Architecting Trusted Execution on RISC-V: Worlds, WorldGuard and Supervisor Domains

As system-level hardware isolation has long been a missing piece in the RISC-V ecosystem, emerging standards are now closing that gap. This session provides a general introduction to deploying hardware-enforced Trusted Execution Environments (TEEs) using the RISC-V Worlds ISA extension and the WorldGuard architecture. We will explore how initiators tag execution environments and how target resources enforce access control rules. Transitioning to software, we will cover defining isolation boundaries via Device Tree bindings and managing system domains within OpenSBI. Finally, we will demonstrate integrating this security stack with OP-TEE, leveraging the RPMI TEE Service Group to establish standardized cross-world communication.