CHERI Linux on a secure enclave SoC: Mocha v0.1.0 (MVP-2)

The COSMIC team is pleased to announce this release of the Mocha repository, which is the first design that contains all the hardware IP blocks specified. It also supports booting CHERI Linux.

The release contains a bitstream which you can flash on the Genesys 2 board lowrisc_mocha_chip_mocha_genesys2_0.bit, a utilisation report chip_mocha_genesys2_utilization_placed.rpt, a set of USB rules for FPGA programming 99-openfpgaloader.rules, a built Verilator simulator Vtop_chip_verilator, a build of example software release_software.tar.gz (including boot ROM and Linux artefacts), and an environment to program the FPGA (flake.nix and fpga_runner.py).

Quick start

Firstly download all the artefacts in the same directory and change to that directory. Then follow these steps to test on FPGA:

1. Install dependencies:
   • OpenFPGALoader, for example: apt install openfpgaloader
   • Picocom, for example: apt install picocom
   • Nix, for example: curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install | sh -s -- --daemon and adding support for Flake by adding experimental-features = nix-command flakes to your Nix configuration (e.g. /etc/nix/nix.conf)
2. Connect your Genesys 2 board with the POWER, UART and JTAG. Make sure to turn on the board using SW8.
3. Configure udev rules:

   cp 99-openfpgaloader.rules /etc/udev/rules.d/99-openfpgaloader.rules
   udevadm control --reload-rules
   udevadm trigger
   usermod -a -G plugdev $USER

4. Program the downloaded bitstream:

   openFPGALoader -b genesys2 lowrisc_mocha_chip_mocha_genesys2_0.bit

5. Extract the example software:

   tar -xzvf release_software.tar.gz

6. Look at UART output:

   picocom $(ls /dev/serial/by-id/usb-FTDI_FT232R_USB_UART_*-port0) -b 1000000 --imap lfcrlf

7. In another terminal, load all the requirements to boot Linux:

   nix run .#fpga-runner -- run -e release/opensbi_with_uboot_fw_payload.elf -f release/linux_image 0x90000000 -f release/rootfs_uboot_image 0xa0000000

   You should see lots of output including Welcome to CHERI Mocha!. You can then use any command supported by busybox, such as:

   ~ # uname -a
    Linux Mocha 6.18.0-g61d1a5ed5594 #1 Tue Jun 23 16:31:15 BST 2026 riscv64 riscv64 riscv64 GNU/Linux
   

   This shows you a full flow of OpenSBI, U-Boot, the Linux kernel and a root filesystem loading on CHERI Mocha!

In simulation you can do the following:

1. Make the simulator executable and run the hello world example by running the following command:

   chmod +x Vtop_chip_verilator
   ./Vtop_chip_verilator -r release/bootrom_scrambled.vmem -E release/examples/hello_world

2. Check the UART output:

   cat uart0.log

   Which should contain content including "Hello CHERI Mocha!"

Please refer to the full developer guide for instructions on how to build the simulator, software and bitstream from source.

Initial release v0.0.1 (MVP-1)

The COSMIC team are pleased to announce the initial release of the Mocha repository. It is a first minimal viable product with an initial set of blocks integrated for a first functional system. We expect a release (MVP-2) in late June 2026 that will integrate the rest of the blocks that will make this a more complete Secure Enclave and include instructions on how to boot a rich operating system. For now this release contains bare-metal examples.

The release contains a bitstream which you can flash on the Genesys 2 board lowrisc_mocha_chip_mocha_genesys2_0.bit, a utilisation report chip_mocha_genesys2_utilization_placed.rpt, a set of USB rules for FPGA programming 99-openfpgaloader.rules, a build of example software examples.tar.gz and a built Verilator simulator Vtop_chip_verilator.

Quick start

Firstly download all the artefacts, then follow the following steps to test on FPGA:

1. Install dependencies:
   • OpenFPGALoader, for example: apt install openfpgaloader
   • Screen, for example: apt install screen
2. Connect your Genesys 2 board with the POWER, UART and JTAG. Make sure to turn on the board using SW8.
3. Configure udev rules:

   cp 99-openfpgaloader.rules /etc/udev/rules.d/99-openfpgaloader.rules
   udevadm control --reload-rules
   udevadm trigger
   usermod -a $USER -G plugdev

4. Program the downloaded bitstream:

   openFPGALoader -b genesys2 lowrisc_mocha_chip_mocha_genesys2_0.bit

5. Look at UART output:

   screen $(ls /dev/serial/by-id/usb-FTDI_FT232R_USB_UART_*-port0) 1000000

   You should press the RESET button on the Genesys 2 board (BTN1) to see bootloader message "Boot ROM!". To exit screen press ctrl-a then k and confirm with y.

In simulation you can do the following:

1. Extract the example software:

   tar -xzvf examples.tar.gz

2. Make the simulator executable and run the hello world example by running the following command:

   chmod +x Vtop_chip_verilator
   ./Vtop_chip_verilator -E release/hello_world_verilator

3. Check the UART output:

   cat uart0.log

   Which should contain content including "Hello CHERI Mocha!"

Programming new software over SPI is also possible using the boot ROM. Here are the steps to run the hello world example:

1. Open up a screen terminal in parallel:

   screen $(ls /dev/serial/by-id/usb-FTDI_FT232R_USB_UART_*-port0) 1000000

2. In another terminal program the SPI. Note you must run this command twice, and it is expected that the second run reports "Fail":

   openFPGALoader --spi --offset 0x4000 --write-flash release/hello_world.bin
   openFPGALoader --spi --offset 0x4000 --write-flash release/hello_world.bin

   In the terminal where you opened screen you should see the following output:

   
   Boot ROM!
   
   First reset
   Jumping to: 0x%0x
   Hello CHERI Mocha!
   timer 100us
   timer 100us
   timer 100us
   timer 100us
   

Please refer to the full developer guide for instructions on how to build the simulator, software and bitstream from source.