kleaf: Move llvm-strings out of hermetic_tools on flag.

It is only used in tests.

- move it out of hermetic_tools.
- implement hermetic_test.use_cc_toolchain and
  add cc toolchain to PATH if it is set.
- Enable use_cc_toolchain for selected tests
  that uses llvm-strings.
- Adds a flag, --remove_strings_from_hermetic_tools
  and --noremove_strings_from_hermetic_tools, that
  signals the deprecation of llvm-strings from hermetic
  tools. Add it to --config=canary.

Test: bazel test --config=stamp --remove_strings_from_hermetic_tools //common:kernel_aarch64_test
Test: bazel run --remove_strings_from_hermetic_tools //build/kernel/kleaf/tests/integration_test -- ScmversionIntegrationTest.test_mainline_ab
Bug: 249369958
Change-Id: Ia258c3b2cb24f9ebf570390a28bbbd54421ce520

9 files changed, 55 insertions, 6 deletions

diff --git a/BUILD.bazel b/BUILD.bazel
index 67431f58..e2ae1289 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -100,7 +100,6 @@ _HERMETIC_TOOLS = [
     "//prebuilts/kernel-build-tools:linux-x86/bin/swig",
     "//prebuilts/kernel-build-tools:linux-x86/bin/tune2fs",
     "//prebuilts/kernel-build-tools:linux-x86/bin/ufdt_apply_overlay",
-    "//prebuilts/clang/host/linux-x86/clang-{}:bin/llvm-strings".format(VARS["CLANG_VERSION"]),
 ] + glob([
     # Intentionally glob here to test for existance of alias destination
     # buildifier: disable=constant-glob
@@ -213,6 +212,11 @@ hermetic_tools(
         "//conditions:default": {
             ":toybox_gzip": "gzip",
         },
+    }) | select({
+        "//build/kernel/kleaf:remove_strings_from_hermetic_tools_is_true": {},
+        "//conditions:default": {
+            "//prebuilts/clang/host/linux-x86/clang-{}:bin/llvm-strings".format(VARS["CLANG_VERSION"]): "llvm-strings",
+        },
     }) | {
         ":toybox": ":".join(_TOYS),
 
diff --git a/kleaf/BUILD.bazel b/kleaf/BUILD.bazel
index ce58f2ed..b45d0486 100644
--- a/kleaf/BUILD.bazel
+++ b/kleaf/BUILD.bazel
@@ -635,6 +635,19 @@ config_setting(
     visibility = ["//visibility:public"],
 )
 
+# If true, drop llvm-strings from hermetic-tools.
+bool_flag(
+    name = "remove_strings_from_hermetic_tools",
+    build_setting_default = False,
+    visibility = ["//visibility:private"],
+)
+
+config_setting(
+    name = "remove_strings_from_hermetic_tools_is_true",
+    flag_values = {":remove_strings_from_hermetic_tools": "1"},
+    visibility = ["//build/kernel:__pkg__"],
+)
+
 # The values of --config, as passed by command line and bazelrc files.
 _config_values = (
     "local",
diff --git a/kleaf/artifact_tests/kernel_test.bzl b/kleaf/artifact_tests/kernel_test.bzl
index 3843e8e0..ef9a5519 100644
--- a/kleaf/artifact_tests/kernel_test.bzl
+++ b/kleaf/artifact_tests/kernel_test.bzl
@@ -73,6 +73,7 @@ def kernel_build_test(
     hermetic_test(
         name = name,
         actual = Label("//build/kernel/kleaf/artifact_tests:kernel_build_test"),
+        use_cc_toolchain = True,
         data = data,
         args = args,
         timeout = "short",
diff --git a/kleaf/bazel.py b/kleaf/bazel.py
index 2d3c6890..b0c84986 100755
--- a/kleaf/bazel.py
+++ b/kleaf/bazel.py
@@ -408,7 +408,6 @@ class BazelWrapper(KleafHelpPrinter):
         self.transformed_startup_options += self._transform_bazelrc_files([
             # Add support for various configs
             # Do not sort, the order here might matter.
-            self.kleaf_repo_dir / "build/kernel/kleaf/bazelrc/canary.bazelrc",
             self.kleaf_repo_dir / "build/kernel/kleaf/bazelrc/ants.bazelrc",
             self.kleaf_repo_dir / "build/kernel/kleaf/bazelrc/android_ci.bazelrc",
             self.kleaf_repo_dir / "build/kernel/kleaf/bazelrc/local.bazelrc",
@@ -461,6 +460,9 @@ class BazelWrapper(KleafHelpPrinter):
             # Experimental bzlmod support
             self.kleaf_repo_dir / "build/kernel/kleaf/bazelrc/bzlmod.bazelrc",
 
+            # Canary goes to the end because it uses flags / configs from elsewhere.
+            self.kleaf_repo_dir / "build/kernel/kleaf/bazelrc/canary.bazelrc",
+
             self.kleaf_repo_dir / "build/kernel/kleaf/common.bazelrc",
         ])
 
diff --git a/kleaf/bazelrc/canary.bazelrc b/kleaf/bazelrc/canary.bazelrc
index afa8455e..d4603bd6 100644
--- a/kleaf/bazelrc/canary.bazelrc
+++ b/kleaf/bazelrc/canary.bazelrc
@@ -18,5 +18,7 @@
 # releases and some of them might get discontinued.
 
 # Enable building the toolchain from sources.
-build:canary --//build/kernel/kleaf:toolchain_from_sources
+build:canary --toolchain_from_sources
 
+# Drop llvm-strings from hermetic tools.
+build:canary --remove_strings_from_hermetic_tools
diff --git a/kleaf/bazelrc/flags.bazelrc b/kleaf/bazelrc/flags.bazelrc
index f8b6764e..a487ccb2 100644
--- a/kleaf/bazelrc/flags.bazelrc
+++ b/kleaf/bazelrc/flags.bazelrc
@@ -28,6 +28,8 @@ build --flag_alias=gzip_is_pigz=//build/kernel/kleaf:gzip_is_pigz
 build --flag_alias=nogzip_is_pigz=no//build/kernel/kleaf:gzip_is_pigz
 build --flag_alias=toolchain_from_sources=//build/kernel/kleaf:toolchain_from_sources
 build --flag_alias=notoolchain_from_sources=no//build/kernel/kleaf:toolchain_from_sources
+build --flag_alias=remove_strings_from_hermetic_tools=//build/kernel/kleaf:remove_strings_from_hermetic_tools
+build --flag_alias=noremove_strings_from_hermetic_tools=no//build/kernel/kleaf:remove_strings_from_hermetic_tools
 
 # flags that control kleaf integrity checking
 build --flag_alias=allow_ddk_unsafe_headers=//build/kernel/kleaf:allow_ddk_unsafe_headers
diff --git a/kleaf/impl/BUILD.bazel b/kleaf/impl/BUILD.bazel
index 56e26176..e8cd6fc3 100644
--- a/kleaf/impl/BUILD.bazel
+++ b/kleaf/impl/BUILD.bazel
@@ -407,6 +407,7 @@ kernel_platform_toolchain(
 
 kernel_platform_toolchain(
     name = "kernel_toolchain_exec",
+    visibility = ["//build/kernel/kleaf/tests:__subpackages__"],
     deps = [
         "//prebuilts/kernel-build-tools:linux_x86_imported_libs",
     ],
diff --git a/kleaf/tests/hermetic_test.bzl b/kleaf/tests/hermetic_test.bzl
index 1d433807..cdf5404f 100644
--- a/kleaf/tests/hermetic_test.bzl
+++ b/kleaf/tests/hermetic_test.bzl
@@ -14,7 +14,9 @@
 
 """Rules that wraps a py_test / py_binary (for test purposes) so it is more hermetic."""
 
+load("@bazel_skylib//lib:shell.bzl", "shell")
 load("//build/kernel/kleaf:hermetic_tools.bzl", "hermetic_toolchain")
+load("//build/kernel/kleaf/impl:common_providers.bzl", "KernelPlatformToolchainInfo")
 
 def _hermetic_test_impl(ctx):
     hermetic_tools = hermetic_toolchain.get(ctx)
@@ -25,6 +27,19 @@ def _hermetic_test_impl(ctx):
     else:
         run_setup = hermetic_tools.run_setup
 
+    runfiles_transitive_files = [
+        hermetic_tools.deps,
+    ]
+
+    if ctx.attr.use_cc_toolchain:
+        kernel_toolchain_exec = ctx.attr._kernel_toolchain_exec[KernelPlatformToolchainInfo]
+        run_setup += """
+export PATH={quoted_real_bin_path}":${{PATH}}"
+""".format(
+            quoted_real_bin_path = "${PWD}/" + shell.quote(kernel_toolchain_exec.bin_path),
+        )
+        runfiles_transitive_files.append(kernel_toolchain_exec.all_files)
+
     script = """#!/bin/bash -e
         {run_setup}
         {actual} "$@"
@@ -35,9 +50,6 @@ def _hermetic_test_impl(ctx):
 
     ctx.actions.write(script_file, script, is_executable = True)
 
-    runfiles_transitive_files = [
-        hermetic_tools.deps,
-    ]
     transitive_runfiles = [
         ctx.attr.actual[DefaultInfo].default_runfiles,
     ]
@@ -54,6 +66,11 @@ def _hermetic_test_impl(ctx):
         runfiles = runfiles,
     )
 
+def _get_kernel_toolchain_exec(use_cc_toolchain):
+    if use_cc_toolchain:
+        return Label("//build/kernel/kleaf/impl:kernel_toolchain_exec")
+    return None
+
 _RULE_ATTRS = dict(
     doc = "Wraps a test binary so it runs with hermetic tools.",
     implementation = _hermetic_test_impl,
@@ -78,6 +95,12 @@ _RULE_ATTRS = dict(
         "data": attr.label_list(allow_files = True, doc = """
             See [data](https://bazel.build/reference/be/common-definitions#typical.data)
         """),
+        "use_cc_toolchain": attr.bool(
+            doc = "Also include CC toolchain",
+        ),
+        "_kernel_toolchain_exec": attr.label(
+            default = _get_kernel_toolchain_exec,
+        ),
     },
     toolchains = [hermetic_toolchain.type],
 )
diff --git a/kleaf/tests/integration_test/BUILD.bazel b/kleaf/tests/integration_test/BUILD.bazel
index f196067b..568a1c12 100644
--- a/kleaf/tests/integration_test/BUILD.bazel
+++ b/kleaf/tests/integration_test/BUILD.bazel
@@ -33,6 +33,7 @@ hermetic_test_binary(
     # - The test can use `git`
     # - The bazel wrapper can use `repo` when not running on CI
     append_host_path = True,
+    use_cc_toolchain = True,
 )
 
 py_binary(