[caliptra] build FPGA variants of the boot components

MODULE.bazel

@@ -111,6 +111,18 @@ caliptra_repos_ext = use_extension(
 )
 use_repo(caliptra_repos_ext, "caliptra_mcu_sw", "caliptra_sw")
 
+# VCK190 subsystem bitstream matching the caliptra_mcu_sw pin above. URL and
+# sha256 are copied from hw/fpga/bitstream_manifests/subsystem.toml at that
+# commit; bump them together with the pin.
+http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
+
+http_file(
+    name = "caliptra_fpga_bitstream",
+    downloaded_file_path = "caliptra-bitstream.pdi",
+    sha256 = "bb4892661af8769104694e5bd307a993264460a286437e0d8bc3b2f1de60173d",
+    urls = ["https://storage.googleapis.com/caliptra-github-ci-bitstreams/v1/a2cd177353b7f06170766f367743b98c900b1d7b/runtime_a2cd177.pdi"],
+)
+
 nonhermetic_repo = use_repo_rule("//target/earlgrey/tooling/signing:nonhermetic.bzl", "nonhermetic_repo")
 
 nonhermetic_repo(name = "nonhermetic")

target/veer/tooling/BUILD.bazel

@@ -48,6 +48,7 @@ pw_py_importable_runfile(
 mcu_rom_wrapper(
     name = "mcu_rom_bin_transitioned",
     target = "//third_party/caliptra/caliptra-mcu-sw:mcu_rom_bin",
+    visibility = ["//target/veer:__subpackages__"],
 )
 
 pw_py_importable_runfile(

target/veer/tooling/caliptra_runner.bzl

@@ -6,17 +6,31 @@
 load("@pigweed//pw_kernel/tooling:system_image.bzl", "SystemImageInfo")
 
 def _target_type_transition_impl(_, attr):
+    # target_type selects the image's memory map; //third_party/caliptra:platform
+    # selects the matching Caliptra ROM/FW and MCU ROM variants.
     if attr.interface == "fpga":
-        return {"//target/veer:target_type": "fpga"}
+        return {
+            "//target/veer:target_type": "fpga",
+            "//third_party/caliptra:platform": "fpga",
+        }
     if attr.interface == "emulator":
-        return {"//target/veer:target_type": "emulator"}
+        return {
+            "//target/veer:target_type": "emulator",
+            "//third_party/caliptra:platform": "emulator",
+        }
 
-    return {"//target/veer:target_type": "silicon"}
+    return {
+        "//target/veer:target_type": "emulator",
+        "//third_party/caliptra:platform": "emulator",
+    }
 
 _target_type_transition = transition(
     implementation = _target_type_transition_impl,
     inputs = [],
-    outputs = ["//target/veer:target_type"],
+    outputs = [
+        "//target/veer:target_type",
+        "//third_party/caliptra:platform",
+    ],
 )
 
 def _mcu_rom_transition_impl(settings, attr):
@@ -29,11 +43,12 @@ _mcu_rom_transition = transition(
 )
 
 def _caliptra_runner_impl(ctx):
-    system_image_info = ctx.attr.target[0][SystemImageInfo]
+    system_image_info = ctx.attr.target[SystemImageInfo]
     bin_file = system_image_info.bin
     elf_file = system_image_info.elf
     runner = ctx.executable._caliptra_runner
 
+    platform = "fpga" if ctx.attr.interface == "fpga" else "emulator"
     manifest = ctx.actions.declare_file("{}.manifest".format(ctx.attr.name))
     ctx.actions.run(
         inputs = [
@@ -47,7 +62,8 @@ def _caliptra_runner_impl(ctx):
         arguments = [
             "auth-manifest",
             "create",
-            "--mcu_image={},0x4000000,0,2,2".format(bin_file.path),
+            "--platform={}".format(platform),
+            "--mcu_image={}".format(bin_file.path),
             "--caliptra_rom={}".format(ctx.file.caliptra_rom.path),
             "--caliptra_firmware={}".format(ctx.file.caliptra_firmware.path),
             "--vendor_pk_hash={}".format(ctx.attr.vendor_pk_hash),
@@ -57,19 +73,20 @@ def _caliptra_runner_impl(ctx):
 
     run_script = ctx.actions.declare_file(ctx.attr.name + ".sh")
 
-    # TODO: currently, the caliptra rom, firmware and mcu-rom are hardcoded in the runner python script.
-    # Perhaps these shoulc be arguments to the script instead.
     ctx.actions.write(
         output = run_script,
         is_executable = True,
         content = """#!/bin/bash
-{runner} --interface {interface} --elf {elf} --bin {bin} --manifest {manifest} --vendor-pk-hash {vendor_pk_hash} {optional_args}
+{runner} --interface {interface} --elf {elf} --bin {bin} --manifest {manifest} --caliptra-rom {caliptra_rom} --caliptra-firmware {caliptra_firmware} --mcu-rom {mcu_rom} --vendor-pk-hash {vendor_pk_hash} {optional_args}
 """.format(
             runner = runner.short_path,
             interface = ctx.attr.interface,
             elf = elf_file.short_path,
             bin = bin_file.short_path,
             manifest = manifest.short_path,
+            caliptra_rom = ctx.file.caliptra_rom.short_path,
+            caliptra_firmware = ctx.file.caliptra_firmware.short_path,
+            mcu_rom = ctx.file.mcu_rom.short_path,
             vendor_pk_hash = ctx.attr.vendor_pk_hash,
             optional_args = "",
         ),
@@ -79,7 +96,14 @@ def _caliptra_runner_impl(ctx):
 
     return [DefaultInfo(
         runfiles = ctx.runfiles(
-            files = [manifest, bin_file, runner],
+            files = [
+                manifest,
+                bin_file,
+                runner,
+                ctx.file.caliptra_rom,
+                ctx.file.caliptra_firmware,
+                ctx.file.mcu_rom,
+            ],
             transitive_files = runner_files_depset,
         ),
         executable = run_script,
@@ -100,11 +124,15 @@ _BASE_ATTRS = {
         doc = "The interface to use.",
         mandatory = True,
     ),
+    "mcu_rom": attr.label(
+        allow_single_file = True,
+        default = "//target/veer/tooling:mcu_rom_bin_transitioned",
+        doc = "MCU ROM",
+    ),
     "target": attr.label(
         doc = "The system_image target to run.",
         mandatory = True,
         providers = [SystemImageInfo],
-        cfg = _target_type_transition,
     ),
     "vendor_pk_hash": attr.string(
         default = "b17ca877666657ccd100e6926c7206b60c995cb68992c6c9baefce728af05441dee1ff415adfc187e1e4edb4d3b2d909",
@@ -128,12 +156,14 @@ caliptra_runner = rule(
     implementation = _caliptra_runner_impl,
     executable = True,
     attrs = _BASE_ATTRS,
+    cfg = _target_type_transition,
 )
 
 caliptra_test = rule(
     implementation = _caliptra_runner_impl,
     test = True,
     attrs = _BASE_ATTRS,
+    cfg = _target_type_transition,
 )
 
 def _mcu_rom_wrapper_impl(ctx):

target/veer/tooling/caliptra_runner.py

@@ -86,6 +86,24 @@ def _parse_args():
         type=pathlib.Path,
         help="authorization manifest",
     )
+    parser.add_argument(
+        "--caliptra-rom",
+        type=pathlib.Path,
+        default=pathlib.Path(_CPTRA_ROM),
+        help="caliptra ROM binary",
+    )
+    parser.add_argument(
+        "--caliptra-firmware",
+        type=pathlib.Path,
+        default=pathlib.Path(_CPTRA_FIRMWARE),
+        help="caliptra firmware bundle binary",
+    )
+    parser.add_argument(
+        "--mcu-rom",
+        type=pathlib.Path,
+        default=pathlib.Path(_MCU_ROM),
+        help="MCU ROM binary",
+    )
     parser.add_argument(
         "--vendor-pk-hash",
         type=str,
@@ -142,15 +160,18 @@ def load_and_run(
     manifest: str,
     vendor_pk_hash: str,
     elf: Path | None = None,
+    caliptra_rom: Path | str = _CPTRA_ROM,
+    caliptra_firmware: Path | str = _CPTRA_FIRMWARE,
+    mcu_rom: Path | str = _MCU_ROM,
 ) -> list[str]:
     """Prepare arguments to load an image into a board and spawn a console."""
     if interface == "emulator":
         cmd = [
             _EMULATOR,
-            f"--rom={_MCU_ROM}",
+            f"--rom={mcu_rom}",
             f"--firmware={image}",
-            f"--caliptra-rom={_CPTRA_ROM}",
-            f"--caliptra-firmware={_CPTRA_FIRMWARE}",
+            f"--caliptra-rom={caliptra_rom}",
+            f"--caliptra-firmware={caliptra_firmware}",
             "--i3c-port=65534",
             "--rom-offset=0x80000000",
             "--rom-size=0x10000",
@@ -296,6 +317,9 @@ def _main(args) -> int:
         args.manifest,
         args.vendor_pk_hash,
         elf=args.elf,
+        caliptra_rom=args.caliptra_rom,
+        caliptra_firmware=args.caliptra_firmware,
+        mcu_rom=args.mcu_rom,
     )
     # TODO(cfrantz): add support for the tokenized console.
     return_code = simple_console(cmd)

third_party/caliptra/BUILD.bazel

@@ -1,6 +1,7 @@
 # Licensed under the Apache-2.0 license
 # SPDX-License-Identifier: Apache-2.0
 
+load("@bazel_skylib//rules:common_settings.bzl", "string_flag")
 load("@rules_python//python:defs.bzl", "py_binary", "py_library", "py_test")
 load("//third_party/caliptra:versions.bzl", "CALIPTRA_VERSIONS")
 
@@ -13,6 +14,28 @@ load("//third_party/caliptra:versions.bzl", "CALIPTRA_VERSIONS")
 
 package(default_visibility = ["//visibility:public"])
 
+# Which Caliptra subsystem platform the boot components (Caliptra ROM/FW, MCU
+# ROM) are built for. Rules that run an image on a given platform (e.g.
+# //target/veer/tooling:caliptra_runner.bzl) set this with a transition.
+string_flag(
+    name = "platform",
+    build_setting_default = "emulator",
+    values = [
+        "emulator",
+        "fpga",
+    ],
+)
+
+config_setting(
+    name = "platform_emulator",
+    flag_values = {":platform": "emulator"},
+)
+
+config_setting(
+    name = "platform_fpga",
+    flag_values = {":platform": "fpga"},
+)
+
 config_setting(
     name = "is_riscv32imc",
     constraint_values = [