From e1c72642274fb5e04ba79d988f1a534e627a74b8 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Fri, 2 Oct 2026 16:10:25 -0700
Subject: [PATCH] build: libgcc-free RISC-V FDT byte swaps, prebuilt keytools,
 LDFLAGS_EXTRA

---
 Makefile          | 17 +++++++++++++++++
 options.mk        |  1 +
 src/fdt.c         |  8 ++++++++
 test-app/Makefile |  3 +++
 4 files changed, 29 insertions(+)

diff --git a/Makefile b/Makefile
index eb7d095f51..9d2e9cb384 100644
--- a/Makefile
+++ b/Makefile
@@ -326,6 +326,7 @@ ifeq ($(USE_ARMCLANG),1)
     endif
   endif
   LDFLAGS:=$(ARMCLANG_LDFLAGS) --map --list=wolfboot.map
+  LDFLAGS+=$(LDFLAGS_EXTRA)
   LSCRIPT:=config/target.sct
   LSCRIPT_IN:=hal/$(TARGET).sct
   LSCRIPT_FLAGS:=--scatter=$(LSCRIPT)
@@ -565,7 +566,23 @@ include tools/test-renode.mk
 
 hal/$(TARGET).o:
 
+# Prebuilt keygen and sign supplied on the command line (a native build under
+# Yocto, say) are used as-is; the in-tree keytools are built unless both are
+# given, since the signing steps fall back to the in-tree sign tool.
+ifeq ($(origin KEYGEN_TOOL),command line)
+  ifeq ($(origin SIGN_TOOL),command line)
+    KEYTOOLS_PREBUILT:=1
+  endif
+endif
+ifeq ($(KEYTOOLS_PREBUILT),1)
+keytools_check:
+	$(Q)command -v "$(KEYGEN_TOOL)" >/dev/null || \
+		(echo "KEYGEN_TOOL is not executable: $(KEYGEN_TOOL)" >&2 && false)
+	$(Q)command -v "$(SIGN_TOOL)" >/dev/null || \
+		(echo "SIGN_TOOL is not executable: $(SIGN_TOOL)" >&2 && false)
+else
 keytools_check: keytools
+endif
 
 test-emu:
 	$(MAKE) -C test-app/emu-test-apps WOLFBOOT_ROOT="$(CURDIR)" test-emu
diff --git a/options.mk b/options.mk
index cd8719d03d..24f6829fe8 100644
--- a/options.mk
+++ b/options.mk
@@ -1567,6 +1567,7 @@ ifneq (,$(filter RISCV RISCV64,$(ARCH)))
 endif
 
 CFLAGS+=$(CFLAGS_EXTRA)
+LDFLAGS+=$(LDFLAGS_EXTRA)
 OBJS+=$(OBJS_EXTRA)
 
 # The authenticated STM32H5 ECC256 secure-app path retains certificate parsing.
diff --git a/src/fdt.c b/src/fdt.c
index 6e9c25b00b..cb29d0dbd6 100644
--- a/src/fdt.c
+++ b/src/fdt.c
@@ -76,6 +76,11 @@ uint32_t cpu_to_fdt32(uint32_t x)
 {
 #ifdef BIG_ENDIAN_ORDER
     return x;
+#elif defined(__riscv) && !defined(__riscv_zbb)
+    /* Without Zbb the builtin becomes a libgcc call, which a soft-float
+     * build on a Linux toolchain cannot link. */
+    return ((x & 0x000000FFU) << 24) | ((x & 0x0000FF00U) << 8) |
+           ((x & 0x00FF0000U) >> 8) | ((x & 0xFF000000U) >> 24);
 #else
     return (uint32_t)__builtin_bswap32(x);
 #endif
@@ -84,6 +89,9 @@ uint64_t cpu_to_fdt64(uint64_t x)
 {
 #ifdef BIG_ENDIAN_ORDER
     return x;
+#elif defined(__riscv) && !defined(__riscv_zbb)
+    return ((uint64_t)cpu_to_fdt32((uint32_t)x) << 32) |
+           (uint64_t)cpu_to_fdt32((uint32_t)(x >> 32));
 #else
     return (uint64_t)__builtin_bswap64(x);
 #endif
diff --git a/test-app/Makefile b/test-app/Makefile
index 7089046bd3..4bfcc1539a 100644
--- a/test-app/Makefile
+++ b/test-app/Makefile
@@ -1445,6 +1445,9 @@ ifeq ($(USE_ARMCLANG),1)
   LDFLAGS:=$(ARMCLANG_LDFLAGS) --map --list=image.map --scatter=$(LSCRIPT)
 endif
 
+# After every target-specific LDFLAGS reset above, so it applies to all of them.
+LDFLAGS+=$(LDFLAGS_EXTRA)
+
 # Capture final flags for locally built wolfSSL objects.
 WOLFSSL_CFLAGS:=$(CFLAGS)
 WOLFTPM_CFLAGS:=$(CFLAGS)