Add hello world imm rom ext

[lchiawei]

• Add minimized C code, startup asm and linker script for a standalone IM_EXT build target.
• Add a bazel rule imm_rom_ext_section, which will transform binaries into object files and turn it to a target that can be directly used as deps of ROM_EXT's bazel targets.
• Reuse the rule opentitan_binary to build IM_EXT and add a attribute to skip the signing stage to the rule. The manifest given as None will turn into the default manifest and keep the signing operation so we need to skip it explicitly.
• Add a map for all IM_EXT target that can be used and make the ROM_EXT targets iterate the map to generate multiple targets.
• Update the ROM_EXT to use in e2e verified boot test.

---

This PR partially addresses #24368.

The first commit is included in #25043. I will remove it after it is reviewed and merged.

[pamaury]

My memory might be fuzzy but I think that opentitan_binary exports not only the signed binary but also the unsigned one, just a different output group. Therefore, I think you might not need a new attribute to skip signing, you just need to teach imm_rom_ext_section to look for the unsigned binary (probably use use ctx.attr.src and look at src.output_group["<exec_env>_binary"].

Alternatively, you might want to use the kind attribute (in common_binary_attrs) to introduce a new type of binary? And/or: if you introduce a new exec_env (which might make sense here), you can probably create one with no default manifest so it doesn't sign by default?

[lchiawei]

@pamaury

My memory might be fuzzy but I think that opentitan_binary exports not only the signed binary but also the unsigned one, just a different output group. Therefore, I think you might not need a new attribute to skip signing, you just need to teach imm_rom_ext_section to look for the unsigned binary (probably use use ctx.attr.src and look at src.output_group["<exec_env>_binary"].

I did some experiments, if I reuse the exec env //hw/top_earlgrey:silicon_creator, then the signing will cause the following error:

ERROR: /usr/local/google/home/lchiawei/opentitan/sw/device/silicon_creator/imm_rom_ext/BUILD:40:17: PreSigningArtifacts sw/device/silicon_creator/imm_rom_ext/hello_world_binaries_silicon_creator.test_key_0.pre-signing failed: (Exit 1): opentitantool failed: error executing PreSigningArtifacts command (from target //sw/device/silicon_creator/imm_rom_ext:hello_world_binaries) bazel-out/k8-fastbuild-ST-13d3ddad9198/bin/sw/host/opentitantool/opentitantool '--rcfile=' --quiet image manifest update ... (remaining 4 arguments skipped)

Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging
Error: Image doesn't appear to contain a manifest, or the manifest is corrupted

Caused by:
    Condition failed: `manifest.signed_region_end <= len` (4294967295 vs 1048576)

Alternatively, you might want to use the kind attribute (in common_binary_attrs) to introduce a new type of binary? And/or: if you introduce a new exec_env (which might make sense here), you can probably create one with no default manifest so it doesn't sign by default?

Actually I did found that the issues only happen when we use "//hw/top_earlgrey:silicon_creator" as the exec env, and using an empty manifest in that exec env can solve the issue. As currently all exec envs will derive same binaries and I plan to match the exec env between IM_EXT and ROM_EXT in the future, I will simply use fpga_cw340 as the only exec env. The exec env for silicon creator with empty manifest will be add in the future. And I also remove the attribute to skip the signing process.

[pamaury]

@pamaury

My memory might be fuzzy but I think that opentitan_binary exports not only the signed binary but also the unsigned one, just a different output group. Therefore, I think you might not need a new attribute to skip signing, you just need to teach imm_rom_ext_section to look for the unsigned binary (probably use use ctx.attr.src and look at src.output_group["<exec_env>_binary"].

I did some experiments, if I reuse the exec env //hw/top_earlgrey:silicon_creator, then the signing will cause the following error:

ERROR: /usr/local/google/home/lchiawei/opentitan/sw/device/silicon_creator/imm_rom_ext/BUILD:40:17: PreSigningArtifacts sw/device/silicon_creator/imm_rom_ext/hello_world_binaries_silicon_creator.test_key_0.pre-signing failed: (Exit 1): opentitantool failed: error executing PreSigningArtifacts command (from target //sw/device/silicon_creator/imm_rom_ext:hello_world_binaries) bazel-out/k8-fastbuild-ST-13d3ddad9198/bin/sw/host/opentitantool/opentitantool '--rcfile=' --quiet image manifest update ... (remaining 4 arguments skipped)

Use --sandbox_debug to see verbose messages from the sandbox and retain the sandbox build root for debugging
Error: Image doesn't appear to contain a manifest, or the manifest is corrupted

Caused by:
    Condition failed: `manifest.signed_region_end <= len` (4294967295 vs 1048576)

Ah yes, in retrospect this makes sense (although the error message is obscure and seems to point an underflow in the code).

Actually I did found that the issues only happen when we use "//hw/top_earlgrey:silicon_creator" as the exec env, and using an empty manifest in that exec env can solve the issue. As currently all exec envs will derive same binaries and I plan to match the exec env between IM_EXT and ROM_EXT in the future, I will simply use fpga_cw340 as the only exec env. The exec env for silicon creator with empty manifest will be add in the future. And I also remove the attribute to skip the signing process.

That solution seems acceptable.

[timothytrippel]

LGTM, thanks! I think we just need to rebase this again and fix the CI failure, then we can merge.

[timothytrippel]

we can remove this todo, it is no longer relevant I think

[lchiawei]

Hi @timothytrippel ,

Thanks for your review. I've removed those TODOs and rebased my commit.