Use rules_qemu for cross-architecture generators

MODULE.bazel

@@ -15,6 +15,7 @@ bazel_dep(name = "rules_cc", version = "0.2.25")
 bazel_dep(name = "llvm", version = "0.8.24")
 bazel_dep(name = "libbpf", version = "1.7.0.bcr.1")
 bazel_dep(name = "rules_shell", version = "0.8.0")
+bazel_dep(name = "rules_qemu", version = "0.3.0")
 bazel_dep(name = "grpc", version = "1.84.0", repo_name = "com_github_grpc_grpc")
 
 # gRPC's older minimum imports a removed Google APIs extension repository.
@@ -198,42 +199,18 @@ http_file(
 )
 
 # Statically-linked QEMU user-mode emulators.
-QEMU_USER_EXPORTS = 'exports_files(["usr/bin/qemu-aarch64", "usr/bin/qemu-riscv64", "usr/bin/qemu-x86_64"])'
-
-deb_data = use_repo_rule("//tools/bazeldefs:extensions/deb_data.bzl", "deb_data")
-
-http_archive(
-    name = "qemu_user_amd64",
-    build_file_content = 'exports_files(["data.tar.xz"])',
-    sha256 = "ca6ede739327a20ae5a3498230c8a3a9a072c586e131bc6bcc1201eb1725e336",
-    type = "deb",
-    urls = [
-        "https://snapshot.debian.org/archive/debian/20260905T205002Z/pool/main/q/qemu/qemu-user_10.0.13%2Bds-0%2Bdeb13u1_amd64.deb",
-        "https://deb.debian.org/debian/pool/main/q/qemu/qemu-user_10.0.13%2Bds-0%2Bdeb13u1_amd64.deb",
-    ],
-)
-
-deb_data(
-    name = "qemu_user_amd64_files",
-    build_file_content = QEMU_USER_EXPORTS,
-    data = "@qemu_user_amd64//:data.tar.xz",
-)
-
-http_archive(
-    name = "qemu_user_arm64",
-    build_file_content = 'exports_files(["data.tar.xz"])',
-    sha256 = "c73711af02b97cd5e2667e735d9c06890c57165517110ca4e646c95a7083158d",
-    type = "deb",
-    urls = [
-        "https://snapshot.debian.org/archive/debian/20260905T205002Z/pool/main/q/qemu/qemu-user_10.0.13%2Bds-0%2Bdeb13u1_arm64.deb",
-        "https://deb.debian.org/debian/pool/main/q/qemu/qemu-user_10.0.13%2Bds-0%2Bdeb13u1_arm64.deb",
-    ],
+qemu = use_extension("@rules_qemu//qemu/extension:qemu.bzl", "qemu")
+use_repo(
+    qemu,
+    "qemu_system_toolchains",
+    "qemu_user_toolchains",
 )
 
-deb_data(
-    name = "qemu_user_arm64_files",
-    build_file_content = QEMU_USER_EXPORTS,
-    data = "@qemu_user_arm64//:data.tar.xz",
+register_toolchains(
+    "@qemu_user_toolchains//:qemu_linux_aarch64_on_linux_x86_64",
+    "@qemu_user_toolchains//:qemu_linux_riscv64_on_linux_aarch64",
+    "@qemu_user_toolchains//:qemu_linux_riscv64_on_linux_x86_64",
+    "@qemu_user_toolchains//:qemu_linux_x86_64_on_linux_aarch64",
 )
 
 # Root certificates.

governance/licensing.yaml

@@ -60,15 +60,159 @@ exceptions:
       test containers and is not linked into released gVisor binaries.
       Its source archive and GPLv2 license are retained with the build inputs,
       and the test image includes the license text.
-  - dependency: qemu_user_amd64
+  - dependency: qemu_user_prebuilt_linux_amd64_aarch64
     license: GPL-2.0-only
     exception_rationale: >-
-      QEMU user-mode emulators for x86_64 build machines, run as a build tool
-      to execute binaries built for the target architecture when
-      cross-compiling. QEMU is neither linked into nor distributed with gVisor.
-  - dependency: qemu_user_arm64
+      QEMU user-mode emulator for aarch64 target binaries on amd64 build
+      machines. The executable uses QEMU's GPL terms, not the MIT license of
+      the prebuilt repository's build scripts. Used only for cross-compilation;
+      QEMU is neither linked into nor distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_arm
     license: GPL-2.0-only
     exception_rationale: >-
-      QEMU user-mode emulators for arm64 build machines, run as a build tool
-      to execute binaries built for the target architecture when
-      cross-compiling. QEMU is neither linked into nor distributed with gVisor.
+      QEMU user-mode emulator for arm target binaries on amd64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_i386
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for i386 target binaries on amd64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_mips64
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for mips64 target binaries on amd64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_ppc
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for ppc target binaries on amd64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_ppc64le
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for ppc64le target binaries on amd64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_riscv32
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for riscv32 target binaries on amd64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_riscv64
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for riscv64 target binaries on amd64 build
+      machines. The executable uses QEMU's GPL terms, not the MIT license of
+      the prebuilt repository's build scripts. Used only for cross-compilation;
+      QEMU is neither linked into nor distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_s390x
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for s390x target binaries on amd64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_amd64_x86_64
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for x86_64 target binaries on amd64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_aarch64
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for aarch64 target binaries on arm64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_arm
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for arm target binaries on arm64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_i386
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for i386 target binaries on arm64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_mips64
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for mips64 target binaries on arm64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_ppc
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for ppc target binaries on arm64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_ppc64le
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for ppc64le target binaries on arm64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_riscv32
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for riscv32 target binaries on arm64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_riscv64
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for riscv64 target binaries on arm64 build
+      machines. The executable uses QEMU's GPL terms, not the MIT license of
+      the prebuilt repository's build scripts. Used only for cross-compilation;
+      QEMU is neither linked into nor distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_s390x
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for s390x target binaries on arm64 build
+      machines, declared by the user toolchain alongside the selected
+      cross-compilers. The executable uses QEMU's GPL terms, not the MIT
+      license of its build scripts. QEMU is neither linked into nor
+      distributed with gVisor.
+  - dependency: qemu_user_prebuilt_linux_arm64_x86_64
+    license: GPL-2.0-only
+    exception_rationale: >-
+      QEMU user-mode emulator for x86_64 target binaries on arm64 build
+      machines. The executable uses QEMU's GPL terms, not the MIT license of
+      the prebuilt repository's build scripts. Used only for cross-compilation;
+      QEMU is neither linked into nor distributed with gVisor.

pkg/seccomp/precompiledseccomp/defs.bzl

@@ -2,6 +2,53 @@
 
 load("//tools:defs.bzl", "go_binary", "select_arch", "target_emulator")
 
+def _run_generator_impl(ctx):
+    generator = ctx.attr.exec_generator or ctx.attr.generator
+    executable = generator[DefaultInfo].files_to_run
+    tools = []
+    arguments = []
+    qemu = None
+    toolchain = None
+    if not ctx.attr.exec_generator:
+        if ctx.attr.qemu:
+            qemu = ctx.attr.qemu[DefaultInfo].files_to_run
+        elif target_emulator.toolchain_type:
+            qemu_info = ctx.toolchains[target_emulator.toolchain_type]
+            if qemu_info:
+                qemu = qemu_info.qemu
+                toolchain = target_emulator.toolchain_type
+    if qemu:
+        arguments.extend(ctx.attr.qemu_args)
+        tools.append(executable)
+        arguments.append(executable.executable.path)
+        executable = qemu
+    arguments.extend([
+        "--package=" + ctx.attr.out_package_name,
+        "--out=" + ctx.outputs.out.path,
+    ])
+    ctx.actions.run(
+        executable = executable,
+        outputs = [ctx.outputs.out],
+        tools = tools,
+        arguments = arguments,
+        mnemonic = "PrecompileSeccomp",
+        toolchain = toolchain,
+    )
+    return [DefaultInfo(files = depset([ctx.outputs.out]))]
+
+_run_generator = rule(
+    implementation = _run_generator_impl,
+    attrs = {
+        "generator": attr.label(executable = True, cfg = "target"),
+        "exec_generator": attr.label(executable = True, cfg = "exec"),
+        "out": attr.output(mandatory = True),
+        "out_package_name": attr.string(mandatory = True),
+        "qemu": attr.label(executable = True, cfg = "exec"),
+        "qemu_args": attr.string_list(),
+    },
+    toolchains = target_emulator.toolchains,
+)
+
 def precompiled_seccomp_rules(
         name,
         programs_to_compile_go_library,
@@ -13,7 +60,7 @@ def precompiled_seccomp_rules(
     """Generates a Go source file containing precompiled seccomp-bpf programs.
 
     Args:
-        name: Name of the final genrule.
+        name: Name of the generated target.
         programs_to_compile_go_library: go_library target which describes the
             set of seccomp-bpf programs that you wish to precompile. This must
             define the following package-level function:
@@ -28,7 +75,7 @@ def precompiled_seccomp_rules(
         out_package_name: Go package name that `out` belongs to.
         exclude_in_fastbuild: Whether to skip precompilation in fastbuild mode.
             The auto-generated `GetPrecompiled` function will fail all lookups.
-        tags: List of tags to pass to the generated genrule.
+        tags: List of tags to pass to the generated action.
     """
     if exclude_in_fastbuild:
         native.config_setting(
@@ -153,69 +200,26 @@ def precompiled_seccomp_rules(
             ],
         )
 
-    # This genrule actually runs the go_binary we just declared, and writes
-    # its output (containing the precompiled rules) to the desired `out` file.
-    #
-    # The generator is a source (rather than a tool) of this genrule, so that
-    # it is built for the target platform rather than for the execution
-    # platform. If the execution platform's architecture differs from the
-    # target's (i.e. when cross-compiling), it is run under a user-mode
-    # emulator. If no emulator is configured for the target architecture, it
-    # is run directly, which works if the kernel is configured to run foreign
-    # binaries (binfmt_misc) and fails otherwise.
-    #
-    # Execution platform constraints are deliberately not used here: they would
-    # make cross-architecture configurations fail analysis wherever no
-    # execution platform for the target architecture is available.
-    emulator = target_emulator()
-    out_args = " --package='" + out_package_name + "' --out=$@"
-    run_gen_cmd = (
-        "GEN=$(location :" + name + "_gen_bin); " +
-        "RUN=; " +
-        "if [ -n \"$$TARGET_ARCH\" ] && [ \"$$(uname -m)\" != \"$$TARGET_ARCH\" ]; then " +
-        "  RUN=\"$$EMULATOR\"; " +
-        "fi; " +
-        "$$RUN \"$$GEN\"" + out_args + " || { " +
-        "  echo \"Failed to run $$GEN (built for $$TARGET_ARCH) on $$(uname -m)" +
-        " (emulator: $${RUN:-none}).\" >&2; " +
-        "  exit 1; " +
-        "}"
-    )
-    run_gen_env = (
-        "TARGET_ARCH=" + select_arch(
-            amd64 = "x86_64",
-            arm64 = "aarch64",
-            riscv64 = "riscv64",
-            default = "",
-        ) + "; " +
-        "EMULATOR='" + emulator.cmd + "'; "
-    )
+    # Compile the real generator for the target platform and the stub for the
+    # execution platform. The action resolves QEMU for this target/exec pair.
+    generator = ":" + name + "_gen_bin"
+    exec_generator = None
     if exclude_in_fastbuild:
-        native.genrule(
-            name = name,
-            outs = [out],
-            srcs = select({
-                ":" + name + "_fastbuild_cond": [],
-                "//conditions:default": [":" + name + "_gen_bin"],
-            }),
-            # The stubbed generator's output does not depend on the
-            # architecture, so it is built for the execution platform.
-            cmd = run_gen_env + select({
-                ":" + name + "_fastbuild_cond": "$(location :" + name + "_gen_stubbed_bin)" + out_args,
-                "//conditions:default": run_gen_cmd,
-            }),
-            tools = select({
-                ":" + name + "_fastbuild_cond": [":" + name + "_gen_stubbed_bin"],
-                "//conditions:default": [],
-            }) + emulator.tools,
-            tags = tags + ["requires-mem:16g"],
-        )
-    else:
-        native.genrule(
-            name = name,
-            outs = [out],
-            srcs = [":" + name + "_gen_bin"],
-            cmd = run_gen_env + run_gen_cmd,
-            tools = emulator.tools,
-            tags = tags + ["requires-mem:16g"],
-        )
+        generator = select({
+            ":" + name + "_fastbuild_cond": None,
+            "//conditions:default": generator,
+        })
+        exec_generator = select({
+            ":" + name + "_fastbuild_cond": ":" + name + "_gen_stubbed_bin",
+            "//conditions:default": None,
+        })
+    _run_generator(
+        name = name,
+        generator = generator,
+        exec_generator = exec_generator,
+        out = out,
+        out_package_name = out_package_name,
+        qemu = target_emulator.binary,
+        qemu_args = select_arch(arm64 = ["-cpu", "neoverse-n1"], default = []),
+        tags = tags + ["requires-mem:16g"],
+    )