<longsleep> ogra_: mhm could have been laptos - i remember it not very good
<longsleep> ogra_: i saw some code in u-boot with which was labled secure boot using some keys fused into the soc
<longsleep> ogra_: did not look closes yet though
<ogra_> "fused into the soc" heh
<ogra_> might be hard to do if you are not a manufacturer
<longsleep> true, but getting the uboot signed might be possible somehow
<tbr> HS silicon often uses keys from a PROM inside the soc
<longsleep> yeah - without knowing anything .. how are the phones which use u-boot protect their bootloader?
<ogra_> usualyl from the preloader as i understand
<longsleep> right, and how is the preloader protected from beeing overwritten with a preloader which does not validate anything?
<tbr> longsleep: e.g. QC usually only loads a signed loader and will not boot if it's not signed
<ogra_> yeah
<tbr> and most phones don't use u-boot but a-boot or that other thing
<ogra_> and you cant easily overwrite it either
<longsleep> right
<ogra_> some use uboot, but only chainloaded
<longsleep> tbr: so i asume it is pretty hard to get secure boot on arm when the soc would boot any loader
<tbr> longsleep: just as on x86, it's not an arch dependent problem
<longsleep> tbr: right, i see - thanks!
<longsleep> ogra_: are there any device which do not chain load uboot with some binary boot loader blob?
<tbr> intel will also want your firstborn if you want the secure version of their CPUs
<longsleep> hehe
<ogra_> longsleep, yeah, most of them ...
<ogra_> uboot on phones is rather a rare case ... it exists though
<tbr> TI SoCs can usually be booted with u-boot directly
<tbr> e.g. the BB with its AM335x
<tbr> MLO is just a minimal u-boot
<longsleep> oh, thats cool, so no proprietary part required to boot them up?
<tbr> correct
<tbr> not like RPi that requires that ginormous blob to boot the GPU before it even thinks about ARM cores
<tbr> also u-boot on x86 works well
<tbr> and I don't mean chain loaded
<longsleep> is that in use on x86 in some machines one can buy?
<tbr> yes, 