test,build: replace lowRISC/crt with llvm-mingw and test Win32 ATE DLL

.github/workflows/main.yml

@@ -42,6 +42,12 @@ jobs:
       - name: Test everything
         # Skip running lint tests as those are run in a previous stage.
         run: bazelisk test --test_tag_filters=-lint,-fpga //...
+      # Tagged `manual` (it needs podman and builds a container image), so it is
+      # not covered by the wildcard above. This is the only check that actually
+      # executes the Win32 artifact we ship.
+      - name: Test Win32 ATE DLL
+        if: always()
+        run: bazelisk test //src/ate/test_programs:ate_dll_smoke_test --test_output=errors
 
   # Run integration tests.
   integration_tests:
@@ -70,6 +76,15 @@ jobs:
       - name: Run TLS test (RSA)
         if: always()
         run: OPENTITAN_VAR_DIR=$(pwd)/.otvar-dev-tls-rsa ./tests/run_tls_test.sh
+      # Same coverage as the TLS tests above, but driving the Win32 `ate.dll`
+      # we ship to ATE vendors, from a container that stands in for a Windows
+      # ATE machine.
+      - name: Run Windows ATE DLL test (PQ)
+        if: always()
+        run: OPENTITAN_VAR_DIR=$(pwd)/.otvar-dev-windll-pq ./tests/run_ate_dll_test.sh --pq
+      - name: Run Windows ATE DLL test (RSA)
+        if: always()
+        run: OPENTITAN_VAR_DIR=$(pwd)/.otvar-dev-windll-rsa ./tests/run_ate_dll_test.sh
       - name: Run integration tests (SoftHSM2, PQ)
         if: always()
         run: OT_PROV_ORCHESTRATOR_PATH="${OT_PROV_ORCHESTRATOR_PATH}" OT_PROV_ORCHESTRATOR_UNPACK="${OT_PROV_ORCHESTRATOR_UNPACK}" OPENTITAN_VAR_DIR=$(pwd)/.otvar-dev-ate-pq ./tests/run_ate_test.sh --pq

.gitignore

@@ -3,6 +3,7 @@
 .opentitan
 .otdev
 .otprod
+.otvar*
 bazel-*
 *.swp
 result

MODULE.bazel

@@ -356,8 +356,8 @@ http_archive(
 # Legacy HTTP Archives & Cross Compilation
 # -------------------------------------------------------------------------
 
-# GCC MXE MinGW32 Toolchain
-_MXE_BUILD_FILE = """
+# LLVM-MinGW Win32 Toolchain
+_LLVM_MINGW_BUILD_FILE = """
 package(default_visibility = ["//visibility:public"])
 filegroup(
     name = "all",
@@ -367,14 +367,14 @@ exports_files(glob(["bin/**"]))
 """
 
 http_archive(
-    name = "gcc_mxe_mingw32_files",
-    build_file_content = _MXE_BUILD_FILE,
-    sha256 = "215b9dfa070687dafab29453b04a075e7955c2c7f3b8d16960207cfde730f126",
-    strip_prefix = "mxe",
-    urls = ["https://github.com/lowRISC/crt/releases/download/v0.4.14/mxe-binaries-win32.tar.xz"],
+    name = "llvm_mingw_files",
+    build_file_content = _LLVM_MINGW_BUILD_FILE,
+    sha256 = "4d905bae713182f1a2b4d33875fe5aa544ce9fc04cc153acb47755a90ca62f16",
+    strip_prefix = "llvm-mingw-20260908-msvcrt-ubuntu-22.04-x86_64",
+    urls = ["https://github.com/mstorsjo/llvm-mingw/releases/download/20260908/llvm-mingw-20260908-msvcrt-ubuntu-22.04-x86_64.tar.xz"],
 )
 
-register_toolchains("//third_party/crt/toolchains/gcc_mxe_mingw32:cc_toolchain_pc-win32")
+register_toolchains("//third_party/llvm_mingw:cc_toolchain_win32")
 
 # Protobuf matchers
 http_archive(

rules/windows_binary.bzl

@@ -4,44 +4,40 @@
 
 def _windows_platform_transition_impl(settings, attr):
     return {
-        "//command_line_option:platforms": "//third_party/crt/platforms/x86_32:win32",
+        "//command_line_option:platforms": "//third_party/llvm_mingw:win32",
     }
 
 windows_platform_transition = transition(
     implementation = _windows_platform_transition_impl,
     inputs = [],
-    outputs = ["//command_line_option:platforms"],
+    outputs = [
+        "//command_line_option:platforms",
+    ],
 )
 
 def _windows_binary_impl(ctx):
     # The dependency 'dep' is now built in the windows configuration.
     # ctx.attr.dep is a list because the transition is 1:1.
     dep = ctx.attr.dep[0]
 
-    # Determine the output file name based on the target name.
-    # We expect a DLL for Windows binaries (linkshared=True).
-    output = ctx.actions.declare_file(ctx.label.name + ".dll")
+    # Determine the output file name based on the target name. DLLs are
+    # produced by cc_binary targets with linkshared = True, executables by
+    # regular cc_binary targets.
+    extension = ctx.attr.extension
+    output = ctx.actions.declare_file(ctx.label.name + "." + extension)
 
     found = False
     for f in dep[DefaultInfo].files.to_list():
-        if f.extension == "dll":
+        if f.extension == extension:
             ctx.actions.symlink(output = output, target_file = f)
             found = True
             break
 
     if not found:
-        # Fallback: just forward everything if no DLL found (though unexpected for this specific use case)
-        # Or fail. Let's fail to be explicit, as we expect a DLL.
-        # But maybe it's an exe?
-        for f in dep[DefaultInfo].files.to_list():
-            if f.extension == "exe":
-                ctx.actions.declare_file(ctx.label.name + ".exe")
-                ctx.actions.symlink(output = output, target_file = f)
-                found = True
-                break
-
-    if not found:
-        fail("Could not find .dll or .exe in dependency output. Files: " + str(dep[DefaultInfo].files.to_list()))
+        fail("Could not find .{} in dependency output. Files: {}".format(
+            extension,
+            str(dep[DefaultInfo].files.to_list()),
+        ))
 
     return [
         DefaultInfo(
@@ -54,6 +50,11 @@ windows_binary = rule(
     implementation = _windows_binary_impl,
     attrs = {
         "dep": attr.label(cfg = windows_platform_transition),
+        "extension": attr.string(
+            default = "dll",
+            values = ["dll", "exe"],
+            doc = "Artifact extension produced by `dep`.",
+        ),
         "_allowlist_function_transition": attr.label(
             default = "@bazel_tools//tools/allowlists/function_transition_allowlist",
         ),

src/ate/BUILD.bazel

@@ -2,7 +2,7 @@
 # Licensed under the Apache License, Version 2.0, see LICENSE for details.
 # SPDX-License-Identifier: Apache-2.0
 
-load("//third_party/crt/rules:pkg_win.bzl", "pkg_win")
+load("@rules_pkg//pkg:zip.bzl", "pkg_zip")
 load("//rules:windows_binary.bzl", "windows_binary")
 load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
@@ -16,6 +16,14 @@ WINDOWS_LIBS = [
     "-lstdc++",  # Standard C++ library
 ]
 
+# Header-only view of the public DLL C API, for consumers that load `ate.dll`
+# dynamically (e.g. the Win32 smoke test) and must not link the client itself.
+cc_library(
+    name = "ate_api_hdr",
+    hdrs = ["ate_api.h"],
+    includes = ["."],
+)
+
 cc_library(
     name = "ate_client",
     srcs = ["ate_client.cc"],
@@ -126,14 +134,13 @@ windows_binary(
     dep = ":ate_bin",
 )
 
-pkg_win(
+pkg_zip(
     name = "windows",
     srcs = [
         "ate_api.h",
         "ate_perso_blob.h",
         ":ate",
     ],
-    platform = "//third_party/crt/platforms/x86_32:win32",
 )
 
 go_library(

src/ate/test_programs/BUILD.bazel

@@ -5,6 +5,7 @@
 package(default_visibility = ["//visibility:public"])
 
 load("@io_bazel_rules_go//go:def.bzl", "go_binary")
+load("//rules:windows_binary.bzl", "windows_binary")
 
 cc_binary(
     name = "cp",
@@ -54,3 +55,49 @@ go_binary(
         "@org_golang_google_grpc//resolver:go_default_library",
     ],
 )
+
+# Win32 host that loads the shipped `ate.dll` and calls `CreateClient()`. Built
+# for Windows only; it is executed under wine by `:ate_dll_smoke_test`.
+cc_binary(
+    name = "ate_dll_smoke_bin",
+    srcs = ["ate_dll_smoke.cc"],
+    linkopts = ["-lstdc++"],
+    target_compatible_with = [
+        "@platforms//os:windows",
+    ],
+    deps = ["//src/ate:ate_api_hdr"],
+)
+
+windows_binary(
+    name = "ate_dll_smoke",
+    dep = ":ate_dll_smoke_bin",
+    extension = "exe",
+)
+
+# Loads the Win32 ATE DLL inside a Wine container and exercises `CreateClient()`
+# in both insecure and mTLS modes.
+#
+# Tagged `manual` because it requires `podman` and `openssl` on the host, and
+# builds a container image on first run; run it explicitly with:
+#   bazelisk test //src/ate/test_programs:ate_dll_smoke_test
+sh_test(
+    name = "ate_dll_smoke_test",
+    srcs = ["run_ate_dll_smoke_test.sh"],
+    data = [
+        ":ate_dll_smoke",
+        "//src/ate",
+        "//util:ate_client_container.sh",
+        "//util/containers/ate_client:container_files",
+    ],
+    env = {
+        "SMOKE_EXE": "$(rootpath :ate_dll_smoke)",
+        "ATE_DLL": "$(rootpath //src/ate)",
+    },
+    tags = [
+        "external",
+        "local",
+        "manual",
+        "no-remote",
+        "no-sandbox",
+    ],
+)