From 2c41ce12dd9d37e4268731c49ff1f58ad197165a Mon Sep 17 00:00:00 2001
From: Gary Guo <gary.guo@lowrisc.org>
Date: Wed, 3 Jan 2024 14:18:22 +0000
Subject: [PATCH] Add a dev shell for opentitan

---
 dev/opentitan.nix | 73 +++++++++++++++++++++++++++++++++++++++++++++++
 flake.nix         |  7 ++++-
 2 files changed, 79 insertions(+), 1 deletion(-)
 create mode 100644 dev/opentitan.nix

diff --git a/dev/opentitan.nix b/dev/opentitan.nix
new file mode 100644
index 0000000..766c4e5
--- /dev/null
+++ b/dev/opentitan.nix
@@ -0,0 +1,73 @@
+{
+  pkgs,
+  ncurses5-fhs,
+  python_ot,
+  verilator_ot,
+  edaTools ? [],
+  wrapCCWith,
+  gcc-unwrapped,
+  pkg-config,
+  ...
+}: let
+  edaExtraDeps = with pkgs; [elfutils openssl];
+
+  # Bazel rules_rust expects build PIE binary in opt build but doesn't request PIE/PIC, so force PIC
+  gcc-patched = wrapCCWith {
+    cc = gcc-unwrapped;
+    nixSupport.cc-cflags = ["-fPIC"];
+  };
+
+  # Bazel filters out all environment including PKG_CONFIG_PATH. Append this inside wrapper.
+  pkg-config-patched = pkg-config.override {
+    extraBuildCommands = ''
+      echo "export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/lib/pkgconfig" >> $out/nix-support/utils.bash
+    '';
+  };
+in
+  (pkgs.buildFHSEnv {
+    name = "opentitan";
+    targetPkgs = _:
+      with pkgs;
+        [
+          bazelisk
+
+          python_ot
+          verilator_ot
+
+          # For serde-annotate which can be built with just cargo
+          rustup
+
+          # Bazel downloads Rust compilers which are not patchelfed and they need this.
+          zlib
+          openssl
+          curl
+
+          gcc-patched
+          pkg-config-patched
+
+          libxcrypt-legacy
+          udev
+          libftdi1
+          libusb1 # needed for libftdi1 pkg-config
+          ncurses5-fhs
+
+          srecord
+
+          # For documentation
+          hugo
+          doxygen
+        ]
+        ++ map (tool:
+          tool.override {
+            extraDependencies = edaExtraDeps;
+          })
+        edaTools;
+    extraOutputsToInstall = ["dev"];
+
+    extraBwrapArgs = [
+      # OpenSSL included in the Python downloaded by Bazel makes use of these paths.
+      "--symlink ${pkgs.openssl.out}/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf"
+      "--symlink /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem"
+    ];
+  })
+  .env
diff --git a/flake.nix b/flake.nix
index 06f2c9d..69765ee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -26,8 +26,13 @@
       pkgs = import nixpkgs {
         inherit system;
       };
-    in {
+    in rec {
       packages = import ./pkgs {inherit pkgs inputs;};
+      devShells = {
+        opentitan = pkgs.callPackage ./dev/opentitan.nix {
+          inherit (packages) ncurses5-fhs verilator_ot python_ot;
+        };
+      };
       formatter = pkgs.alejandra;
     });
   in