is a followup to the patches that landed in 2024.01 and nearly
made sure that source files for producing .dtbo files use the .dtso
extension. In the same release, a few new .dts files snuck in, and
there was also some test code involving .dtbo -> .dtbo.S -> .dtbo.o I
didn't really know how to handle at the time. This should finish the
job, bring us in sync with linux (at least in this respect), and drop
the .dts -> .dtbo build rule.

[equivalent to linux commit 81d362732bac]

As a follow up to the series allowing DTB overlays to built from .dtso
files. Now that all overlays have been renamed, remove the ability to
build from overlays from .dts files to prevent any files with the old
name from accidental being added.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>

[linux commit 941214a512d8, modified for U-Boot by removing the
include of vmlinux.lds.h and replacing STRUCT_ALIGNMENT by 16.]

DTB files can be built into the kernel by converting them to assembly
files then assembling them into object files. We extend this here
for DTB overlays with the .dtso extensions.

We change the start and end delimiting tag prefix to make it clear that
this data came from overlay files.

Signed-off-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>

The EFI Capsule ESL file (EFI Signature List File) used for authentication
is a binary generated from the EFI Capsule public key certificate. Instead
of including it in the source repo, automatically generate it from the
certificate file during the build process.

Currently, sandbox is the only device using this, so removed its ESL file
and set the (new) CONFIG_EFI_CAPSULE_CRT_FILE config to point to its public
key certificate.

Signed-off-by: Jonathan Humphreys <j-humphreys@ti.com>