Add a dev shell for opentitan

dev/opentitan.nix

@@ -0,0 +1,73 @@
+{
+  pkgs,
+  ncurses5-fhs,
+  bazel_ot,
+  python_ot,
+  verilator_ot,
+  edaTools ? [],
+  wrapCCWith,
+  gcc-unwrapped,
+  pkg-config,
+  ...
+}: let
+  edaExtraDeps = with pkgs; [elfutils openssl];
+
+  # Bazel rules_rust expects build PIE binary in opt build but doesn't request PIE/PIC, so force PIC
+  gcc-patched = wrapCCWith {
+    cc = gcc-unwrapped;
+    nixSupport.cc-cflags = ["-fPIC"];
+  };
+
+  # Bazel filters out all environment including PKG_CONFIG_PATH. Append this inside wrapper.
+  pkg-config-patched = pkg-config.override {
+    extraBuildCommands = ''
+      echo "export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:/usr/lib/pkgconfig" >> $out/nix-support/utils.bash
+    '';
+  };
+in
+  (pkgs.buildFHSEnv {
+    name = "opentitan";
+    targetPkgs = _:
+      with pkgs;
+        [
+          bazel_ot
+          python_ot
+          verilator_ot
+
+          # For serde-annotate which can be built with just cargo
+          rustup
+
+          # Bazel downloads Rust compilers which are not patchelfed and they need this.
+          zlib
+          openssl
+          curl
+
+          gcc-patched
+          pkg-config-patched
+
+          libxcrypt-legacy
+          udev
+          libftdi1
+          libusb1 # needed for libftdi1 pkg-config
+          ncurses5-fhs
+
+          srecord
+
+          # For documentation
+          hugo
+          doxygen
+        ]
+        ++ map (tool:
+          tool.override {
+            extraDependencies = edaExtraDeps;
+          })
+        edaTools;
+    extraOutputsToInstall = ["dev"];
+
+    extraBwrapArgs = [
+      # OpenSSL included in the Python downloaded by Bazel makes use of these paths.
+      "--symlink ${pkgs.openssl.out}/etc/ssl/openssl.cnf /etc/ssl/openssl.cnf"
+      "--symlink /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem"
+    ];
+  })
+  .env

flake.nix

@@ -26,8 +26,13 @@
       pkgs = import nixpkgs {
         inherit system;
       };
-    in {
+    in rec {
       packages = import ./pkgs {inherit pkgs inputs;};
+      devShells = {
+        opentitan = pkgs.callPackage ./dev/opentitan.nix {
+          inherit (packages) ncurses5-fhs bazel_ot verilator_ot python_ot;
+        };
+      };
       formatter = pkgs.alejandra;
     });
   in

pkgs/bazel_ot/default.nix

@@ -0,0 +1,20 @@
+{
+  runCommand,
+  bazelisk,
+  bazel_6,
+  ...
+}:
+# OpenTitan requires a specific version of Bazel.
+# We *could* package our own Bazel, but it can't be a simple override since Bazel build process
+# require a lot of Internet dependencies.
+#
+# For simplicity we'll just let bazelisk do the heavyloading.
+#
+# This package basically just creates an alias from bazel to bazelisk and adds the auto completion
+# which is absent in bazelisk.
+runCommand "bazel" {} ''
+  cp -r ${bazelisk} $out
+  chmod -R +w $out
+  ln -s $out/bin/bazelisk $out/bin/bazel
+  cp -r ${bazel_6}/share $out/share
+''

pkgs/default.nix

@@ -7,8 +7,11 @@
   ...
 }:
 {
+  ncurses5-fhs = pkgs.callPackage ./ncurses5-fhs.nix {};
+
   verilator_ot = import ./verilator {inherit pkgs;};
   python_ot = pkgs.callPackage ./python_ot {inherit inputs;};
+  bazel_ot = pkgs.callPackage ./bazel_ot {};
 }
 // pkgs.lib.optionalAttrs (pkgs.system == "x86_64-linux") {
   lowrisc-toolchain-gcc-rv32imcb = pkgs.callPackage ./lowrisc-toolchain-gcc-rv32imcb.nix {};

pkgs/ncurses5-fhs.nix

@@ -0,0 +1,19 @@
+{
+  runCommand,
+  ncurses5,
+  patchelf,
+  ...
+}:
+# If SONAME is specified, lookup cache files created by ldconfig will only use the SONAME and will ignore
+# the filename, this casues libtinfo.so to not be found under FHS. Patch ncurses5 to provide a libtinfo.so
+# with proper SONAME.
+runCommand "ncurses5" {
+  outputs = ["out" "dev" "man"];
+} ''
+  cp -r ${ncurses5} $out
+  chmod +w $out/lib
+  cp -L --no-preserve=mode --remove-destination `realpath $out/lib/libtinfo.so.5` $out/lib/libtinfo.so.5
+  ${patchelf}/bin/patchelf --set-soname libtinfo.so.5 $out/lib/libtinfo.so.5
+  cp -r ${ncurses5.dev} $dev
+  cp -r ${ncurses5.man} $man
+''