There are plenty of boards that run using mainline u-boot and mainline Linux, you can often ignore the vendor BSP.
You are right about ARM though, TrustZone is another DRM-oriented aspect of ARM-based SoCs.
back
3 comments
While TrustZone can implement DRM, it is not a closed management engine. If you control the board, you can load your own OS there (but, conversely, if you cannot load your own OS there, you do not control the board).
There was a talk at FOSDEM this year about using TrustZone to run a small hypervisor: https://fosdem.org/2016/schedule/event/microkernels_genode_u...
The boot ROMs on these things are proprietary, though. The vendors I've talked with have been extremely coy about what's in them (got an overview from Marvell once, spent a day looking at code on a projector screen and getting a walkthrough. They could have hidden much).
The boot ROM typically gets out of your way pretty quickly, though. At worst it means you have to deal with some firmware-signing nonsense before chaining into a Linux kernel (or U-Boot); it isn't active in a running system.
I should add that the code we saw may not have been the code that was actually run. It had reset vectors and whatnot, but that's no guarantee there were no hidden ROMs that ran code before the code we reviewed got run. And it's certainly no guarantee there are no hidden hardware-level state machines that unlock . . . things. Things like ignoring X bits in pages, or being able to do some low-bandwidth computation with code embedded at the stenographic level.
TrustZone is just another processor mode and associated memory protection, nothing more, nothing less.
It's equally as incoherent to say supervisor mode and the MMU is 'DRM-oriented'.
In practice, TrustZone is for DRM.