140d553cfSPaul BeesleyOP-TEE Dispatcher 240d553cfSPaul Beesley================= 340d553cfSPaul Beesley 440d553cfSPaul Beesley`OP-TEE OS`_ is a Trusted OS running as Secure EL1. 540d553cfSPaul Beesley 640d553cfSPaul BeesleyTo build and execute OP-TEE follow the instructions at 740d553cfSPaul Beesley`OP-TEE build.git`_ 840d553cfSPaul Beesley 9*05c69cf7SJeffrey KardatzkeThere are two different modes for loading the OP-TEE OS. The default mode will 10*05c69cf7SJeffrey Kardatzkeload it as the BL32 payload during boot, and is the recommended technique for 11*05c69cf7SJeffrey Kardatzkeplatforms to use. There is also another technique that will load OP-TEE OS after 12*05c69cf7SJeffrey Kardatzkeboot via an SMC call by enabling the option for OPTEE_ALLOW_SMC_LOAD that was 13*05c69cf7SJeffrey Kardatzkespecifically added for ChromeOS. Loading OP-TEE via an SMC call may be insecure 14*05c69cf7SJeffrey Kardatzkedepending upon the platform configuration. If using that option, be sure to 15*05c69cf7SJeffrey Kardatzkeunderstand the risks involved with allowing the Trusted OS to be loaded this 16*05c69cf7SJeffrey Kardatzkeway. ChromeOS uses a boot flow where it verifies the signature of the firmware 17*05c69cf7SJeffrey Kardatzkebefore executing it, and then only if the signature is valid will the 'secrets' 18*05c69cf7SJeffrey Kardatzkeused by the TEE become accessible. The firmware then verifies the signature of 19*05c69cf7SJeffrey Kardatzkethe kernel using depthcharge, and the kernel verifies the rootfs using 20*05c69cf7SJeffrey Kardatzkedm-verity. The SMC call to load OP-TEE is then invoked immediately after the 21*05c69cf7SJeffrey Kardatzkekernel finishes loading and before any attack vectors can be opened up by 22*05c69cf7SJeffrey Kardatzkemounting writable filesystems or opening network/device connections. this 23*05c69cf7SJeffrey Kardatzkeensures the platform is 'closed' and running signed code through the point where 24*05c69cf7SJeffrey KardatzkeOP-TEE is loaded. 25*05c69cf7SJeffrey Kardatzke 2640d553cfSPaul Beesley-------------- 2740d553cfSPaul Beesley 28*05c69cf7SJeffrey Kardatzke*Copyright (c) 2014-2023, Arm Limited and Contributors. All rights reserved.* 2940d553cfSPaul Beesley 3040d553cfSPaul Beesley.. _OP-TEE OS: https://github.com/OP-TEE/build 3140d553cfSPaul Beesley.. _OP-TEE build.git: https://github.com/OP-TEE/build 32