[caliptra] add support for building HW model from OpenPRoT

MODULE.bazel

@@ -9,6 +9,7 @@ module(
 bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "pigweed")
 bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "rules_cc", version = "0.2.22")
 bazel_dep(name = "rules_rust", version = "0.70.0")
 bazel_dep(name = "rules_rust_mdbook", version = "0.70.0")
 bazel_dep(name = "rules_platform", version = "0.1.0")
@@ -36,9 +37,27 @@ git_override(
 
 pw_rust = use_extension("@pigweed//pw_toolchain/rust:extensions.bzl", "pw_rust")
 pw_rust.toolchain(cipd_tag = "git_revisions:fe5c95d4ae33ec9d7831921e448e2daf8264ea42,7b074fc9362a4a6a5f172dd8936a22fb25eff96b")
-use_repo(pw_rust, "pw_rust_toolchains")
+use_repo(
+    pw_rust,
+    "pw_rust_toolchains",
+    # Used by //toolcain/aarch64_linux
+    "rust_toolchain_host_linux_x86_64",
+    "rust_toolchain_target_aarch64-unknown-linux-gnu_aarch64",
+)
+
+# Used by //toolcain/aarch64_linux
+pw_cxx_toolchain = use_extension("@pigweed//pw_toolchain/cc:pw_cxx_toolchain.bzl", "pw_cxx_toolchain")
+use_repo(pw_cxx_toolchain, "llvm_toolchain")
+
+pw_cipd = use_extension("@pigweed//pw_env_setup/bazel/cipd:defs.bzl", "cipd")
+use_repo(pw_cipd, linux_sysroot = "pigweed.linux_sysroot")
 
 register_toolchains(
+    # Must precede host_cc_toolchain_linux and @pw_rust_toolchains//:all, which
+    # matches any Linux target CPU or any aarch64 platform respectively
+    "//toolchain/aarch64_linux:cc_toolchain_aarch64_linux",
+    "//toolchain/aarch64_linux:rust_toolchain_aarch64_linux_nightly",
+    "//toolchain/aarch64_linux:rust_toolchain_aarch64_linux_stable",
     "@pigweed//pw_toolchain/host_clang:host_cc_toolchain_linux",
     "@pigweed//pw_toolchain/host_clang:host_cc_toolchain_macos",
     "@pigweed//pw_toolchain/arm_clang:arm_clang_cc_toolchain_cortex-m4",
@@ -172,6 +191,15 @@ http_file(
     urls = ["https://storage.googleapis.com/caliptra-github-ci-bitstreams/v1/a2cd177353b7f06170766f367743b98c900b1d7b/runtime_a2cd177.pdi"],
 )
 
+# caliptra-ss OTP controller memory map, needed by caliptra-hw-model's build
+# script (fpga_subsystem).
+http_file(
+    name = "caliptra_ss_otp_ctrl_mmap",
+    downloaded_file_path = "otp_ctrl_mmap.hjson",
+    sha256 = "7aa3729ad3b8dacd80134773fcbfa1476a8b8b05d4c340d7ff0190adbedb934b",
+    urls = ["https://raw.githubusercontent.com/chipsalliance/caliptra-ss/01b0a3528e196f4219d20dd9cbfec3727869d5d9/src/fuse_ctrl/data/otp_ctrl_mmap.hjson"],
+)
+
 nonhermetic_repo = use_repo_rule("//target/earlgrey/tooling/signing:nonhermetic.bzl", "nonhermetic_repo")
 
 nonhermetic_repo(name = "nonhermetic")

third_party/caliptra/caliptra-mcu-sw/BUILD.bazel

@@ -236,6 +236,72 @@ rust_library(
     ],
 )
 
+# Upstream hw/model (crate caliptra-mcu-hw-model) for host-side test binaries.
+# On aarch64 (//toolchain/aarch64_linux), enables `fpga_realtime` so
+# `DefaultHwModel` is `ModelFpgaRealtime`; on x86_64 host, `DefaultHwModel` is
+# `ModelEmulated`. caliptra-mcu-builder is left out: the library only uses it
+# from tests (see hw_model_no_builder.patch), which keeps signing and OpenSSL
+# out of the build.
+rust_library(
+    name = "mcu_hw_model",
+    srcs = ["@caliptra_mcu_sw//:hw_model_srcs"],
+    crate_features = select({
+        "@platforms//cpu:aarch64": ["fpga_realtime"],
+        "//conditions:default": [],
+    }),
+    crate_name = "caliptra_mcu_hw_model",
+    crate_root = "@caliptra_mcu_sw//:hw/model/src/lib.rs",
+    edition = "2021",
+    proc_macro_deps = ["@rust_caliptra_crates_host//:int-enum"],
+    rustc_flags = ["--cap-lints=allow"],
+    deps = [
+        ":emulator_bmc",
+        ":emulator_caliptra",
+        ":emulator_consts",
+        ":emulator_periph",
+        ":emulator_registers_generated",
+        ":mcu_testing_common",
+        ":romtime",
+        "//third_party/caliptra:crate_bitfield",
+        "//third_party/caliptra:crate_caliptra-mcu-otp-lifecycle",
+        "//third_party/caliptra:crate_caliptra-mcu-registers-generated",
+        "//third_party/caliptra:crate_tock-registers",
+        "//third_party/caliptra/caliptra-sw:caliptra_emu_bus",
+        "//third_party/caliptra/caliptra-sw:caliptra_emu_cpu",
+        "//third_party/caliptra/caliptra-sw:caliptra_emu_periph",
+        "//third_party/caliptra/caliptra-sw:caliptra_hw_model",
+        "//third_party/caliptra/caliptra-sw:caliptra_hw_model_types",
+        "@rust_caliptra_crates//:caliptra-api",
+        "@rust_caliptra_crates//:caliptra-api-types",
+        "@rust_caliptra_crates//:caliptra-mcu-mbox-common",
+        "@rust_caliptra_crates//:caliptra-mcu-ocp",
+        "@rust_caliptra_crates//:caliptra-mcu-otp-digest",
+        "@rust_caliptra_crates//:caliptra-registers",
+        "@rust_caliptra_crates//:caliptra-ureg",
+        # Same zerocopy as caliptra-api (embedded repo), whose types derive it.
+        "@rust_caliptra_crates//:zerocopy",
+        "@rust_caliptra_crates_host//:anyhow",
+        "@rust_caliptra_crates_host//:caliptra-emu-types",
+        "@rust_caliptra_crates_host//:caliptra-image-types",
+        "@rust_caliptra_crates_host//:caliptra-mcu-config",
+        "@rust_caliptra_crates_host//:caliptra-mcu-config-emulator",
+        "@rust_caliptra_crates_host//:caliptra-mcu-config-fpga",
+        "@rust_caliptra_crates_host//:caliptra-mcu-poll-common",
+        "@rust_caliptra_crates_host//:ecdsa",
+        "@rust_caliptra_crates_host//:fips204",
+        "@rust_caliptra_crates_host//:hex",
+        "@rust_caliptra_crates_host//:libc",
+        "@rust_caliptra_crates_host//:p384",
+        "@rust_caliptra_crates_host//:rand",
+        "@rust_caliptra_crates_host//:semver",
+        "@rust_caliptra_crates_host//:sha2",
+        "@rust_caliptra_crates_host//:sha3",
+        "@rust_caliptra_crates_host//:tempfile",
+        "@rust_caliptra_crates_host//:thiserror",
+        "@rust_caliptra_crates_host//:uio",
+    ],
+)
+
 rust_library(
     name = "romtime",
     srcs = ["@caliptra_mcu_sw//:all_files"],

third_party/caliptra/caliptra-mcu-sw/hw_model_no_builder.patch

@@ -0,0 +1,12 @@
+--- hw/model/src/lib.rs
++++ hw/model/src/lib.rs
+@@ -36,6 +36,9 @@
+ use zerocopy::FromBytes;
+
+ // Re-export flash image builder for creating flash images from firmware bytes
++// Only used by tests; gated so the library builds without caliptra-mcu-builder
++// (and its signing/OpenSSL dependencies).
++#[cfg(test)]
+ pub use caliptra_mcu_builder::flash_image::build_flash_image_bytes;
+
+ mod bus_logger;

third_party/caliptra/caliptra-mcu-sw/overlay.BUILD

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 exports_files(
-    glob(["**/Cargo.toml"]),
+    glob(["**/Cargo.toml"]) + ["hw/fuses.hjson"],
     visibility = ["//visibility:public"],
 )
 
@@ -22,6 +22,7 @@ exports_files(
         "platforms/emulator/rom/src/main.rs",
         "platforms/fpga/rom/src/main.rs",
         "romtime/src/lib.rs",
+        "hw/model/src/lib.rs",
     ],
     visibility = ["//visibility:public"],
 )
@@ -67,3 +68,9 @@ filegroup(
     srcs = glob(["**"]),
     visibility = ["//visibility:public"],
 )
+
+filegroup(
+    name = "hw_model_srcs",
+    srcs = glob(["hw/model/src/**/*.rs"]),
+    visibility = ["//visibility:public"],
+)

third_party/caliptra/caliptra-sw/BUILD.bazel

@@ -62,6 +62,75 @@ rust_library(
     ],
 )
 
+# caliptra-hw-model for host-side test binaries. Used by
+# //third_party/caliptra/caliptra-mcu-sw:mcu_hw_model. On aarch64
+# (//toolchain/aarch64_linux), enables `fpga_subsystem`.
+#
+# Its build script reads caliptra-ss's OTP memory map from
+# $CARGO_MANIFEST_DIR/../hw/latest/caliptra-ss/... (a submodule @caliptra_sw
+# doesn't fetch). rules_rust sets CARGO_MANIFEST_DIR to the build script
+# target's package, so the script lives in ./hw-model and the map is staged
+# below at the matching hw/latest/caliptra-ss/... path, mirroring upstream's
+# layout.
+genrule(
+    name = "caliptra_ss_otp_ctrl_mmap",
+    srcs = ["@caliptra_ss_otp_ctrl_mmap//file"],
+    outs = ["hw/latest/caliptra-ss/src/fuse_ctrl/data/otp_ctrl_mmap.hjson"],
+    cmd = "cp $< $@",
+    visibility = [":__subpackages__"],
+)
+
+rust_library(
+    name = "caliptra_hw_model",
+    srcs = ["@caliptra_sw//:hw_model_srcs"],
+    compile_data = ["@caliptra_sw//:hw_fpga_files"],
+    crate_features = select({
+        "@platforms//cpu:aarch64": ["fpga_subsystem"],
+        "//conditions:default": [],
+    }),
+    crate_name = "caliptra_hw_model",
+    crate_root = "@caliptra_sw//:hw-model/src/lib.rs",
+    edition = "2021",
+    proc_macro_deps = [
+        "//third_party/caliptra:crate_serde_derive",
+    ],
+    rustc_flags = ["--cap-lints=allow"],
+    deps = [
+        ":caliptra_emu_bus",
+        ":caliptra_emu_cpu",
+        ":caliptra_emu_periph",
+        "//third_party/caliptra/caliptra-sw/hw-model:caliptra_hw_model_build_script",
+        ":caliptra_hw_model_types",
+        ":caliptra_image_fake_keys",
+        "//third_party/caliptra:crate_bitfield",
+        "//third_party/caliptra:crate_bitflags",
+        "//third_party/caliptra:crate_serde",
+        "//third_party/caliptra:crate_smlang",
+        "//third_party/caliptra:crate_tock-registers",
+        "@rust_caliptra_crates//:caliptra-api",
+        "@rust_caliptra_crates//:caliptra-api-types",
+        "@rust_caliptra_crates//:caliptra-registers",
+        "@rust_caliptra_crates//:caliptra-ureg",
+        # Same zerocopy as caliptra-api (embedded repo), whose types derive it.
+        "@rust_caliptra_crates//:zerocopy",
+        "@rust_caliptra_crates_host//:anyhow",
+        "@rust_caliptra_crates_host//:bit-vec",
+        "@rust_caliptra_crates_host//:caliptra-emu-types",
+        "@rust_caliptra_crates_host//:caliptra-image-types",
+        "@rust_caliptra_crates_host//:libc",
+        "@rust_caliptra_crates_host//:nix",
+        "@rust_caliptra_crates_host//:once_cell",
+        "@rust_caliptra_crates_host//:rand",
+        "@rust_caliptra_crates_host//:regex",
+        "@rust_caliptra_crates_host//:rustix",
+        "@rust_caliptra_crates_host//:scopeguard",
+        "@rust_caliptra_crates_host//:sha2",
+        "@rust_caliptra_crates_host//:sha3",
+        "@rust_caliptra_crates_host//:thiserror",
+        "@rust_caliptra_crates_host//:uio",
+    ],
+)
+
 rust_library(
     name = "caliptra_emu_cpu",
     srcs = ["@caliptra_sw//:emu_cpu_srcs"],

third_party/caliptra/caliptra-sw/hw-model/BUILD.bazel

@@ -0,0 +1,34 @@
+# Licensed under the Apache-2.0 license
+# SPDX-License-Identifier: Apache-2.0
+
+load("@rules_rust//cargo:defs.bzl", "cargo_build_script")
+
+# Build script for //third_party/caliptra/caliptra-sw:caliptra_hw_model. It is
+# in this package so that CARGO_MANIFEST_DIR/.. is
+# //third_party/caliptra/caliptra-sw, where the caliptra-ss OTP memory map is
+# staged (see :caliptra_ss_otp_ctrl_mmap there).
+cargo_build_script(
+    name = "caliptra_hw_model_build_script",
+    srcs = ["@caliptra_sw//:hw-model/build.rs"],
+    build_script_env = {
+        # Otherwise the script downloads fuses.hjson from GitHub at the MCU
+        # commit in caliptra-sw's CI config; use the copy at our
+        # caliptra-mcu-sw pin instead.
+        "CALIPTRA_MCU_FUSES_HJSON": "$(execpath @caliptra_mcu_sw//:hw/fuses.hjson)",
+    },
+    crate_features = select({
+        "@platforms//cpu:aarch64": ["fpga_subsystem"],
+        "//conditions:default": [],
+    }),
+    crate_root = "@caliptra_sw//:hw-model/build.rs",
+    data = [
+        "//third_party/caliptra/caliptra-sw:caliptra_ss_otp_ctrl_mmap",
+        "@caliptra_mcu_sw//:hw/fuses.hjson",
+    ],
+    edition = "2021",
+    visibility = ["//third_party/caliptra/caliptra-sw:__pkg__"],
+    deps = [
+        "@rust_caliptra_crates_host//:deser-hjson",
+        "@rust_caliptra_crates_host//:serde",
+    ],
+)

third_party/caliptra/caliptra-sw/overlay.BUILD

@@ -16,6 +16,8 @@ exports_files(
         "sw-emulator/lib/derive/src/lib.rs",
         "sw-emulator/lib/periph/src/lib.rs",
         "hw-model/types/src/lib.rs",
+        "hw-model/build.rs",
+        "hw-model/src/lib.rs",
         "image/gen/src/lib.rs",
         "image/crypto/src/lib.rs",
         "image/fake-keys/src/lib.rs",
@@ -109,3 +111,16 @@ filegroup(
     srcs = glob(["hw-model/types/src/**/*.rs"]),
     visibility = ["//visibility:public"],
 )
+
+filegroup(
+    name = "hw_model_srcs",
+    srcs = glob(["hw-model/src/**/*.rs"]),
+    visibility = ["//visibility:public"],
+)
+
+# Files caliptra-hw-model include_str!s from hw/fpga (OpenOCD configs).
+filegroup(
+    name = "hw_fpga_files",
+    srcs = glob(["hw/fpga/*.cfg", "hw/fpga/*.txt"]),
+    visibility = ["//visibility:public"],
+)