[bazel,manuf] New architecture for provisioning extensions

Signed-off-by: Amaury Pouly <amaury.pouly@opentitan.org>

Author: pamaury

MODULE.bazel

@@ -346,18 +346,37 @@ hooks.repo(
     dummy = "@lowrisc_opentitan//:sw/device/tests/closed_source",
     env = "SECURE_MANUFACTURER_HOOKS_DIR",
 )
-hooks.repo(
-    name = "provisioning_exts",
-    dummy = "@lowrisc_opentitan//:sw/device/silicon_creator/manuf/extensions",
-    env = "PROV_EXTS_DIR",
-)
 use_repo(
     hooks,
     "manufacturer_test_hooks",
-    "provisioning_exts",
     "secure_manufacturer_test_hooks",
 )
 
+# Provisioning extension module, use --override_module to point to the non-dummy implementation.
+# Note: downstream infrastructure searches for this bazel_dep by regex to determine if we're
+# using the legacy PROV_EXTS_DIR environment variable or the new override commandline flag.
+bazel_dep(name = "ot_provisioning_exts", version = "1.0.1")
+
+# Dummy repository, can be overriden on the command-line to point to ot-sku
+local_path_override(
+    module_name = "ot_provisioning_exts",
+    path = "sw/device/silicon_creator/manuf/extensions",
+)
+
+# We import an extension of the repository so that it can define extra repositories.
+provisioning_exts_extra = use_extension("@ot_provisioning_exts//:extension.bzl", "extra")
+
+# We always import the provisioning_exts_extra repository so that it can be refered to by
+# the provisioning_exts repo defined below.
+use_repo(provisioning_exts_extra, "provisioning_exts_extra")
+
+# We import the repo rule.
+provisioning_exts_hook = use_repo_rule("@ot_provisioning_exts//:hook.bzl", "hook")
+
+# Crucially, this repository is injected into the OT module so it can freely depend on everything the OT repo depends on.
+# At the same time, it can also depend on everything in @ot_provisioning_exts, which can contain arbitrary stuff.
+provisioning_exts_hook(name = "provisioning_exts")
+
 register_toolchains("//rules/opentitan:localtools")
 
 register_toolchains("//toolchain:cc_toolchain_opentitan")

MODULE.bazel.lock

@@ -2,31 +2,7 @@
 # Licensed under the Apache License, Version 2.0, see LICENSE for details.
 # SPDX-License-Identifier: Apache-2.0
 
-load("@rules_rust//rust:defs.bzl", "rust_library")
-
-package(default_visibility = ["//visibility:public"])
-
-cc_library(
-    name = "default_perso_fw_ext",
-    srcs = ["default_personalize_ext.c"],
-    deps = [
-        "@//sw/device/lib/dif:flash_ctrl",
-        "@//sw/device/lib/testing/json:provisioning_data",
-        "@//sw/device/lib/testing/test_framework:status",
-        "@//sw/device/lib/testing/test_framework:ujson_ottf",
-        "@//sw/device/silicon_creator/lib/cert",
-        "@//sw/device/silicon_creator/manuf/base:personalize_ext",
-        "@//sw/device/silicon_creator/manuf/lib:flash_info_fields",
-    ],
-)
-
-rust_library(
-    name = "default_ft_ext_lib",
-    srcs = ["default_ft_ext_lib.rs"],
-    crate_name = "ft_ext_lib",
-    deps = [
-        "@//sw/host/provisioning/util_lib",
-        "@crate_index//:anyhow",
-        "@crate_index//:arrayvec",
-    ],
-)
+exports_files([
+    "hook.bzl",
+    "extension.bzl",
+])

sw/device/silicon_creator/manuf/extensions/BUILD.bazel

@@ -2,7 +2,7 @@
 # Licensed under the Apache License, Version 2.0, see LICENSE for details.
 # SPDX-License-Identifier: Apache-2.0
 
-workspace(name = "provisioning_exts")
+module(name = "ot_provisioning_exts")
 
 # This is a sample workspace to demonstrate how to write custom provisioning
 # flow extensions. This bazel repository is not stand-alone project: it must

…creator/manuf/extensions/WORKSPACE.bazel …on_creator/manuf/extensions/MODULE.bazelsw/device/silicon_creator/manuf/extensions/WORKSPACE.bazel renamed to sw/device/silicon_creator/manuf/extensions/MODULE.bazel sw/device/silicon_creator/manuf/extensions/WORKSPACE.bazel renamed to sw/device/silicon_creator/manuf/extensions/MODULE.bazel

@@ -0,0 +1,8 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+# Make sure that the directories below are not considered part
+# of the repository. They are made available # to the OT repository
+# by the `hook` repository rule and the `extra` extension.
+ignore_directories(["repo", "extra"])

sw/device/silicon_creator/manuf/extensions/REPO.bazel

@@ -0,0 +1,27 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+load("@bazel_tools//tools/build_defs/repo:local.bzl", "local_repository")
+
+def _extra_repo_impl(rctx):
+    # This is basically a reimplementation of local_repository but doing
+    # so avoids crafting paths manually in the extension which end up putting
+    # absolute paths in the lock file. The issue fundamentally boils down to
+    # the fact that when a repository extension executes, local_repository
+    # treats path as relative to the *root* MODULE.bazel and not the extension's
+    # MODULE.bazel
+    src_dir = rctx.path(Label("@ot_provisioning_exts//:extra"))
+    for p in src_dir.readdir():
+        rctx.symlink(p, p.basename)
+
+_extra_repo = repository_rule(
+    implementation = _extra_repo_impl,
+)
+
+def _extra_impl(mctx):
+    _extra_repo(name = "provisioning_exts_extra")
+
+extra = module_extension(
+    implementation = _extra_impl,
+)

sw/device/silicon_creator/manuf/extensions/extension.bzl

@@ -0,0 +1,3 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0

sw/device/silicon_creator/manuf/extensions/extra/BUILD.bazel

@@ -0,0 +1,3 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0

sw/device/silicon_creator/manuf/extensions/extra/MODULE.bazel

@@ -0,0 +1,13 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+def _hook_impl(rctx):
+    # This is basically a reimplementation of local_repository
+    src_dir = rctx.path(Label("@ot_provisioning_exts//:repo"))
+    for p in src_dir.readdir():
+        rctx.symlink(p, p.basename)
+
+hook = repository_rule(
+    implementation = _hook_impl,
+)

sw/device/silicon_creator/manuf/extensions/hook.bzl

@@ -0,0 +1,32 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "default_perso_fw_ext",
+    srcs = ["default_personalize_ext.c"],
+    deps = [
+        "@lowrisc_opentitan//sw/device/lib/dif:flash_ctrl",
+        "@lowrisc_opentitan//sw/device/lib/testing/json:provisioning_data",
+        "@lowrisc_opentitan//sw/device/lib/testing/test_framework:status",
+        "@lowrisc_opentitan//sw/device/lib/testing/test_framework:ujson_ottf",
+        "@lowrisc_opentitan//sw/device/silicon_creator/lib/cert",
+        "@lowrisc_opentitan//sw/device/silicon_creator/manuf/base:personalize_ext",
+        "@lowrisc_opentitan//sw/device/silicon_creator/manuf/lib:flash_info_fields",
+    ],
+)
+
+rust_library(
+    name = "default_ft_ext_lib",
+    srcs = ["default_ft_ext_lib.rs"],
+    crate_name = "ft_ext_lib",
+    deps = [
+        "@crate_index//:anyhow",
+        "@crate_index//:arrayvec",
+        "@lowrisc_opentitan//sw/host/provisioning/util_lib",
+    ],
+)