[cheriot,rtl] Integrate CHERIoT subsys into Earl Grey

SUMMARY.md

@@ -348,6 +348,13 @@
     - [Hardware Interfaces](./hw/ip/aon_timer/doc/interfaces.md)
     - [Registers](./hw/ip/ascon/doc/registers.md)
     - [Checklist](./hw/ip/ascon/doc/checklist.md)
+  - [CHERIoT Memory Subsystem](./hw/ip/cheriot/README.md)
+    - [Theory of Operation](./hw/ip/cheriot/doc/theory_of_operation.md)
+    - [Design Verification](./hw/ip/cheriot/dv/README.md)
+    - [Testplan](./hw/ip/cheriot/data/cheriot_testplan.hjson)
+    - [Hardware Interfaces](./hw/ip/cheriot/doc/interfaces.md)
+    - [Registers](./hw/ip/cheriot/doc/registers.md)
+    - [Checklist](./hw/ip/cheriot/doc/checklist.md)
   - [CSRNG](./hw/ip/csrng/README.md)
     - [Theory of Operation](./hw/ip/csrng/doc/theory_of_operation.md)
     - [Design Verification](./hw/ip/csrng/dv/README.md)

hw/Makefile

@@ -23,6 +23,7 @@ IPS ?= aes           \
        adc_ctrl      \
        aon_timer     \
        bkdr_loader   \
+       cheriot       \
        csrng         \
        dma           \
        edn           \

hw/ip/BUILD

@@ -18,6 +18,7 @@ filegroup(
         "//hw/ip/aes:rtl_files",
         "//hw/ip/aon_timer:rtl_files",
         "//hw/ip/bkdr_loader:rtl_files",
+        "//hw/ip/cheriot:rtl_files",
         "//hw/ip/csrng:rtl_files",
         "//hw/ip/dma:rtl_files",
         "//hw/ip/edn:rtl_files",

hw/ip/README.md

@@ -9,6 +9,7 @@
 | [`aon_timer`]    | Wakeup and watchdog timers running on a low-power, always-on clock                                                                |
 | [`ascon`]        | Ascon authenticated encryption and decryption engine                                                                              |
 | [`bkdr_loader`]  | Provides FPGA-only indirect programming to RAMs                                                                                   |
+| [`cheriot`]      | CHERIoT-aware memory subsystem                                                                                                    |
 | [`csrng`]        | Takes entropy bits to produce cryptographically secure random numbers for consumption by hardware blocks and by software          |
 | [`dma`]          | DMA Controller for the integrated OpenTitan.                                                                                      |
 | [`edn`]          | Distributes random numbers produced by CSRNG to hardware blocks                                                                   |
@@ -44,6 +45,7 @@
 [`aon_timer`]: ./aon_timer/README.md
 [`ascon`]: ./ascon/README.md
 [`bkdr_loader`]: ./bkdr_loader/README.md
+[`cheriot`]: ./cheriot/README.md
 [`csrng`]: ./csrng/README.md
 [`dma`]: ./dma/README.md
 [`edn`]: ./edn/README.md

hw/ip/cheriot/BUILD

@@ -0,0 +1,30 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "rtl_files",
+    srcs = glob(
+        ["**"],
+        exclude = [
+            "dv/**",
+            "doc/**",
+            "README.md",
+        ],
+    ) + [
+        "//hw/ip/cheriot/data:all_files",
+    ],
+)
+
+filegroup(
+    name = "doc_files",
+    srcs = glob(
+        [
+            "**/*.md",
+            "**/*.svg",
+        ],
+        allow_empty = True,
+    ) + ["//hw/ip/cheriot/data:doc_files"],
+)

hw/ip/cheriot/README.md

@@ -0,0 +1,57 @@
+# CHERIoT Memory Subsystem Technical Specification
+<!-- BEGIN CMDGEN util/mdbook_regression_links.py --hjson hw/ip/cheriot/data/cheriot.hjson --top earlgrey -->
+| Regression | Version | [Stages](https://opentitan.org/book/doc/project_governance/development_stages.html) | Results |
+|-|-|-|-|
+ [`cheriot`](https://dashboard.reports.lowrisc.org/opentitan/earlgrey/dashboard.html) | 1.0.0 | D1, V0 | ![](https://dashboard.reports.lowrisc.org/opentitan/earlgrey/badge/cheriot/test.svg) ![](https://dashboard.reports.lowrisc.org/opentitan/earlgrey/badge/cheriot/passing.svg) ![](https://dashboard.reports.lowrisc.org/opentitan/earlgrey/badge/cheriot/functional.svg) ![](https://dashboard.reports.lowrisc.org/opentitan/earlgrey/badge/cheriot/code.svg) |
+
+<!-- END CMDGEN -->
+
+# Overview
+
+This document specifies the CHERIoT memory subsystem.
+The subsystem sits between the CHERIoT-capable Ibex core and the main crossbar and follows the
+[Comportability Specification](../../../doc/contributing/hw/comportability/README.md).
+
+A CHERIoT capability is 65 bits in size: 32 bits pointer, 32 bits meta data do the pointer, and a single validity tag bit.
+OpenTitan keeps a 32-bit interconnect, so a capabilities are transferred in two consecutive 32-bit
+accesses, and the tag is carried on a sideband signal, which shares the handshakes, next to the TL-UL structs
+.
+The subsystem is responsible for handling and storing the validity tag bit. It splits a data access
+of Ibex into the data access towards the interconnect and a tag access towards a dedicated and guarded meta SRAM.
+
+The capability validity tags for main SRAM and NVM, and the revocation bitmap for the heap stored in the main 
+SRAM are stored using a `sram_ctrl`.
+
+## Features
+
+- Splits Ibex data accesses into a data access towards the interconnect and a capability tag access
+  towards the meta SRAM, and joins their responses.
+- Read-modify-write access to implement bit-granular access to capability bits.
+- Clears any capability tag of any location written by a non-capability store.
+- Exposes the revocation bitmap in to core's address map and serves the core's TRVK filter.exit
+- Per-port access checking: each of the three requesters may only reach the meta SRAM region it owns,
+  with word-granular accesses only.
+- Fatal alert on a meta SRAM response integrity fault or a hardened FIFO pointer error.
+
+## Description
+
+The CHERIoT HWIP has three requesters towards the meta SRAM and arbitrates between them:
+
+- The *tag filter* folled by the *RMW filter* which perform the bit-granular tag update.
+- The core's TRVK filter, which reads the revocation bitmap on every capability load.
+- The system, which reads and writes the revocation bitmap through the `revbm` memory window.
+
+Each requester passes an *access checker* module that confirms the address falls in the region that
+requester owns and that the operation is a full-word read or write.
+Invalid acccesses receive a TL-UL error response.
+Because the capability tag regions are not reachable from the `revbm` window, software can neither
+read nor write capability tags.
+
+Requests that the subsystem generates or rewrites get command and data integrity, so end-to-end bus 
+integrity holds from the Ibex lockstep through the CHERIoT HWIP domain to the storage cells. 
+An integrity fault raises the `fatal_fault` alert.
+
+
+See the [Theory of Operation](doc/theory_of_operation.md) for the datapath, the meta SRAM address
+map, and the access-check rules.
+

hw/ip/cheriot/cheriot.core

@@ -0,0 +1,83 @@
+CAPI=2:
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+name: "lowrisc:ip:cheriot:0.1"
+description: "CHERIoT memory subsystem"
+
+filesets:
+  files_rtl:
+    depend:
+      - lowrisc:prim:all
+      - lowrisc:ip:tlul
+      - pulp-platform:common_cells:common_cells
+    files:
+      - rtl/cheriot_reg_pkg.sv
+      - rtl/cheriot_regs_reg_top.sv
+      - rtl/cheriot_rmw_filter.sv
+      - rtl/cheriot_tag_filter.sv
+      - rtl/cheriot_access_check.sv
+      - rtl/cheriot.sv
+    file_type: systemVerilogSource
+
+  files_verilator_waiver:
+    depend:
+      # common waivers
+      - lowrisc:lint:common
+      - lowrisc:lint:comportable
+    files:
+      - lint/cheriot.vlt
+    file_type: vlt
+
+  files_ascentlint_waiver:
+    depend:
+      # common waivers
+      - lowrisc:lint:common
+      - lowrisc:lint:comportable
+    files:
+      - lint/cheriot.waiver
+    file_type: waiver
+
+  files_veriblelint_waiver:
+    depend:
+      # common waivers
+      - lowrisc:lint:common
+      - lowrisc:lint:comportable
+    files:
+      - lint/cheriot.vbl
+    file_type: veribleLintWaiver
+
+parameters:
+  SYNTHESIS:
+    datatype: bool
+    paramtype: vlogdefine
+
+
+targets:
+  default: &default_target
+    filesets:
+      - tool_verilator  ? (files_verilator_waiver)
+      - tool_ascentlint ? (files_ascentlint_waiver)
+      - tool_veriblelint ? (files_veriblelint_waiver)
+      - files_rtl
+    toplevel: cheriot
+
+  lint:
+    <<: *default_target
+    default_tool: verilator
+    parameters:
+      - SYNTHESIS=true
+    tools:
+      verilator:
+        mode: lint-only
+        verilator_options:
+          - "-Wall"
+
+  syn:
+    <<: *default_target
+    # TODO: set default to DC once
+    # this option is available
+    # olofk/edalize#89
+    default_tool: icarus
+    parameters:
+      - SYNTHESIS=true

hw/ip/cheriot/data/BUILD

@@ -0,0 +1,18 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+package(default_visibility = ["//visibility:public"])
+
+filegroup(
+    name = "all_files",
+    srcs = glob(["**"]),
+)
+
+filegroup(
+    name = "doc_files",
+    srcs = glob(
+        ["*_testplan.hjson"],
+        allow_empty = True,
+    ),
+)