3 ms·

There are plenty of boards that run using mainline u-boot and mainline Linux, you can often ignore the vendor BSP. You are right about ARM though, TrustZone is

There are plenty of boards that run using mainline u-boot and mainline Linux, you can often ignore the vendor BSP. You are right about ARM though, TrustZone is another DRM-oriented aspect of ARM-based SoCs.

ctz 11y ago
TrustZone is just another processor mode and associated memory protection, nothing more, nothing less. It's equally as incoherent to say supervisor mode and the MMU is 'DRM-oriented'.
- ashitlerferad 11y ago
  In practice, TrustZone is for DRM.
tremon 11y ago
While TrustZone can implement DRM, it is not a closed management engine. If you control the board, you can load your own OS there (but, conversely, if you cannot load your own OS there, you do not control the board). There was a talk at FOSDEM this year about using TrustZone to run a small hypervisor: https://fosdem.org/2016/schedule/event/microkernels_genode_usb_armory/ https://fosdem.org/2016/schedule/event/microkernels_genode_u...
kabdib 11y ago
The boot ROMs on these things are proprietary, though. The vendors I've talked with have been extremely coy about what's in them (got an overview from Marvell once, spent a day looking at code on a projector screen and getting a walkthrough. They could have hidden much).
- duskwuff 11y ago
  The boot ROM typically gets out of your way pretty quickly, though. At worst it means you have to deal with some firmware-signing nonsense before chaining into a Linux kernel (or U-Boot); it isn't active in a running system.
  - kabdib 11y ago
    I should add that the code we saw may not have been the code that was actually run. It had reset vectors and whatnot, but that's no guarantee there were no hidden ROMs that ran code before the code we reviewed got run. And it's certainly no guarantee there are no hidden hardware-level state machines that unlock . . . things. Things like ignoring X bits in pages, or being able to do some low-bandwidth computation with code embedded at the stenographic level.

ctz 11y ago

TrustZone is just another processor mode and associated memory protection, nothing more, nothing less. It's equally as incoherent to say supervisor mode and the MMU is 'DRM-oriented'.

ashitlerferad 11y ago
In practice, TrustZone is for DRM.

tremon 11y ago

While TrustZone can implement DRM, it is not a closed management engine. If you control the board, you can load your own OS there (but, conversely, if you cannot load your own OS there, you do not control the board). There was a talk at FOSDEM this year about using TrustZone to run a small hypervisor: https://fosdem.org/2016/schedule/event/microkernels_genode_usb_armory/ https://fosdem.org/2016/schedule/event/microkernels_genode_u...

kabdib 11y ago

The boot ROMs on these things are proprietary, though. The vendors I've talked with have been extremely coy about what's in them (got an overview from Marvell once, spent a day looking at code on a projector screen and getting a walkthrough. They could have hidden much).

duskwuff 11y ago
The boot ROM typically gets out of your way pretty quickly, though. At worst it means you have to deal with some firmware-signing nonsense before chaining into a Linux kernel (or U-Boot); it isn't active in a running system.
- kabdib 11y ago
  I should add that the code we saw may not have been the code that was actually run. It had reset vectors and whatnot, but that's no guarantee there were no hidden ROMs that ran code before the code we reviewed got run. And it's certainly no guarantee there are no hidden hardware-level state machines that unlock . . . things. Things like ignoring X bits in pages, or being able to do some low-bandwidth computation with code embedded at the stenographic level.