About

OP-TEE (Open Portable Trusted Execution Environment) is an open-source TEE designed for secure software execution implemented according to the GlobalPlatform TEE Client API and TEE Internal Core API. This project fosters collaboration among RISE members and individuals to develop OP-TEE for RISC-V.

Project Scope and Timelines

• PoC implementation of OP-TEE OS and OpenSBI 
• Run optee_test on QEMU virt (riscv64, dual-core)
• Run optee_test on Andes AE350 platform (QEMU and FPGA) 
• Leverage domain context switching and RPXY extension for OP-TEE SPD driver

• Add CI support for QEMU RV64 virt in OP-TEE OS 
• Integrate U-Boot
• Support dynamic shared memory

Components and Repos

• https://gitlab.com/riseproject/riscv-optee/optee_build.git
• https://gitlab.com/riseproject/riscv-optee/optee_os.git 
• https://gitlab.com/riseproject/riscv-optee/opensbi.git
• https://gitlab.com/riseproject/riscv-optee/u-boot.git
• https://gitlab.com/riseproject/riscv-optee/linux.git

QEMU Virt test environment

This implementation uses PMP to isolate TEE and REE, no secure interrupt registered, software, timer and external interrupts will cause TEE managed exit to REE for interrupt handling.  

Boot process:

Memory Layout:

build commands:

export WORKDIR=`pwd`
 
git clone https://gitlab.com/riseproject/riscv-optee/optee_build.git -b main build
git clone https://gitlab.com/riseproject/riscv-optee/optee_os.git -b main
git clone https://gitlab.com/riseproject/riscv-optee/opensbi.git -b main
git clone https://gitlab.com/riseproject/riscv-optee/u-boot.git -b main
git clone https://gitlab.com/riseproject/riscv-optee/linux.git -b main
 
git clone https://github.com/OP-TEE/optee_client.git -b 4.2.0
git clone https://github.com/OP-TEE/optee_test.git -b 4.2.0
git clone https://github.com/linaro-swg/optee_examples.git -b 4.2.0
git clone https://github.com/buildroot/buildroot -b 2022.11.1
git clone https://github.com/qemu/qemu -b v8.2.2
 
cd build
make -f toolchain.mk ARCH=riscv -j $(nproc)
make -f qemu_riscv64.mk qemu
make -f qemu_riscv64.mk opensbi
make -f qemu_riscv64.mk u-boot
make -f qemu_riscv64.mk linux
make -f qemu_riscv64.mk buildroot
ln -s $WORKDIR/linux/arch/riscv/boot/dts/qemu/qemu_rv64_virt_domain.dtb $WORKDIR
 
# qemu enabled semihosting for secure world console
make -f qemu_riscv64.mk run-only
 
# launch another terminal and connect to normal world
telnet localhost 64320
# run 'xtest' or 'optee_example*' in Linux shell

Stakeholders and Partners

• RISE
  • Andes Technology
    
    • Yu Chien Peter Lin <peterlin@andestech.com>
    • Alvin Che-Chia Chang <alvinga@andestech.com>
    • Tim Ouyang <tim609@andestech.com>

Dependencies

• MPXY/RPMI Specification
• SBI_00_04 - Domain Context Switch Support

Measure of Success

• Support QEMU virt (riscv64) in OP-TEE OS
• Support OP-TEE SPD in OpenSBI
• Support SMC-like RISC-V ABI in Linux and U-Boot OP-TEE drivers

Future Work

• IOPMP: To allow domains to request access ownership of devices
• AIA/APLIC: Secure/Non-secure interrupt handling
• Secure boot: Integrate ZSBL & FSBL to verify the signature of images
• FF-A like ABI: Unified protocol used among Secure/Non-secure images (need to be standardised for RISC-V)
• SmMTT: Additional secure features e.g. memory isolation, assigning interrupts to domains, etc. 

RISE Requirements

None

Status

Updates