Skip to main content

Milestone 2

Milestone 2 Status​

This milestone is delivered.

Background​

RISC-V OP-TEE continuous integration has historically been compile-only, GCC-only, and without the QEMU runtime testing available for Arm. Consequently, features could compile without being exercised end to end through xtest.

ASLR and compiler-instrumented stack-canary support are already present upstream for OP-TEE core and trusted applications, but lack upstream documentation and RISC-V CI coverage.

This milestone establishes broader compiler support, runtime infrastructure, and documentation for ASLR and compiler-instrumented stack-canary support.

Milestone Description​

Milestone 2 expands RISC-V compiler coverage, enables runtime testing under QEMU, and documents existing ASLR and stack-canary support for OP-TEE core and trusted applications.

Milestone Update​

Documentation​

The committed ASLR and stack-canary documentation completes the two documentation deliverables. Both are published in OP-TEE's latest Read the Docs documentation:

The pages are available in the latest documentation, which reflects newer merged changes. They are not yet available in stable, which follows the released OP-TEE documentation version.

Support OP-TEE compilation with LLVM/Clang​

Introduced LLVM (22.1.8) into the buildroot infrastructure at buildroot rp022-m2 branch.

Test Instructions

# Fetch code and build with new LLVM defconfig
$ git clone https://gitlab.com/riseproject/riscv-optee/buildroot.git -b rp022-m2
$ cd buildroot
$ make qemu_riscv64_virt_optee_llvm_defconfig
$ make -j$(nproc) CMAKE_POLICY_VERSION_MINIMUM=3.5

# Start QEMU
$ ./output/images/start-qemu.sh

# Open a console and telnet to launch the kernel
$ telnet localhost 64320

# Run xtest after kernel login
$ xtest

OP-TEE RISC-V64 xtest CI enablement​

Added QEMU RISC-V64-specific manifest
Pull request: manifest 353
Status: Merged

Added docker dependencies for RISC-V build flow
Pull request: docker_optee_os_ci 1
Status: Merged

Added build support for qemu_riscv64 platform, including build/test integration and RISC-V-specific CI test handling.
Pull request: build 870
Status: Merged

Add GitHub Actions workflow for the RISC-V64 QEMU xtest flow.
Pull request: optee_os 7927
Status: Reviewed, pending merge

The current optee_os master branch is not ready for running xtest as it is missing the MPXY implementations, thus optee_os 7927 is pending merge until below prerequisites (or their successor revisions) are merged into the master branch to unblock the xtest.

Alvin Chang (3):
core: riscv: sbi_mpxy_rpmi: add RPMI request forward service definitions
core: riscv: sbi_mpxy_rpmi: implement request forward communication via SBI MPXY
core: riscv: replace experimental SBI TEE extension with MPXY-based communication

Yu-Chien Peter Lin (11):
core: riscv: sbi_mpxy: allow configurable shared memory size
core: riscv: sbi_mpxy: add debug logging for shared memory setup
core: riscv: sbi_mpxy_rpmi: initialize shared memory before channel enumeration
core: riscv: sbi_mpxy_rpmi: store uniform shmem size in RPMI context
core: riscv: sbi_mpxy_rpmi: replace redundant assignment with assertion
core: riscv: sbi_mpxy_rpmi: probe SBI_MPXY extension before channel initialization
core: riscv: sbi_mpxy: use hart_index instead of hart ID for mpxy_core_local_array
core: riscv: boot: initialize SBI MPXY and bind RPMI request forward channels
core: riscv: sbi_mpxy_rpmi: handle multi-part message retrieval
core: riscv: sbi_mpxy_rpmi: use proper request structure for message completion
core: riscv: sbi_mpxy_rpmi: reduce minimum slot size to 64 bytes

You can find above commits from upstream-test. Please reference on the conversations at manifest 353 for the community agreements.

Upstream Submissions​

The following OP-TEE documentation submission relates to this milestone:

Date SubmittedSubmissionPatchset LinksPatchset Status
July 6, 2026Documentation for compiler-instrumented stack canariesPR #288Merged
July 6, 2026Documentation for OP-TEE core and trusted-application ASLRPR #288Merged
July 21, 2026OP-TEE OS runtime failures fixes when building with LLVM.PR #7890Merged
August 12, 2026Added QEMU RISC-V64-specific manifestPR #353Merged
August 12, 2026Added build support for qemu_riscv64 platform, including build/test integration and RISC-V-specific CI test handling.PR #870Merged
August 12, 2026Add GitHub Actions workflow for the RISC-V64 QEMU xtest flow.PR #7927Reviewed, pending merge
August 12, 2026Added docker dependencies for RISC-V build flowPR #1Merged

Requirements​

  • Document RISC-V ASLR behavior for OP-TEE core and trusted applications in optee_doc.
  • Document compiler-instrumented stack canaries for RISC-V OP-TEE core and trusted applications in optee_doc.
  • Support compilation with both GCC and LLVM/Clang.
  • Verify that OP-TEE compiles and links correctly with both compiler families.
  • Enable QEMU-based RISC-V runtime-test infrastructure comparable to the existing Arm setup.
  • Run the OP-TEE xtest suite under QEMU with GCC-built and LLVM/Clang-built software.

Deliverables​

  • ASLR documentation for OP-TEE core and trusted applications. (delivered, merged)
  • Stack-canary documentation for OP-TEE core and trusted applications. (delivered, merged)
  • GCC and LLVM/Clang build support for RISC-V OP-TEE. (delivered, merged)
  • End-to-end QEMU runtime testing with xtest. (delivered, merged)