[cheriot,rtl] Add shadow copies for the capability CSRs
@SamuelRiedel is already working on this.
Since Aug 21, 2026.
- Dominant language
- SystemVerilog
- Stars
- 2.1k
- Forks
- 810
- Avg merge
- 5d 23h
- Merged PRs (30d)
- 9
Description
The integer CSRs that need fault-injection protection use `ibex_csr` with a shadow copy. The CHERIoT capability CSRs added in #2475 (`mtvec_cap`, `mepc_cap`, `mtdc_cap`, `mscratchc_cap`, `depc_cap`, `dscratch0/1_cap` in `ibex_cs_registers.sv`) are plain flops without one, so MTCC does not get the protection that MTVEC has.
In a `SecureIbex` configuration these registers are duplicated in the shadow core, so a fault should surface in the lockstep comparison before it can leave the core. The gap matters for configurations without lockstep, and for consistency with the integer CSRs.
Scope:
- MTCC at minimum, since MTVEC is shadowed
- decide whether the root capabilities (MTDC, MScratchC) warrant it too
- best done together with reworking these registers to use `ibex_csr`
Agreed with @nasahlpa in review: https://github.com/lowRISC/ibex/pull/2475#discussion_r3821814549
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.