Milestone 2

Milestone 2 Status

This milestone is in progress.

The committed ASLR and stack-canary documentation completes the two documentation deliverables. Both are published in OP-TEE's latest Read the Docs documentation:

• Address Space Layout Randomization (ASLR)
• Compiler-instrumented Stack Canaries

The pages are available in the latest documentation, which reflects newer merged changes. They are not yet available in stable, which follows the released OP-TEE documentation version.

Compiler coverage and end-to-end QEMU runtime testing remain in progress.

Upstream Submissions

The following OP-TEE documentation submission relates to this milestone:

Date Submitted	Submission	Patchset Links	Patchset Status
July 6, 2026	Documentation for compiler-instrumented stack canaries	Documentation pull request #288; stack-canary patch	Committed (commit)
July 6, 2026	Documentation for OP-TEE core and trusted-application ASLR	Documentation pull request #288; ASLR patch	Committed (commit)

---

Background

RISC-V OP-TEE continuous integration has historically been compile-only, GCC-only, and without the QEMU runtime testing available for Arm. Consequently, features could compile without being exercised end to end through xtest.

ASLR and compiler-instrumented stack-canary support are already present upstream for OP-TEE core and trusted applications, but lack upstream documentation and RISC-V CI coverage.

This milestone establishes broader compiler support, runtime infrastructure, and documentation for ASLR and compiler-instrumented stack-canary support.

Milestone Description

Milestone 2 expands RISC-V compiler coverage, enables runtime testing under QEMU, and documents existing ASLR and stack-canary support for OP-TEE core and trusted applications.

Requirements

• Support compilation with both GCC and LLVM/Clang.
• Verify that OP-TEE compiles and links correctly with both compiler families.
• Enable QEMU-based RISC-V runtime-test infrastructure comparable to the existing Arm setup.
• Run the OP-TEE xtest suite under QEMU with GCC-built and LLVM/Clang-built software.
• Validate ASLR for OP-TEE core and trusted applications with both compiler families.
• Enable strong compiler-instrumented stack protection by default for LLVM/Clang, consistent with CFG_CORE_STACK_PROTECTOR_STRONG=y.
• Document RISC-V ASLR behavior for OP-TEE core and trusted applications in optee_doc.
• Document compiler-instrumented stack canaries for RISC-V OP-TEE core and trusted applications in optee_doc.

Deliverables

• GCC and LLVM/Clang build support for RISC-V OP-TEE.
• End-to-end QEMU runtime testing with xtest.
• ASLR documentation for OP-TEE core and trusted applications.
• Stack-canary documentation for OP-TEE core and trusted applications.