nix: stdenv with toolchain to build linux for mocha

flake.nix

@@ -71,13 +71,12 @@
         llvm = lrPkgs.llvm_cheri;
       };
       ftditool-cli = inputs.ftditool.packages.${system}.default;
-
+      cheri-toolchain = pkgs.callPackage ./nix/cheri_toolchain.nix {inherit (lrPkgs) llvm_cheri;};
       commonPackages = with pkgs; [
         bison
         cmake
         flex
         gnumake
-        screen
         picocom
         gtkwave
         openfpgaloader
@@ -89,17 +88,31 @@
         srecord
         d2
         dtc
+        autoconf
+        automake
+        bc
+        bmake
+        byacc
+        libarchive
+        libarchive.dev
+        libelf
+        libtool
+        pkg-config
+        zlib
+        zlib.dev
+        cheri-toolchain.cheriStdenv.cc
       ];
     in {
       formatter = pkgs.alejandra;
       devShells = rec {
-        default = cheri;
-        cheri = pkgs.mkShell {
-          name = "mocha-cheri";
+        default = baremetal;
+        baremetal = pkgs.mkShell {
+          name = "baremetal";
+          strictDeps = true;
+          hardeningDisable = [ "all" ];
           nativeBuildInputs =
             commonPackages
             ++ (with lrPkgs; [
-              llvm_cheri
               verilator_5_040
             ]);
           buildInputs = with pkgs; [libelf zlib];
@@ -108,6 +121,12 @@
             UV_PYTHON_DOWNLOADS = "never";
             # Force uv to use nixpkgs Python interpreter
             UV_PYTHON = pythonSet.python.interpreter;
+
+            HOSTCC = "${pkgs.llvmPackages_21.clang}/bin/clang";
+            HOSTCXX = "${pkgs.llvmPackages_21.clang}/bin/clang++";
+            HOSTLD = "${pkgs.llvmPackages_21.lld}/bin/ld.lld";
+            LLVM = "1";
+            ARCH = "riscv";
           };
         };
       };

nix/CrossToolchain.cmake.in

@@ -0,0 +1,67 @@
+# Copyright lowRISC contributors.
+#
+# SPDX-License-Identifier: MIT
+
+set(CMAKE_SYSTEM_NAME Linux)
+set(CMAKE_SYSTEM_PROCESSOR riscv64)
+
+set(CMAKE_C_COMPILER "@llvmCheri@/bin/clang")
+set(CMAKE_C_COMPILER_TARGET "riscv64-linux-musl")
+set(CMAKE_CXX_COMPILER "@llvmCheri@/bin/clang++")
+set(CMAKE_CXX_COMPILER_TARGET "riscv64-linux-musl")
+set(CMAKE_ASM_COMPILER "@llvmCheri@/bin/clang")
+set(CMAKE_ASM_COMPILER_TARGET "riscv64-linux-musl")
+
+set(CMAKE_AR
+    "@llvmCheri@/bin/llvm-ar"
+    CACHE FILEPATH "ar")
+set(CMAKE_RANLIB
+    "@llvmCheri@/bin/llvm-ranlib"
+    CACHE FILEPATH "ranlib")
+set(CMAKE_NM
+    "@llvmCheri@/bin/llvm-nm"
+    CACHE FILEPATH "nm")
+set(CMAKE_STRIP
+    "@llvmCheri@/bin/llvm-strip"
+    CACHE FILEPATH "strip")
+set(CMAKE_LINKER
+    "@llvmCheri@/bin/ld.lld"
+    CACHE FILEPATH "linker")
+
+set(CHERI_COMMON_FLAGS
+    "-target riscv64-linux-musl \
+    -B@llvmCheri@/bin \
+    -march=rv64imaczcherihybrid_zcherilevels \
+    -mabi=l64pc128 \
+    -mno-relax \
+    -Xclang -target-feature -Xclang +cheri-bounded-vararg \
+    -Xclang -target-feature -Xclang +cheri-bounded-memarg-caller \
+    -Xclang -target-feature -Xclang +cheri-bounded-memarg-callee \
+    -isystem @linuxHeadersPurecap@/usr/include \
+    -ggdb \
+    -gz \
+    -Wno-error=unused-command-line-argument \
+    -ffreestanding \
+    -Werror=implicit-function-declaration \
+    -Werror=format \
+    -Werror=incompatible-pointer-types \
+    -Werror=cheri-capability-misuse \
+    -Werror=cheri-bitwise-operations \
+    -Werror=pass-failed \
+    -Werror=cheri-prototypes \
+    -Werror=undefined-internal"
+)
+
+set(CHERI_LINKER_FLAGS "${CHERI_COMMON_FLAGS} -fuse-ld=lld")
+
+set(CMAKE_C_FLAGS_INIT "${CHERI_COMMON_FLAGS}")
+set(CMAKE_CXX_FLAGS_INIT "${CHERI_COMMON_FLAGS}")
+set(CMAKE_ASM_FLAGS_INIT "${CHERI_COMMON_FLAGS}")
+set(CMAKE_EXE_LINKER_FLAGS_INIT "${CHERI_LINKER_FLAGS}")
+set(CMAKE_SHARED_LINKER_FLAGS_INIT "${CHERI_LINKER_FLAGS}")
+set(CMAKE_MODULE_LINKER_FLAGS_INIT "${CHERI_LINKER_FLAGS}")
+
+set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER)
+set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY ONLY)
+set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE ONLY)
+set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE ONLY)

nix/cheri_toolchain.nix

@@ -0,0 +1,209 @@
+# Copyright lowRISC contributors.
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+{
+  lib,
+  stdenv,
+  gnumake,
+  cmake,
+  rsync,
+  fetchFromGitHub,
+  llvm_cheri,
+  pkgsCross,
+}: let
+  CHERI_FLAGS = "rv64imaczcherihybrid_zcherilevels";
+  MABI = "l64pc128";
+in rec {
+  linux-headers-purecap = stdenv.mkDerivation {
+    pname = "linux-headers-purecap";
+    version = "6.18";
+
+    src = fetchFromGitHub {
+      owner = "CHERI-Alliance";
+      repo = "linux";
+      rev = "af04d488044fa684760d6480f3623e51b46568ca";
+      fetchSubmodules = true;
+      hash = "sha256-Gjjs+vV0meFHOAt9i88WMzpFEq8IZ1oXDFVXb7ZuLI8=";
+    };
+
+    nativeBuildInputs = [
+      gnumake
+      rsync
+    ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = ''
+      runHook preInstall
+
+      make -j$NIX_BUILD_CORES headers_install \
+        ARCH=riscv \
+        INSTALL_HDR_PATH=$out/usr
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "CHERI RISC-V 64 purecap Linux kernel (codasip-cheri-riscv-6.18)";
+      platforms = ["x86_64-linux"];
+    };
+  };
+
+  muslc-linux-riscv64-purecap = stdenv.mkDerivation {
+    pname = "muslc-linux-riscv64-purecap";
+    version = "std093";
+
+    src = fetchFromGitHub {
+      owner = "CHERI-Alliance";
+      repo = "musl";
+      rev = "12d15cddabcfb3f4f0612730f7147e7cf8c5579f";
+      fetchSubmodules = true;
+      hash = "sha256-8cEUnBQSsWEUoe5gLR/3jFO3KwTddJOhDTDnNZgUIXQ=";
+    };
+
+    nativeBuildInputs = [
+      gnumake
+      llvm_cheri
+    ];
+
+    dontConfigure = false;
+
+    configurePhase = ''
+      runHook preConfigure
+
+      # Dynamically fetch the resource dir
+      RESOURCE_DIR=$(${llvm_cheri}/bin/clang -print-resource-dir)
+
+      ./configure \
+        --prefix= \
+        --disable-shared \
+        CC="clang \
+          -target riscv64-linux-musl \
+          -march=${CHERI_FLAGS} \
+          -mabi=${MABI} \
+          -mno-relax \
+          -Xclang -target-feature -Xclang +cheri-bounded-vararg \
+          -Xclang -target-feature -Xclang +cheri-bounded-memarg-caller \
+          -Xclang -target-feature -Xclang +cheri-bounded-memarg-callee \
+          -idirafter $RESOURCE_DIR/include"
+
+      runHook postConfigure
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      make install-headers DESTDIR=$out
+      make install-libs DESTDIR=$out
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+  };
+
+  compiler-rt-builtins-purecap = stdenv.mkDerivation {
+    pname = "compiler-rt-builtins-purecap";
+    version = "std093";
+
+    src = llvm_cheri.src;
+    sourceRoot = "source/compiler-rt/lib/builtins";
+
+    nativeBuildInputs = [
+      cmake
+      llvm_cheri
+    ];
+
+    llvmCheri = llvm_cheri;
+    linuxHeadersPurecap = linux-headers-purecap;
+
+    preConfigure = ''
+      substituteAll ${./CrossToolchain.cmake.in} CrossToolchain.cmake
+    '';
+
+    configurePhase = ''
+      runHook preConfigure
+
+      cmake -S . -B build \
+        --toolchain=../CrossToolchain.cmake \
+        -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+        -DLLVM_CONFIG_PATH=NOTFOUND \
+        -DCMAKE_DISABLE_FIND_PACKAGE_LLVM=true \
+        -DCOMPILER_RT_EXCLUDE_ATOMIC_BUILTIN=false \
+        -DCOMPILER_RT_BAREMETAL_BUILD=false \
+        -DCOMPILER_RT_DEFAULT_TARGET_ONLY=true \
+        -DTARGET_TRIPLE="riscv64-linux-musl" \
+        -DCMAKE_SYSROOT="${muslc-linux-riscv64-purecap}" \
+        -DCOMPILER_RT_DEBUG=true \
+        -DCMAKE_C_COMPILER=${llvm_cheri}/bin/clang \
+        -DCMAKE_CXX_COMPILER=${llvm_cheri}/bin/clang++ \
+        -DCMAKE_ASM_COMPILER=${llvm_cheri}/bin/clang \
+        -DCMAKE_C_FLAGS="-march=${CHERI_FLAGS} -mabi=${MABI} -isystem ${linux-headers-purecap}/usr/include" \
+        -DCMAKE_CXX_FLAGS="-march=${CHERI_FLAGS} -mabi=${MABI} -isystem ${linux-headers-purecap}/usr/include" \
+        -DCMAKE_ASM_FLAGS="-march=${CHERI_FLAGS} -mabi=${MABI} -isystem ${linux-headers-purecap}/usr/include" \
+        -DCMAKE_INSTALL_PREFIX="$out"
+    '';
+
+    buildPhase = ''
+      cmake --build build
+    '';
+
+    installPhase = ''
+      cmake --build build --target install
+      runHook postInstall
+    '';
+
+    postInstall = ''
+      mkdir -p $out/lib
+
+      ln -fsn $out/lib/linux/libclang_rt.builtins-riscv64.a $out/lib/libclang_rt.builtins-riscv64.a
+      ln -fsn $out/lib/linux/libclang_rt.builtins-riscv64.a $out/lib/libgcc.a
+
+      ln -fsn $out/lib/linux/clang_rt.crtbegin-riscv64.o $out/lib/crtbeginT.o
+      ln -fsn $out/lib/linux/clang_rt.crtbegin-riscv64.o $out/lib/crtbeginS.o
+      ln -fsn $out/lib/linux/clang_rt.crtend-riscv64.o $out/lib/crtend.o
+      ln -fsn $out/lib/linux/clang_rt.crtend-riscv64.o $out/lib/crtendS.o
+    '';
+
+    dontFixup = true;
+  };
+
+  cheriBintools = pkgsCross.riscv64.wrapBintoolsWith {
+    bintools = llvm_cheri;
+    libc = muslc-linux-riscv64-purecap;
+    coreutils = pkgsCross.riscv64.buildPackages.coreutils;
+    extraBuildCommands = ''
+      for tool in ar as nm objcopy objdump ranlib readelf size strings strip; do
+        # Link bare names: llvm-nm -> nm
+        if [ -x "$out/bin/$tool" ]; then
+          ln -s "$tool" "$out/bin/llvm-$tool"
+        fi
+      done
+    '';
+  };
+
+  cheriCC = pkgsCross.riscv64.wrapCCWith {
+    cc = llvm_cheri;
+    bintools = cheriBintools;
+    libc = muslc-linux-riscv64-purecap;
+    coreutils = pkgsCross.riscv64.buildPackages.coreutils;
+    extraBuildCommands = ''
+      echo "-isystem ${linux-headers-purecap}/usr/include" >> $out/nix-support/cc-cflags
+      echo "-B${compiler-rt-builtins-purecap}/lib" >> $out/nix-support/cc-cflags
+      echo "-L${compiler-rt-builtins-purecap}/lib" >> $out/nix-support/cc-ldflags
+    '';
+  };
+
+  cheriStdenv = pkgsCross.riscv64.stdenv.override {
+    cc = cheriCC;
+    allowedRequisites = null;
+
+    targetPlatform =
+      stdenv.targetPlatform
+      // {
+        config = "riscv64-linux-musl";
+        libc = "musl";
+      };
+  };
+}