diff --git a/Makefile b/Makefile
index 75a7a74..e7b9a26 100644
--- a/Makefile
+++ b/Makefile
@@ -35,16 +35,14 @@
 include $(ROOTDIR)/build/platforms/$(PLATFORM)/platform.mk
 
 prereqs_apt: $(ROOTDIR)/scripts/install-prereqs.sh \
-		 ${CANTRIP_PLATFORM_APT_DEPS}
+		 ${PLATFORM_APT_DEPS}
 	$(ROOTDIR)/scripts/install-prereqs.sh \
-		-a "${CANTRIP_PLATFORM_APT_DEPS}"
+		-a "${PLATFORM_APT_DEPS}"
 
 prereqs_py: $(ROOTDIR)/scripts/install-prereqs.sh \
-		 $(ROOTDIR)/scripts/python-requirements.txt \
-		 ${CANTRIP_PLATFORM_PYTHON_DEPS}
+		 $(ROOTDIR)/scripts/python-requirements.txt ${PLATFORM_PYTHON_DEPS}
 	$(ROOTDIR)/scripts/install-prereqs.sh \
-		-p "$(ROOTDIR)/scripts/python-requirements.txt \
-			 ${CANTRIP_PLATFORM_PYTHON_DEPS}" \
+		-p "$(ROOTDIR)/scripts/python-requirements.txt ${PLATFORM_PYTHON_DEPS}"
 
 ## Installs build prerequisites
 #
diff --git a/platforms/nexus/platform.mk b/platforms/nexus/platform.mk
index 9ba485e..48e93be 100644
--- a/platforms/nexus/platform.mk
+++ b/platforms/nexus/platform.mk
@@ -1,7 +1,7 @@
 # Platform-specific requirements handled by "m prereqs"
-CANTRIP_PLATFORM_PYTHON_DEPS=\
+PLATFORM_PYTHON_DEPS=\
     ${ROOTDIR}/hw/opentitan-upstream/python-requirements.txt
-CANTRIP_PLATFORM_APT_DEPS=\
+PLATFORM_APT_DEPS=\
     ${ROOTDIR}/hw/opentitan-upstream/apt-requirements.txt
 
 # Put host tool targets first.
diff --git a/platforms/rpi3/platform.mk b/platforms/rpi3/platform.mk
index 20e8f3d..549b7c1 100644
--- a/platforms/rpi3/platform.mk
+++ b/platforms/rpi3/platform.mk
@@ -1,6 +1,6 @@
 # Platform-specific requirements handled by "m prereqs"
-CANTRIP_PLATFORM_PYTHON_DEPS=
-CANTRIP_PLATFORM_APT_DEPS=
+PLATFORM_PYTHON_DEPS=
+PLATFORM_APT_DEPS=
 
 include $(ROOTDIR)/build/platforms/rpi3/cantrip.mk
 include $(ROOTDIR)/build/platforms/rpi3/cantrip_builtins.mk
diff --git a/platforms/sencha/cantrip_apps.mk b/platforms/sencha/cantrip_apps.mk
new file mode 100644
index 0000000..ac655d9
--- /dev/null
+++ b/platforms/sencha/cantrip_apps.mk
@@ -0,0 +1 @@
+# CantripOS Test Application configuration
diff --git a/platforms/sencha/cantrip_builtins.mk b/platforms/sencha/cantrip_builtins.mk
new file mode 100644
index 0000000..f85e941
--- /dev/null
+++ b/platforms/sencha/cantrip_builtins.mk
@@ -0,0 +1,23 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Placeholder until the top-level cantrip_builtins.mk is cleaned up.
+
+CANTRIP_APPS_RELEASE  :=
+CANTRIP_MODEL_RELEASE :=
+
+CANTRIP_APPS_DEBUG    :=
+CANTRIP_MODEL_DEBUG   :=
+
+CANTRIP_SCRIPTS       :=
diff --git a/platforms/sencha/cheriot.mk b/platforms/sencha/cheriot.mk
new file mode 100644
index 0000000..40a8e2b
--- /dev/null
+++ b/platforms/sencha/cheriot.mk
@@ -0,0 +1,144 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Builds CHERIoT firmware.
+# The source for cheriot-rtos is in $(CHERIOT_SRC_DIR)
+# The source for the application is in $(CHERIOT_FIRMWARE_SRC_DIR), defined
+#   according to ${CHERIOT_FIRMWARE} in ${PLATFORM}/platform.mk
+# The outputs are placed in $(CHERIOT_FIRMWARE_DEBUG) or $(CHERIOT_FIRMWARE_RELEASE)
+
+# Drivers for each platform and platform-specific make targets are stored in
+# platform/$PLATFORM/platform.mk make files. Everything in this file must be
+# made platform-agnostic. As such, we use phony targets that can be extended in
+# the platform.mk files as double-colon (::) aggregate targets. These phony
+# targets are explicitly grouped and have notes in their doccomments.
+
+CHERIOT_SRC_DIR      := $(ROOTDIR)/sw/cheriot-rtos
+
+# CHERIOT_OUT_DIR is defined in build/setup.sh
+CHERIOT_OUT_DEBUG   := $(CHERIOT_OUT_DIR)/debug
+CHERIOT_OUT_RELEASE := $(CHERIOT_OUT_DIR)/release
+
+CHERIOT_FIRMWARE_DEBUG   := $(CHERIOT_OUT_DEBUG)/cheriot/cheriot/release/${CHERIOT_FIRMWARE}-firmware
+# XXX debug builds don't work atm
+#CHERIOT_FIRMWARE_DEBUG   := $(CHERIOT_OUT_DEBUG)/cheriot/cheriot/debug/${CHERIOT_FIRMWARE}-firmware
+CHERIOT_FIRMWARE_RELEASE := $(CHERIOT_OUT_RELEASE)/cheriot/cheriot/release/${CHERIOT_FIRMWARE}-firmware
+
+# TODO: add CHERIOT_FIRMWARE_SRC_DIR (not currently defined in time to use here)
+CHERIOT_SOURCES := $(shell find $(CHERIOT_SRC_DIR) \(\
+	-name \*.rs -or \
+	-name \*.c -or \
+	-name \*.h -or \
+	-name \*.cpp \
+	\) -type f)
+
+# Platform-specific aggregate targets
+
+## Builds auto-generated include files for the CHERIoT system
+#
+# In the generic case, this is a noop. But it's an aggregate target,
+# so that platform-specific headers may also be generated from other
+# parts of the project.
+#
+# Note: this is a platform-specific aggregate phony target, and additional rules
+# for each platform are defined in build/$PLATFORM/platform.mk
+cheriot-gen-headers::
+
+## Cleans the auto-generated CHERIoT include files
+#
+# Note: this is a platform-specific aggregate phony target, and additional rules
+# for each platform are defined in build/$PLATFORM/platform.mk
+cheriot-clean-headers::
+
+## CHERIoT debug build-tree preparation target
+#
+# Prepares the output directory tree for building. In the generic case, this
+# just makes our target directory tree, but each specific platform may also need
+# to link in source files or modify the target tree somewhat. This aggregate
+# target provides that functionality for a debug build.
+#
+# Note: this is a platform-specific aggregate phony target, and additional rules
+# for each platform are defined in build/$PLATFORM/platform.mk
+cheriot-build-debug-prepare:: | $(CHERIOT_OUT_DEBUG)
+
+## CHERIoT release build-tree preparation target
+#
+# Prepares the output directory tree for building. In the generic case, this
+# just makes our target directory tree, but each specific platform may also need
+# to link in source files or modify the target tree somewhat. This aggregate
+# target provides that functionality for a release build.
+#
+# Note: this is a platform-specific aggregate phony target, and additional rules
+# for each platform are defined in build/$PLATFORM/platform.mk
+cheriot-build-release-prepare:: | $(CHERIOT_OUT_RELEASE)
+
+# CHERIoT-generic targets
+
+## Cleans all CHERIoT build artifacts for the current platform
+# TODO(sleffler): cheriot-clean-headers once they are per-platform
+cheriot-clean:
+	rm -rf $(CHERIOT_OUT_DIR)
+
+$(CHERIOT_OUT_DEBUG):
+	mkdir -p $(CHERIOT_OUT_DEBUG)
+
+$(CHERIOT_OUT_RELEASE):
+	mkdir -p $(CHERIOT_OUT_RELEASE)
+
+# Update submodules to track any changes in the .gitmodules. Alternatively
+# the submodules could be mirrored and spliced by the manifest but any
+# pinned sha's would then need to be tracked.
+cheriot_check:
+	echo Updating $(CHERIOT_SRC_DIR) submodules...; \
+	git -C $(CHERIOT_SRC_DIR) submodule sync && \
+		git -C $(CHERIOT_SRC_DIR) submodule update --init --jobs=8 --depth=10; \
+
+
+# Build CHERIoT firmware image.
+
+$(CHERIOT_FIRMWARE_DEBUG): $(CHERIOT_SOURCES) cheriot-gen-headers cheriot-build-debug-prepare | cheriot_check $(CHERIOT_OUT_DEBUG)
+	export XMAKE_CONFIGDIR=${CHERIOT_OUT_DEBUG}; \
+	cd ${CHERIOT_FIRMWARE_SRC_DIR} && \
+		xmake config \
+			-o ${CHERIOT_OUT_DEBUG} \
+			--sdk=${ROOTDIR}/cache/cheriot-tools \
+			--board=${PLATFORM} \
+			${CHERIOT_DEBUG_CONFIG_OPTIONS} && \
+	xmake build
+
+## Generates CHERIoT build artifacts with debugging suport
+cheriot-bundle-debug: $(CHERIOT_FIRMWARE_DEBUG)
+
+$(CHERIOT_FIRMWARE_RELEASE): $(CHERIOT_SOURCES) cheriot-gen-headers cheriot-build-release-prepare | cheriot_check $(CHERIOT_OUT_RELEASE)
+	export XMAKE_CONFIGDIR=${CHERIOT_OUT_RELEASE}; \
+	cd ${CHERIOT_FIRMWARE_SRC_DIR} && \
+		xmake config \
+			-o ${CHERIOT_OUT_RELEASE} \
+			--sdk=${ROOTDIR}/cache/cheriot-tools \
+			--board=${PLATFORM} \
+			${CHERIOT_RELEASE_CONFIG_OPTIONS} && \
+	xmake build
+
+## Generates CHERIoT build artifacts setup for release
+cheriot-bundle-release: $(CHERIOT_FIRMWARE_RELEASE)
+
+## Generates both debug & release CHERIoT build artifacts
+cheriot: cheriot-bundle-debug cheriot-bundle-release
+
+.PHONY:: cheriot cheriot_check cheriot-clean
+.PHONY:: cheriot-bundle-debug cheriot-bundle-release
+.PHONY:: cheriot-builtins-debug cheriot-builtins-release
+.PHONY:: cheriot-gen-headers cheriot-clean-headers
+.PHONY:: cheriot-build-debug-prepare cheriot-build-release-prepare
+.PHONY:: $(CHERIOT_OUT_DEBUG) $(CHERIOT_OUT_RELEASE)
diff --git a/platforms/sencha/platform.mk b/platforms/sencha/platform.mk
new file mode 100644
index 0000000..8706c9d
--- /dev/null
+++ b/platforms/sencha/platform.mk
@@ -0,0 +1,131 @@
+#!/bin/bash
+#
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Firmware image to build & load at boot.
+ifeq ($(CHERIOT_FIRMWARE),)
+$(error "CHERIOT_FIRMWARE not set. Did build/platforms/${PLATFORM}/setup.sh get sourced?")
+endif
+CHERIOT_FIRMWARE_SRC_DIR	:= ${ROOTDIR}/hw/matcha/sw/device/cheriot/${CHERIOT_FIRMWARE}
+
+# Optional xmake config options, typically useful for enabling debugging
+# otherwise compiled out.
+#CHERIOT_DEBUG_CONFIG_OPTIONS=--debug-scheduler=true --debug-allocator=true
+#CHERIOT_RELEASE_CONFIG_OPTIONS=--debug-scheduler=true --debug-allocator=true
+
+# Platform-specific requirements handled by "m prereqs"
+PLATFORM_PYTHON_DEPS=\
+    ${ROOTDIR}/hw/opentitan-upstream/python-requirements.txt
+PLATFORM_APT_DEPS=\
+    ${ROOTDIR}/hw/opentitan-upstream/apt-requirements.txt
+
+# Put host tool targets first.
+include $(ROOTDIR)/build/platforms/nexus/renode.mk
+include $(ROOTDIR)/build/platforms/sencha/cheriot.mk
+include $(ROOTDIR)/build/platforms/sencha/riscv_toolchain.mk
+
+include $(ROOTDIR)/build/platforms/nexus/iree.mk
+include $(ROOTDIR)/build/platforms/nexus/kelvin.mk
+include $(ROOTDIR)/build/platforms/nexus/opentitan_sw.mk
+include $(ROOTDIR)/build/platforms/nexus/opentitan_hw.mk
+include $(ROOTDIR)/build/platforms/nexus/matcha_hw.mk
+include $(ROOTDIR)/build/platforms/nexus/tock.mk
+
+# Put simulation targets at the end
+include $(ROOTDIR)/build/platforms/sencha/sim.mk
+
+# Driver include files auto-generated from opentitan definitions.
+
+ifeq ($(OPENTITAN_SOURCE),)
+$(error "OPENTITAN_SOURCE not set. Did build/platforms/sencha/setup.sh get sourced?")
+endif
+
+ifeq ($(OPENTITAN_GEN_DIR),)
+$(error "OPENTITAN_GEN_DIR not set. Did build/platforms/sencha/setup.sh get sourced?")
+endif
+
+$(OPENTITAN_GEN_DIR):
+	mkdir -p $(OPENTITAN_GEN_DIR)
+
+# Matcha hw config #defines generated from RTL
+
+I2S_HEADER=$(OPENTITAN_GEN_DIR)/i2s_regs.h
+ML_TOP_HEADER=$(OPENTITAN_GEN_DIR)/ml_top_regs.h
+TLUL_MAILBOX_HEADER=$(OPENTITAN_GEN_DIR)/tlul_mailbox_regs.h
+UART_HEADER=$(OPENTITAN_GEN_DIR)/uart_regs.h
+
+$(I2S_HEADER): $(REGTOOL) $(I2S_HJSON) | $(OPENTITAN_GEN_DIR)
+	$(REGTOOL) -D -o $@ $(I2S_HJSON)
+$(ML_TOP_HEADER): $(REGTOOL) $(ML_TOP_HJSON) | $(OPENTITAN_GEN_DIR)
+	$(REGTOOL) -D -o $@ $(ML_TOP_HJSON)
+$(TLUL_MAILBOX_HEADER): $(REGTOOL) $(MBOX_HJSON) | $(OPENTITAN_GEN_DIR)
+	$(REGTOOL) -D -o $@ $(MBOX_HJSON)
+$(UART_HEADER): $(REGTOOL) $(UART_HJSON) | $(OPENTITAN_GEN_DIR)
+	$(REGTOOL) -D -o $@ $(UART_HJSON)
+
+TOP_MATCHA_DIR=${CHERIOT_OUT_DIR}/top_matcha
+TOP_MATCHA_MEMORY_HEADER=$(TOP_MATCHA_DIR)/sw/autogen/top_matcha_memory.h
+TOP_MATCHA_IRQ_HEADER=$(TOP_MATCHA_DIR)/sw/autogen/top_matcha_smc_irq.h
+# NB: could depend on the templates instead
+TOPGEN_MATCHA=${ROOTDIR}/hw/matcha/util/topgen_matcha.py
+
+${TOP_MATCHA_DIR}:
+	mkdir -p $(TOP_MATCHA_DIR)
+
+# NB: no way to generate just the files we need
+$(TOP_MATCHA_IRQ_HEADER): $(TOPGEN_MATCHA) ${TOP_MATCHA_DIR} $(TOP_MATCHA_HJSON)
+	PYTHONPATH=${OPENTITAN_SOURCE}/util/ ${TOPGEN_MATCHA} -t ${TOP_MATCHA_HJSON} -o ${TOP_MATCHA_DIR}/ --top-only
+$(TOP_MATCHA_MEMORY_HEADER): $(TOPGEN_MATCHA) ${TOP_MATCHA_DIR} $(TOP_MATCHA_HJSON)
+	PYTHONPATH=${OPENTITAN_SOURCE}/util/ ${TOPGEN_MATCHA} -t ${TOP_MATCHA_HJSON} -o ${TOP_MATCHA_DIR}/ --top-only
+
+# Targets to install the symlink to opentitan headers for each build
+
+cheriot-build-debug-prepare:: | $(CHERIOT_OUT_DEBUG)
+	ln -sf $(CHERIOT_OUT_DIR)/opentitan-gen $(CHERIOT_OUT_DEBUG)/
+
+cheriot-build-release-prepare:: | $(CHERIOT_OUT_RELEASE)
+	ln -sf $(CHERIOT_OUT_DIR)/opentitan-gen $(CHERIOT_OUT_RELEASE)/
+
+CHERIOT_GEN_HEADERS=\
+    $(I2S_HEADER) \
+    $(ML_TOP_HEADER) \
+    $(TLUL_MAILBOX_HEADER) \
+    $(UART_HEADER) \
+    $(TOP_MATCHA_IRQ_HEADER) \
+    $(TOP_MATCHA_MEMORY_HEADER)
+
+cheriot-gen-headers:: $(CHERIOT_GEN_HEADERS)
+
+cheriot-clean-headers::
+	rm -f $(CHERIOT_GEN_HEADERS)
+
+# Point to the clang++ target to make sure the binary is installed.
+$(CACHE)/cheriot-tools/bin/clang++: | $(CACHE)
+	./scripts/install-toolchain.sh cheriot
+
+## Installs the LLVM compiler for CHERIoT
+#
+# Requires network access. This fetches the toolchain from the GCP archive and
+# extracts it locally to the cache/.
+install_cheriot: $(CACHE)/cheriot-tools/bin/clang++
+
+# NB: install the prebuilt CHERIoT toolchain. Note this means it
+# is necessary to do something like:
+# $ set-platform sencha
+# $ m tools
+# to get a working build environment.
+tools:: install_cheriot
+
+.PHONY:: install_cheriot
diff --git a/platforms/sencha/riscv_toolchain.mk b/platforms/sencha/riscv_toolchain.mk
new file mode 100644
index 0000000..0df299a
--- /dev/null
+++ b/platforms/sencha/riscv_toolchain.mk
@@ -0,0 +1,74 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# TODO: might need sail for reference (e.g. for testrig)
+
+TOOLCHAIN_CHERIOT_SRC_DIR := $(OUT)/tmp/toolchain/cheriot-llvm-project
+TOOLCHAIN_CHERIOT_BUILD_DIR := $(OUT)/tmp/toolchain/build_toolchain_cheriot
+TOOLCHAIN_CHERIOT_OUT_DIR := $(CACHE)/cheriot-tools
+TOOLCHAIN_CHERIOT_BIN       := $(TOOLCHAIN_CHERIOT_OUT_DIR)/bin/llvm-objdump
+
+TOOLCHAIN_BUILD_DATE := $(shell date +%Y-%m-%d)
+
+
+toolchain_cheriot_src:
+	if [[ -f "${TOOLCHAIN_CHERIOT_BIN}" ]]; then \
+		echo "Toolchain exists, run 'm toolchain_cheriot_clean' if you really want to rebuild"; \
+	else \
+		"$(ROOTDIR)/scripts/download-toolchain.sh" "$(TOOLCHAIN_CHERIOT_SRC_DIR)" CHERIOT; \
+	fi
+
+$(TOOLCHAIN_CHERIOT_BUILD_DIR):
+	mkdir -p $(TOOLCHAIN_CHERIOT_BUILD_DIR)
+
+$(TOOLCHAIN_CHERIOT_BIN): | toolchain_cheriot_src $(TOOLCHAIN_CHERIOT_BUILD_DIR)
+	cmake -B $(TOOLCHAIN_CHERIOT_BUILD_DIR) \
+		-DCMAKE_INSTALL_PREFIX=$(TOOLCHAIN_CHERIOT_OUT_DIR) \
+		-DCMAKE_BUILD_TYPE=Release \
+		-DLLVM_ENABLE_PROJECTS="clang;clang-tools-extra;lld" \
+		-DLLVM_ENABLE_UNWIND_TABLES=NO \
+		-DLLVM_TARGETS_TO_BUILD=RISCV \
+		-DLLVM_DISTRIBUTION_COMPONENTS="clang;clangd;lld;llvm-objdump" \
+		-G Ninja \
+		$(TOOLCHAIN_CHERIOT_SRC_DIR)/llvm
+	cmake --build $(TOOLCHAIN_CHERIOT_BUILD_DIR) --target install-distribution
+	cmake --build $(TOOLCHAIN_CHERIOT_BUILD_DIR) --target clean
+
+$(OUT)/toolchain_cheriot_$(TOOLCHAIN_BUILD_DATE).tar.gz: $(TOOLCHAIN_CHERIOT_BIN)
+	tar -C $(CACHE) -czf \
+		"$(OUT)/toolchain_cheriot_$(TOOLCHAIN_BUILD_DATE).tar.gz" cheriot-tools
+	cd $(OUT) && sha256sum "toolchain_cheriot_$(TOOLCHAIN_BUILD_DATE).tar.gz" > \
+		"toolchain_cheriot_$(TOOLCHAIN_BUILD_DATE).tar.gz.sha256sum"
+	@echo "==========================================================="
+	@echo "CHERIoT Toolchain tarball ready at $(OUT)/toolchain_cheriot_$(TOOLCHAIN_BUILD_DATE).tar.gz"
+	@echo "==========================================================="
+
+## Builds CHERIoT LLVM toolchain.
+#
+# Note: this actually builds from source, rather than fetching a release
+# tarball, and is most likely not the target you actually want.
+#
+# This target can take hours to build, and results in a tarball and sha256sum
+# called `out/toolchain_cheriot_<timestamp>.tar.gz` and
+# `out/toolchain_cheriot_<timestamp>.tar.gz.sha256sum`, ready for
+# upload. In the process of generating this tarball, this target also builds the
+# actual tools in `cache/toolchain_cheriot`, so untarring this tarball is
+# unneccessary.
+toolchain_cheriot: $(OUT)/toolchain_cheriot_$(TOOLCHAIN_BUILD_DATE).tar.gz
+
+## Removes the CHERIoT toolchain from cache/, forcing a re-fetch if needed.
+toolchain_cheriot_clean:
+	rm -rf "$(TOOLCHAIN_CHERIOT_OUT_DIR)" "$(TOOLCHAIN_CHERIOT_SRC_DIR)" "$(TOOLCHAIN_CHERIOT_BUILD_DIR)"
+
+.PHONY:: toolchain_cheriot toolchain_cheriot_src toolchain_cheriot_clean
diff --git a/platforms/sencha/setup.sh b/platforms/sencha/setup.sh
new file mode 100644
index 0000000..1da8111
--- /dev/null
+++ b/platforms/sencha/setup.sh
@@ -0,0 +1,94 @@
+#!/bin/bash
+#
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Firmware image to build & load at boot.
+# NB: the pathname to the source directory is formulated in platform.mk
+export CHERIOT_FIRMWARE="soundstream"
+
+export C_PREFIX="riscv32-unknown-elf-"
+
+export OPENTITAN_GEN_DIR="${CHERIOT_OUT_DIR}/opentitan-gen/include/opentitan"
+export OPENTITAN_SOURCE="${ROOTDIR}/hw/opentitan-upstream"
+
+# Some build.rs files use the regtool crate which needs to know where to find
+# regtool.py.
+export REGTOOL="${OPENTITAN_SOURCE}/util/regtool.py"
+# The following files are the input to regtool.py
+export I2S_HJSON="${ROOTDIR}/hw/matcha/hw/top_matcha/ip/i2s/data/i2s.hjson"
+export MBOX_HJSON="${ROOTDIR}/hw/matcha/hw/top_matcha/ip/tlul_mailbox/data/tlul_mailbox.hjson"
+export ML_TOP_HJSON="${ROOTDIR}/hw/matcha/hw/top_matcha/ip/ml_top/data/ml_top.hjson"
+export TIMER_HJSON="${OPENTITAN_GEN_DIR}/rv_timer.hjson"
+export UART_HJSON="${OPENTITAN_SOURCE}/hw/ip/uart/data/uart.hjson"
+export VC_TOP_HJSON="${ROOTDIR}/hw/matcha/hw/top_matcha/ip/vc_top/data/vc_top.hjson"
+# Input for topgen_matcha.py to generate hw configuration
+export TOP_MATCHA_HJSON="${ROOTDIR}/hw/matcha/hw/top_matcha/data/top_matcha.hjson"
+
+function parting_messages() {
+    if [[ ! -d "${RUSTDIR}" ]] ||
+       [[ ! -d "${ROOTDIR}/cache/cheriot-tools" ]] ||
+       [[ ! -d "${ROOTDIR}/cache/toolchain" ]] ||
+       [[ ! -d "${ROOTDIR}/cache/toolchain_kelvin" ]] ||
+       [[ ! -d "${ROOTDIR}/cache/renode" ]]; then
+        echo
+        echo '!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'
+        echo You have missing tools. Please run \'m prereqs\' followed
+        echo by \'m tools\' to install them.
+        echo '!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!'
+        echo
+        [[ -d "${RUSTDIR}" ]] || echo "${RUSTDIR} is missing!"
+        [[ -d "${ROOTDIR}/cache/cheriot-tools" ]] || echo "${ROOTDIR}/cache/cheriot-tools is missing"
+        [[ -d "${ROOTDIR}/cache/toolchain" ]] || echo "${ROOTDIR}/cache/toolchain is missing"
+        [[ -d "${ROOTDIR}/cache/toolchain_kelvin" ]] || echo "${ROOTDIR}/cache/toolchain_kelvin is missing!"
+        [[ -d "${ROOTDIR}/cache/renode" ]] || echo "${ROOTDIR}/cache/renode is missing!"
+    fi
+    echo Run \'set-nexus-id NN\' to set your Nexus board ID
+}
+
+function sim_kelvin
+{
+    # Run the ELF/Bin program with kelvin_sim
+    local bin_file="$(realpath $1)"
+    local magic_bytes="$(xxd -p -l 4 ${bin_file})"
+    local -a flags=()
+    local is_elf=false
+    if [[ ${magic_bytes} == "7f454c46" ]]; then
+      is_elf=true
+    else
+      flags+=("--entry_point 0 ")
+    fi
+
+    if [[ "$2" == "debug" ]]; then
+        flags+=("-i")
+        if [[ "${is_elf}" == false ]]; then
+            echo "debug mode only works on ELF files"
+            return 1
+        fi
+    fi
+
+    ("${OUT}/kelvin/sim/kelvin_sim" "${bin_file}" ${flags[@]})
+}
+
+function sim_kelvin_renode
+{
+    # Run the Bin program with renode
+    local bin_file="$(realpath $1)"
+    local command="start;"
+
+    (cd "${ROOTDIR}" && renode -e "\$bin=@${bin_file}; i @sim/config/kelvin.resc; \
+        ${command} sysbus.ml_top_controlblock WriteDoubleWord 0xc 0" \
+        --disable-xwt --console)
+
+}
diff --git a/platforms/sencha/sim.mk b/platforms/sencha/sim.mk
new file mode 100644
index 0000000..eac860f
--- /dev/null
+++ b/platforms/sencha/sim.mk
@@ -0,0 +1,103 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+EXT_FLASH_DEBUG=$(CHERIOT_OUT_DEBUG)/ext_flash.tar
+EXT_FLASH_RELEASE=$(CHERIOT_OUT_RELEASE)/ext_flash.tar
+
+TMP_DEBUG=$(CHERIOT_OUT_DEBUG)/tmp
+TMP_RELEASE=$(CHERIOT_OUT_RELEASE)/tmp
+
+sim_configs:
+	$(RENODE_SIM_GENERATOR_SCRIPT)
+
+clean_sim_configs:
+	@rm -rf $(OUT)/renode_configs
+
+$(TMP_DEBUG):
+	mkdir $(TMP_DEBUG)
+$(TMP_RELEASE):
+	mkdir $(TMP_RELEASE)
+
+# XXX symlink cheriot fw to "kernel" to satisfy elfloader
+$(EXT_FLASH_DEBUG): $(MATCHA_BUNDLE_DEBUG) $(CHERIOT_FIRMWARE_DEBUG) | $(TMP_DEBUG)
+	cp -f $(MATCHA_BUNDLE_DEBUG) $(TMP_DEBUG)/matcha-tock-bundle
+	${C_PREFIX}strip $(TMP_DEBUG)/matcha-tock-bundle
+	${C_PREFIX}objcopy -O binary -g $(TMP_DEBUG)/matcha-tock-bundle $(TMP_DEBUG)/matcha-tock-bundle.bin
+	ln -sf $(CHERIOT_FIRMWARE_DEBUG) $(TMP_DEBUG)/kernel
+	tar -C $(TMP_DEBUG) -cvhf $@ matcha-tock-bundle.bin kernel
+ext_flash_debug: $(EXT_FLASH_DEBUG)
+
+# XXX symlink cheriot fw to "kernel" to satisfy elfloader
+$(EXT_FLASH_RELEASE): $(MATCHA_BUNDLE_RELEASE) $(CHERIOT_FIRMWARE_RELEASE) | $(TMP_RELEASE)
+	cp -f $(MATCHA_BUNDLE_RELEASE) $(TMP_RELEASE)/matcha-tock-bundle
+	${C_PREFIX}strip $(TMP_RELEASE)/matcha-tock-bundle
+	${C_PREFIX}objcopy -O binary -g $(TMP_RELEASE)/matcha-tock-bundle $(TMP_RELEASE)/matcha-tock-bundle.bin
+	ln -sf $(CHERIOT_FIRMWARE_RELEASE) $(TMP_RELEASE)/kernel
+	tar -C $(TMP_RELEASE) -cvhf $@ matcha-tock-bundle.bin kernel
+ext_flash_release: $(EXT_FLASH_RELEASE)
+
+# Renode commands to issue before the initial start of a simulation.
+# This pauses all cores and then sets cpu0 (SC).
+RENODE_PRESTART_CMDS=pause; cpu0 IsHalted false;
+PORT_PRESTART_CMDS:=$(shell $(ROOTDIR)/scripts/generate-renode-port-cmd.sh $(RENODE_PORT))
+
+# XXX the same for now
+SENCHA_RESC_DEBUG=sim/config/sencha.resc
+SENCHA_RESC_RELEASE=sim/config/sencha.resc
+
+SENCHA_REPL=sim/config/platforms/sencha.repl
+
+## Launches an end-to-end build of the system and starts Renode
+#
+# This top-level target triggers the `matcha_tock_release`, `cheriot`, `renode`,
+# `multihart_boot_rom`, and `iree` targets to build the entire system and then
+# finally starts the Renode simulator.
+#
+# This is the default target for the build system, and is generally what you
+# need for day-to-day work on the software side of Shodan.
+simulate: renode kelvin_sim multihart_boot_rom ext_flash_release
+	$(RENODE_CMD) -e "\
+    \$$repl_file = @${SENCHA_REPL}; \
+    \$$tar = @$(EXT_FLASH_RELEASE); \
+    \$$sc_bin =@$(TMP_RELEASE)/matcha-tock-bundle.bin; \
+    $(PORT_PRESTART_CMDS) i @${SENCHA_RESC_RELEASE}; \
+        $(RENODE_PRESTART_CMDS) start"
+
+## Debug version of the `simulate` target
+#
+# This top-level target does the same job as `simulate`, but instead of
+# unhalting the CPUs and starting the system, this alternate target only unhalts
+# cpu0, and uses the debug build of TockOS from the `matcha_tock_debug` target.
+simulate-debug: renode kelvin_sim multihart_boot_rom ext_flash_debug
+	$(RENODE_CMD) -e "\
+    \$$repl_file = @${SENCHA_REPL}; \
+    \$$tar = @$(EXT_FLASH_DEBUG); \
+    \$$sc_bin =@$(TMP_DEBUG)/matcha-tock-bundle.bin; \
+    $(PORT_PRESTART_CMDS) i @${SENCHA_RESC_DEBUG}; \
+        $(RENODE_PRESTART_CMDS); start"
+
+## Debug version of the `simulate` target
+#
+# This top-level target does the same job as `simulate-debug`, but instead of
+# unhalting the CPUs and starting the system, this alternate target starts
+# renode with no CPUs unhalted, allowing for GDB to be used for early system
+# start.
+debug-simulation: renode kelvin_sim multihart_boot_rom ext_flash_debug
+	$(RENODE_CMD) -e "\
+    \$$repl_file = @${SENCHA_REPL}; \
+    \$$tar = @$(EXT_FLASH_DEBUG); \
+    \$$sc_bin =@$(TMP_DEBUG)/matcha-tock-bundle.bin; \
+    $(PORT_PRESTART_CMDS) i @${SENCHA_RESC_DEBUG}; start"
+
+.PHONY:: sim_configs clean_sim_configs simulate simulate-debug debug-simulation
diff --git a/platforms/shodan/platform.mk b/platforms/shodan/platform.mk
index 864dbbe..5e898da 100644
--- a/platforms/shodan/platform.mk
+++ b/platforms/shodan/platform.mk
@@ -1,7 +1,7 @@
 # Platform-specific requirements handled by "m prereqs"
-CANTRIP_PLATFORM_PYTHON_DEPS=\
+PLATFORM_PYTHON_DEPS=\
     ${ROOTDIR}/hw/opentitan-upstream/python-requirements.txt
-CANTRIP_PLATFORM_APT_DEPS=\
+PLATFORM_APT_DEPS=\
     ${ROOTDIR}/hw/opentitan-upstream/apt-requirements.txt
 
 # Put host tool targets first.
diff --git a/platforms/sparrow/platform.mk b/platforms/sparrow/platform.mk
index f9a603c..ef3521a 100644
--- a/platforms/sparrow/platform.mk
+++ b/platforms/sparrow/platform.mk
@@ -1,7 +1,7 @@
 # Platform-specific requirements handled by "m prereqs"
-CANTRIP_PLATFORM_PYTHON_DEPS=\
+PLATFORM_PYTHON_DEPS=\
     ${ROOTDIR}/hw/opentitan-upstream/python-requirements.txt
-CANTRIP_PLATFORM_APT_DEPS=\
+PLATFORM_APT_DEPS=\
     ${ROOTDIR}/hw/opentitan-upstream/apt-requirements.txt
 
 # Put host tool targets first.
diff --git a/setup.sh b/setup.sh
index 5a5d39b..9ef8165 100644
--- a/setup.sh
+++ b/setup.sh
@@ -180,6 +180,7 @@
 
     export PLATFORM="${platform}"
     export CANTRIP_OUT_DIR="${OUT}/cantrip/${PLATFORM}"
+    export CHERIOT_OUT_DIR="${OUT}/cheriot/${PLATFORM}"
     source "${ROOTDIR}/build/platforms/${platform}/setup.sh"
 }