1OP-TEE Dispatcher 2================= 3 4`OP-TEE OS`_ is a Trusted OS running as Secure EL1. 5 6To build and execute OP-TEE follow the instructions at 7`OP-TEE build.git`_ 8 9There are two different modes for loading the OP-TEE OS. The default mode will 10load it as the BL32 payload during boot, and is the recommended technique for 11platforms to use. There is also another technique that will load OP-TEE OS after 12boot via an SMC call by enabling the option for OPTEE_ALLOW_SMC_LOAD that was 13specifically added for ChromeOS. Loading OP-TEE via an SMC call may be insecure 14depending upon the platform configuration. If using that option, be sure to 15understand the risks involved with allowing the Trusted OS to be loaded this 16way. ChromeOS uses a boot flow where it verifies the signature of the firmware 17before executing it, and then only if the signature is valid will the 'secrets' 18used by the TEE become accessible. The firmware then verifies the signature of 19the kernel using depthcharge, and the kernel verifies the rootfs using 20dm-verity. The SMC call to load OP-TEE is then invoked immediately after the 21kernel finishes loading and before any attack vectors can be opened up by 22mounting writable filesystems or opening network/device connections. this 23ensures the platform is 'closed' and running signed code through the point where 24OP-TEE is loaded. 25 26-------------- 27 28*Copyright (c) 2014-2023, Arm Limited and Contributors. All rights reserved.* 29 30.. _OP-TEE OS: https://github.com/OP-TEE/build 31.. _OP-TEE build.git: https://github.com/OP-TEE/build 32
