1*91f16700SchasingluluOP-TEE Dispatcher 2*91f16700Schasinglulu================= 3*91f16700Schasinglulu 4*91f16700Schasinglulu`OP-TEE OS`_ is a Trusted OS running as Secure EL1. 5*91f16700Schasinglulu 6*91f16700SchasingluluTo build and execute OP-TEE follow the instructions at 7*91f16700Schasinglulu`OP-TEE build.git`_ 8*91f16700Schasinglulu 9*91f16700SchasingluluThere are two different modes for loading the OP-TEE OS. The default mode will 10*91f16700Schasingluluload it as the BL32 payload during boot, and is the recommended technique for 11*91f16700Schasingluluplatforms to use. There is also another technique that will load OP-TEE OS after 12*91f16700Schasingluluboot via an SMC call by enabling the option for OPTEE_ALLOW_SMC_LOAD that was 13*91f16700Schasingluluspecifically added for ChromeOS. Loading OP-TEE via an SMC call may be insecure 14*91f16700Schasingluludepending upon the platform configuration. If using that option, be sure to 15*91f16700Schasingluluunderstand the risks involved with allowing the Trusted OS to be loaded this 16*91f16700Schasingluluway. ChromeOS uses a boot flow where it verifies the signature of the firmware 17*91f16700Schasinglulubefore executing it, and then only if the signature is valid will the 'secrets' 18*91f16700Schasingluluused by the TEE become accessible. The firmware then verifies the signature of 19*91f16700Schasingluluthe kernel using depthcharge, and the kernel verifies the rootfs using 20*91f16700Schasingluludm-verity. The SMC call to load OP-TEE is then invoked immediately after the 21*91f16700Schasinglulukernel finishes loading and before any attack vectors can be opened up by 22*91f16700Schasinglulumounting writable filesystems or opening network/device connections. this 23*91f16700Schasingluluensures the platform is 'closed' and running signed code through the point where 24*91f16700SchasingluluOP-TEE is loaded. 25*91f16700Schasinglulu 26*91f16700Schasinglulu-------------- 27*91f16700Schasinglulu 28*91f16700Schasinglulu*Copyright (c) 2014-2023, Arm Limited and Contributors. All rights reserved.* 29*91f16700Schasinglulu 30*91f16700Schasinglulu.. _OP-TEE OS: https://github.com/OP-TEE/build 31*91f16700Schasinglulu.. _OP-TEE build.git: https://github.com/OP-TEE/build 32