iq-9075-evk: add an open-firmware variant booting via U-Boot SPL - #2957

Signing the U-Boot SPL as the Qualcomm TZ image requires a SWIV segment in
the ELF first. Package the annotation tool from boot-firmware-ci so the
u-boot recipe can run it.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

When QCOM_UBOOT_SPL_FIT is set, stage BL31 and OP-TEE for the FIT that
uboot-sign assembles, and prepare the SPL for the Qualcomm secure-boot
chain: wrapped into an ELF, annotated with a SWIV segment, signed as the TZ
image and deployed as u-boot-spl-<type>.mbn.

BL31 and OP-TEE come from per-platform recipes, so the SoC configuration
names them.

No machine enables the flow yet.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

The SPL only enforces the FIT signatures when built with
CONFIG_SPL_FIT_SIGNATURE, which qcom_lemans_spl_defconfig does not set, so
the key uboot-sign embeds into its device tree is carried unused. Add the
fragment that turns verification on, pulled in exactly when the FIT is
signed.

It has to enable CONFIG_RSA as well: SPL_FIT_SIGNATURE only implies SPL_RSA,
which is hidden behind "if RSA" in lib/rsa/Kconfig, so on its own it yields
an SPL with no algorithm for rsa2048.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

With the flow enabled the signed FIT goes to the uefi partition in place of
the FIP, and the signed SPL replaces the TZ image. Guarded by
QCOM_UBOOT_SPL_FIT, which no machine enables yet.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

In the SPL FIT flow the u-boot recipe assembles BL31, OP-TEE and U-Boot
proper into a FIT, so TF-A only has to provide bl31.bin. The dependency on
u-boot-qcom, which exists to pull u-boot.bin into the FIP, then has to go
along with the FIP itself, or the two recipes depend on each other. Without
a FIP there is nothing left for do_install to wrap and sign either.

Defaults are unchanged for machines that do not set QCOM_UBOOT_SPL_FIT.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

qcom_lemans_spl_defconfig builds a U-Boot SPL next to U-Boot proper. It is a
sibling of qcom_lemans_defconfig rather than an extension of it, so it needs
an entry of its own: U-Boot proper is carried inside a FIT and placed by the
SPL, so the configuration neither pins the load address the flashed variant
uses nor builds the ELF that gets signed for the uefi partition.

That also makes it unusable on its own, so it is left out of the qcom-armv8a
catchall.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

Where the SPL FIT flow places BL31, OP-TEE and U-Boot proper, where the SPL
itself is entered, which recipes provide BL31 and OP-TEE and which platform
name the SWIV annotation uses all follow from the SoC rather than from the
board, so keep them with the SoC configuration.

Nothing reads them unless the machine also requires
conf/machine/include/qcom-uboot-spl-fit.inc.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

Collect the settings of the SPL FIT boot flow in one include, so that a
machine opts in by requiring it and selecting a U-Boot configuration that
builds an SPL. The XBL takes the SPL path only with the XBLConfig variant
that has the "uboot_spl" flag set, which the boot firmware ships.

Signing the FIT is off by default, as the boot images are already
authenticated by the Qualcomm chain, where the XBL authenticates the SPL.

No machine requires the include yet.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

bootm applies overlays when a base configuration is followed by feature
configurations. Make that selection configurable, so a machine can have
overlays applied before the kernel is booted. Empty keeps the default
configuration of the FIT.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

LINUX_QCOM_KERNEL_DEVICETREE holds the device trees that exist only in the
linux-qcom kernels, and it is appended to KERNEL_DEVICETREE for those
recipes alone, as adding them unconditionally would break a linux-yocto
build. The FIT image recipe builds its configurations from
KERNEL_DEVICETREE as well, so without the same treatment those device
trees are built and deployed but never reach the FIT.

Append them there too, keyed on the selected kernel so that a linux-yocto
build is unaffected.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

uboot-sign.bbclass reassembles the SPL as a plain concatenation of the
nodtb image and the signed device tree, dropping the padding U-Boot puts
between them when BSS is part of the image. The SPL FIT flow needs that
padding: without it the device tree lands inside BSS and the SPL finds
none, before the console is up.

Carry it until the OE-core patch is merged.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

Add a variant of the open-firmware machine that boots through a U-Boot SPL
instead of the TF-A BL2/FIP loader, so that the first stage after the
Qualcomm XBL is an open-source loader.

It is a machine of its own rather than a change of iq-9075-evk-open-fw,
because the two produce different boot images for the same board and both
are worth keeping. qcs9100-ride-sx keeps the FIP flow as well: its XBL
requires QCOM-signed boot images and resets right after handing off to the
SPL.

The XBL hands off without loading the hypervisor here, so Linux owns EL2.
The base device tree describes the SMMU stream IDs for the case where the
hypervisor set them up, and without the EL2 overlay the GPU fails to
initialise and the DSP remoteprocs and the video codec fail to load their
firmware, so bootm applies it on top of the base DTB.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

Build the SPL variant next to the FIP based iq-9075-evk-open-fw, so that both
boot flows keep building.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>

Add the CI row for the combination this variant exists for: a U-Boot SPL
loading U-Boot proper, which in turn boots a U-Boot kernel FIT image. The
default build keeps the regular kernel image.

Assisted-by: Claude Code:claude-fable-5
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>