Merge branch 'lowRISC:master' into vt_checkins

.bazelrc

@@ -2,6 +2,9 @@
 # Licensed under the Apache License, Version 2.0, see LICENSE for details.
 # SPDX-License-Identifier: Apache-2.0
 
+# Opt-out of bzlmod for now and continue to use `WORKSPACE`.
+common --noenable_bzlmod
+
 # https://docs.opentitan.org/doc/rm/c_cpp_coding_style/#cxx-version specifies
 build --action_env=BAZEL_CXXOPTS="-std=gnu++14"
 build --cxxopt='-std=gnu++14'
@@ -14,10 +17,12 @@ build --strip='never'
 # Override default enablement of flags from @crt//common to control C compiler
 # warnings.
 build --features=-pedantic_warnings
+build --host_features=-pedantic_warnings
 
 # Enable toolchain hardening features.
 # `guards` adds `unimp` guard instructions after unconditional jumps.
 build --features=guards
+build --host_features=guards
 
 # Use --config=disable_hardening to disable hardening to measure the
 # impact of the hardened sequences on code size.

.bazelversion

@@ -1 +1 @@
-6.2.1
+7.3.1

.github/actions/install-deps/action.yml

@@ -0,0 +1,85 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Install dependencies
+description: Install system dependencies needed for OpenTitan
+
+inputs:
+  verilator-version:
+    description: Verilator version to install
+    required: true
+    default: '4.210'
+  verilator-path:
+    description: Path at which to install Veriltator
+    required: true
+    default: /tools/verilator
+  verible-version:
+    description: Verible version to install
+    required: true
+    default: 'v0.0-3622-g07b310a3'
+  verible-path:
+    description: Path at which to install Verible
+    required: true
+    default: /tools/verible
+
+runs:
+  using: composite
+  steps:
+    - name: Install system dependencies
+      run: |
+        sudo apt update
+        grep '^[^#]' apt-requirements.txt | xargs sudo apt install -y
+      shell: bash
+
+    - uses: astral-sh/setup-uv@v3
+      with:
+        version: '0.4.20'
+        enable-cache: true
+        cache-dependency-glob: |
+          pyproject.toml
+          python-requirements.txt
+
+    - name: Install Python
+      shell: bash
+      run: |
+        uv python install 3.8
+        # Create a virtual environment for UV
+        uv venv ~/.local/share/venv
+        echo "$HOME/.local/share/venv/bin" >> "$GITHUB_PATH"
+        echo "VIRTUAL_ENV=$HOME/.local/share/venv" >> "$GITHUB_ENV"
+
+    - name: Install Python dependencies
+      shell: bash
+      run: |
+        uv pip install -r python-requirements.txt --require-hashes
+        # We installed uv from setup-uv action, so uninstall from venv to prevent conflict
+        uv pip uninstall uv
+
+    - name: Install Verilator
+      run: |
+        VERILATOR_TAR="verilator-v${{ inputs.verilator-version }}.tar.gz"
+        VERILATOR_URL="https://storage.googleapis.com/verilator-builds/${VERILATOR_TAR}"
+        curl -f -Ls -o "/tmp/${VERILATOR_TAR}" "$VERILATOR_URL" || {
+          echo "failed to download Verilator from ${VERILATOR_URL}" >&2
+          exit 1
+        }
+        sudo mkdir -p "${{ inputs.verilator-path }}"
+        sudo chmod 777 "${{ inputs.verilator-path }}"
+        tar -C "${{ inputs.verilator-path }}" -xvzf "/tmp/${VERILATOR_TAR}"
+        echo "${{ inputs.verilator-path }}/v${{ inputs.verilator-version }}/bin" >> "$GITHUB_PATH"
+      shell: bash
+
+    - name: Install Verible
+      run: |
+        VERIBLE_TAR="verible-${{ inputs.verible-version }}-linux-static-x86_64.tar.gz"
+        VERIBLE_URL="https://github.com/chipsalliance/verible/releases/download/${{ inputs.verible-version }}/${VERIBLE_TAR}"
+        curl -f -Ls -o "/tmp/${VERIBLE_TAR}" "$VERIBLE_URL" || {
+          echo "failed to download Verible from ${VERIBLE_URL}" >&2
+          exit 1
+        }
+        sudo mkdir -p "${{ inputs.verible-path }}"
+        sudo chmod 777 "${{ inputs.verible-path }}"
+        tar -C "${{ inputs.verible-path }}" -xvzf "/tmp/${VERIBLE_TAR}" --strip-components=1
+        echo "${{ inputs.verible-path }}/bin" >> "$GITHUB_PATH"
+      shell: bash

.github/workflows/ci.yml

@@ -0,0 +1,228 @@
+# Copyright lowRISC contributors (OpenTitan project).
+# Licensed under the Apache License, Version 2.0, see LICENSE for details.
+# SPDX-License-Identifier: Apache-2.0
+
+name: CI
+on:
+  pull_request:
+  push:
+    branches-ignore:
+      - "backport-*"
+    tags:
+      - "*"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+env:
+  VIVADO_VERSION: "2021.1"
+
+jobs:
+  quick_lint:
+    name: Lint (quick)
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Required so we can lint commit messages.
+      - name: Install dependencies
+        uses: ./.github/actions/install-deps
+      - name: Environment
+        run: ./ci/scripts/show-env.sh
+      - name: Commit metadata
+        run: ./ci/scripts/lint-commits.sh "$GITHUB_BASE_REF"
+        if: ${{ github.event_name == 'pull_request' }}
+      - name: License headers
+        run: ./ci/scripts/check-licence-headers.sh "$GITHUB_BASE_REF"
+        if: ${{ github.event_name == 'pull_request' }}
+      - name: Executable bits
+        run: ./ci/scripts/exec-check.sh
+      - name: Non-ASCII characters
+        run: ./ci/scripts/check-ascii.sh
+      - name: Python (flake8)
+        run: ./ci/scripts/python-lint.sh "$GITHUB_BASE_REF"
+        if: ${{ github.event_name == 'pull_request' }}
+      - name: Python (mypy)
+        run: ./ci/scripts/mypy.sh
+      - name: Validate testplans with schema
+        run: ./ci/scripts/validate_testplans.sh
+      - name: C/C++ formatting
+        run: ./ci/bazelisk.sh test //quality:clang_format_check
+      - name: Rust formatting
+        run: ./ci/bazelisk.sh test //quality:rustfmt_check
+      - name: Shellcheck
+        run: ./ci/bazelisk.sh test //quality:shellcheck_check
+      - name: Header guards
+        run: ./ci/scripts/include-guard.sh "$GITHUB_BASE_REF"
+        if: ${{ github.event_name == 'pull_request' }}
+      - name: Trailing whitespace
+        run: ./ci/scripts/whitespace.sh "$GITHUB_BASE_REF"
+        if: ${{ github.event_name == 'pull_request' }}
+      - name: Broken links
+        run: ./ci/scripts/check-links.sh
+      - name: Generated documentation
+        run: ./ci/scripts/check-cmdgen.sh
+
+  slow_lint:
+    name: Lint (slow)
+    runs-on: ubuntu-20.04
+    needs: quick_lint
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Bitstream cache requires all commits.
+      - name: Install dependencies
+        uses: ./.github/actions/install-deps
+      - name: Countermeasures implemented (earlgrey)
+        run: ./ci/scripts/check-countermeasures.sh earlgrey
+        continue-on-error: true
+      - name: Countermeasures implemented (englishbreakfast)
+        run: ./ci/scripts/check-countermeasures.sh englishbreakfast
+        continue-on-error: true
+      - name: Bazel test suite tags
+        run: ./ci/scripts/check_bazel_test_suites.py
+        continue-on-error: true
+      # See #21973: disabled until Verilator tags are fixed.
+      # - name: Check Bazel tags
+      #   run: ./ci/scripts/check-bazel-tags.sh
+      #   continue-on-error: true
+      - name: Banned Bazel rules
+        run: ./ci/scripts/check-bazel-banned-rules.sh
+      - name: Bazel target names
+        run: ./ci/scripts/check_bazel_target_names.py
+        continue-on-error: true
+      - name: DV software images
+        run: ./ci/scripts/check_dv_sw_images.sh
+        continue-on-error: true
+      - name: Build documentation
+        run: ./ci/scripts/build-docs.sh
+      - name: Generated files
+        run: ./ci/scripts/check-generated.sh
+        env:
+          OT_DESTRUCTIVE: 1 # Required by the script to clean up.
+      - name: Buildifier
+        run: ./ci/bazelisk.sh test //quality:buildifier_check
+      - name: Vendored files
+        run: ./ci/scripts/check-vendoring.sh
+      - name: Verible RTL
+        run: ./ci/scripts/verible-lint.sh rtl
+      - name: Verible DV
+        run: ./ci/scripts/verible-lint.sh dv
+      - name: Verible FPV
+        run: ./ci/scripts/verible-lint.sh fpv
+
+  airgapped_build:
+    name: Airgapped build
+    runs-on: ubuntu-20.04
+    needs: quick_lint
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Bitstream cache requires all commits.
+      - name: Install dependencies
+        uses: ./.github/actions/install-deps
+      - name: Prepare airgapped environment
+        run: ./util/prep-bazel-airgapped-build.sh
+      - name: Build in the airgapped environment
+        run: ./ci/scripts/test-airgapped-build.sh
+
+  verible_lint:
+    name: Verible lint
+    runs-on: ubuntu-24.04
+    needs: quick_lint
+    if: ${{ github.event_name == 'pull_request' }}
+    env:
+      verible_config: hw/lint/tools/veriblelint/lowrisc-styleguide.rules.verible_lint
+      verible_version: v0.0-3430-g060bde0f
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare Verible config
+        run: |
+          echo "Concatenating Verible waivers"
+          find . -type f -name '*.vbl' -exec cat {} \; >> verible_waiver
+
+          echo "::group::Verible config"
+          cat "$verible_config"
+          echo "::endgroup::"
+
+          echo "::group::Verible waiver"
+          cat "verible_waiver"
+          echo "::endgroup::"
+      - name: Run Verible linter action
+        uses: chipsalliance/[email protected]
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          verible_version: ${{ env.verible_version }}
+          reviewdog_reporter: 'github-pr-check'
+          suggest_fixes: 'false'
+          config_file: ${{ env.verible_config }}
+          extra_args: "--waiver_files=verible_waiver"
+
+  verilator_englishbreakfast:
+    name: Verilated English Breakfast
+    runs-on: ubuntu-20.04
+    needs: quick_lint
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        uses: ./.github/actions/install-deps
+      - name: Build simulator with Verilator
+        run: ./ci/scripts/build-chip-verilator.sh englishbreakfast
+      - name: Upload binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: verilated_englishbreakfast
+          path: build-bin/hw/top_englishbreakfast/Vchip_englishbreakfast_verilator
+          overwrite: true
+      - name: Test
+        run: ./ci/scripts/run-english-breakfast-verilator-tests.sh
+
+  # Build CW305 variant of the English Breakfast toplevel design using Vivado
+  chip_englishbreakfast_cw305:
+    name: CW305's Bitstream
+    runs-on: ubuntu-22.04-bitstream
+    needs: quick_lint
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        uses: ./.github/actions/install-deps
+      - name: Build bitstream
+        run: |
+          # Build CW305 test rom required by `build-bitstream-vivado.sh`
+          rom_path="sw/device/lib/testing/test_rom"
+          ci/bazelisk.sh build "//${rom_path}:test_rom_fpga_cw305" \
+            --features=-rv32_bitmanip \
+            --copt=-DOT_IS_ENGLISH_BREAKFAST_REDUCED_SUPPORT_FOR_INTERNAL_USE_ONLY_
+          vmem="$(ci/bazelisk.sh cquery --output=files "//${rom_path}:test_rom_fpga_cw305" \
+            --features=-rv32_bitmanip \
+            --copt=-DOT_IS_ENGLISH_BREAKFAST_REDUCED_SUPPORT_FOR_INTERNAL_USE_ONLY_
+          )"
+          mkdir -p "build-bin/${rom_path}"
+          cp "$vmem" "build-bin/${rom_path}"
+
+          module load "xilinx/vivado/${VIVADO_VERSION}"
+          ci/scripts/build-bitstream-vivado.sh top_englishbreakfast cw305
+      - name: Upload bitstream
+        uses: actions/upload-artifact@v4
+        with:
+          name: chip_englishbreakfast_cw305
+          path: build-bin/hw/top_englishbreakfast/lowrisc_systems_chip_englishbreakfast_cw305_0.1.bit
+          overwrite: true
+
+  build_docker_containers:
+    name: Build Docker Containers
+    runs-on: ubuntu-20.04
+    needs: quick_lint
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build Developer Utility Container
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: util/container/Dockerfile
+        continue-on-error: true
+      - name: Build Documentation Redirector Container
+        uses: docker/build-push-action@v6
+        with:
+          context: site/redirector/landing