1. Getting Started

1.1. What is Keystone?

Keystone is an open-source TEE framework for RISC-V processors.

You can currently try Keystone on QEMU, FireSim (FPGA), or the SiFive HiFive Unleashed board.

You can migrate the Keystone enclave into arbitrary RISC-V processor, with a very small modification on hardware to plant the silicon root of trust.

Attention

We’re actively adding more documents right now. Please post in Keystone forum or create a GitHub issue if you face any undocumented trouble.

Attention

The current version (0.X) of Keystone is not formally verified, nor matured. We recommend you to use Keystone only for research purposes until it gets stablized. We appreciate any contribution for making Keystone better.

1.2. Quick Start

Following documents are quick guide to test or deploy Keystone on various platforms.

• 1.2.1. Testing Keystone with QEMU
• 1.2.2. Testing Keystone with FireSim (w/ Chipyard Framework)
• 1.2.3. Example Hardware Deployment

1.3. Tutorials

• Hello world with libc

• Hello world without libc

• Remote Attestation

1.4. Keystone Demo

The Keystone Demo is an example of the current capabilities of the Keystone enclave framework.

See https://github.com/keystone-enclave/keystone-demo and documentation contained within.

1.5. A Guide to Keystone Components

The Keystone repository (https://github.com/keystone-enclave/keystone) consists of a number of sub-components as gitmodules or directories. This is a brief overview of them.

+ keystone/
|-- patches/
|  # required patches for submodules
|-- bootrom/
|  # Keystone bootROM for QEMU virt board, including trusted boot chain.
|-- buildroot/
|  # Linux buildroot. Builds a minimal working Linux image for our test platforms.
|-- docs/
|  # Contains read-the-docs formatted and hosted documentation, such as this article.
|-- riscv-gnu-toolchain/
|  # Unmodified toolchain for building riscv targets. Required to build all other components.
|-- linux-keystone-driver/
|  # A loadable kernel module for Keystone enclave.
|-- linux/
|  # Linux kernel
|-- sm/
|  # OpenSBI firmware + Keystone security monitor
|-- qemu/
|  # QEMU
+-- sdk/
   # Tools, libraries, and example apps for building enclaves on Keystone