openssl: add riscv64 support with perlasm assembly generation

base/cvd/MODULE.bazel

@@ -10,6 +10,7 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.19.3")
 bazel_dep(name = "aspect_rules_lint", version = "1.4.4", dev_dependency = True)
 bazel_dep(name = "bazel_skylib", version = "1.8.2", dev_dependency = True)
 bazel_dep(name = "boringssl", version = "0.20241024.0")
+bazel_dep(name = "rules_perl", version = "0.2.4")
 bazel_dep(name = "brotli")
 bazel_dep(name = "crc32c")
 bazel_dep(name = "curl")
@@ -65,3 +66,73 @@ include("//toolchain:bazel.MODULE.bazel")
 include("//toolchain:llvm.MODULE.bazel")
 include("//toolchain:python.MODULE.bazel")
 include("//toolchain:rust.MODULE.bazel")
+
+# riscv64: rules_rust does not support riscv64 host out of the box.
+# Patch triple.bzl to add riscv64gc to the supported linux architectures
+# and map the riscv64 arch string to riscv64gc (Rust's triple prefix).
+# Also patch crate_universe to include riscv64gc-unknown-linux-gnu in the
+# default SUPPORTED_PLATFORM_TRIPLES so generated BUILD files are compatible.
+single_version_override(
+    module_name = "rules_rust",
+    patches = [
+        "//patches/rules_rust:riscv64_triple.patch",
+        "//patches/rules_rust:riscv64_supported_platform.patch",
+    ],
+    patch_strip = 1,
+)
+
+# riscv64: toolchains_llvm does not support riscv64 as a host architecture.
+# Patch to add linux-riscv64 to SUPPORTED_TARGETS and its target system name.
+single_version_override(
+    module_name = "toolchains_llvm",
+    patches = [
+        "//patches/toolchains_llvm:riscv64_common.patch",
+        "//patches/toolchains_llvm:riscv64_configure.patch",
+        "//patches/toolchains_llvm:riscv64_cc_toolchain_config.patch",
+        # Fix: system_module_map filtering needs to strip %workspace% prefix,
+        # so non-existing include dirs (lib64/, arch-specific c++/v1) are 
+        # filtered out when using toolchain_root with an absolute path.
+        # This is a generic bug affecting any toolchain_root usage.
+        "//patches/toolchains_llvm:system_modulemap_filter.patch",
+    ],
+    patch_strip = 1,
+)
+
+# riscv64: aspect_bazel_lib's expand_template toolchain has no prebuilt
+# binary for riscv64. Patch to add linux_riscv64 support using a locally
+# built binary at /usr/local/bin/expand_template.
+# Build it from the aspect_bazel_lib source with:
+#   go build -o /usr/local/bin/expand_template .
+single_version_override(
+    module_name = "aspect_bazel_lib",
+    patches = ["//patches/aspect_bazel_lib:riscv64_expand_template.patch"],
+    patch_strip = 1,
+)
+
+# riscv64: rules_perl 0.2.4 has no riscv64 perl toolchain and its MODULE.bazel
+# cannot be patched via single_version_override.  Instead, download the prebuilt
+# perl tarball ourselves and register a local toolchain definition.
+perl_riscv64 = use_repo_rule("@rules_perl//perl:repo.bzl", "perl_download")
+perl_riscv64(
+    name = "perl_linux_riscv64",
+    urls = ["https://github.com/monkey-jsun/relocatable-perl-riscv/releases/download/5.42.2.0-riscv64/perl-linux-riscv64.tar.xz"],
+    sha256 = "23049b4574d76e35ec774160f6231ddae6127d1918de800c9d11eb25636e7351",
+    strip_prefix = "perl-linux-riscv64",
+)
+
+register_toolchains("//toolchain:perl_linux_riscv64_toolchain")
+
+# riscv64: openssl 3.3.1.bcr.1 overlay does not include riscv64 constants.
+# Use a patched overlay tarball that adds constants-linux-riscv64.bzl.
+# Also patch BUILD.bazel to add riscv64 to all select() blocks.
+# Source: https://github.com/monkey-jsun/android-cuttlefish/releases/tag/prebuilt-riscv64-assests
+single_version_override(
+    module_name = "openssl",
+    patches = [
+        "//patches/openssl:riscv64_overlay.patch",
+        "//patches/openssl:openssl_riscv64_build.patch",
+        "//patches/openssl:openssl_riscv64_def_hdrs.patch",
+    ],
+    patch_strip = 1,
+)
+

base/cvd/patches/aspect_bazel_lib/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(glob(["*.patch"]))

base/cvd/patches/aspect_bazel_lib/riscv64_expand_template.patch

@@ -0,0 +1,39 @@
+--- a/lib/private/expand_template_toolchain.bzl	2026-04-05 19:36:45.255432026 +0000
++++ b/lib/private/expand_template_toolchain.bzl	2026-04-05 19:37:30.308498432 +0000
+@@ -36,6 +36,12 @@
+             "@platforms//cpu:aarch64",
+         ],
+     ),
++    "linux_riscv64": struct(
++        compatible_with = [
++            "@platforms//os:linux",
++            "@platforms//cpu:riscv64",
++        ],
++    ),
+     "linux_s390x": struct(
+         compatible_with = [
+             "@platforms//os:linux",
+@@ -161,6 +167,23 @@
+ def _expand_template_platform_repo_impl(rctx):
+     is_windows = rctx.attr.platform.startswith("windows_")
+     meta = EXPAND_TEMPLATE_PLATFORMS[rctx.attr.platform]
++
++    # riscv64: no prebuilt binary from upstream. Download from our fork.
++    if rctx.attr.platform == "linux_riscv64":
++        rctx.download(
++            url = "https://github.com/monkey-jsun/android-cuttlefish/releases/download/prebuilt-riscv64-assests/expand_template-linux_riscv64",
++            output = "expand_template",
++            executable = True,
++            sha256 = "44e16855671021905fd581a85df8a5c54731709374e0e305132bee759bd744ec",
++        )
++        build_content = """# @generated by @aspect_bazel_lib//lib/private:expand_template_toolchain.bzl
++load("@aspect_bazel_lib//lib/private:expand_template_toolchain.bzl", "expand_template_toolchain")
++exports_files(["expand_template"])
++expand_template_toolchain(name = "expand_template_toolchain", bin = "expand_template", visibility = ["//visibility:public"])
++"""
++        rctx.file("BUILD.bazel", build_content)
++        return
++
+     release_platform = meta.release_platform if hasattr(meta, "release_platform") else rctx.attr.platform
+     release_file = "expand_template-{}{}".format(release_platform, ".exe" if is_windows else "")
+

base/cvd/patches/openssl/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(glob(["*.patch"]))

base/cvd/patches/openssl/openssl_riscv64_build.patch

@@ -0,0 +1,133 @@
+--- a/BUILD.bazel	2026-04-07 04:53:37.512538708 +0000
++++ b/BUILD.bazel	2026-04-07 05:22:07.136257395 +0000
+@@ -45,6 +45,20 @@
+     _LINUX_ARM64_PERLASM_TOOLS = "PERLASM_TOOLS",
+ )
+ load(
++    "@openssl-generated-overlay//:constants-linux-riscv64.bzl",
++    _LINUX_RISCV64_GEN_FILES = "GEN_FILES",
++    _LINUX_RISCV64_LIBCRYPTO_DEFINES = "LIBCRYPTO_DEFINES",
++    _LINUX_RISCV64_LIBCRYPTO_SRCS = "LIBCRYPTO_SRCS",
++    _LINUX_RISCV64_LIBSSL_DEFINES = "LIBSSL_DEFINES",
++    _LINUX_RISCV64_LIBSSL_SRCS = "LIBSSL_SRCS",
++    _LINUX_RISCV64_OPENSSL_APP_DEFINES = "OPENSSL_APP_DEFINES",
++    _LINUX_RISCV64_OPENSSL_APP_SRCS = "OPENSSL_APP_SRCS",
++    _LINUX_RISCV64_OPENSSL_DEFINES = "OPENSSL_DEFINES",
++    _LINUX_RISCV64_PERLASM_GEN = "PERLASM_GEN",
++    _LINUX_RISCV64_PERLASM_OUTS = "PERLASM_OUTS",
++    _LINUX_RISCV64_PERLASM_TOOLS = "PERLASM_TOOLS",
++)
++load(
+     "@openssl-generated-overlay//:constants-linux-x86_64-clang.bzl",
+     _LINUX_X86_64_GEN_FILES = "GEN_FILES",
+     _LINUX_X86_64_LIBCRYPTO_DEFINES = "LIBCRYPTO_DEFINES",
+@@ -117,6 +131,7 @@
+         "@bazel_tools//src/conditions:linux_x86_64": _LINUX_X86_64_OPENSSL_APP_SRCS,
+         "@bazel_tools//src/conditions:darwin_arm64": _DARWIN_ARM64_OPENSSL_APP_SRCS,
+         "@bazel_tools//src/conditions:darwin_x86_64": _DARWIN_X86_64_OPENSSL_APP_SRCS,
++        "@bazel_tools//src/conditions:linux_riscv64": _LINUX_RISCV64_OPENSSL_APP_SRCS,
+     }),
+     copts = [
+         "-iquote",
+@@ -130,6 +145,7 @@
+         "@bazel_tools//src/conditions:linux_x86_64": _LINUX_X86_64_OPENSSL_APP_DEFINES,
+         "@bazel_tools//src/conditions:darwin_arm64": _DARWIN_ARM64_OPENSSL_APP_DEFINES,
+         "@bazel_tools//src/conditions:darwin_x86_64": _DARWIN_X86_64_OPENSSL_APP_DEFINES,
++        "@bazel_tools//src/conditions:linux_riscv64": _LINUX_RISCV64_OPENSSL_APP_DEFINES,
+     }),
+     visibility = ["//visibility:public"],
+     deps = [":ssl"],
+@@ -184,6 +200,7 @@
+         "@bazel_tools//src/conditions:linux_x86_64": _LINUX_X86_64_LIBCRYPTO_SRCS,
+         "@bazel_tools//src/conditions:darwin_arm64": _DARWIN_ARM64_LIBCRYPTO_SRCS,
+         "@bazel_tools//src/conditions:darwin_x86_64": _DARWIN_X86_64_LIBCRYPTO_SRCS,
++        "@bazel_tools//src/conditions:linux_riscv64": _LINUX_RISCV64_LIBCRYPTO_SRCS,
+     }),
+     hdrs = glob(
+         [
+@@ -219,11 +236,13 @@
+         "@bazel_tools//src/conditions:linux_x86_64": _LINUX_X86_64_OPENSSL_DEFINES,
+         "@bazel_tools//src/conditions:darwin_arm64": _DARWIN_ARM64_OPENSSL_DEFINES,
+         "@bazel_tools//src/conditions:darwin_x86_64": _DARWIN_X86_64_OPENSSL_DEFINES,
++        "@bazel_tools//src/conditions:linux_riscv64": _LINUX_RISCV64_OPENSSL_DEFINES,
+     }) + select({
+         "@bazel_tools//src/conditions:linux_aarch64": _LINUX_ARM64_LIBCRYPTO_DEFINES,
+         "@bazel_tools//src/conditions:linux_x86_64": _LINUX_X86_64_LIBCRYPTO_DEFINES,
+         "@bazel_tools//src/conditions:darwin_arm64": _DARWIN_ARM64_LIBCRYPTO_DEFINES,
+         "@bazel_tools//src/conditions:darwin_x86_64": _DARWIN_X86_64_LIBCRYPTO_DEFINES,
++        "@bazel_tools//src/conditions:linux_riscv64": _LINUX_RISCV64_LIBCRYPTO_DEFINES,
+     }),
+     # To make sure downstream targets add the right copts to be able to include the headers.
+     includes = ["include"],
+@@ -247,6 +266,7 @@
+         "@bazel_tools//src/conditions:linux_x86_64": _LINUX_X86_64_LIBSSL_SRCS,
+         "@bazel_tools//src/conditions:darwin_arm64": _DARWIN_ARM64_LIBSSL_SRCS,
+         "@bazel_tools//src/conditions:darwin_x86_64": _DARWIN_X86_64_LIBSSL_SRCS,
++        "@bazel_tools//src/conditions:linux_riscv64": _LINUX_RISCV64_LIBSSL_SRCS,
+     }),
+     hdrs = glob(
+         ["include/openssl/*.h"],
+@@ -257,11 +277,13 @@
+         "@bazel_tools//src/conditions:linux_x86_64": _LINUX_X86_64_OPENSSL_DEFINES,
+         "@bazel_tools//src/conditions:darwin_arm64": _DARWIN_ARM64_OPENSSL_DEFINES,
+         "@bazel_tools//src/conditions:darwin_x86_64": _DARWIN_X86_64_OPENSSL_DEFINES,
++        "@bazel_tools//src/conditions:linux_riscv64": _LINUX_RISCV64_OPENSSL_DEFINES,
+     }) + select({
+         "@bazel_tools//src/conditions:linux_aarch64": _LINUX_ARM64_LIBSSL_DEFINES,
+         "@bazel_tools//src/conditions:linux_x86_64": _LINUX_X86_64_LIBSSL_DEFINES,
+         "@bazel_tools//src/conditions:darwin_arm64": _DARWIN_ARM64_LIBSSL_DEFINES,
+         "@bazel_tools//src/conditions:darwin_x86_64": _DARWIN_X86_64_LIBSSL_DEFINES,
++        "@bazel_tools//src/conditions:linux_riscv64": _LINUX_RISCV64_LIBSSL_DEFINES,
+     }),
+     # To make sure downstream targets add the right copts to be able to include the headers.
+     includes = ["include"],
+@@ -273,7 +295,7 @@
+ )
+
+ PERLASM_TOOLS = glob(
+-    ["crypto/perlasm/*.pl"],
++    ["crypto/perlasm/*.pl", "crypto/perlasm/*.pm"],
+     exclude = COMMON_GENERATED_FILES,
+ )
+
+@@ -291,10 +313,15 @@
+             "@bazel_tools//src/conditions:linux_x86_64": CC_ENV_CMD + _LINUX_X86_64_PERLASM_GEN,
+             "@bazel_tools//src/conditions:darwin_arm64": CC_ENV_CMD + _DARWIN_ARM64_PERLASM_GEN,
+             "@bazel_tools//src/conditions:darwin_x86_64": CC_ENV_CMD + _DARWIN_X86_64_PERLASM_GEN,
++            # Post-process perlasm output: replace non-PIC 'jal ra,SYMBOL' with
++            # PIC-compatible 'call SYMBOL' (auipc+jalr pseudo-instruction).
++            # Upstream perlasm bug: aes-riscv64.pl generates jal for AES_set_encrypt_key.
++            "@bazel_tools//src/conditions:linux_riscv64": CC_ENV_CMD + _LINUX_RISCV64_PERLASM_GEN + "\n".join(["sed -i 's/jal\\s\\+ra,/call /g' $(OUTS)"]),
+         }),
+         target_compatible_with = [{
+             "arm64": "@platforms//cpu:arm64",
+             "x86_64": "@platforms//cpu:x86_64",
++            "riscv64": "@platforms//cpu:riscv64",
+         }[k]],
+         toolchains = [
+             "@bazel_tools//tools/cpp:current_cc_toolchain",
+@@ -305,11 +332,13 @@
+             "@bazel_tools//src/conditions:linux_x86_64": depset(direct = _LINUX_X86_64_PERLASM_TOOLS).to_list(),
+             "@bazel_tools//src/conditions:darwin_arm64": depset(direct = _DARWIN_ARM64_PERLASM_TOOLS).to_list(),
+             "@bazel_tools//src/conditions:darwin_x86_64": depset(direct = _DARWIN_X86_64_PERLASM_TOOLS).to_list(),
++            "@bazel_tools//src/conditions:linux_riscv64": depset(direct = _LINUX_RISCV64_PERLASM_TOOLS).to_list(),
+         }),
+     )
+     for k, v in {
+         "arm64": _DARWIN_ARM64_PERLASM_OUTS,
+         "x86_64": _LINUX_X86_64_PERLASM_OUTS,
++        "riscv64": _LINUX_RISCV64_PERLASM_OUTS,
+     }.items()
+ ]
+
+@@ -359,6 +388,10 @@
+             contents = v,
+             filename = k,
+         ) for k, v in _DARWIN_X86_64_GEN_FILES.items()]),
++        "@bazel_tools//src/conditions:linux_riscv64": "\n".join([GEN_FILE_CMD.format(
++            contents = v,
++            filename = k,
++        ) for k, v in _LINUX_RISCV64_GEN_FILES.items()]),
+     }),
+ )
+

base/cvd/patches/openssl/openssl_riscv64_def_hdrs.patch

@@ -0,0 +1,10 @@
+--- a/BUILD.bazel	2026-04-06 14:33:37.864860763 +0000
++++ b/BUILD.bazel	2026-04-06 15:30:14.443131594 +0000
+@@ -210,6 +210,7 @@
+             "include/openssl/**/*.h",
+             "include/crypto/*.h",
+             "include/crypto/**/*.h",
++            "include/crypto/*.def",
+         ],
+     ) + [":generated-headers"],
+     additional_compiler_inputs = [":generated-headers"] + glob(

base/cvd/patches/openssl/riscv64_overlay.patch

@@ -0,0 +1,11 @@
+--- a/MODULE.bazel
++++ b/MODULE.bazel
+@@ -15,6 +15,6 @@
+
+ http_archive(
+     name = "openssl-generated-overlay",
+-    integrity = "sha256-fXZ0Cr/DKjm29wLDqlmqKr2XnXMbWMjGYuVnsuVxWdA=",
+-    url = "https://github.com/raccoons-build/bazel-openssl-cc/releases/download/3.3.1.bcr.1/bazel-openssl-cc-3.3.1.bcr.1.tar.gz",
++    integrity = "sha256-3+93Mm6Z+pl4pf8tPebqgp35OVH4YqTYJzGaKf+/1PQ=",
++    url = "https://github.com/monkey-jsun/android-cuttlefish/releases/download/prebuilt-riscv64-assests/bazel-openssl-cc-3.3.1.bcr.1+riscv64.tar.gz",
+ )

base/cvd/patches/rules_rust/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(["riscv64_triple.patch"])

base/cvd/patches/rules_rust/riscv64_supported_platform.patch

@@ -0,0 +1,10 @@
+--- a/crate_universe/private/crates_repository.bzl
++++ b/crate_universe/private/crates_repository.bzl
+@@ -34,6 +34,7 @@
+     "x86_64-pc-windows-msvc",
+     "x86_64-unknown-linux-gnu",
+     "x86_64-unknown-nixos-gnu",
++    "riscv64gc-unknown-linux-gnu",
+ ]
+
+ def _crates_repository_impl(repository_ctx):

base/cvd/patches/rules_rust/riscv64_triple.patch

@@ -0,0 +1,21 @@
+--- a/rust/platform/triple.bzl
++++ b/rust/platform/triple.bzl
+@@ -129,7 +129,7 @@
+     # Detect the host's cpu architecture
+
+     supported_architectures = {
+-        "linux": ["aarch64", "x86_64", "s390x", "powerpc64le"],
++        "linux": ["aarch64", "x86_64", "s390x", "powerpc64le", "riscv64gc"],
+         "macos": ["aarch64", "x86_64"],
+         "windows": ["aarch64", "x86_64"],
+     }
+@@ -141,6 +141,9 @@
+     if arch == "ppc64le":
+         arch = "powerpc64le"
+
++    if arch == "riscv64":
++        arch = "riscv64gc"
++
+     if "linux" in repository_ctx.os.name:
+         _validate_cpu_architecture(arch, supported_architectures["linux"])
+         prefix = "{}-unknown-linux".format(arch)

base/cvd/patches/toolchains_llvm/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(glob(["*.patch"]))

base/cvd/patches/toolchains_llvm/riscv64_cc_toolchain_config.patch

@@ -0,0 +1,17 @@
+--- a/toolchain/cc_toolchain_config.bzl
++++ b/toolchain/cc_toolchain_config.bzl
+@@ -82,6 +82,14 @@ def cc_toolchain_config(
+             "clang",
+             "glibc_unknown",
+         ),
++        "linux-riscv64": (
++            "clang-riscv64-linux",
++            "riscv64",
++            "glibc_unknown",
++            "clang",
++            "clang",
++            "glibc_unknown",
++        ),
+         "linux-armv7": (
+             "clang-armv7-linux",
+             "armv7",

base/cvd/patches/toolchains_llvm/riscv64_common.patch

@@ -0,0 +1,10 @@
+--- a/toolchain/internal/common.bzl
++++ b/toolchain/internal/common.bzl
+@@ -16,6 +16,7 @@ SUPPORTED_TARGETS = [
+     ("linux", "x86_64"),
+     ("linux", "aarch64"),
+     ("linux", "armv7"),
++    ("linux", "riscv64"),
+     ("darwin", "x86_64"),
+     ("darwin", "aarch64"),
+     ("none", "riscv32"),

base/cvd/patches/toolchains_llvm/riscv64_configure.patch

@@ -0,0 +1,10 @@
+--- a/toolchain/internal/configure.bzl
++++ b/toolchain/internal/configure.bzl
+@@ -347,6 +347,7 @@ def _cc_toolchain_str(
+         "darwin-aarch64": "aarch64-apple-macosx",
+         "linux-aarch64": "aarch64-unknown-linux-gnu",
+         "linux-armv7": "armv7-unknown-linux-gnueabihf",
++        "linux-riscv64": "riscv64-unknown-linux-gnu",
+         "linux-x86_64": "x86_64-unknown-linux-gnu",
+         "none-riscv32": "riscv32-unknown-none-elf",
+         "none-x86_64": "x86_64-unknown-none",

base/cvd/patches/toolchains_llvm/system_modulemap_filter.patch

@@ -0,0 +1,11 @@
+--- a/toolchain/internal/configure.bzl	2026-04-04 05:46:35.154316311 +0000
++++ b/toolchain/internal/configure.bzl	2026-04-04 05:47:15.999204323 +0000
+@@ -684,6 +684,8 @@
+
+ def _is_hermetic_or_exists(rctx, path, sysroot_path):
+     path = path.replace("%sysroot%", sysroot_path).replace("//", "/")
++    if path.startswith("%workspace%/"):
++        path = path.removeprefix("%workspace%")
+     if not path.startswith("/"):
+         return True
+     return rctx.path(path).exists

base/cvd/toolchain/BUILD.bazel

@@ -1,3 +1,21 @@
+load("@rules_perl//perl:toolchain.bzl", "perl_toolchain")
+
 package(default_visibility = ["//visibility:public"])
 
 filegroup(name = "empty")
+
+# riscv64 perl toolchain using prebuilt perl-linux-riscv64 tarball.
+perl_toolchain(
+    name = "perl_linux_riscv64_toolchain_impl",
+    runtime = ["@perl_linux_riscv64//:runtime"],
+)
+
+toolchain(
+    name = "perl_linux_riscv64_toolchain",
+    exec_compatible_with = [
+        "@platforms//os:linux",
+        "@platforms//cpu:riscv64",
+    ],
+    toolchain = ":perl_linux_riscv64_toolchain_impl",
+    toolchain_type = "@rules_perl//perl:toolchain_type",
+)