[verilator] Statically link the verilator simulator

In order to run in foreign CI environments, we need to statically link
verilator to avoid glibc versioning issues.  Worse, the current
debian/ubuntu package for `libelf` has an error that prevents static
linking.

- Include the latest upstream libelf which corrects the linking error.
- Set the CFLAGS and LDFLAGS environment variables during the build of
  the simulator to statically link and include the upstream libelf.

Signed-off-by: Chris Frantz <[email protected]>

Author: cfrantz

MODULE.bazel

@@ -283,7 +283,7 @@ hsm = use_extension("//third_party/hsm:extensions.bzl", "hsm")
 use_repo(hsm, "cloud_kms_hsm", "opensc", "sc_hsm", "softhsm2")
 
 system_libs = use_extension("//third_party/system_libs:extensions.bzl", "system_libs")
-use_repo(system_libs, "libudev_zero")
+use_repo(system_libs, "libelf", "libudev_zero")
 
 nist_cavp = use_extension("//third_party/nist_cavp_testvectors:extensions.bzl", "nist_cavp")
 use_repo(

MODULE.bazel.lock

@@ -41,6 +41,18 @@ fusesoc_build(
         "//:cores",
     ],
     data = ["//hw/ip/otbn:all_files"],
+    env = {
+        # Note: when `make` is executed to build the simulator, it executes inside of
+        # a build directory 6 levels down from where the location directives will
+        # evaluate to.
+        "CFLAGS_FOR_BUILD": "-I../../../../../../$(location @libelf//:gen_dir)/include",
+        "LDFLAGS_FOR_BUILD": "-static ../../../../../../$(location @libelf//:gen_dir)/lib/libelf.a",
+    },
+    extra_deps = [
+        # Note: the current debian/ubuntu `libelf1` package will not statically link.
+        # We supply the latest version which fixes the linking error.
+        "@libelf//:gen_dir",
+    ],
     make_options = ":make_options",
     output_groups = {
         "binary": ["sim-verilator/Vchip_sim_tb"],

hw/BUILD

@@ -4,8 +4,8 @@
 
 load("@rules_pkg//pkg:mappings.bzl", "pkg_filegroup", "pkg_files")
 load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
-load("//rules/opentitan:splice.bzl", "bitstream_splice")
 load("//rules:flags.bzl", "build_with_flags")
+load("//rules/opentitan:splice.bzl", "bitstream_splice")
 
 package(default_visibility = ["//visibility:public"])
 
@@ -71,20 +71,12 @@ build_with_flags(
     target = "//sw/host/opentitantool:package",
 )
 
-build_with_flags(
-    name = "hsmtool",
-    flags = {
-        "//rules:static_link_host_tools": "True",
-    },
-    target = "//sw/host/hsmtool:package",
-)
-
 # TODO(cfrantz): Implement release automation so we don't have to publish the artifact manually.
 # Upload this to the GCS bucket `artifacts.opentitan.org` and name the file
 # with a date tag (e.g. devbundle-YYYYMMDD.tar.xz).
 #
 # For example:
-# $ gcloud --acount[email protected] \
+# $ gcloud --account[email protected] \
 #       storage cp \
 #           bazel-bin/release/devbundle/devbundle.tar.xz \
 #           gs://artifacts.opentitan.org/dev_bundle/devbundle-20250718.tar.xz
@@ -94,13 +86,16 @@ pkg_tar(
     srcs = [
         ":bazel",
         ":bitstreams_pkg",
-        ":hsmtool",
         ":opentitantool",
         "//hw:package",
         "//hw/ip/otp_ctrl/data:package",
         "//sw/device/lib/testing/test_rom:package",
         "//sw/device/silicon_creator/lib/ownership/keys/fake:fpga_dev_pkg",
         "//sw/device/silicon_creator/rom_ext:fpga_dev_pkg",
+        # Note: a static build of hsmtool doesn't work because the PKCS#11
+        # middleware libraries are typically dynamically linked and load
+        # glibc and friends.
+        "//sw/host/hsmtool:package",
     ],
     extension = "tar.xz",
     tags = ["manual"],

release/devbundle/BUILD

@@ -80,18 +80,20 @@ def _fusesoc_build_impl(ctx):
     args.add_all(ctx.attr.systems)
     args.add_all(flags)
 
+    env = {k: ctx.expand_location(v, ctx.attr.extra_deps) for k, v in ctx.attr.env.items()}
+
     # Note: the `fileset_top` flag used above is specific to the OpenTitan
     # project to select the correct RTL fileset.
     ctx.actions.run(
         mnemonic = "FuseSoC",
         outputs = outputs,
-        inputs = ctx.files.srcs + ctx.files.cores + ctx.files._fusesoc + [
+        inputs = ctx.files.srcs + ctx.files.cores + ctx.files._fusesoc + ctx.files.extra_deps + [
             cfg_file,
         ],
         arguments = [args],
         executable = ctx.executable._fusesoc,
         use_default_shell_env = False,
-        env = ENV,
+        env = ENV | env,
     )
     return [
         DefaultInfo(
@@ -107,6 +109,8 @@ fusesoc_build = rule(
         "cores": attr.label_list(allow_files = True, doc = "FuseSoC core specification files"),
         "srcs": attr.label_list(allow_files = True, doc = "Source files"),
         "data": attr.label_list(allow_files = True, doc = "Files needed at runtime"),
+        "extra_deps": attr.label_list(allow_files = True, doc = "Extra deps needed to build the model"),
+        "env": attr.string_dict(doc = "Environment variables to set during the build"),
         "target": attr.string(mandatory = True, doc = "Target name (e.g. 'sim')"),
         "systems": attr.string_list(mandatory = True, doc = "Systems to build"),
         "flags": attr.string_list(doc = "Flags controlling the FuseSOC system build"),

rules/fusesoc.bzl

@@ -0,0 +1,28 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+load("@rules_foreign_cc//foreign_cc:configure.bzl", "configure_make")
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "all_srcs",
+    srcs = glob(["**"]),
+)
+
+configure_make(
+    name = "libelf",
+    args = ["-j"],
+    #autoreconf = True,
+    #autoreconf_options = ["-fi"],
+    configure_in_place = True,
+    lib_source = ":all_srcs",
+    out_static_libs = ["libelf.a"],
+)
+
+filegroup(
+    name = "gen_dir",
+    srcs = [":libelf"],
+    output_group = "gen_dir",
+)

third_party/system_libs/BUILD.libelf.bazel

@@ -16,3 +16,10 @@ def _system_libs_repos():
         strip_prefix = "libudev-zero-1.0.3",
         sha256 = "0bd89b657d62d019598e6c7ed726ff8fed80e8ba092a83b484d66afb80b77da5",
     )
+    http_archive(
+        name = "libelf",
+        build_file = Label("//third_party/system_libs:BUILD.libelf.bazel"),
+        url = "https://sourceware.org/elfutils/ftp/0.193/elfutils-0.193.tar.bz2",
+        strip_prefix = "elfutils-0.193",
+        sha256 = "7857f44b624f4d8d421df851aaae7b1402cfe6bcdd2d8049f15fc07d3dde7635",
+    )