[NPU] Adopt the new HSM OV blob format

src/plugins/intel_npu/src/common/CMakeLists.txt

@@ -4,23 +4,8 @@
 
 set(TARGET_NAME "openvino_npu_common")
 
-set(SOURCES
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/compiler_adapter_factory.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/option_support_cache.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/device_helpers.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/icompiled_model.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/icompiler_adapter.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/igraph.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/iparser.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/itt.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/network_metadata.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/npu.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/parser_factory.hpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/src/device_helpers.cpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/src/igraph.cpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/src/network_metadata.cpp
-    ${CMAKE_CURRENT_SOURCE_DIR}/src/npu.cpp
-)
+file(GLOB SOURCES ${CMAKE_CURRENT_SOURCE_DIR}/include/intel_npu/common/*.hpp
+                  ${CMAKE_CURRENT_SOURCE_DIR}/src/*.cpp)
 source_group(TREE ${CMAKE_CURRENT_SOURCE_DIR} FILES ${SOURCES})
 
 add_library(${TARGET_NAME} STATIC ${SOURCES})

src/plugins/intel_npu/src/common/include/intel_npu/common/blob_sections_registry.hpp

@@ -0,0 +1,102 @@
+// Copyright (C) 2018-2026 Intel Corporation
+// SPDX-License-Identifier: Apache-2.0
+//
+
+#pragma once
+
+#include <cinttypes>
+#include <memory>
+#include <queue>
+#include <unordered_map>
+#include <unordered_set>
+
+#include "intel_npu/common/isection.hpp"
+#include "intel_npu/common/runtime_requirements.hpp"
+#include "intel_npu/utils/logger/logger.hpp"
+
+namespace intel_npu {
+
+class BlobSectionsRegistry final {
+public:
+    BlobSectionsRegistry();
+
+    /**
+     * @brief Add a new blob section to the writing queue.
+     *
+     * @param section The section to be added in the writing queue.
+     * @param id TODO
+     * @return The instance ID of the section. This number corresponds to the order within the writing queue and it is
+     * used to distringuish between sections of the same type. This number is unique only among sections of the same
+     * type.
+     */
+    SectionID register_section(const std::shared_ptr<ISection>& section,
+                               const std::optional<SectionID>& parsed_id = std::nullopt);
+
+    /**
+     * @brief Retrieve a parsed section.
+     * @note This should be called only after "read" was invoked.
+     * @return The requested section if found, else "nullptr"
+     */
+    std::shared_ptr<ISection> retrieve_section(const SectionID& id) const;
+
+    /**
+     * @brief Retrieve the first parsed section of the given type.
+     * @note This should be called only after "read" was invoked.
+     * @note This function exists only for convenience. Most section types will typically have a single instance inside
+     * a compiled model.
+     * @return The first parsed section of the given type if any, else "nullptr"
+     */
+    std::shared_ptr<ISection> retrieve_any_section(const SectionType section_type) const;
+
+    /**
+     * @brief Retrieves all parsed sections of the given type.
+     * @note This should be called only after "read" was invoked.
+     * @return All parsed sections of the given type if any, else "std::nullopt"
+     */
+    std::vector<std::shared_ptr<ISection>> retrieve_sections(const SectionType type) const;
+
+    std::queue<std::shared_ptr<ISection>> get_write_queue() const;
+
+    /**
+     * @return true if at least one section of the given type has been parsed
+     * @return false otherwise
+     */
+    bool has_section_of_type(const SectionType section_type) const;
+
+    /**
+     * @return The number of parsed sections of the given type
+     */
+    size_t count_sections_of_type(const SectionType section_type) const;
+
+    /**
+     * @return A summary of the blob content, represented as a map between section types and their number of occurrences
+     * in the blob
+     */
+    std::unordered_map<SectionType, size_t> get_content_summary() const;
+
+    // TODO update
+    /**
+     * @brief Builds the runtime requirements (CRE + individual "compatibility substrings") based on the sections
+     * registered so far.
+     * @note The requirements are built on demand and not stored in order to make sure the requirements are aligned with
+     * the content of the blob.
+     */
+    std::shared_ptr<ISection> build_runtime_requirements_section() const;
+
+private:
+    /**
+     * @brief Tracks the next available instance ID for each section type. This should assure that the generated section
+     * IDs (type + instance) are unique per compiled model.
+     */
+    uint16_t m_next_section_id;
+    /**
+     * @brief Queue that holds all sections to be written at export time.
+     */
+    std::queue<std::shared_ptr<ISection>> m_write_queue;
+    std::unordered_map<SectionID, std::shared_ptr<ISection>> m_ids_to_sections;
+    std::unordered_map<SectionType, std::vector<std::shared_ptr<ISection>>> m_types_to_sections;
+
+    Logger m_logger;
+};
+
+}  // namespace intel_npu

src/plugins/intel_npu/src/plugin/include/blob_source.hpp → src/plugins/intel_npu/src/common/include/intel_npu/common/blob_source.hpp

@@ -90,6 +90,9 @@ class BlobSource {
      */
     bool is_contiguous() const;
 
+    std::variant<std::reference_wrapper<std::istream>, std::pair<std::reference_wrapper<const ov::Tensor>, size_t>>
+    get_source() const;
+
 private:
     /**
      * @brief A union that captures all possible data types of the blob. The tensor type also has a separate data cursor

src/plugins/intel_npu/src/common/include/intel_npu/common/cre.hpp

@@ -0,0 +1,198 @@
+// Copyright (C) 2018-2026 Intel Corporation
+// SPDX-License-Identifier: Apache-2.0
+//
+
+#pragma once
+
+#include <unordered_set>
+
+#include "intel_npu/common/cre_token.hpp"
+#include "intel_npu/common/isection.hpp"
+#include "intel_npu/common/isection_type_evaluator.hpp"
+#include "intel_npu/common/section_id.hpp"
+#include "intel_npu/common/section_type.hpp"
+#include "intel_npu/common/single_section_instance_evaluator.hpp"
+#include "intel_npu/utils/logger/logger.hpp"
+#include "openvino/core/except.hpp"
+
+namespace intel_npu {
+
+/**
+ * @brief Exception used to indicate an invalid expression. Logic errors or other type of failures should not be
+ * represented by this.
+ */
+class InvalidCRE final : public ov::AssertFailure {
+public:
+    [[noreturn]] static void create(const char* file,
+                                    int line,
+                                    const char* check_string,
+                                    const std::string& context_info,
+                                    const std::string& explanation);
+
+protected:
+    explicit InvalidCRE(const std::string& what_arg) : ov::AssertFailure(what_arg) {}
+};
+
+enum class CRESpecialTokenCode { AND, OR, NOT, OPEN, CLOSE };
+
+/**
+ * @brief All tokens that are not operands. This set is made by operators and parrenthesis.
+ */
+class CRESpecialToken final : public CREToken {
+public:
+    CRESpecialToken(const CRESpecialTokenCode code);
+
+    CRESpecialTokenCode get_code() const;
+
+    bool operator==(const CRESpecialToken& other) const;
+
+    bool operator!=(const CRESpecialToken& other) const;
+
+    /**
+     * @warning Do not modify the string values. These values are stored as part of the CRE within the blob's runtime
+     * requirements. Changing these may break compatibility.
+     */
+    std::string to_string() const override;
+
+private:
+    CRESpecialTokenCode m_code;
+};
+
+bool is_cre_special_token(const std::shared_ptr<CREToken>& candidate);
+
+/**
+ * @brief Handles the construction, validation, evaluation and serialization of the Compatibility Requirements
+ * Expression.
+ * @details The CRE is used to evaluate the high-level compatibility requirements *between* sections types and/or
+ * instances using a logical expression. This evaluation happens during model import or when a compatibility descriptor
+ * is validated using the "Plugin::get_property" API call.
+ */
+class CRE final {
+public:
+    CRE(const ov::log::Level log_level = ov::log::Level::WARNING);
+
+    CRE(const std::vector<std::shared_ptr<CREToken>>& subexpression,
+        const ov::log::Level log_level = ov::log::Level::WARNING);
+
+    /**
+     * @brief Append a new token to the CRE, at depth-level 1. All tokens found at this depth-level are bound by a
+     * logical "AND" operator.
+     */
+    void append_to_expression(const std::shared_ptr<CREToken> requirement_token);
+
+    /**
+     * @brief Append a new CRE subexpression to the CRE, at depth-level 1. All tokens found at this depth-level are
+     * bound by a logical "AND" operator.
+     */
+    void append_to_expression(const std::vector<std::shared_ptr<CREToken>>& subexpression);
+
+    size_t get_expression_length() const;
+
+    std::vector<std::shared_ptr<CREToken>> get_expression() const;
+
+    bool empty() const;
+
+    /**
+     * @brief Evaluates the expression using the given evaluators for section types and instances.
+     * @details The support for both section types and instances is evaluated in a lazy manner: the check support
+     * function is called only upon encountering the corresponding CRE token.
+     *
+     * @param section_type_evaluators A mapping between section types and their (lazy) evaluators.
+     * @param section_instance_evaluators A mapping between section IDs and their (lazy) evaluators.
+     */
+    ov::CompatibilityCheck check_compatibility(
+        const std::unordered_map<SectionType, std::shared_ptr<ISectionTypeEvaluator>>& section_type_evaluators,
+        const std::unordered_map<SectionID, SingleSectionInstanceEvaluator>& section_instance_evaluators) const;
+
+    /**
+     * @brief Serializes the CRE.
+     * @note This "human-readable" form is meant to be used:
+     *   1. Inside the runtime requirements section, as part of a compiled model and
+     *   2. As part of the compatibility descriptor returned to the user via the "Plugin::get_property" API call.
+     */
+    std::string to_string() const;
+
+    /**
+     * @brief Deserializes the CRE string into internal token codes.
+     */
+    static CRE from_string(const std::string_view cre, const ov::log::Level log_level = ov::log::Level::WARNING);
+
+    bool operator==(const CRE& other) const;
+
+    bool operator!=(const CRE& other) const;
+
+    // TODO reconsider these
+    // Some "globals" for convenience
+    static inline const auto AND_PTR = std::make_shared<CRESpecialToken>(CRESpecialTokenCode::AND);
+    static inline const auto OR_PTR = std::make_shared<CRESpecialToken>(CRESpecialTokenCode::OR);
+    static inline const auto NOT_PTR = std::make_shared<CRESpecialToken>(CRESpecialTokenCode::NOT);
+    static inline const auto OPEN_PTR = std::make_shared<CRESpecialToken>(CRESpecialTokenCode::OPEN);
+    static inline const auto CLOSE_PTR = std::make_shared<CRESpecialToken>(CRESpecialTokenCode::CLOSE);
+
+    static inline const CRESpecialToken AND = *AND_PTR;
+    static inline const CRESpecialToken OR = *OR_PTR;
+    static inline const CRESpecialToken NOT = *NOT_PTR;
+    static inline const CRESpecialToken OPEN = *OPEN_PTR;
+    static inline const CRESpecialToken CLOSE = *CLOSE_PTR;
+
+private:
+    enum class Delimiter { PARRENTHESIS, SIZE };
+
+    /**
+     * @brief Checks if the given expression forms a valid CRE.
+     * @details The easiest way to verify this is to check if the expression can be evaluated successfully, regardless
+     * of result. This is what this function does.
+     */
+    bool is_expression_valid(const std::vector<std::shared_ptr<CREToken>>& expression) const;
+
+    bool subexpression_already_registered(const std::vector<std::shared_ptr<CREToken>>& subexpression) const;
+
+    void advance_iterator(std::vector<std::shared_ptr<CREToken>>::const_iterator& expression_iterator,
+                          const std::vector<std::shared_ptr<CREToken>>::const_iterator& expression_end) const;
+
+    bool end_condition(const std::vector<std::shared_ptr<CREToken>>::const_iterator& expression_iterator,
+                       const std::vector<std::shared_ptr<CREToken>>::const_iterator& expression_end,
+                       const Delimiter end_delimiter) const;
+
+    /**
+     * @brief Evaluates a subexpression from left to right.
+     * @details The evaluation starts from the position where the iterator was left at. The end of the subexpression is
+     * determined based on the given type of delimiter.
+     *
+     * The parent of the current subexpression might have determined that all evaluations within this subexpression have
+     * no impact on the final result. If that is the case, then "skip_all_evaluations" should be set to true, and
+     * operand evaluation will be skipped to save some resources (unless "force_all_evaluations" was also set to true).
+     *
+     * All operands can take one of two forms: a SectionType alone, or a SectionType followed by a SectionID. The given
+     * section type evaluators are used as part of the evaluation process of all operands. The instance evaluators are
+     * the second layer of operand evalution, used only when a SectionID is present and the type evaluation succeeded.
+     * @param expression_iterator The cursor corresponding to the expression that is being evaluated. The initial value
+     * indicates the start of the subexpression.
+     * @param expression_end Points towards the end of the whole expression.
+     * @param section_type_evaluators Entities used to evaluate whether or not the current software supports the
+     * corresponding SectionType.
+     * @param section_instance_evaluators Used to evaluate the operands that contain a SectionID.
+     * @param end_delimiter The type of delimiter that is used for judging the end of the subexpression.
+     * @param skip_all_evaluations If set to "true", all operand evaluations wihtin this subexpressions will be skipped
+     * (unless "force_all_evaluations" was also set to true). However, some validity checks will still be performed.
+     * @param force_all_evaluations Forces all evaluations to be performed. This flag has a higher priority than
+     * "skip_all_evaluations". This is meant to be used when validating the whole CRE is desired.
+     */
+    ov::CompatibilityCheck evaluate(
+        std::vector<std::shared_ptr<CREToken>>::const_iterator& expression_iterator,
+        const std::vector<std::shared_ptr<CREToken>>::const_iterator& expression_end,
+        const std::unordered_map<SectionType, std::shared_ptr<ISectionTypeEvaluator>>& section_type_evaluators,
+        const std::unordered_map<SectionID, SingleSectionInstanceEvaluator>& section_instance_evaluators,
+        const Delimiter end_delimiter,
+        const bool skip_all_evaluations = false,
+        const bool force_all_evaluations = false) const;
+
+    /**
+     * @note Stitched together using "AND"s, these subexpression form the whole expression.
+     */
+    std::vector<std::vector<std::shared_ptr<CREToken>>> m_subexpressions;
+
+    Logger m_logger;
+};
+
+}  // namespace intel_npu

src/plugins/intel_npu/src/common/include/intel_npu/common/cre_token.hpp

@@ -0,0 +1,24 @@
+// Copyright (C) 2018-2026 Intel Corporation
+// SPDX-License-Identifier: Apache-2.0
+//
+
+#pragma once
+
+#include <string>
+
+namespace intel_npu {
+
+/**
+ * @brief Basic unit that composes the compatibility requirements expression
+ */
+class CREToken {
+public:
+    virtual ~CREToken() = default;
+
+    virtual std::string to_string() const = 0;
+
+protected:
+    CREToken() = default;
+};
+
+}  // namespace intel_npu

src/plugins/intel_npu/src/common/include/intel_npu/common/encrypted_schedules_flag_section.hpp

@@ -0,0 +1,36 @@
+// Copyright (C) 2018-2026 Intel Corporation
+// SPDX-License-Identifier: Apache-2.0
+//
+
+#pragma once
+
+#include <functional>
+
+#include "intel_npu/common/isection.hpp"
+
+namespace intel_npu {
+
+/**
+ * @brief Section containing a flag that indicates whether or not the compiler schedules within the compiled models have
+ * been encrypted.
+ */
+class EncryptedSchedulesFlagSection final : public ISection {
+public:
+    EncryptedSchedulesFlagSection(const bool applied_encryption);
+
+    std::vector<std::shared_ptr<CREToken>> get_compatibility_requirements_subexpression(
+        const std::unordered_map<SectionID, std::shared_ptr<ISection>>& all_registered_sections) const override;
+
+    void encode(const ov::runtime::hsm::SectionSink& sink) const override;
+
+    bool get_flag() const;
+
+    static ov::runtime::hsm::SectionDecoder<std::shared_ptr<ISection>> decode;
+
+private:
+    bool m_flag;
+
+    Logger m_logger;
+};
+
+}  // namespace intel_npu