OpenTitan patches on 10.2.0

.github/workflows/build_test.yaml

@@ -0,0 +1,198 @@
+---
+#------------------------------------------------------------------------------
+# QEMU OpenTitan CI
+#
+# Copyright (c) 2023-2025 Rivos, Inc.
+# Copyright (c) 2025 lowRISC contributors.
+# SPDX-License-Identifier: Apache License 2.0
+#------------------------------------------------------------------------------
+
+name: Build & Test QEMU OT
+on:
+  - pull_request
+  - workflow_dispatch
+jobs:
+  build-clang:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Install deps
+        run: |
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key |
+            sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc &&
+          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" &&
+          sudo apt-get update &&
+          sudo apt-get install -y git make pkg-config clang-21 cmake ninja-build python3 rust-all \
+            libpixman-1-dev libglib2.0-dev
+      - name: Check out QEMU
+        uses: actions/checkout@v4
+      - name: Configure
+        run: |
+          rm -rf build-clang
+          git clean -dffx subprojects
+          mkdir build-clang
+          (cd build-clang &&
+           ../configure --cc=clang-21 --disable-werror --disable-install-blobs \
+             --target-list=riscv32-softmmu,riscv64-softmmu)
+      - name: Build
+        run: |
+          ninja -C build-clang &&
+          ninja -C build-clang qemu-img &&
+          strip build-clang/qemu-system-riscv32
+      - name: Create minimal test binaries
+        run: |
+          scripts/opentitan/swexit.py -t ibexdemo -b 0x0 -o build-clang/exit_id.bin
+          scripts/opentitan/swexit.py -t earlgrey -b 0x80 -o build-clang/exit_eg.bin
+          scripts/opentitan/swexit.py -t darjeeling -b 0x80 -o build-clang/exit_dj.bin
+      - name: Upload QEMU binary artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: qemu-bin
+          path: |
+            build-clang/qemu-system-riscv32
+            build-clang/exit_*.bin
+            docs/config/opentitan/*.cfg
+          retention-days: 1
+      - name: Pack source artifacts
+        # GitHub takes ages to retrieve each source file, so pack them
+        run: |
+          tar czf qemu-src-artifact.tar.gz \
+            subprojects/libtomcrypt/src/headers/*.h \
+            build-clang/*.h \
+            build-clang/qapi/*.h \
+            build-clang/trace/*.h \
+            build-clang/config.status \
+            build-clang/compile_commands.json
+      - name: Upload QEMU source artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: qemu-src
+          path: qemu-src-artifact.tar.gz
+          retention-days: 1
+
+  format:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Install tools
+        run: |
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key |
+            sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc &&
+          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" &&
+          sudo apt-get update &&
+          sudo apt-get install -y clang-format-21
+      - name: Check out QEMU
+        uses: actions/checkout@v4
+      - name: Check C code format
+        run: |
+          scripts/opentitan/ot-format.sh --ci --Werror --dry-run
+
+  lint-python:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out QEMU
+        uses: actions/checkout@v4
+      - name: Install tools
+        run: |
+          sudo apt-get update &&
+          sudo apt-get install -y python3-pip
+          # ubuntu "latest" is too old to require --break-system-packages ...
+          pip3 install -r scripts/opentitan/requirements.txt
+      - name: Lint Python code
+        run: |
+          flake8 --config scripts/opentitan/.flake8 scripts/opentitan/*.py \
+          python/qemu/jtagtools python/qemu/ot
+          pylint --rcfile scripts/opentitan/.pylintrc -d 'duplicate-code' -d 'fixme' \
+          scripts/opentitan/*.py python/qemu/jtagtools python/qemu/ot
+
+  lint-clang:
+    runs-on: ubuntu-24.04
+    needs: build-clang
+    steps:
+      - name: Install tools
+        run: |
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key |
+            sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc &&
+          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" &&
+          sudo apt-get update &&
+          sudo apt-get install -y clang-tidy-21 libglib2.0-dev
+      - name: Check out QEMU
+        uses: actions/checkout@v4
+      - name: Download QEMU source artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: qemu-src
+      - name: Unpack source artifacts
+        run: |
+          tar xzf qemu-src-artifact.tar.gz
+      - name: Clang tidy
+        # Expect many warnings/errors (accounted but not reported) from included QEMU files
+        run: |
+          scripts/opentitan/ot-tidy.py --build-dir build-clang --ci-files -j
+
+  lint-commits:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Don't shallow clone, we need to see all commits.
+      - name: Lint commits
+        run: ./scripts/opentitan/lint-commits.sh "origin/${{ github.base_ref }}"
+
+  test-clang:
+    runs-on: ubuntu-24.04
+    needs: build-clang
+    steps:
+      - name: Install tools
+        run: |
+          sudo apt-get update &&
+          sudo apt-get install -y libpixman-1-0 libglib2.0-dev
+      - name: Download QEMU binary artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: qemu-bin
+      - name: Check machine availability
+        run: |
+          chmod +x build-clang/qemu-system-riscv32 &&
+          build-clang/qemu-system-riscv32 -M help | grep ibexdemo &&
+          build-clang/qemu-system-riscv32 -M help | grep ot-earlgrey &&
+          build-clang/qemu-system-riscv32 -M help | grep ot-darjeeling
+      - name: Check IbexDemo VM execution
+        run: |
+          timeout -s KILL 4 build-clang/qemu-system-riscv32 -M ibexdemo -nographic \
+            -device loader,addr=0x100080,file=build-clang/exit_id.bin -d in_asm,int
+      - name: Check EarlGrey VM execution
+        run: |
+          timeout -s KILL 4 build-clang/qemu-system-riscv32 -M ot-earlgrey,no_epmp_cfg=true -nographic \
+            -object ot-rom_img,id=rom,file=build-clang/exit_eg.bin -global ot-ibex_wrapper.lc-ignore=on \
+            -readconfig docs/config/opentitan/earlgrey.cfg -d in_asm,int \
+            -trace ot_ibex_wrapper_exit
+      - name: Check Darjeeling VM execution
+        run: |
+          timeout -s KILL 4 build-clang/qemu-system-riscv32 -M ot-darjeeling,no_epmp_cfg=true -nographic \
+            -object ot-rom_img,id=rom0,file=build-clang/exit_dj.bin -global ot-ibex_wrapper.lc-ignore=on \
+            -readconfig docs/config/opentitan/darjeeling.cfg -d in_asm,int \
+            -trace ot_ibex_wrapper_exit
+
+  build-gcc:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Install tools
+        run: |
+          wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key |
+          sudo tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc &&
+          sudo add-apt-repository "deb http://apt.llvm.org/noble/ llvm-toolchain-noble-21 main" &&
+          sudo apt-get update &&
+          sudo apt-get install -y git make pkg-config gcc cmake ninja-build python3 rust-all \
+            libpixman-1-dev libglib2.0-dev
+      - name: Check out QEMU
+        uses: actions/checkout@v4
+      - name: Configure
+        run: |
+          rm -rf build-gcc
+          git clean -dffx subprojects
+          mkdir build-gcc
+          (cd build-gcc &&
+           ../configure --cc=gcc --enable-werror --disable-install-blobs \
+             --target-list=riscv32-softmmu,riscv64-softmmu)
+      - name: Build
+        run: |
+          ninja -C build-gcc

.github/workflows/ci_regression.yml

@@ -0,0 +1,51 @@
+#------------------------------------------------------------------------------
+# OpenTitan CI regression runner
+#
+# Copyright (c) 2025 lowRISC CIC
+# SPDX-License-Identifier: Apache License 2.0
+#------------------------------------------------------------------------------
+
+name: OT Tests
+on:
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      opentitan_repo:
+        description: OpenTitan repository to be checked out
+        required: true
+        default: lowRISC/opentitan
+        type: string
+      opentitan_ref:
+        description: Branch, tag, or commit ref from OpenTitan to test
+        required: true
+        default: earlgrey_1.0.0
+        type: string
+
+jobs:
+  earlgrey_rom_with_fake_keys:
+    name: ROM
+    uses: ./.github/workflows/eg_regression.yml
+    secrets: inherit
+    with:
+      exec_env: sim_qemu_rom_with_fake_keys
+      opentitan_repo: ${{ inputs.opentitan_repo || 'lowRISC/opentitan' }}
+      opentitan_ref: ${{ inputs.opentitan_ref || 'earlgrey_1.0.0' }}
+
+  earlgrey_rom_ext:
+    name: ROM_EXT
+    uses: ./.github/workflows/eg_regression.yml
+    secrets: inherit
+    with:
+      exec_env: sim_qemu_rom_ext
+      test_timeout: 150
+      opentitan_repo: ${{ inputs.opentitan_repo || 'lowRISC/opentitan' }}
+      opentitan_ref: ${{ inputs.opentitan_ref || 'earlgrey_1.0.0' }}
+
+  earlgrey_sival_rom_ext:
+    name: SiVal ROM_EXT
+    uses: ./.github/workflows/eg_regression.yml
+    secrets: inherit
+    with:
+      exec_env: sim_qemu_sival_rom_ext
+      opentitan_repo: ${{ inputs.opentitan_repo || 'lowRISC/opentitan' }}
+      opentitan_ref: ${{ inputs.opentitan_ref || 'earlgrey_1.0.0' }}

.github/workflows/create_release.yml

@@ -0,0 +1,51 @@
+name: Create Release
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        required: true
+        type: string
+
+jobs:
+  release:
+    permissions:
+      # Necessary permissions to create a release.
+      contents: write
+    env:
+      BUILD_DIR: build
+      BRANCH_NAME: ${{ github.event.repository.default_branch }}
+      RELEASE_BIN_ARCHIVE: qemu-ot-earlgrey-${{ inputs.release_tag }}-x86_64-unknown-linux-gnu.tar.gz
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v3
+      # Update the package index, then install all dependencies listed in
+      # the various apt-requirements.txt files in the project.
+      - name: Install Dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y ninja-build libpixman-1-dev
+      - name: Configure
+        run: |
+          mkdir "$BUILD_DIR"
+          cd "$BUILD_DIR"
+          ../configure --target-list=riscv32-softmmu --without-default-features --enable-tcg \
+            --enable-tools --enable-trace-backends=log
+      - name: Build
+        run: |
+          cd "$BUILD_DIR"
+          ninja
+          ninja qemu-img
+      - name: Create binary archive
+        run: |
+          ./scripts/opentitan/make_release.sh "$RELEASE_BIN_ARCHIVE" . "$BUILD_DIR"
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release create \
+            --target "$BRANCH_NAME" \
+            ${{ inputs.release_tag }} \
+            --generate-notes \
+            "$RELEASE_BIN_ARCHIVE#QEMU system emulator"

.github/workflows/eg_regression.yml

@@ -0,0 +1,78 @@
+#------------------------------------------------------------------------------
+# OpenTitan regression run definition
+#
+# Copyright (c) 2025 lowRISC CIC
+# SPDX-License-Identifier: Apache License 2.0
+#------------------------------------------------------------------------------
+
+name: OpenTitan Regression
+on:
+  workflow_call:
+    inputs:
+      exec_env:
+        description: OpenTitan QEMU execution environment to test
+        required: true
+        default: qemu  # Default tag, captures all QEMU exec envs in OpenTitan
+        type: string
+      test_timeout:
+        description: The maximum timeout in seconds to use per executed test
+        required: false
+        type: string
+      opentitan_repo:
+        description: OpenTitan repository to be checked out
+        required: true
+        default: lowRISC/opentitan
+        type: string
+      opentitan_ref:
+        description: Branch, tag, or commit ref from OpenTitan to test
+        required: true
+        default: earlgrey_1.0.0
+        type: string
+
+jobs:
+  regression:
+    name: EG Regression
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout OpenTitan
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ inputs.opentitan_repo || 'lowRISC/opentitan' }}
+          ref: ${{ inputs.opentitan_ref || 'earlgrey_1.0.0' }}
+          fetch-depth: 0 # fetch all commits to avoid bug with bitstream rule
+
+      - name: Prepare OpenTitan environment
+        uses: ./.github/actions/prepare-env
+
+      - name: Checkout QEMU
+        uses: actions/checkout@v5
+        with:
+          path: qemu
+
+      - name: Build QEMU
+        working-directory: qemu
+        run: |
+          ./configure \
+            --target-list=riscv32-softmmu \
+            --without-default-features \
+            --enable-tcg \
+            --disable-tools \
+            --enable-trace-backends=log
+
+          ninja -C build qemu-system-riscv32
+
+      - name: Run OpenTitan regressions
+        shell: bash
+        run: |
+          set -o pipefail
+          ./qemu/scripts/opentitan/run-bazel-tests.sh ./ qemu \
+            ${{ inputs.exec_env }} \
+            ${{ inputs.test_timeout }} \
+            | tee ${{ inputs.exec_env }}_test_results.txt
+
+      - name: Upload Bazel test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ inputs.exec_env }}-bazel-test-results
+          path: ${{ inputs.exec_env }}_test_results.txt